Looking Under the Hood of Z-Wave

Badenhop, Christopher W.; Graham, Steve; Mullins, Barry E.; Mailloux, Logan O.

doi:10.1145/3285030

Cited by 6 publications

(2 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There have been many studies to analyze the Z-Wave protocol (e.g., [3], [4], [5], [6], [7], [8], [9], [16], [17], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28]); among these, some focused on the analysis of the Z-Wave traffic. MBIDS [8] analyzed 11 Z-Wave CMDCLs to find misuse cases.…”

Section: Related Work a Research On The Z-wave Protocolmentioning

confidence: 99%

ZMAD: Lightweight Model-Based Anomaly Detection for the Structured Z-Wave Protocol

et al. 2023

View full text Add to dashboard Cite

Smart home automation is part of the Internet of Things that enables house remote control via the use of smart devices, sensors, and actuators. Despite its convenience, vulnerabilities in smart home devices provide attackers with an opportunity to break into the smart home infrastructure without permission. In fact, millions of Z-Wave smart home legacy devices are vulnerable to wireless injection attacks due to the lack of encryption support and the lack of firmware updates. Worse yet, recent Z-Wave secure S2 devices with built-in encryption are also vulnerable to specific targeted attacks, i.e., attacking S2 devices is possible via vulnerable legacy devices or injecting malicious unencrypted packets that alter S2 devices normal operations. In this paper, we present ZMAD, a lightweight anomaly-based intrusion detection system (IDS) for monitoring and detecting wireless attacks on Z-Wave smart home devices. ZMAD uses a technique called packet formalization to address heterogeneous packets coming from various Z-Wave devices. ZMAD also uses a centralized learning approach to profile normal communication patterns of devices to increase Z-Wave Command Class coverage. By constructing a lightweight artificial neural network built from scratch in consideration of packet formalization and centralized learning, ZMAD can effectively detect abnormal behaviors in Z-Wave networks and runs on an external device to avoid network overhead. We applied ZMAD to an evaluation testbed constructed using 17 top-rated real-world Z-Wave smart home devices.From our experiments, we confirmed that ZMAD could effectively discover wireless injected packets with an accuracy of 98% for its artificial neural network. Our further analysis demonstrated that ZMAD is more effective than existing approaches, increasing the coverage of Z-Wave Command Classes by 663% while reducing five to 47 times the size of the trained model (23.1 KB) compared to existing deep learning architectures.

show abstract

Section: Related Work a Research On The Z-wave Protocolmentioning

confidence: 99%

ZMAD: Lightweight Model-Based Anomaly Detection for the Structured Z-Wave Protocol

et al. 2023

View full text Add to dashboard Cite

show abstract

“…Secondly, memory acquisition tools need to load a kernel module on Linux based systems (the most used by IoT devices) and to create a profile of the volatile memory so that it can be examined. These two processes are not feasible at all on IoT devices, so only carrying out a remote analysis of the device will allow the extraction of information from the volatile data [27,14,10].…”

Section: Introductionmentioning

confidence: 99%

Integrating the edge computing paradigm into the development of IoT forensic methodologies

Castelo Gómez,

Ruiz-Villafranca

2023

Int. J. Inf. Secur.

View full text Add to dashboard Cite

With the number of attacks and cyberincidents affecting Internet of Things (IoT) devices on the rise, the need for carrying out forensic investigations to determine what has happened has grown at the same pace. However, due to the characteristics and requirements of this environment, the solutions used until now in the field are not suitable to be followed, as they are not able to guarantee the effective retrieval and study of the pieces of evidence. Under these circumstances, new ways of interacting with IoT units are needed, and the edge computing paradigm has emerged as an interesting asset to complement IoT networks. Attack, anomaly and intrusion detection, or data encryption are some of the fields in which this approach has been successfully applied. Following this concept, this article presents an IoT forensic methodology that integrates the edge computing technology in order to assist in the investigation process, trying to address some of the issues that are hindering the effectiveness of examinations in this scenario. In addition, this proposal is compared with the existing ones in the research community, and evaluated by testing it in two case studies representing real-life scenarios, ultimately demonstrating suitability to be used for IoT forensic examinations.

show abstract