CNS Core: Small: BehavIoT: Modeling and Controlling Internet of Things Behavior Using Netowork-Inferred State Machines

越来越多的智能互联对象，即物联网（IoT），正变得价格合理、流行且功能丰富。虽然这些设备带来了广泛的社会效益，包括健康、安全、可访问性和可持续性，但由于它们提供的服务种类繁多，它们也带来了重要的安全、隐私和管理挑战。导致这种行为的根本问题是，物联网系统传统上是封闭的系统，对于设备（或一组设备）是否以可能违反隐私、安全性和正确性等预期的方式运行，消费者和调查人员几乎无法提供任何信息。为了解决这个问题，该项目将研究如何自动确定物联网系统何时损害隐私、安全性和正确性，以及如何缓解此类问题。关键思想是关注从这些设备产生的网络流量中收集的信息，因为网络流量是所有此类物联网系统最终依赖的公共平台。具体来说，该项目将开发一种技术，根据物联网系统的网络流量对其行为进行建模，然后使用这些模型来识别意外行为。为了减轻意外行为，项目将确定网络内策略，如隔离、更改和/或阻止此类流量。通过理解和建模设备行为，解决物联网设备的意外行为，该项目有可能提高用户的安全性。此外，通过提高对新威胁和现有威胁的认识，我们提出的工作可以鼓励设备制造商提高其部署的隐私性、安全性和正确性。该项目的目标是探索物联网部署的网络推断行为分析，结合对其生成的网络流量的控制，可以识别和减轻物联网系统中的不当行为。我们的关键见解是，物联网设备特别适合状态机分析，因为它们往往具有一组有限的功能（即，由一组有限的事件触发的“摄像头录制”，“麦克风监听”等状态）。为了解决不能依靠源代码通过静态分析来构建此类模型的事实，该项目将把物联网设备视为黑盒，并推断状态机模型，该模型使用所有物联网设备生成的一个外部可观察信号来描述其行为：网络流量。在构建了这样的推断状态机（及其转移概率）之后，该项目将分析它们随时间的演变，以识别错误行为——当设备以意外或不希望的方式在状态之间转换时（例如，由于妥协、数据泄露或错误配置）。为了提供广泛的不当行为的覆盖范围，该项目将(i)通过依赖无监督分类技术检测以前从未遇到过的行为；（ii）通过在我们的模型中结合单个物联网设备的行为来考虑整个系统的行为，从而捕获任何紧急全局系统行为的原因；（iii）生成在实践中易于理解和分析的全系统行为模型，例如状态机，其中状态表示单个物联网设备行为的变化，并且转换显示以概率表示的时间依赖性。最后，该项目将使用中间盒来实际使用状态机模型，作为保护整个物联网系统免受个体和全局不当行为影响的一种方式。这种方法的一个优点是，它依赖于物联网系统中的共同点（即互联网流量），自然地与平台无关；此外，可以立即部署网络内解决方案（例如，在家庭或企业网关中）以产生广泛的影响。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

An increasing number of smart interconnected objects, known as the Internet of Things (IoT), are becoming affordable, popular, and rich in functionality. While these devices enabled a wide range of societal benefits including health, safety, accessibility and sustainability, they also present important security, privacy, and management challenges due to the large set of diverse services they offer. The fundamental problem that opens the door to such behavior is that IoT systems are traditionally closed systems that provide consumers and investigators with little-to-no information about whether a device (or set of devices) is behaving in ways that might violate expectations such as privacy, security, and correctness. To address this problem, this project will investigate how to automatically determine when IoT systems compromise privacy, security and correctness, and how to mitigate such problems. The key idea is to focus on information gleaned from the network traffic that such devices generate, since network traffic is the common platform that all such IoT systems ultimately rely upon. Specifically, the project will develop technology that models the behavior of an IoT system from its network traffic, then use these models to identify unexpected behavior. To mitigate unexpected behavior, the project will identify in-network strategies such as isolating, changing, and/or blocking such traffic. By understanding and modeling device behavior and addressing unexpected behavior from IoT devices, this project has the potential to improve safety and security for users. Further, by raising awareness of new and existing threats, our proposed work can encourage device manufacturers to improve the privacy, security, and correctness of their deployments.The goal of this project is to explore the extent to which network-inferred behavioral analysis of IoT deployments, combined with control over the network traffic they generate, can identify and mitigate misbehavior in IoT systems. Our key insight is that IoT devices are particularly amenable to state-machine analysis, as they tend to have a limited set of functionality (i.e., states such as "camera recording", "microphone listening", etc.) that is triggered by a limited set of events. To address the fact that one cannot rely on source code to build such models via static analysis, this project will instead treat IoT devices as black boxes and inferring state-machine models that describe their behavior using the one externally observable signal all IoT devices generate: net- work traffic. After building such inferred state machines (and their transition probabilities), the project will analyze their evolution over time to identify misbehaviors -- when a device transitions between states in unexpected or unwanted ways (e.g., due to compromise, data exfiltration, or misconfiguration). To provide coverage of a wide range of misbehaviors, the project will (i) detect behaviors that never before encountered by relying on unsupervised classification techniques; (ii) consider the behavior of the system as a whole by combining in our model the behavior of individual IoT devices, thus capturing the cause of any emergent global system behavior; (iii) produce a system-wide behavior model that is easy to understand and analyze in practice, such as a state machine in which states represents changes in the behavior of individual IoT devices, and transitions show temporal dependencies expressed as probabilities. Finally, the project will employ middleboxes to actually use state machine models as a way to protect a whole IoT system from both individual and global misbehavior. An advantage to this approach is that it is naturally platform-independent by relying on the common denominator in IoT systems, i.e., Internet traffic; further, an in-network solution can be immediately deployed (e.g., in a home or enterprise gateway) for broad impact.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.