Scalable analysis of interaction threats in IoT systems

Alhanahnah, Mohannad; Stevens, Clay; Bagheri, Hamid

doi:10.1145/3395363.3397347

Cited by 51 publications

(44 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We evaluated our models with an experimental study performed over models of 222 real-world smart home apps for Samsung Smart-Things. These app models were automatically extracted from the source code of the applications by applying static analysis as described by Alhanahnah, et al [2], to extract an inter-procedural control flow graph (ICFG) from each app and translate the relevant nodes from the ICFG into the triggers, conditions, and actions defining the models for the rules of the app. Our evaluation addresses the following research questions:…”

Section: Discussionmentioning

confidence: 99%

“…To compare the two approaches, we used the Alloy Analyzer [20] to generate counterexamples for safety properties for seven types of possible interactions between co-located apps in a smart home IoT system. The definitions of these safety properties were adapted from prior work [2,11,13,31]. We translated each safety property into a pair of assertions-one for the state-based model and the other for the rule-based model.…”

Section: Methodsmentioning

confidence: 99%

“…Wang, et al [31] define a set of inter-rule vulnerabilities as path-based properties, but they provide no evaluation of scalability. Alhanahnah, et al [2] demostrated an automated, holistic analysis for IoT coordination threats from which we drew our app models; however, that work does not consider the state-based approach compared here.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Comparing formal models of IoT app coordination analysis

Stevens

Alhanahnah

Yan

et al. 2020

Proceedings of the 3rd ACM SIGSOFT International Workshop on Software Security From Design to Deployment

Self Cite

View full text Add to dashboard Cite

The rising popularity of the Internet-of-Things (IoT) devices has driven their increasing adoption in various settings, such as modern homes. IoT systems integrate such physical devices with third-party apps, which can coordinate in arbitrary ways. However, malicious or undesired coordination can lead to serious vulnerabilities. This paper explores two different ways, i.e., a commonly-used statebased approach and a holistic, rule-based approach, to formally model app coordination and the safety and security thereof in the context of IoT platforms. The less common rule-base approach allows for a smaller, more scalable model. We realize both modeling approaches using bounded model checking with Alloy to automatically identify potential cases where apps exhibit coordination relationships. We evaluate the effectiveness of the modeling approaches by checking a corpus of real-world IoT apps of Samsung SmartThings and IFTTT. The experimental results demonstrate that our rule-based modeling leads to a more scalable analysis. CCS CONCEPTS • Security and privacy → Software and application security.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Comparing formal models of IoT app coordination analysis

Stevens

Alhanahnah

Yan

et al. 2020

Proceedings of the 3rd ACM SIGSOFT International Workshop on Software Security From Design to Deployment

Self Cite

View full text Add to dashboard Cite

show abstract

“…IoTCOM approach is proposed in (Alhanahnah et al, 2020). IoTCOM is based on the static analysis of behavioral models of IoT apps and formal methods to detect the security and safety violations against some predefined IoT safety and security properties.…”

Section: /31mentioning

confidence: 99%

Peer Review #1 of "A conflicts’ classification for IoT-based services: a comparative survey (v0.1)"

2021

View full text Add to dashboard Cite

“…The IoTCOM approach is proposed in Alhanahnah, Stevens & Bagheri (2020). IoTCOM is based on the static analysis of behavioral models of IoT apps and formal methods to detect the security and safety violations against some predefined IoT safety and security properties.…”

Section: Literature Analysis Of Conflicts' Classificationmentioning

confidence: 99%

Figure 1: Example of building environment control via two users.

View full text Add to dashboard Cite

Scalable analysis of interaction threats in IoT systems

Cited by 51 publications

References 39 publications

Comparing formal models of IoT app coordination analysis

Comparing formal models of IoT app coordination analysis

Peer Review #1 of "A conflicts’ classification for IoT-based services: a comparative survey (v0.1)"

Figure 1: Example of building environment control via two users.

Contact Info

Product

Resources

About