Shortfall-Based Optimal Security Provisioning for Internet of Things

Abstract

We present a formal method for computing the best security provisioning for Internet of Things (IoT) scenarios characterized by a high degree of mobility. The security infrastructure is intended as a security resource allocation plan, computed as the solution of an optimization problem that minimizes the risk of having IoT devices not monitored by any resource. We employ the shortfall as a risk measure, a concept mostly used in the economics, and adapt it to our scenario. We show how to compute and evaluate an allocation plan, and how such security solutions address the continuous topology changes that affect an IoT environment

Modeling and Analysis of Integrated Proactive Defense Mechanisms for Internet of Things

“…Some existing approaches have adopted a risk-based or vulnerability-based security model to assess the effectiveness of defense mechanisms [1], [24], [26]. Abie and Balasingham [1] proposed a risk-based security framework for IoT environments in the eHealth domain to measure expected risk and/or potential benefits by taking a game theoretic approach and context-aware techniques.…”

“…However, both works [1], [26] only proposed high-level ideas about the metrics without any formulation and did not consider the key characteristics of IoT environments where lightweight defense mechanisms are vital to securing a large-scale, resource-constrained IoT system. Rullo et al [24] proposed an approach to compute the optimal security resource allocation plan for an IoT network consisting of mobile nodes and introduced a risk metric inspired by economics to evaluate the allocation plans. However, it only considered the device-level mechanisms and did not show the system-level evaluation.…”

“…Unlike the existing approaches above [1], [24], [26], we proposed a lightweight, affordable method to evaluate the deployment of an integrated defense mechanism for an IoT environment by meeting both security and performance goals of a system.…”

Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception

“…In the literature, a risk-based security model has also been used to assess the effectiveness of defense mechanisms [28], [29], [30]. [28] proposed a risk-based security framework for IoT environments in the eHealth domain to measure expected risk and/or potential benefits by taking a game theoretic approach and context-aware techniques.…”

“…However, only high-level ideas about the metrics were described without taking into account key characteristics of IoT environments that would require lightweight solutions. [29] proposed a method to come up with the optimal security resource allocation plan for an IoT network consisting of mobile nodes using a risk metric estimated by reflecting an economic perspective. However, only device-level evaluations were considered without showing system-level evaluations.…”