Iota: A Framework for Analyzing System-Level Security of IoTs
Zheng Fang, Hao Fu, Tianbo Gu, Pengfei Hu, Jinyue Song, Trent Jaeger,, Prasant Mohapatra

TL;DR
Iota is a comprehensive framework that models, analyzes, and visualizes system-level security vulnerabilities in IoT environments, considering physical dependencies and app semantics to improve attack detection and system fortification.
Contribution
The paper introduces Iota, a novel logic programming-based framework that performs system-level security analysis of IoT systems, incorporating physical dependencies and NLP-based app semantics extraction.
Findings
Over 80% accuracy in vulnerability precondition prediction
62.8% of shortest attack traces were unexpected by administrators
Attack graph analysis is highly efficient, taking only 1.2 seconds for 50 devices
Abstract
Most IoT systems involve IoT devices, communication protocols, remote cloud, IoT applications, mobile apps, and the physical environment. However, existing IoT security analyses only focus on a subset of all the essential components, such as device firmware, and ignore IoT systems' interactive nature, resulting in limited attack detection capabilities. In this work, we propose Iota, a logic programming-based framework to perform system-level security analysis for IoT systems. Iota generates attack graphs for IoT systems, showing all of the system resources that can be compromised and enumerating potential attack traces. In building Iota, we design novel techniques to scan IoT systems for individual vulnerabilities and further create generic exploit models for IoT vulnerabilities. We also identify and model physical dependencies between different devices as they are unique to IoT systems…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Network Security and Intrusion Detection · Information and Cyber Security
