Effectiveness of Transformer Models on IoT Security Detection in StackOverflow Discussions

TL;DR

This paper introduces a domain-specific dataset of IoT security discussions from Stack Overflow and evaluates transformer models for automatic detection, revealing the complexity of IoT security topics and the need for specialized models.

Contribution

The paper presents the first IoT security dataset from Stack Overflow and develops a domain-specific transformer-based detector with improved accuracy.

Findings

Transformer models perform worse when transferred across domains.

IoT security discussions are more complex than traditional security discussions.

A domain-specific detector achieved an F1-score of 0.69.

Abstract

The Internet of Things (IoT) is an emerging concept that directly links to the billions of physical items, or "things", that are connected to the Internet and are all gathering and exchanging information between devices and systems. However, IoT devices were not built with security in mind, which might lead to security vulnerabilities in a multi-device system. Traditionally, we investigated IoT issues by polling IoT developers and specialists. This technique, however, is not scalable since surveying all IoT developers is not feasible. Another way to look into IoT issues is to look at IoT developer discussions on major online development forums like Stack Overflow (SO). However, finding discussions that are relevant to IoT issues is challenging since they are frequently not categorized with IoT-related terms. In this paper, we present the "IoT Security Dataset", a domain-specific dataset of 7147 samples focused solely on IoT security discussions. As there are no automated tools to label these samples, we manually labeled them. We further employed multiple transformer models to automatically detect security discussions. Through rigorous investigations, we found that IoT security discussions are different and more complex than traditional security discussions. We demonstrated a considerable performance loss (up to 44%) of transformer models on cross-domain datasets when we transferred knowledge from a general-purpose dataset "Opiner", supporting our claim. Thus, we built a domain-specific IoT security detector with an F1-Score of 0.69. We have made the dataset public in the hope that developers would learn more about the security discussion and vendors would enhance their concerns about product security.