Collaborative Research: CPS: Medium: Enabling Data-Driven Security and Safety Analyses for Cyber-Physical Systems

由于家庭自动化提供的便利，智能家居产品已经变得非常受消费者欢迎。然而，在弥合网络与物理鸿沟的过程中，家庭自动化带来了家庭网络攻击面的扩大。分析和预防智能家居中的安全和安全故障的研究在实践中面临着一个根本的障碍：家庭自动化使用的不良特征。也就是说，如果不知道用户如何实现家庭自动化，就很难解决设计和分析安全系统中的几个关键挑战，这可能会使解决方案在实际部署中无效。该项目旨在弥合这一差距，并为研究人员、最终用户和系统设计人员提供收集、生成和分析家庭自动化使用的真实实例的方法。这种方法建立在新兴智能家居平台的一个独特特征的基础上：以触发动作程序的形式存在“用户驱动的”自动化，用户通过平台提供的用户界面进行配置。特别是，该项目设计了一些方法来捕获和建模这种用户驱动的家庭自动化，以生成具有统计意义和有用的使用场景。在该项目过程中开发的技术将允许研究人员和从业者分析组成现代智能家居的网络物理系统的各种安全、安全和隐私属性，最终导致部署更安全的智能家居物联网(IoT)设备。该项目还将制作和传播关于开发安全软件的最佳做法的教育材料，重点是物联网设备，适合纳入各级教育的现有计算机扫盲课程。此外，该项目将侧重于从传统上代表性较低的类别招聘和留住计算机科学专业的学生。该项目围绕三个具体目标展开。首先，它将开发新的数据收集战略，使最终用户能够以灵活的方式轻松地指定例程，以及基于自然语言处理(NLP)的技术，用于自动处理数据并将其转换为适合建模的格式。其次，它将介绍将例程转换为现实的家庭自动化事件序列的方法，了解它们的潜在属性，并使用易于理解的语言建模技术对它们进行建模。第三，它将使智能家居使用模型与环境联系起来，以做出专门迎合安全分析的预测，并开发工具，允许在执行真实产品的预测事件序列的同时检查智能家居的状态。在此项目过程中开发的技术和模型将与行业合作伙伴进行验证，并有望成为开发人员和研究人员了解智能家居的安全和隐私属性的工具。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Smart home products have become extremely popular with consumers due to the convenience offered through home automation. In bridging the cyber-physical gap, however, home automation brings a widening of the cyber attack surface of the home. Research towards analyzing and preventing security and safety failures in a smart home faces a fundamental obstacle in practice: the poor characterization of home automation usage. That is, without the knowledge of how users automate their homes, it is difficult to address several critical challenges in designing and analyzing security systems, potentially rendering solutions ineffective in actual deployments. This project aims to bridge this gap, and provide researchers, end-users, and system designers with the means to collect, generate, and analyze realistic examples of home automation usage. This approach builds upon a unique characteristic of emerging smart home platforms: the presence of "user-driven" automation in the form of trigger-action programs that users configure via platform-provided user interfaces. In particular, this project devises methods to capture and model such user-driven home automation to generate statistically significant and useful usage scenarios. The techniques that will be developed during the course of this project will allow researchers and practitioners to analyze various security, safety and privacy properties of the cyber-physical systems that comprise modern smart homes, ultimately leading to deployments of smart home Internet of Things (IoT) devices that are more secure. The project will also produce and disseminate educational materials on best practices for developing secure software with an emphasis on IoT devices, suitable for integration into existing computer literacy courses at all levels of education. In addition, the project will focus on recruiting and retaining computer science students from traditionally underrepresented categories. This project is centered on three specific goals. First, it will develop novel data collection strategies that allow end-users to easily specify routines in a flexible manner, as well as techniques based on Natural language Processing (NLP) for automatically processing and transforming the data into a format suitable for modeling. Second, it will introduce approaches for transforming routines into realistic home automation event sequences, understanding their latent properties and modeling them using well-understood language modeling techniques. Third, it will contextualize the smart home usage models to make predictions that cater to security analyses specifically and develop tools that allow for the inspection of a smart home’s state alongside the execution of predicted event sequences on real products. The techniques and models developed during the course of this project will be validated with industry partners and are expected to become instrumental for developers and researchers to understand security and privacy properties of smart homes.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.