Can I Sleep Safely in My Smarthome? A Novel Framework on Automating Dynamic Risk Assessment in IoT Environments

Abstract

Fully automated homes, equipped with the latest iot devices, aiming to drastically improve the quality of lives of those inhabiting such homes, is it not a perfect setting for cyber threats? More than that, this is a fear of many regular citizens and a trending topic for researchers to apply cti for seamless cyber security. This paper focuses on the ra methodology for smarthome environments, targeting to include all types of iot devices. Unfortunately, existing approaches mostly focus on the manual or periodic formal ra, or individual device-specific cyber security solutions. This paper presents a draf, aiming to automate the identification of ongoing attacks and the evaluation of the likelihood of associated risks. Moreover, draf dynamically proposes mitigation strategies when full automation of the decision making is not possible. The theoretical model of draf was implemented and tested in smarthome testbeds deployed in several European countries. The resulting data indicate strong promises for the automation of decision making to control the tightly coupled balance between cyber security and privacy compromise in terms of the embedded services’ usability, end-users’ expectations and their level of cyber concerns.

Integrating Human Factors in the Visualisation of Usable Transparency for Dynamic Risk Assessment

“…The most notable works providing the taxonomy of smart home-specific attacks and threats were provided by Bugeja et al [26] and Heartfield et al [36]. With cross-correlation performed in the scope of risk identification under the GHOST project [5], we further reduced the initial listing by applying criteria on the attack simulation feasibility. The sections hereafter outline each category of attacks included in our analysis along with the scenario definition, implemented demonstration and validation methodology.…”

“…These advances are fused together within the implementation of DRA [5], which relies on probabilistic traffic profiling, the intelligence on the threat and vulnerability likelihood and the associated risk's severity, which permits identifying network anomalies and coordinating the selection of the appropriate mitigation action.…”

“…Consequently, an eager need for tools providing visibility of cyber risks and threats has been raised in parallel with the deployment of cutting-edge smart homes [4]. For that matter, dynamic risk assessment (DRA)-based tools are foreseen to allow smart home users to take control and make appropriate decisions regarding the existing cybersecurity and privacy risks [5]. Such technology intends to automate threat identification and provide control and monitoring features for mitigation any detected risks.…”

“…The work presented in this paper is part of the last sequence in the execution chain, namely automating mitigation decisions and informing the end user. It therefore directly follows up the research on risk assessment (RA) [5], which serves as an input to this work.…”

Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT

“…This RA variant called dynamic risk assessment (DRA) targets continuous, near real-time, on-the-fly reassessments. Applying DRA in IoT is not new, as it has been addressed in many discussions [22,23] and case studies for threat-based RA in smart homes [24][25][26][27]. These studies highlight that DRA provides better observability (this term comes from control theory and distributed systems [28]; it is used nowadays as a means to understand a system's states by inspecting the data it generates in event logs, metrics, etc.…”