CPS: Medium: Detecting and Controlling Unwanted Data Flows in the Internet of Things

许多新兴的互联网连接设备都不是个人电脑。它们是特殊用途的商品消费电子设备，例如智能恒温器和智能门锁。这些设备统称为物联网（IoT）。它们越来越多地应用于智能家居、智能城市、智能交通系统、工业网络等领域。物联网的承诺是改善日常生活质量，使社会更富有成效。然而，物联网设备并非没有技术和社会风险。技术风险部分来自软件和安全漏洞。物联网设备的巨大多样性和数量使得整体一致性存在问题，并导致各种效率低下。在一些部署的物联网设备的生命周期中存在风险，它们的软件可能永远不会打补丁，它们的硬件可能永远不会修复；也就是说，这些设备实际上会无限期地处于脆弱状态。社会风险部分来自于现在可以从大多数地方使用物联网设备收集的大量数据，这违反了隐私规范。此外，受损的物联网设备可能会成为一个大规模的高度分布式平台，淹没互联网，扰乱社会的许多重要服务。该项目开发的技术可确保物联网部署保持安全，并在联网智能设备广泛部署的情况下保护用户隐私。基于网络的防御常见攻击和设备所有者检查、审计、控制和共享数据的能力是减轻技术和社会风险的基本能力。本项目重点：(1)保护设备免受通常通过使用不受信任的软件库引入的漏洞的影响，(2)检测设备何时表现出异常行为，这可能表明未经授权的数据泄露或设备泄露，依赖于网络流量模式的统计异常检测，以及(3)使用网络防火墙规则控制网络中不必要的数据泄漏和攻击，这些异常检测系统的输出，软件系统可以让这些设备的所有者检查和确定发送和接收的数据。该项目推进了网络流量分析、异常检测和网络安全分段的理论和实践，确保物联网部署在连接设备不安全的情况下保持安全。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Many emerging Internet-connected devices are not personal computers. They are special-purpose commodity consumer electronic devices such as, for example, smart thermostats and smart door locks. Collectively, these devices are known as the Internet of Things (IoT). They are increasingly used in smart homes, smart cities, intelligent transportation systems, industrial networks and more. The promise of IoT is to improve the quality of everyday life and make society more productive.IoT devices however are not without technological and societal risk. The technological risk derives in part from software and security vulnerabilities. The vast diversity and number of IoT devices make overall consistency problematic and contribute to various inefficiencies. There are risks over the life cycle of some deployed IoT devices that their software may never be patched and their hardware never repaired; i.e., these devices will effectively remain vulnerable indefinitely. The societal risk derives in part from the massive data that is now possible to collect using IoT devices from most anywhere, which violate privacy norms. Moreover, compromised IoT devices might serve as a large-scale highly distributed platform to flood the Internet, disrupting many vital services for society.This project develops technologies that ensure that IoT deployments remain secure and protect user privacy in the face of the widespread deployment of connected smart devices. Network-based defenses against common attacks and device owners' ability to inspect, audit, control and share data are essential capabilities to mitigating technological and societal risks. This project focuses: (1) protecting the devices from vulnerabilities that are often introduced through the use of untrusted software libraries, (2) detecting when devices exhibit anomalous behavior that would suggest an unauthorized data leak or device compromise, relying on statistical anomaly detection of network traffic patterns, and (3) controlling unwanted data leaks and attacks in the network using network firewall rules, outputs from these anomaly detection systems, and software systems that let the owners of these devices inspect and determine the data sent and received. This project advances the theory and practice of network traffic analysis, anomaly detection, and secure segmentation of networks that ensure IoT deployments remain secure despite insecure connected devices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.