Risk Prediction of IoT Devices Based on Vulnerability Analysis

Abstract

Internet of Things (IoT) devices are becoming more widespread not only in areas such as smart homes and smart cities but also in research and office environments. The sheer number, heterogeneity, and limited patch availability provide significant challenges for the security of both office networks and the Internet in general. The systematic estimation of device risks, which is essential for mitigation decisions, is currently a skill-intensive task that requires expertise in network vulnerability scanning, as well as manual effort in firmware binary analysis. This article introduces SAFER, 1 the Security Assessment Framework for Embedded-device Risks, which enables a semi-automated risk assessment of IoT devices in any network. SAFER combines information from network device identification and automated firmware analysis to estimate the current risk associated with the device. Based on past vulnerability data and vendor patch intervals for device models, SAFER extrapolates those observations into the future using different automatically parameterized prediction models. Based on that, SAFER also estimates an indicator for future security risks. This enables users to be aware of devices exposing high risks in the future. One major strength of SAFER over other approaches is its scalability, achieved through significant automation. To demonstrate this strength, we apply SAFER in the network of a large multinational organization, to systematically assess the security level of hundreds of IoT devices on large-scale networks. Results indicate that SAFER successfully identified 531 out of 572 devices leading to a device identification rate of 92.83 %, analyzed 825 firmware images, and predicted the current and future security risk for 240 devices.

Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices

“…Before presenting our evaluation, we first introduce details of the SAFER framework on which our evaluation builds. We also explain what enhancements we have introduced compared to the version described in [23]. Figure 1 shows an overview of SAFER and its components.…”

“…Figure 1 shows an overview of SAFER and its components. The SAFER framework implements various components to 1) identify [24,1] IoT devices, 2) gather vulnerability information for identified devices [23] , 3) score [23] this information and 4) display [22] results to support SAFER's users in making informed decisions regarding their devices' security.…”

“…In its last step, all information is aggregated and SAFER computes a Current Device Security Risk Indicator (CDSRI) and a Future Device Security Risk Indicator (FDSRI) based on past evidence. Previous works about SAFER describe its components [24,1,22] and the overall framework [23] but evaluate in particular the FDSRI with only few devices and less details.…”

“…This paper presents an in-depth and large-scale IoT device security assessment by utilizing the risk prediction & scoring component of the Security Assessment Framework for Embedded-device Risks (SAFER) [23]. SAFER is a highly-automated framework to identify devices on the network for estimating their current as well as future security risk based on publicly retrievable firmware information.…”

“…Oser et al [23] describe SAFER extensively, however the evaluation focuses on device identification and the authors only performed a preliminary evaluation of the risk metrics with 38 device models. They concluded that for their reduced data-set, current and future risk was predicted with almost 100 % accuracy.…”