A lightweight vulnerability mitigation framework for IoT devices

Noy Hadar, Shachar Siboni, Yuval Elovici

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

24 Scopus citations

Abstract

Many of today's Internet of Things (IoT) devices are vulnerable due to the large amount of overhead incurred when their operating systems are patched against emerging vulnerabilities. In addition, legacy IoT devices are no longer supported by their manufacturers, leaving customers with unpatched devices that can be easily exploited by attackers. Thus, there is an urgent need for a solution that provides a lightweight and low-cost mechanism for preventing exploitation of vulnerable IoT devices. In this paper, we propose an innovative cloud-based framework for protecting IoT devices. The proposed framework consists of a cloud service and a designated IoT security appliance. The security appliance controls the network traffic flowing to and from the vulnerable device and verifies that it does not violate a set of rules, represented by a vulnerability mitigation policy, that have been derived and synthesized by the cloud service from public corpora of Common Vulnerabilities and Exposures (CVE). We demonstrate how the proposed solution can be applied as a cost-effective solution capable of preventing exploitation of vulnerable IP cameras as part of a prominent botnet attack called Mirai.

Original languageEnglish
Title of host publicationIoT S and P 2017 - Proceedings of the 2017 Workshop on Internet of Things Security and Privacy, co-located with CCS 2017
PublisherAssociation for Computing Machinery, Inc
Pages71-75
Number of pages5
ISBN (Electronic)9781450353960
DOIs
StatePublished - 3 Nov 2017
Event1st Workshop on Internet of Things Security and Privacy, IoT S and P 201717 - Dallas, United States
Duration: 3 Nov 2017 → …

Publication series

NameIoT S and P 2017 - Proceedings of the 2017 Workshop on Internet of Things Security and Privacy, co-located with CCS 2017

Conference

Conference1st Workshop on Internet of Things Security and Privacy, IoT S and P 201717
Country/TerritoryUnited States
CityDallas
Period3/11/17 → …

Keywords

  • Exploitation
  • Internet of Things (IoT)
  • Mitigation
  • Patching
  • Prevention
  • Security

ASJC Scopus subject areas

  • Computer Networks and Communications

Fingerprint

Dive into the research topics of 'A lightweight vulnerability mitigation framework for IoT devices'. Together they form a unique fingerprint.

Cite this