Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

A framework for automating security analysis of the internet of things

Published: 01 April 2017 Publication History

Abstract

The Internet of Things (IoT) is enabling innovative applications in various domains. Due to its heterogeneous and wide-scale structure, it introduces many new security issues. To address this problem, we propose a framework for modeling and assessing the security of the IoT and provide a formal definition of the framework. Generally, the framework consists of five phases: (1) data processing, (2) security model generation, (3) security visualization, (4) security analysis, and (5) model updates. Using the framework, we can find potential attack scenarios in the IoT, analyze the security of the IoT through well-defined security metrics, and assess the effectiveness of different defense strategies. The framework is evaluated via three scenarios, which are the smart home, wearable healthcare monitoring and environment monitoring scenarios. We use the analysis results to show the capabilities of the proposed framework for finding potential attack paths and mitigating the impact of attacks.

References

[1]
Abie, H., Balasingham, I., 2012. Risk-based adaptive security for smart IoT in eHealth. In: Proceedings of the 7th International Conference on Body Area Networks (BodyNets '12). IEEE, pp. 269275.
[2]
Albanese, M., Jajodia, S., Noel, S., 2012. Time-efficient and cost-effective network hardening using attack graphs. In: Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN '12). IEEE, pp. 112.
[3]
Amani, M., Mahmoodi, T., Tatipamula, M., Aghvami, H., 2014. Programmable policies for data offloading in LTE network. In: Proceedings of the 2014 IEEE International Conference on Communications (ICC '14). IEEE, pp. 31543159.
[4]
Q.M. Ashraf, M.H. Habaebi, Autonomic schemes for threat mitigation in internet of things, J. Netw. Comput. Appl., 49 (2015) 112-127.
[5]
Atamli, A., Martin, A., 2014. Threat-based security analysis for the internet of things. In: Proceedings of the 2014 International Workshop on Secure Internet of Things (SIoT '14), IEEE Computer Society, pp. 3543.
[6]
Bachy, Y., Basse, F., Nicomette, V., Alata, E., Kaaniche, M., Courrege, J.C., Lukjanenko, P., 2015. Smart-TV security analysis: practical experiments. In: 2015 Proceedings of the 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN '15). IEEE, pp. 497504.
[7]
Bai, F., Helmy, A., 2006. A survey of mobility modeling and analysis in wireless adhoc networks. In: Wireless Ad Hoc and Sensor Networks. Springer (Chapter 1).
[8]
Berhanu, Y., Abie, H., Hamdi, M., 2013. A testbed for adaptive security for IoT in eHealth. In: Proceedings of the International Workshop on Adaptive Security (ASPI '13), ACM, pp. 18.
[9]
C.J. Bernardos, A. de la Oliva, P. Serrano, A. Banchs, L.M. Contreras, H. Jin, J.C. Zuniga, An architecture for software defined wireless networking, IEEE Wirel. Commun., 21 (2014) 52-61.
[10]
C. Bettstetter, H. Hartenstein, X. Prez-Costa, Stochastic properties of the random waypoint mobility model, Wirel. Netw., 10 (2004) 555-567.
[11]
Bettstetter, C., 2001. Smooth is better than sharp: a random mobility model for simulation of wireless networks. In: Proceedings of the 4th ACM International Workshop on Modeling, Analysis and Simulation of Wireless and Mobile Systems (MSWIM '01), ACM, pp. 1927.
[12]
Bilge, L., Dumitras, T., 2012. Before we knew it: an empirical study of zero-day attacks in the real world. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS '12), ACM, pp. 833844.
[13]
Blank, R.M., Gallagher, P.D., 2012. NIST Special Publication 800-30 Revision 1 Guide for Conducting Risk Assessments. Tech. Rep., National Institute of Standards and Technology.
[14]
T. Camp, J. Boleng, V. Davies, A survey of mobility models for ad hoc network research, Wirel. Commun. Mob. Comput., 2 (2002) 483-502.
[15]
C.Y. Chang, C.H. Kuo, J.C. Chen, T.C. Wang, Design and implementation of an IoT access point for smart home, Appl. Sci., 5 (2015) 1882-1903.
[16]
P.Y. Chen, S.M. Cheng, K.C. Chen, Information fusion to defend intentional attack in internet of things, IEEE Internet Things J., 1 (2014) 337-348.
[17]
Coppolino, L., D'Alessandro, V., D'Antonio, S., Lev, L., Romano, L., 2015. My smart home is under attack. In: 2015 IEEE Proceedings of the 18th International Conference on Computational Science and Engineering (CSE '15), IEEE Computer Society, pp. 145151.
[18]
Deng, J., Han, R., Mishra, S., 2005. Countermeasures against traffic analysis attacks in wireless sensor networks. In: Proceedings of the 1st International Conference on Security and Privacy for Emerging Areas in Communications Networks (SecureComm '05). IEEE, pp. 113126.
[19]
El-Mougy, A., Ibnkahla, M., Hegazy, L., 2015. Software-defined wireless network architectures for the internet-of-things. In: 2015 Proceedings of the 40th Annual IEEE Conference on Local Computer networks (LCN '15), IEEE Computer Society, pp. 804811.
[20]
Eschenauer, L., Gligor, V.D., 2002. A key-management scheme for distributed sensor networks. In: Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS '02), ACM, pp. 4147.
[21]
Gallon, L., Bascou, J., 2011. Using CVSS in attack graphs. In: Proceedings of the 6th International Conference on Availability, Reliability and Security (ARES '11). IEEE, pp. 5966.
[22]
Gante, A.D., Aslan, M., Matrawy, A., 2014. Smart wireless sensor network management based on software-defined networking. In: 2014 Proceedings of the 27th Biennial Symposium on Communications (QBSC '14). IEEE, pp. 7175.
[23]
Ge, M., Kim, D.S., 2015. A framework for modeling and assessing security of the internet of things. In: 2015 IEEE Proceedings of the 21st International Conference on Parallel and Distributed Systems (ICPADS '15), IEEE Computer Society, pp. 776781.
[24]
K. Gill, S.H. Yang, F. Yao, X. Lu, A ZigBee-based home automation system, IEEE Trans. Consum. Electron., 55 (2009) 422-430.
[25]
Goodspeed, T., 2016. MSP430 buffer Overflow exploit for wireless sensor nodes. URL http://travisgoodspeed.blogspot.co.nz/2007/08/machine-code-injection-for-wireless.html (accessed 14.09.16).
[26]
J. Gubbi, R. Buyya, S. Marusic, M. Palaniswami, Internet of things (IoT): a vision, architectural elements, and future directions, Future Gener. Comput. Syst., 29 (2013) 1645-1660.
[27]
Habib, K., Leister, W., 2015. Threats identification for the smart internet of things in eHealth and adaptive security countermeasures. In: 2015 Proceedings of the 7th International Conference on New Technologies, Mobility and Security (NTMS '15). IEEE, pp. 15.
[28]
A. Hakiri, P. Berthou, A. Gokhale, S. Abdellatif, Publish/subscribe-enabled software defined networking for efficient and scalable IoT communications, IEEE Commun. Mag., 53 (2015) 48-54.
[29]
Hamdi, M., Abie, H., 2014. Game-based adaptive security in the internet of things for eHealth. In: Proceedings of the 2014 IEEE International Conference on Communications (ICC '14). IEEE, pp. 920925.
[30]
J.B. Hong, D.S. Kim, Assessing the effectiveness of moving target defenses using security models, IEEE Trans. Dependable Secur. Comput., 13 (2015) 163-177.
[31]
J.B. Hong, D.S. Kim, Towards scalable security analysis using multi-layered security models, J. Netw. Comput. Appl., 75 (2016) 156-168.
[32]
Hong, J., Kim, D., 2012. HARMs: hierarchical attack representation models for network security analysis. In: Proceedings of the 10th Australian Information Security Management Conference (AISM '12).
[33]
Hong, X., Gerla, M., Pei, G., Chiang, C.-C., 1999. A group mobility model for Ad Hoc wireless networks. In: Proceedings of the 2nd ACM International Workshop on Modeling, Analysis and Simulation of Wireless and Mobile Systems (MSWiM '99), ACM, pp. 5360.
[34]
F. Hu, Q. Hao, K. Bao, A survey on software-defined network and openflow: from concept to implementation, IEEE Commun. Surv. Tutor., 16 (2014) 2181-2206.
[35]
X. Huang, P. Craig, H. Lin, Z. Yan, SecIoT: a security framework for the internet of things, Secur. Commun. Netw., 9 (2015) 3083-3094.
[36]
IEEE, 2003. IEEE Std 802.15.4-2003: Part 15.4: Wireless Medium Access Control and Physical Layer Specifications for Low-Rate Wireless Personal Area Networks, Tech. Rep. IEEE, 2003.
[37]
Ingols, K., Chu, M., Lippmann, R., Webster, S., Boyer, S., 2009. Modeling Modern network attacks and countermeasures using attack graphs. In: Proceedings of the 25th Annual Computer Security Applications Conference (ACSAC '09), IEEE Computer Society, pp. 117126.
[38]
Ingols, K., Lippmann, R., Piwowarski, K., 2006. Practical attack graph generation for network defense. In: Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC '06), IEEE Computer Society, pp. 121130.
[39]
A. Jacobsson, M. Boldt, B. Carlsson, A risk analysis of a smart home automation system, Future Gener. Comput. Syst., 56 (2016) 719-733.
[40]
Jha, S., Sheyner, O., Wing, J., 2002. Two formal analys s of attack graphs. In: Proceedings of the 15th IEEE Workshop on Computer Security Foundations (CSFW '02), IEEE Computer Society, pp. 4963.
[41]
Jia, F., Hong, J.B., Kim, D.S., 2015. Towards automated generation and visualization of hierarchical attack representation models. In: Proceedings of the 2015 IEEE International Conference on Computer and Information Technology; Ubiquitous Computing and Communications; Dependable, Autonomic and Secure Computing; Pervasive Intelligence and Computing (CIT/IUCC/DASC/PICOM). IEEE, pp. 16891696.
[42]
Johansson, P., Larsson, T., Hedman, N., Mielczarek, B., Degermark, M., 1999. Scenario-based performance analysis of routing protocols for mobile Ad-Hoc networks. In: Proceedings of the 5th Annual ACM/IEEE International Conference on Mobile Computing and Networking (MobiCom '99), ACM, pp. 195206.
[43]
S.D.T. Kelly, N.K. Suryadevara, S.C. Mukhopadhyay, Towards the implementation of IoT for environmental condition monitoring in homes, IEEE Sens. J., 13 (2013) 3846-3853.
[44]
Kinney, P., 2003. ZigBee Technology: Wireless Control that Simply Works, Tech. Rep. ZigBee Alliance.
[45]
J. Ko, C. Lu, M.B. Srivastava, J.A. Stankovic, A. Terzis, M. Welsh, Wireless sensor networks for healthcare, Proc. IEEE, 98 (2010) 1947-1960.
[46]
D. Kreutz, F.M.V. Ramos, P.E. Verssimo, C.E. Rothenberg, S. Azodolmolky, S. Uhlig, Software-defined networking: a comprehensive survey, Proc. IEEE, 103 (2015) 14-76.
[47]
B. Latr, B. Braem, I. Moerman, C. Blondia, P. Demeester, A survey on wireless body area networks, Wirel. Netw., 17 (2011) 1-18.
[48]
Latre, B., Braem, B., Moerman, I., Blondia, C., Reusens, E., Joseph, W., Demeester, P., 2007. A low-delay protocol for multihop wireless body area networks. In: Proceedings of the 4th Annual International Conference on Mobile and Ubiquitous Systems: Networking Services (MobiQuitous '07). IEEE, pp. 18.
[49]
M.T. Lazarescu, Design of a WSN platform for long-term environmental monitoring for IoT applications, IEEE J. Emerg. Sel. Top. Circuits Syst., 3 (2013) 45-54.
[50]
Lei, T., Lu, Z., Wen, X., Zhao, X., Wang, L., 2014. SWAN: An SDN based campus WLAN framework. In: 2014 Proceedings of the 4th International Conference on Wireless Communications, Vehicular Technology, Information Theory and Aerospace Electronic Systems (VITAE '14). IEEE, pp. 15.
[51]
D. Leversage, E. James, Estimating a system's mean time-to-compromise, IEEE Secur. Priv., 6 (2008) 52-60.
[52]
J. Liu, Y. Li, M. Chen, W. Dong, D. Jin, Software-defined internet of things for smart urban sensing, IEEE Commun. Mag., 53 (2015) 55-63.
[53]
T. Luo, H.P. Tan, T. Quek, Sensor openflow: enabling software-defined wireless sensor networks, IEEE Commun. Lett., 16 (2012) 1896-1899.
[54]
Mauw, S., Oostdijk, M., 2005. Foundations of attack trees. In: Proceedings of the 8th International Conference on Information Security and Cryptology (ICISC '05), Springer-Verlag, pp. 186198.
[55]
Michele, B., Karpow, A., 2014. Watch and be watched: compromising all smart TV generations. In: 2014 IEEE Proceedings of the 11th Consumer Communications and Networking Conference (CCNC '14). IEEE, pp. 351356.
[56]
Miyazaki, T., Yamaguchi, S., Kobayashi, K., Kitamichi, J., Guo, S., Tsukahara, T., Hayashi, T., 2014. A software defined wireless sensor network. In: Proceedings of the 2014 International Conference on Computing, Networking and Communications (ICNC '14). IEEE, pp. 847852.
[57]
B.A.A. Nunes, M. Mendonca, X.N. Nguyen, K. Obraczka, T. Turletti, A survey of software-defined networking: past, present, and future of programmable networks, IEEE Commun. Surv. Tutor., 16 (2014) 1617-1634.
[58]
Ou, X., Govindavajhala, S., Appel, A.W., 2005. MulVAL: a logic-based network security analyzer. In: Proceedings of the 14th Conference on USENIX Security Symposium (SSYM '05), USENIX Association, pp. 88.
[59]
K. Pentikousis, Y. Wang, W. Hu, Mobileflow: toward software-defined mobile networks, IEEE Commun. Mag., 51 (2013) 44-53.
[60]
Radomirovic, S., 2010. Towards a model for security and privacy in the internet of things. In: Proceedings of the 1st International Workshop Security of the Internet of Things (SecIoT '10).
[61]
R. Roman, P. Najera, J. Lopez, Securing the internet of things, Computer, 44 (2011) 51-58.
[62]
R. Roman, J. Zhou, J. Lopez, On the features and challenges of security and privacy in distributed internet of things, Comput. Netw., 57 (2013) 2266-2279.
[63]
Rontidis, G., Panaousis, E., Laszka, A., Dagiuklas, T., Malacaria, P., Alpcan, T., 2015. A game-theoretic approach for minimizing security risks in the internet-of-things. In: Proceedings of the 2015 IEEE International Conference on Communication Workshop (ICCW '15). IEEE, pp. 26392644.
[64]
A. Roy, D.S. Kim, K.S. Trivedi, Attack countermeasure trees (ACT): towards unifying the constructs of attack and defense trees, Secur. Commun. Netw., 5 (2012) 929-943.
[65]
R.A. Sahner, K.S. Trivedi, A. Puliafito, Performance and Reliability Analysis of Computer Systems: an Example-Based Approach Using the SHARPE Software Package, Kluwer Academic Publishers, 1996.
[66]
V. Saini, Q. Duan, V. Paruchuri, Threat modeling using attack trees, J. Comput. Sci. Coll., 23 (2008) 124-131.
[67]
Savola, R.M., Abie, H., Sihvonen, M., 2012. Towards metrics-driven adaptive security management in e-Health IoT applications. In: Proceedings of the 7th International Conference on Body Area Networks (BodyNets '12). IEEE, pp. 276281.
[68]
Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M., 2002. Automated generation and analysis of attack graphs. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy (SP '02), IEEE Computer Society, pp. 273284.
[69]
S. Sicari, A. Rizzardi, L. Grieco, A. Coen-Porisini, Security, privacy and trust in internet of things: the road ahead, Comput. Netw., 76 (2015) 146-164.
[70]
Singele, D., Latr, B., Braem, B., Peeters, M., Soete, M., Cleyn, P., Preneel, B., Moerman, I., Blondia, C., 2008. A secure cross-layer protocol for multi-hop wireless body area networks. In: Proceedings of the 7th International Conference on Ad-hoc, Mobile and Wireless Networks (ADHOC-NOW '08), Springer Berlin Heidelberg, pp. 94107.
[71]
Sivaraman, V., Gharakheili, H., Vishwanath, A., Boreli, R., Mehani, O., 2015. Network-level security and privacy control for smart-home IoT devices. In: 2015 IEEE Proceedings of the 11th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob '15). IEEE, pp. 163167.
[72]
Stepanova, T., Zegzhda, D., 2014. Applying large-scale adaptive graphs to modeling internet of things security. In: Proceedings of the 7th International Conference on Security of Information and Networks (SIN '14), ACM, pp. 479482.
[73]
Ten, C.-W., Liu, C.-C., Govindarasu, M., 2007. Vulnerability assessment of cybersecurity for SCADA systems using attack trees. In: Proceedings of the 2007 IEEE Power Engineering Society General Meeting. IEEE, pp. 18.
[74]
Tian, J., Hahner, J., Becker, C., Stepanov, I., Rothermel, K., 2002. Graph-based mobility model for mobile Ad Hoc network simulation. In: Proceedings of the 35th Annual Simulation Symposium. IEEE, pp. 337344.
[75]
Torjusen, A.B., Abie, H., Paintsil, E., Trcek, D., Skomedal, A., 2014. Towards run-time verification of adaptive security for IoT in eHealth. In: Proceedings of the 2014 European Conference on Software Architecture Workshops (ECSAW '14), ACM, pp. 18.
[76]
Unuchek, R., 2016. Obad.a Trojan now being distributed via mobile botnets. URL https://securelist.com/blog/mobile/57453/obad-a-trojan-now-being-distributed-via-mobile-botnets/ (accessed 14.09.16).
[77]
Woo, A., Tong, T., Culler, D., 2003. Taming the underlying challenges of reliable multihop routing in sensor networks. In: Proceedings of the 1st International Conference on Embedded Networked Sensor Systems (SenSys '03), ACM, pp. 1427.
[78]
Wu, D., Arkhipov, D.I., Asmare, E., Qin, Z., McCann, J.A., 2015. Ubiflow: mobility management in urban-scale software defined IoT. In: Proceedings of the 2015 IEEE Conference on Computer Communications (INFOCOM '15). IEEE, pp. 208216.
[79]
J.C. Yang, B.X. Fang, Security model and key technologies for the Internet of things, J. China Univ. Posts Telecommun., 18 (2011) 109-112.
[80]
Yu, T., Sekar, V., Seshan, S., Agarwal, Y., Xu, C., 2015. Handling a trillion (Unfixable) flaws on a billion devices: rethinking network security for the internet-of-things. In: Proceedings of the 14th ACM Workshop on Hot Topics in Networks (HotNets-XIV '15), ACM, pp. 17.
[81]
Zhang, C., Green, R., 2015. Communication security in internet of thing: preventive measure and avoid DDoS attack over IoT network. In: Proceedings of the 18th Symposium on Communications & Networking (CNS '15), Society for Computer Simulation International, pp. 815.

Cited By

View all

Index Terms

  1. A framework for automating security analysis of the internet of things
        Index terms have been assigned to the content through auto-classification.

        Recommendations

        Comments

        Please enable JavaScript to view thecomments powered by Disqus.

        Information & Contributors

        Information

        Published In

        cover image Journal of Network and Computer Applications
        Journal of Network and Computer Applications  Volume 83, Issue C
        April 2017
        221 pages

        Publisher

        Academic Press Ltd.

        United Kingdom

        Publication History

        Published: 01 April 2017

        Author Tags

        1. Attack graphs
        2. Internet of things
        3. Security analysis
        4. Security modeling

        Qualifiers

        • Research-article

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)0
        • Downloads (Last 6 weeks)0
        Reflects downloads up to 02 Oct 2024

        Other Metrics

        Citations

        Cited By

        View all
        • (2024)IoTSecSimComputers and Security10.1016/j.cose.2023.103534136:COnline publication date: 1-Feb-2024
        • (2023)A scalable algorithm for network reachability analysis with cyclic attack graphsJournal of Computer Security10.3233/JCS-21010331:1(29-55)Online publication date: 1-Jan-2023
        • (2023)A Secure Face Recognition for IoT-enabled Healthcare SystemACM Transactions on Sensor Networks10.1145/353412219:3(1-23)Online publication date: 17-Apr-2023
        • (2023)Attack graph analysisComputers and Security10.1016/j.cose.2022.103081126:COnline publication date: 1-Mar-2023
        • (2022)Cloud and Big Data Security System’s Review Principles: A Decisive InvestigationWireless Personal Communications: An International Journal10.1007/s11277-022-09781-0126:2(1013-1050)Online publication date: 1-Sep-2022
        • (2021)Assessing Security of Software Components for Internet of ThingsSecurity and Communication Networks10.1155/2021/66778672021Online publication date: 1-Jan-2021
        • (2021)Proactive Defense for Internet-of-things: Moving Target Defense With CyberdeceptionACM Transactions on Internet Technology10.1145/346702122:1(1-31)Online publication date: 14-Sep-2021
        • (2021)Practice and Exploration of Ideological and Political Teaching in Colleges and Universities Based On the InternetRetracted on September 15, 2021 The Sixth International Conference on Information Management and Technology10.1145/3465631.3465780(1-4)Online publication date: 19-Aug-2021
        • (2021)Innovative Development and Research of Network Ideological and Political Education under the Background of the InternetRetracted on September 15, 2021 The Sixth International Conference on Information Management and Technology10.1145/3465631.3465779(1-4)Online publication date: 19-Aug-2021
        • (2021)Automated Security Assessment Framework for Wearable BLE-enabled Health Monitoring DevicesACM Transactions on Internet Technology10.1145/344864922:1(1-31)Online publication date: 14-Sep-2021
        • Show More Cited By

        View Options

        View options

        Get Access

        Login options

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media