CPS: Medium: Detecting and Controlling Unwanted Data Flows in the Internet of Things

许多新兴的联网设备都不是个人电脑。它们是特殊用途的大宗商品消费电子设备，例如智能恒温器和智能门锁。这些设备统称为物联网(IoT)。它们越来越多地用于智能家居、智能城市、智能交通系统、工业网络等。物联网的承诺是提高日常生活质量，提高社会生产力。然而，物联网设备并不是没有技术和社会风险。技术风险部分源于软件和安全漏洞。物联网设备的巨大多样性和数量使整体一致性成为问题，并导致各种效率低下。在一些部署的物联网设备的生命周期中，存在软件可能永远不会打补丁、硬件永远不会修复的风险；即，这些设备实际上将无限期地保持易受攻击的状态。社会风险在一定程度上源于现在可以使用物联网设备从大多数地方收集的海量数据，这违反了隐私规范。此外，受攻击的物联网设备可能会作为一个大规模的高度分布式平台涌入互联网，扰乱社会的许多重要服务。该项目开发了一些技术，以确保物联网部署保持安全，并在互联智能设备的广泛部署下保护用户隐私。对常见攻击的基于网络的防御以及设备所有者检查、审计、控制和共享数据的能力是缓解技术和社会风险的基本能力。该项目的重点是：(1)保护设备免受经常通过使用不受信任的软件库引入的漏洞；(2)依靠对网络流量模式的统计异常检测，检测设备何时表现出可能表明未经授权的数据泄漏或设备危害的异常行为；以及(3)使用网络防火墙规则、这些异常检测系统的输出以及允许这些设备的所有者检查和确定发送和接收的数据的软件系统来控制网络中不想要的数据泄漏和攻击。该项目推进了网络流量分析、异常检测和网络安全分段的理论和实践，以确保物联网部署在连接设备不安全的情况下仍保持安全。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Many emerging Internet-connected devices are not personal computers. They are special-purpose commodity consumer electronic devices such as, for example, smart thermostats and smart door locks. Collectively, these devices are known as the Internet of Things (IoT). They are increasingly used in smart homes, smart cities, intelligent transportation systems, industrial networks and more. The promise of IoT is to improve the quality of everyday life and make society more productive.IoT devices however are not without technological and societal risk. The technological risk derives in part from software and security vulnerabilities. The vast diversity and number of IoT devices make overall consistency problematic and contribute to various inefficiencies. There are risks over the life cycle of some deployed IoT devices that their software may never be patched and their hardware never repaired; i.e., these devices will effectively remain vulnerable indefinitely. The societal risk derives in part from the massive data that is now possible to collect using IoT devices from most anywhere, which violate privacy norms. Moreover, compromised IoT devices might serve as a large-scale highly distributed platform to flood the Internet, disrupting many vital services for society.This project develops technologies that ensure that IoT deployments remain secure and protect user privacy in the face of the widespread deployment of connected smart devices. Network-based defenses against common attacks and device owners' ability to inspect, audit, control and share data are essential capabilities to mitigating technological and societal risks. This project focuses: (1) protecting the devices from vulnerabilities that are often introduced through the use of untrusted software libraries, (2) detecting when devices exhibit anomalous behavior that would suggest an unauthorized data leak or device compromise, relying on statistical anomaly detection of network traffic patterns, and (3) controlling unwanted data leaks and attacks in the network using network firewall rules, outputs from these anomaly detection systems, and software systems that let the owners of these devices inspect and determine the data sent and received. This project advances the theory and practice of network traffic analysis, anomaly detection, and secure segmentation of networks that ensure IoT deployments remain secure despite insecure connected devices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.