Fear and Logging in the Internet of Things

Abstract

Abstract-As the Internet of Things (IoT) continues to proliferate, diagnosing incorrect behavior within increasinglyautomated homes becomes considerably more difficult. Devices and apps may be chained together in long sequences of triggeraction rules to the point that from an observable symptom (e.g., an unlocked door) it may be impossible to identify the distantly removed root cause (e.g., a malicious app). This is because, at present, IoT audit logs are siloed on individual devices, and hence cannot be used to reconstruct the causal relationships of complex workflows. In this work, we present ProvThings, a platform-centric approach to centralized auditing in the Internet of Things. ProvThings performs efficient automated instrumentation of IoT apps and device APIs in order to generate data provenance that provides a holistic explanation of system activities, including malicious behaviors. We prototype ProvThings for the Samsung SmartThings platform, and benchmark the efficacy of our approach against a corpus of 26 IoT attacks. Through the introduction of a selective code instrumentation optimization, we demonstrate in evaluation that ProvThings imposes just 5% overhead on physical IoT devices while enabling real time querying of system behaviors, and further consider how ProvThings can be leveraged to meet the needs of a variety of stakeholders in the IoT ecosystem.

SafeChain: Securing Trigger-Action Programming From Attack Chains

“…ProvThings [46] provides data provenance to diagnose the trace and root cause of behavior. However, data provenance is useful only in forensic analysis after an attack.…”

“…The increasingly complex interdependencies between devices can easily allow for various attacks, because an adversary controlling one IoT device can now expand influence to more devices through such interdependencies. Unfortunately, attacks leveraging trigger-action rules are difficult to detect manually, as device owners may unintentionally provide access or reveal private information to unauthorized entities due to complex chain reactions [46]. This work presents an automated prevention system called SAFECHAIN which identifies exploitable trigger-action attack chains.…”

“…This work presents an automated prevention system called SAFECHAIN which identifies exploitable trigger-action attack chains. SAFECHAIN can thus work in conjunction with methods that support postmortem attack reconstruction from logs [46], methods that identify errors in individual rules [37], and methods that resolve conflicts between rules [30]- [33].…”

A Study of Data Store-based Home Automation

“…Finally, prior work has proposed novel access control enhancements, which may alleviate some of the concerns raised in this paper. ProvThings [54] provides provenance information that may allow the user to piece together evidence of some of the attacks described in this paper, but does not prevent the attacks themselves. On the contrary, ContextIoT [19] provides users with runtime prompts describing the context of sensitive data accesses, which may alert users to unintended execution of routines (F 4 ), at the cost of reducing automation.…”

Detecting Safety and Security Faults in PLC Systems with Data Provenance

“…Our approach is complete in expressing the causality and dependencies among the data objects through the provenance graph. Another notable work in this area is ProvThings [26] where a provenance collection framework is proposed for IoT apps and devices. ProvThings presents an automated instrumentation mechanism for IoT apps and device APIs.…”