IoTSAT: A formal framework for security analysis of the internet of things (IoT)

Mujahid Mohsin; Zahid Anwar; Ghaith Husari; Ehab Al-Shaer; Mohammad Ashiqur Rahman

doi:10.1109/CNS.2016.7860484

IoTSAT: A formal framework for security analysis of the internet of things (IoT)

Mujahid Mohsin, Zahid Anwar, Ghaith Husari, Ehab Al-Shaer, Mohammad Ashiqur Rahman

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

69 Scopus citations

Abstract

The new attack surface being crafted by the huge influx of IoT devices is both formidable and unpredictable, as it introduces a rich set of unexplored attack techniques and unknown vulnerabilities. These new attack techniques are hard to perceive through traditional means, owing to concealed and cascaded inter-device, inter-system and device-environment dependencies. In this paper, we present IoTSAT, a formal framework for security analysis of IoT. IoTSAT formally models the generic behavior of IoT system of systems, based on device configurations, network topologies, user policies and IoT-specific attack surface. The model is then used to measure system's resilience against potential attacks and identify threat vectors and specific attack techniques, which can be used to achieve higher-level adversary's objectives. We evaluate IoTSAT over realistic IoT networks, which concludes that our approach is scalable and highly beneficial for uncovering complex attack vectors of IoT systems.

Original language	English
Title of host publication	2016 IEEE Conference on Communications and Network Security, CNS 2016
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	180-188
Number of pages	9
ISBN (Electronic)	9781509030651
DOIs	https://doi.org/10.1109/CNS.2016.7860484
State	Published - 21 Feb 2017
Externally published	Yes

Publication series

Name	2016 IEEE Conference on Communications and Network Security, CNS 2016

Bibliographical note

Publisher Copyright:
© 2016 IEEE.

Keywords

Formal verification
IoT security analysis
IoT system modeling
IoT threat classification
IoT threat modeling
SMT

ASJC Scopus subject areas

Computer Networks and Communications
Safety, Risk, Reliability and Quality

Access to Document

10.1109/CNS.2016.7860484

Cite this

Mohsin, M., Anwar, Z., Husari, G., Al-Shaer, E., & Rahman, M. A. (2017). IoTSAT: A formal framework for security analysis of the internet of things (IoT). In 2016 IEEE Conference on Communications and Network Security, CNS 2016 (pp. 180-188). Article 7860484 (2016 IEEE Conference on Communications and Network Security, CNS 2016). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/CNS.2016.7860484

@inproceedings{196facd112434ea68d955c6debb4f0c0,

title = "IoTSAT: A formal framework for security analysis of the internet of things (IoT)",

abstract = "The new attack surface being crafted by the huge influx of IoT devices is both formidable and unpredictable, as it introduces a rich set of unexplored attack techniques and unknown vulnerabilities. These new attack techniques are hard to perceive through traditional means, owing to concealed and cascaded inter-device, inter-system and device-environment dependencies. In this paper, we present IoTSAT, a formal framework for security analysis of IoT. IoTSAT formally models the generic behavior of IoT system of systems, based on device configurations, network topologies, user policies and IoT-specific attack surface. The model is then used to measure system's resilience against potential attacks and identify threat vectors and specific attack techniques, which can be used to achieve higher-level adversary's objectives. We evaluate IoTSAT over realistic IoT networks, which concludes that our approach is scalable and highly beneficial for uncovering complex attack vectors of IoT systems.",

keywords = "Formal verification, IoT security analysis, IoT system modeling, IoT threat classification, IoT threat modeling, SMT",

author = "Mujahid Mohsin and Zahid Anwar and Ghaith Husari and Ehab Al-Shaer and Rahman, \{Mohammad Ashiqur\}",

note = "Publisher Copyright: {\textcopyright} 2016 IEEE.",

year = "2017",

month = feb,

day = "21",

doi = "10.1109/CNS.2016.7860484",

language = "English",

series = "2016 IEEE Conference on Communications and Network Security, CNS 2016",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "180--188",

booktitle = "2016 IEEE Conference on Communications and Network Security, CNS 2016",

address = "United States",

}

Mohsin, M, Anwar, Z, Husari, G, Al-Shaer, E & Rahman, MA 2017, IoTSAT: A formal framework for security analysis of the internet of things (IoT). in 2016 IEEE Conference on Communications and Network Security, CNS 2016., 7860484, 2016 IEEE Conference on Communications and Network Security, CNS 2016, Institute of Electrical and Electronics Engineers Inc., pp. 180-188. https://doi.org/10.1109/CNS.2016.7860484

IoTSAT: A formal framework for security analysis of the internet of things (IoT). / Mohsin, Mujahid; Anwar, Zahid; Husari, Ghaith et al.
2016 IEEE Conference on Communications and Network Security, CNS 2016. Institute of Electrical and Electronics Engineers Inc., 2017. p. 180-188 7860484 (2016 IEEE Conference on Communications and Network Security, CNS 2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - IoTSAT

T2 - A formal framework for security analysis of the internet of things (IoT)

AU - Mohsin, Mujahid

AU - Anwar, Zahid

AU - Husari, Ghaith

AU - Al-Shaer, Ehab

AU - Rahman, Mohammad Ashiqur

PY - 2017/2/21

Y1 - 2017/2/21

N2 - The new attack surface being crafted by the huge influx of IoT devices is both formidable and unpredictable, as it introduces a rich set of unexplored attack techniques and unknown vulnerabilities. These new attack techniques are hard to perceive through traditional means, owing to concealed and cascaded inter-device, inter-system and device-environment dependencies. In this paper, we present IoTSAT, a formal framework for security analysis of IoT. IoTSAT formally models the generic behavior of IoT system of systems, based on device configurations, network topologies, user policies and IoT-specific attack surface. The model is then used to measure system's resilience against potential attacks and identify threat vectors and specific attack techniques, which can be used to achieve higher-level adversary's objectives. We evaluate IoTSAT over realistic IoT networks, which concludes that our approach is scalable and highly beneficial for uncovering complex attack vectors of IoT systems.

AB - The new attack surface being crafted by the huge influx of IoT devices is both formidable and unpredictable, as it introduces a rich set of unexplored attack techniques and unknown vulnerabilities. These new attack techniques are hard to perceive through traditional means, owing to concealed and cascaded inter-device, inter-system and device-environment dependencies. In this paper, we present IoTSAT, a formal framework for security analysis of IoT. IoTSAT formally models the generic behavior of IoT system of systems, based on device configurations, network topologies, user policies and IoT-specific attack surface. The model is then used to measure system's resilience against potential attacks and identify threat vectors and specific attack techniques, which can be used to achieve higher-level adversary's objectives. We evaluate IoTSAT over realistic IoT networks, which concludes that our approach is scalable and highly beneficial for uncovering complex attack vectors of IoT systems.

KW - Formal verification

KW - IoT security analysis

KW - IoT system modeling

KW - IoT threat classification

KW - IoT threat modeling

KW - SMT

UR - https://www.scopus.com/pages/publications/85016084461

U2 - 10.1109/CNS.2016.7860484

DO - 10.1109/CNS.2016.7860484

M3 - Conference contribution

AN - SCOPUS:85016084461

T3 - 2016 IEEE Conference on Communications and Network Security, CNS 2016

SP - 180

EP - 188

BT - 2016 IEEE Conference on Communications and Network Security, CNS 2016

PB - Institute of Electrical and Electronics Engineers Inc.

ER -

Mohsin M, Anwar Z, Husari G, Al-Shaer E, Rahman MA. IoTSAT: A formal framework for security analysis of the internet of things (IoT). In 2016 IEEE Conference on Communications and Network Security, CNS 2016. Institute of Electrical and Electronics Engineers Inc. 2017. p. 180-188. 7860484. (2016 IEEE Conference on Communications and Network Security, CNS 2016). doi: 10.1109/CNS.2016.7860484

IoTSAT: A formal framework for security analysis of the internet of things (IoT)

Abstract

Publication series

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this