Modeling Internet-of-Things (IoT) Behavior for Enforcing Security and Privacy Policies

The availability and usage of the Internet of Things (IoT) have grown significantly over the last decade. This growth in ubiquitous computing has enabled continuous observation, decision-making, and execution of actions to improve the livelihood of millions. However, IoT also has an increased cybersecurity risk by making the user vulnerable to attacks from the outside or disclosing information without the user’s knowledge. As a result, it becomes essential to understand the behavior of IoT devices and then model the behavior at a higher level of abstraction that enables automated reasoning, reducing the gap between policy requirements and its analysis. Towards this end, we have developed our proposed framework, which combines policy requirements guided structured experimentation performed on the IoT devices, followed by modeling to store the knowledge for analysis. We leverage the experimental findings to formulate the relationship of IoT devices in the model. The creation of this model enables automated analysis to identify if there is a potential violation of security or privacy. We demonstrate our approach by investigating the behavior of IoT devices and performing analysis to check if the IoT devices execute risky cybersecurity behavior.