[Paper Review] Discovering Physical Interaction Vulnerabilities in IoT Deployments.

Muslum Ozgur Ozmen, Xuansong Li+4 more|arXiv (Cornell University)|Feb 3, 2021

Advanced Malware Detection Techniques41 references4 citations

TL;DR

IoTSeer is a security service that translates IoT application source code into hybrid I/O automata to model physical behavior, composites multiple apps into a joint behavior model, and uses grid-based testing and falsification to detect unsafe physical interactions. It identifies root causes of policy violations and suggests patches, demonstrating effectiveness in a real house with 13 actuators, 6 sensors, and 37 apps.

ABSTRACT

Internet of Things (IoT) applications drive the behavior of IoT deployments according to installed sensors and actuators. It has recently been shown that IoT deployments are vulnerable to physical interactions, caused by design flaws or malicious intent, that can have severe physical consequences. Yet, extant approaches to securing IoT do not translate the app source code into its physical behavior to evaluate physical interactions. Thus, IoT consumers and markets do not possess the capability to assess the safety and security risks these interactions present. In this paper, we introduce the IoTSeer security service for IoT deployments, which uncovers undesired states caused by physical interactions. IoTSeer operates in four phases (1) translation of each actuation command and sensor event in an app source code into a hybrid I/O automaton that defines an app's physical behavior, (2) combining apps in a novel composite automaton that represents the joint physical behavior of interacting apps, (3) applying grid-based testing and falsification to validate whether an IoT deployment conforms to desired physical interaction policies, and (4) identification of the root cause of policy violations and proposing patches that guide users to prevent them. We use IoTSeer in an actual house with 13 actuators and six sensors with 37 apps and demonstrate its effectiveness and performance.

Motivation & Objective

• To address the lack of tools that analyze physical interaction risks in IoT deployments by translating app code into physical behavior models.
• To enable automated detection of unsafe physical interactions arising from app interactions, especially those leading to unintended or harmful outcomes.
• To provide actionable feedback by identifying root causes of policy violations and suggesting corrective patches.
• To bridge the gap between high-level application logic and low-level physical safety by modeling joint behavior of multiple interacting IoT apps.

Proposed method

• Translating each actuation command and sensor event in IoT app source code into a hybrid I/O automaton to represent physical behavior.
• Constructing a composite automaton by combining individual app automata to model joint physical behavior of interacting applications.
• Applying grid-based testing and model falsification to systematically explore state spaces and detect violations of desired physical interaction policies.
• Using formal analysis to trace back policy violations to their root causes in the source code and generate patch suggestions for mitigation.
• Validating the approach in a real-world deployment with 13 actuators, 6 sensors, and 37 applications to assess scalability and effectiveness.

Experimental results

Research questions

• RQ1 Can IoT applications be systematically translated into formal models that capture their physical behavior for security analysis?
• RQ2 How can joint physical behavior be modeled when multiple IoT applications interact in a shared environment?
• RQ3 Can grid-based testing and falsification effectively uncover unsafe physical interaction states in complex IoT deployments?
• RQ4 To what extent can root causes of physical interaction vulnerabilities be automatically diagnosed and corrected?
• RQ5 How effective and scalable is the IoTSeer framework in real-world, large-scale IoT environments?

Key findings

• IoTSeer successfully detected unsafe physical interaction states in a real house with 13 actuators, 6 sensors, and 37 apps, demonstrating practical applicability.
• The framework identified previously unknown interaction vulnerabilities that could lead to unintended physical consequences, such as conflicting actuator commands.
• Root cause analysis enabled precise identification of problematic code patterns, allowing developers to apply targeted fixes.
• The use of grid-based testing and falsification significantly improved the coverage of state space exploration compared to random testing.
• The composite automaton model accurately captured joint behavior across multiple apps, enabling detection of emergent unsafe interactions not visible in isolation.