IoT System Vulnerability Analysis and Network Hardening with Shortest Attack Trace in a Weighted Attack Graph
IoT System Vulnerability Analysis and Network Hardening with Shortest Attack Trace in a Weighted Attack Graph
复制标题
DOI：
10.1145/3576842.3582326
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Yinxin Wan;Xuanli Lin;Abdulhakim Sabur;A. Chang;Kuai Xu;G. Xue
中科院分区：
文献类型：
--
作者：
Yinxin Wan;Xuanli Lin;Abdulhakim Sabur;A. Chang;Kuai Xu;G. Xue
近年来，物联网(IoT)设备已广泛部署在包括智能家居和办公室在内的边缘网络中。尽管物联网的进步带来了令人兴奋的机会，但它也在系统中引入了新的攻击载体和漏洞。已有研究表明，攻击图是进行物联网安全系统级分析的有效模型。本文研究了物联网系统的脆弱性分析和网络加固技术。我们首先将攻击图的概念扩展到加权攻击图，并设计了一种新的计算加权攻击图中最短攻击轨迹的算法。然后，我们对网络强化问题进行了阐述。我们证明了这个问题是NP难的，并设计了一个精确算法和一个启发式算法来解决它。在9个合成物联网系统和2个真实的智能家居物联网测试床上的大量实验表明，我们的最短攻击轨迹算法是健壮和快速的，并且我们的启发式网络硬化算法比精确算法更有效地产生接近最优的结果。
In recent years, Internet of Things (IoT) devices have been extensively deployed in edge networks, including smart homes and offices. Despite the exciting opportunities afforded by the advancements in the IoT, it also introduces new attack vectors and vulnerabilities in the system. Existing studies have shown that the attack graph is an effective model for performing system-level analysis of IoT security. In this paper, we study IoT system vulnerability analysis and network hardening. We first extend the concept of attack graph to weighted attack graph and design a novel algorithm for computing a shortest attack trace in a weighted attack graph. We then formulate the network hardening problem. We prove that this problem is NP-hard, and then design an exact algorithm and a heuristic algorithm to solve it. Extensive experiments on 9 synthetic IoT systems and 2 real-world smart home IoT testbeds demonstrate that our shortest attack trace algorithm is robust and fast, and our heuristic network hardening algorithm is efficient in producing near optimal results compared to the exact algorithm.