UC Davis

The global Internet of Things (IoT) market is growing rapidly. It is predicted that the total global worth of IoT technology could be as much as 6.2 trillion US dollars by 2025. Most IoT systems involve IoT devices, communication protocols, remote cloud, IoT applications, mobile apps, and the physical environment. How- ever, existing IoT security analyses only focus on a subset of all the essential components, such as device firmware or communication protocols, and ignore IoT systems’ interactive nature, resulting in limited attack detection capabilities.

In this dissertation, we introduce frameworks to evaluate the security of IoTs at the system level. We design and prototype ForeSee, a cross-layer vulnerability analysis framework for IoT systems. It generates a multi-layer IoT hypothesis graph which is amenable to existing model checking tools. Even though we come up with a state space compression algorithm to reduce the size of the hypothesis graph, in the worst case scenario, the size of the generated hypothesis graph would still be exponential. To tackle the state explosion problem, we propose IOTA, a logic programming-based framework which generates exploit- dependency attack graphs and computes metrics (shortest attack trace, blast radius, and severity score) to help IoT system administrators to evaluate attack complexity and the impact of each vulnerability.

We then explore the problem of monitoring IoT app execution and uncovering user privacy leakage via wireless traffic analysis. We propose and implement a novel IoT security enforcement framework called IoTGaze that can detect potential anomalies and vulnerabilities in the IoT system by comparing the sniffed wireless events sequence and the sequence extracted from IoT apps’ descriptions. Moreover, in IOTSPY, we show that it is possible to infer the user’s privacy, like living habits, routines, and even installed IoT applications by just sniffing the encrypted wireless traffic.

Our research confirms that the interactive nature of IoT components requires us to consider these components simultaneously so as to uncover more vulnerabilities and evaluate their impacts. We hope our works will stimulate more research on IoT system-level security.