CROSS: A framework for cyber risk optimisation in smart homes
CROSS: A framework for cyber risk optimisation in smart homes
复制标题
DOI：
10.1016/j.cose.2023.103250
复制
发表时间：
2023-04
期刊：
影响因子：
--
通讯作者：
Yunxiao Zhang;P. Malacaria;G. Loukas;E. Panaousis
中科院分区：
文献类型：
--
作者：
Yunxiao Zhang;P. Malacaria;G. Loukas;E. Panaousis
这项工作介绍了一个决策支持框架，称为智能家居网络风险优化(CROSS)，它建议智能家居用户和智能家居服务提供商如何选择最佳的网络安全控制组合，以对抗智能家居中的网络攻击，包括传统网络攻击和对抗性机器学习攻击。CROSS基于多目标双层两阶段优化。在第一阶段优化中，问题被建模为一个同时考虑安全和经济目标的多领导者-追随者博弈，提供商选择一个安全投资组合来保护自己和用户，而理性攻击者则瞄准最弱的路径。第二阶段优化是一款Stackelberg安全游戏，重点是在智能家居用户的职权范围内进行额外的用户安全控制。虽然CROSS可能适用于其他类似的使用案例，但在本文中，我们的目标是解决人工智能(AI)应用程序面临的威胁，因为在智能物联网(IoT)设备中使用AI会给家庭环境带来新的网络威胁。具体地说，我们在支持AI的原型物联网环境中实施并评估了智能供暖用例中的CROSS，该环境结合了现有商业现成(COTS)设备目前存在的特征和漏洞，展示了最佳决策的选择。
This work introduces a decision support framework, calledCyberRiskOptimiser forSmart homeS(CROSS), which advises both smart home users and smart home service providers on how to select an optimal portfolio of cyber security controls to counteract cyber attacks in a smart home including traditional cyber attacks and adversarial machine learning attacks. CROSS is based on a multi-objective bi-level two-stage optimisation. In stage-one optimisation, the problem is modelled as a multi-leader-follower game that considers both security and economic objectives, where the provider selects a security portfolio to protect both itself and its users, while rational attackers target the weakest path. Stage-two optimisation is a Stackelberg security game that focuses on additional user security controls under the remit of smart home users. While CROSS can potentially be applied to other similar use cases, in this paper, our aim is to address threats against artificial intelligence (AI) applications as the use of AI in smart Internet of Things (IoT) devices introduces new cyber threats to home environments. Specifically, we have implemented and assessed CROSS in a smart heating use case in a prototypical AI-enabled IoT environment that combines characteristics and vulnerabilities currently present on existing commercial off-the-shelf (COTS) devices, demonstrating the selection of optimal decisions.