Towards Usable Security Analysis Tools for Trigger-Action Programming
Towards Usable Security Analysis Tools for Trigger-Action Programming
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
McKenna McCall;Eric Zeng;F. H. Shezan;Mitchell Yang;Lujo Bauer;Abhishek Bichhawat;Camille Cobb;Limin Jia;Yuan Tian
中科院分区：
文献类型：
--
作者：
McKenna McCall;Eric Zeng;F. H. Shezan;Mitchell Yang;Lujo Bauer;Abhishek Bichhawat;Camille Cobb;Limin Jia;Yuan Tian
研究表明，机器人动作编程（TAP）是智能家居物联网设备自动化的直观方式，但也可能导致不良行为。例如，如果两个TAP规则具有相同的触发条件，但是一个锁定门而另一个解锁门，则用户可能认为门被锁定，而实际上门没有被锁定。研究人员已经开发出工具来识别错误或不受欢迎的TAP程序，但很少有工作调查的可用性不同的用户交互方法实现的各种工具。本文描述了对TAP安全分析工具提出的技术的可用性和实用性的探索性研究。我们调查了447名Proli fic用户，以评估他们编写声明性策略的能力，识别TAP规则中不需要的模式（反模式），纠正TAP程序错误，以及了解建议的工具是否符合用户的需求。我们发现参与者在编写策略和识别反模式的成功率方面存在相当大的差异。在某些情况下，超过90%的参与者编写了适当的策略，而在其他情况下，没有人成功。我们还发现，参与者并不一定认为工具标记的TAP反模式是不受欢迎的。我们的工作提供了对真实的智能家居用户目标的洞察，强调了在设计TAP安全工具时更严格地评估用户需求和可用性问题的重要性，并为未来的工具开发和TAP研究提供了指导。
Research has shown that trigger-action programming (TAP) is an intuitive way to automate smart home IoT devices, but can also lead to undesirable behaviors. For instance, if two TAP rules have the same trigger condition, but one locks a door while the other unlocks it, the user may believe the door is locked when it is not. Researchers have developed tools to identify buggy or undesirable TAP programs, but little work investigates the usability of the different user-interaction approaches implemented by the various tools. This paper describes an exploratory study of the usability and utility of techniques proposed by TAP security analysis tools. We surveyed 447 Prolific users to evaluate their ability to write declarative policies, identify undesirable patterns in TAP rules (anti-patterns), and correct TAP program errors, as well as to understand whether proposed tools align with users’ needs. We find considerable variation in participants’ success rates writing policies and identifying anti-patterns. For some scenarios over 90% of participants wrote an appropriate policy, while for others nobody was successful. We also find that participants did not necessarily perceive the TAP anti-patterns flagged by tools as undesirable. Our work provides insight into real smart-home users’ goals, highlights the importance of more rigorous evaluation of users’ needs and usability issues when designing TAP security tools, and provides guidance to future tool development and TAP research.