Publication
Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things
| Summary: | The proliferation of Internet of Things (IoT) devices has been expanding several domains, offering unprecedented connectivity and convenience. However, this surge in interconnected devices has brought forth significant security challenges, as constrained budgets and development time leave security in a secondary role, or even non-existent. This is compounded upon by small design and development teams, where security expertise is reduced and lacking, creating a landscape of IoT systems that are unsecured and ripe for attack by malicious actors. The data gathered by these devices, their general lack of security, and the possibility of serving ans entry points to otherwise more secure systems, makes them increasingly tempting targets for exploration and exploitation. This thesis attempts to bridge the gap of aiding in the secure IoT system development, by approaching the issue of security in IoT from a standpoint of low knowledge and/or low expertise in IoT security. The first step towards the main goal is the extensive survey of existing IoT architectures and modeling tools, to aid in identifying the main challenges in secure IoT development and what can be improved or built upon. The second phase advances upon what was surveyed, by proposing an IoT system model that encompasses a large set of IoT ecosystems, and that embeds security in its essence, by identifying, for each system component, what are its critical security requirements, and what are the most attractive targets for an attacker on the given component. This model is complemented by the creation of an attack taxonomy, that attempts to take the most common attacks on IoT, and identifying where in the system those attacks may occur. To further aid the development process and provide a practical substrate to the Doctor of Philosophy (degree) (Ph.D.) work, an attack modeling tool named Attack Trees for IoT (ATIoT) is presented as a means to identify, starting from a system description given through a direct answer questionnaire, the attacks the system may be more susceptible to, providing the user with a set of attack trees, together with detailed node descriptions, of the identified attacks for the described system. Joining ATIoT, other existing tools are mapped to the proposed model, to further aid in identifying where security requirements, best practices, guidelines, security mechanisms and potential threats in an IoT system should be applied or can be found, further enhancing the usefulness of such tools. Motivated by the profound transformation that Artificial Intelligence (AI) is causing in the technological world, and the always fast advancing security area, a series of experiments of applying different AI mechanisms to the developed tools are also detailed herein. They specifically concern the application of classification models to the elicitation of security requirements, and the use of Large Language Models (LLMs) for identifying potential attacks from a textual system description. The thesis presents the results of these experiments, which show the promise of applying such methodologies to the process of security engineering. Main conclusions include achieving the goal of creating a panoply of mechanisms and tools that aid the development of secure IoT systems, that were designed towards being used by developers with low or no security background and expertise. It was also concluded that AI methods can aid in the maintaining of such tools and mechanisms, ensuring their validity in a longer time period, a challenge always present in fast-paced, always evolving areas. |
|---|---|
| Main Authors: | Sequeiros, João Bernardo Ferreira |
| Subject: | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| Year: | 2024 |
| Country: | Portugal |
| Document type: | doctoral thesis |
| Access type: | open access |
| Associated institution: | Universidade da Beira Interior |
| Language: | English |
| Origin: | uBibliorum |
| _version_ | 1868420821292154880 |
|---|---|
| author | Sequeiros, João Bernardo Ferreira |
| author_facet | Sequeiros, João Bernardo Ferreira |
| author_role | author |
| contributor_name_str_mv | Inácio, Pedro Ricardo Morais uBibliorum |
| country_str | PT |
| creators_json_txt | [{\"Person.name\":\"Sequeiros, João Bernardo Ferreira\",\"Person.identifier.orcid\":\"0000-0001-7206-7771\"}] |
| datacite.contributors.contributor.contributorName.fl_str_mv | Inácio, Pedro Ricardo Morais uBibliorum |
| datacite.creators.creator.creatorName.fl_str_mv | Sequeiros, João Bernardo Ferreira |
| datacite.date.Accepted.fl_str_mv | 2024-09-04T00:00:00Z |
| datacite.date.available.fl_str_mv | 2024-09-20T15:52:20Z |
| datacite.date.embargoed.fl_str_mv | 2024-09-20T15:52:20Z |
| datacite.rights.fl_str_mv | http://purl.org/coar/access_right/c_abf2 |
| datacite.subjects.subject.fl_str_mv | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| datacite.titles.title.fl_str_mv | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| dc.contributor.none.fl_str_mv | Inácio, Pedro Ricardo Morais uBibliorum |
| dc.creator.none.fl_str_mv | Sequeiros, João Bernardo Ferreira |
| dc.date.Accepted.fl_str_mv | 2024-09-04T00:00:00Z |
| dc.date.available.fl_str_mv | 2024-09-20T15:52:20Z |
| dc.date.embargoed.fl_str_mv | 2024-09-20T15:52:20Z |
| dc.format.none.fl_str_mv | application/pdf |
| dc.identifier.none.fl_str_mv | http://hdl.handle.net/10400.6/14515 |
| dc.language.none.fl_str_mv | eng |
| dc.rights.cclincense.fl_str_mv | http://creativecommons.org/licenses/by-nc-sa/4.0/ |
| dc.rights.none.fl_str_mv | http://purl.org/coar/access_right/c_abf2 |
| dc.subject.none.fl_str_mv | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| dc.title.fl_str_mv | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| dc.type.none.fl_str_mv | http://purl.org/coar/resource_type/c_db06 |
| description | The proliferation of Internet of Things (IoT) devices has been expanding several domains, offering unprecedented connectivity and convenience. However, this surge in interconnected devices has brought forth significant security challenges, as constrained budgets and development time leave security in a secondary role, or even non-existent. This is compounded upon by small design and development teams, where security expertise is reduced and lacking, creating a landscape of IoT systems that are unsecured and ripe for attack by malicious actors. The data gathered by these devices, their general lack of security, and the possibility of serving ans entry points to otherwise more secure systems, makes them increasingly tempting targets for exploration and exploitation. This thesis attempts to bridge the gap of aiding in the secure IoT system development, by approaching the issue of security in IoT from a standpoint of low knowledge and/or low expertise in IoT security. The first step towards the main goal is the extensive survey of existing IoT architectures and modeling tools, to aid in identifying the main challenges in secure IoT development and what can be improved or built upon. The second phase advances upon what was surveyed, by proposing an IoT system model that encompasses a large set of IoT ecosystems, and that embeds security in its essence, by identifying, for each system component, what are its critical security requirements, and what are the most attractive targets for an attacker on the given component. This model is complemented by the creation of an attack taxonomy, that attempts to take the most common attacks on IoT, and identifying where in the system those attacks may occur. To further aid the development process and provide a practical substrate to the Doctor of Philosophy (degree) (Ph.D.) work, an attack modeling tool named Attack Trees for IoT (ATIoT) is presented as a means to identify, starting from a system description given through a direct answer questionnaire, the attacks the system may be more susceptible to, providing the user with a set of attack trees, together with detailed node descriptions, of the identified attacks for the described system. Joining ATIoT, other existing tools are mapped to the proposed model, to further aid in identifying where security requirements, best practices, guidelines, security mechanisms and potential threats in an IoT system should be applied or can be found, further enhancing the usefulness of such tools. Motivated by the profound transformation that Artificial Intelligence (AI) is causing in the technological world, and the always fast advancing security area, a series of experiments of applying different AI mechanisms to the developed tools are also detailed herein. They specifically concern the application of classification models to the elicitation of security requirements, and the use of Large Language Models (LLMs) for identifying potential attacks from a textual system description. The thesis presents the results of these experiments, which show the promise of applying such methodologies to the process of security engineering. Main conclusions include achieving the goal of creating a panoply of mechanisms and tools that aid the development of secure IoT systems, that were designed towards being used by developers with low or no security background and expertise. It was also concluded that AI methods can aid in the maintaining of such tools and mechanisms, ensuring their validity in a longer time period, a challenge always present in fast-paced, always evolving areas. |
| dirty | 0 |
| eu_rights_str_mv | openAccess |
| format | doctoralThesis |
| fulltext.url.fl_str_mv | https://ubibliorum.ubi.pt/bitstreams/ebae8214-7ac4-4860-8ceb-09261241cd37/download |
| funding.funder.alternateName_str_mv | FCT |
| funding.funder.identifier_str_mv | http://doi.org/10.13039/501100001871 |
| funding.funder.name_str_mv | Fundação para a Ciência e a Tecnologia |
| funding.identifier_str_mv | SFRH/BD/133838/2017 |
| funding.name_str_mv | OE Bolsa de Doutoramento |
| funding_str_mv | SFRH/BD/133838/2017 info:eu-repo/grantAgreement/FCT/OE/SFRH%2FBD%2F133838%2F2017/PT |
| id | ubibliorum_da6959083e59abab98e6d03dabfa4b4d |
| identifier.url.fl_str_mv | http://hdl.handle.net/10400.6/14515 |
| instacron_str | ubi |
| institution | Universidade da Beira Interior |
| instname_str | Universidade da Beira Interior |
| language | eng |
| network_acronym_str | ubibliorum |
| network_name_str | uBibliorum |
| oai_identifier_str | oai:ubibliorum.ubi.pt:10400.6/14515 |
| organization_str_mv | urn:organizationAcronym:ubi |
| person_str_mv | Sequeiros, João Bernardo Ferreira Sequeiros, João Bernardo Ferreira https://www.ciencia-id.pt/1F1D-2389-FA3B 1F1D-2389-FA3B http://orcid.org/0000-0001-7206-7771 0000-0001-7206-7771 |
| publishDate | 2024 |
| reponame_str | uBibliorum |
| repository_id_str | urn:repositoryAcronym:ubibliorum |
| service_str_mv | urn:repositoryAcronym:ubibliorum |
| spelling | engpt_PTThe proliferation of Internet of Things (IoT) devices has been expanding several domains, offering unprecedented connectivity and convenience. However, this surge in interconnected devices has brought forth significant security challenges, as constrained budgets and development time leave security in a secondary role, or even non-existent. This is compounded upon by small design and development teams, where security expertise is reduced and lacking, creating a landscape of IoT systems that are unsecured and ripe for attack by malicious actors. The data gathered by these devices, their general lack of security, and the possibility of serving ans entry points to otherwise more secure systems, makes them increasingly tempting targets for exploration and exploitation. This thesis attempts to bridge the gap of aiding in the secure IoT system development, by approaching the issue of security in IoT from a standpoint of low knowledge and/or low expertise in IoT security. The first step towards the main goal is the extensive survey of existing IoT architectures and modeling tools, to aid in identifying the main challenges in secure IoT development and what can be improved or built upon. The second phase advances upon what was surveyed, by proposing an IoT system model that encompasses a large set of IoT ecosystems, and that embeds security in its essence, by identifying, for each system component, what are its critical security requirements, and what are the most attractive targets for an attacker on the given component. This model is complemented by the creation of an attack taxonomy, that attempts to take the most common attacks on IoT, and identifying where in the system those attacks may occur. To further aid the development process and provide a practical substrate to the Doctor of Philosophy (degree) (Ph.D.) work, an attack modeling tool named Attack Trees for IoT (ATIoT) is presented as a means to identify, starting from a system description given through a direct answer questionnaire, the attacks the system may be more susceptible to, providing the user with a set of attack trees, together with detailed node descriptions, of the identified attacks for the described system. Joining ATIoT, other existing tools are mapped to the proposed model, to further aid in identifying where security requirements, best practices, guidelines, security mechanisms and potential threats in an IoT system should be applied or can be found, further enhancing the usefulness of such tools. Motivated by the profound transformation that Artificial Intelligence (AI) is causing in the technological world, and the always fast advancing security area, a series of experiments of applying different AI mechanisms to the developed tools are also detailed herein. They specifically concern the application of classification models to the elicitation of security requirements, and the use of Large Language Models (LLMs) for identifying potential attacks from a textual system description. The thesis presents the results of these experiments, which show the promise of applying such methodologies to the process of security engineering. Main conclusions include achieving the goal of creating a panoply of mechanisms and tools that aid the development of secure IoT systems, that were designed towards being used by developers with low or no security background and expertise. It was also concluded that AI methods can aid in the maintaining of such tools and mechanisms, ensuring their validity in a longer time period, a challenge always present in fast-paced, always evolving areas.application/pdfpt_PTTowards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of ThingsPersonalSequeiros, João Bernardo FerreiraDSpacehttp://dspace.org/items/c3b3e182-58dc-4ea4-b121-a6948308287cDSpacehttp://dspace.org/items/c3b3e182-58dc-4ea4-b121-a6948308287cFerreira SequeirosJoão BernardoCiência IDhttps://www.ciencia-id.pt1F1D-2389-FA3BORCIDhttp://orcid.org0000-0001-7206-7771Inácio, Pedro Ricardo MoraisHostingInstitutionOrganizationaluBibliorume-mailmailto:noreplyuBibliorum@ubi.ptnoreplyuBibliorum@ubi.ptURNurn:tid:1015684872024-09-20T15:52:20Z2024-09-042024-09-04T00:00:00ZHandlehttp://hdl.handle.net/10400.6/14515http://purl.org/coar/access_right/c_abf2open accessSegurançaInternet-das-CoisasSegurança-por-ConstruçãoModelação-de-SistemasModelação-de- AtaquesInteligência-ArtificialArtificial-IntelligenceCybersecurity2961149 bytesFundação para a Ciência e a TecnologiaBolsa de Doutoramento FCT: Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things [SFRH/BD/133838/2017]info:eu-repo/grantAgreement/FCT/OE/SFRH%2FBD%2F133838%2F2017/PTSFRH/BD/133838/2017OEBolsa de DoutoramentoCrossref Funder IDhttp://doi.org/10.13039/501100001871literaturehttp://purl.org/coar/resource_type/c_db06doctoral thesis2024-09-04http://creativecommons.org/licenses/by-nc-sa/4.0/http://purl.org/coar/access_right/c_abf2application/pdffulltexthttps://ubibliorum.ubi.pt/bitstreams/ebae8214-7ac4-4860-8ceb-09261241cd37/download |
| spellingShingle | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things Sequeiros, João Bernardo Ferreira Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| status | SINGLETON |
| subject.fl_str_mv | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| title | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| title_full | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| title_fullStr | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| title_full_unstemmed | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| title_short | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| title_sort | Towards a Framework for System and Attack Modelling and Mapping of Requirements and Technology for the Internet of Things |
| topic | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| topic_facet | Segurança Internet-das-Coisas Segurança-por-Construção Modelação-de-Sistemas Modelação-de- Ataques Inteligência-Artificial Artificial-Intelligence Cybersecurity |
| url | http://hdl.handle.net/10400.6/14515 |
| visible | 1 |