Tianbo Gu

Zheng Fang, Hao Fu, Tianbo Gu et al.

Most IoT systems involve IoT devices, communication protocols, remote cloud, IoT applications, mobile apps, and the physical environment. However, existing IoT security analyses only focus on a subset of all the essential components, such as device firmware, and ignore IoT systems' interactive nature, resulting in limited attack detection capabilities. In this work, we propose Iota, a logic programming-based framework to perform system-level security analysis for IoT systems. Iota generates attack graphs for IoT systems, showing all of the system resources that can be compromised and enumerating potential attack traces. In building Iota, we design novel techniques to scan IoT systems for individual vulnerabilities and further create generic exploit models for IoT vulnerabilities. We also identify and model physical dependencies between different devices as they are unique to IoT systems and are employed by adversaries to launch complicated attacks. In addition, we utilize NLP techniques to extract IoT app semantics based on app descriptions. To evaluate vulnerabilities' system-wide impact, we propose two metrics based on the attack graph, which provide guidance on fortifying IoT systems. Evaluation on 127 IoT CVEs (Common Vulnerabilities and Exposures) shows that Iota's exploit modeling module achieves over 80% accuracy in predicting vulnerabilities' preconditions and effects. We apply Iota to 37 synthetic smart home IoT systems based on real-world IoT apps and devices. Experimental results show that our framework is effective and highly efficient. Among 27 shortest attack traces revealed by the attack graphs, 62.8% are not anticipated by the system administrator. It only takes 1.2 seconds to generate and analyze the attack graph for an IoT system consisting of 50 devices.

Jinyue Song, Tianbo Gu, Prasant Mohapatra

In order to solve security and privacy issues of centralized cloud services, the edge computing network is introduced, where computing and storage resources are distributed to the edge of the network. However, native edge computing is subject to the limited performance of edge devices, which causes challenges in data authorization, data encryption, user privacy, and other fields. Blockchain is currently the hottest technology for distributed networks. It solves the consistent issue of distributed data and is used in many areas, such as cryptocurrency, smart grid, and the Internet of Things. Our work discussed the security and privacy challenges of edge computing networks. From the perspectives of data authorization, encryption, and user privacy, we analyze the solutions brought by blockchain technology to edge computing networks. In this work, we deeply present the benefits from the integration of the edge computing network and blockchain technology, which effectively controls the data authorization and data encryption of the edge network and enhances the architecture's scalability under the premise of ensuring security and privacy. Finally, we investigate challenges on storage, workload, and latency for future research in this field.

Jinyue Song, Tianbo Gu, Zheng Fang et al.

COVID-19 is a severe global epidemic in human history. Even though there are particular medications and vaccines to curb the epidemic, tracing and isolating the infection source is the best option to slow the virus spread and reduce infection and death rates. There are three disadvantages to the existing contact tracing system: 1. User data is stored in a centralized database that could be stolen and tampered with, 2. User's confidential personal identity may be revealed to a third party or organization, 3. Existing contact tracing systems only focus on information sharing from one dimension, such as location-based tracing, which significantly limits the effectiveness of such systems. We propose a global COVID-19 information sharing and risk notification system that utilizes the Blockchain, Smart Contract, and Bluetooth. To protect user privacy, we design a novel Blockchain-based platform that can share consistent and non-tampered contact tracing information from multiple dimensions, such as location-based for indirect contact and Bluetooth-based for direct contact. Hierarchical smart contract architecture is also designed to achieve global agreements from users about how to process and utilize user data, thereby enhancing the data usage transparency. Furthermore, we propose a mechanism to protect user identity privacy from multiple aspects. More importantly, our system can notify the users about the exposure risk via smart contracts. We implement a prototype system to conduct extensive measurements to demonstrate the feasibility and effectiveness of our system.

Debraj Basu, Tianbo Gu, Prasant Mohapatra

Low Power Wide Area Networks (LPWAN) have been used to support low cost and mobile bi-directional communications for the Internet of Things (IoT), smart city and a wide range of industrial applications. A primary security concern of LPWAN technology is the attacks that block legitimate communication between nodes resulting in scenarios like loss of packets, delayed packet arrival, and skewed packet reaching the reporting gateway. LoRa (Long Range) is a promising wireless radio access technology that supports long-range communication at low data rates and low power consumption. LoRa is considered as one of the ideal candidates for building LPWANs. We use LoRa as a reference technology to review the IoT security threats on the air and the applicability of different countermeasures that have been adopted so far. LoRa nodes that are close to the gateway use a small SF than the nodes which are far away. But it also implies long in-the-air transmission time, which makes the transmitted packets vulnerable to different kinds of malicious attacks, especially in the physical and the link layer. Therefore, it is not possible to enforce a fixed set of rules for all LoRa nodes since they have different levels of vulnerabilities. Our survey reveals that there is an urgent need for secure and uninterrupted communication between an end-device and the gateway, especially when the threat models are unknown in advance. We explore the traditional countermeasures and find that most of them are ineffective now, such as frequency hopping and spread spectrum methods. In order to adapt to new threats, the emerging countermeasures using game-theoretic approaches and reinforcement machine learning methods can effectively identify threats and dynamically choose the corresponding actions to resist threats, thereby making secured and reliable communications.

Tianbo Gu, Zheng Fang, Allaukik Abhishek et al.

Internet of Things (IoT) has become the most promising technology for service automation, monitoring, and interconnection, etc. However, the security and privacy issues caused by IoT arouse concerns. Recent research focuses on addressing security issues by looking inside platform and apps. In this work, we creatively change the angle to consider security problems from a wireless context perspective. We propose a novel framework called IoTGaze, which can discover potential anomalies and vulnerabilities in the IoT system via wireless traffic analysis. By sniffing the encrypted wireless traffic, IoTGaze can automatically identify the sequential interaction of events between apps and devices. We discover the temporal event dependencies and generate the Wireless Context for the IoT system. Meanwhile, we extract the IoT Context, which reflects user's expectation, from IoT apps' descriptions and user interfaces. If the wireless context does not match the expected IoT context, IoTGaze reports an anomaly. Furthermore, IoTGaze can discover the vulnerabilities caused by the inter-app interaction via hidden channels, such as temperature and illuminance. We provide a proof-of-concept implementation and evaluation of our framework on the Samsung SmartThings platform. The evaluation shows that IoTGaze can effectively discover anomalies and vulnerabilities, thereby greatly enhancing the security of IoT systems.

Tianbo Gu, Allaukik Abhishek, Hao Fu et al.

As a massive number of the Internet of Things (IoT) devices are deployed, the security and privacy issues in IoT arouse more and more attention. The IoT attacks are causing tremendous loss to the IoT networks and even threatening human safety. Compared to traditional networks, IoT networks have unique characteristics, which make the attack detection more challenging. First, the heterogeneity of platforms, protocols, software, and hardware exposes various vulnerabilities. Second, in addition to the traditional high-rate attacks, the low-rate attacks are also extensively used by IoT attackers to obfuscate the legitimate and malicious traffic. These low-rate attacks are challenging to detect and can persist in the networks. Last, the attackers are evolving to be more intelligent and can dynamically change their attack strategies based on the environment feedback to avoid being detected, making it more challenging for the defender to discover a consistent pattern to identify the attack. In order to adapt to the new characteristics in IoT attacks, we propose a reinforcement learning-based attack detection model that can automatically learn and recognize the transformation of the attack pattern. Therefore, we can continuously detect IoT attacks with less human intervention. In this paper, we explore the crucial features of IoT traffics and utilize the entropy-based metrics to detect both the high-rate and low-rate IoT attacks. Afterward, we leverage the reinforcement learning technique to continuously adjust the attack detection threshold based on the detection feedback, which optimizes the detection and the false alarm rate. We conduct extensive experiments over a real IoT attack dataset and demonstrate the effectiveness of our IoT attack detection framework.

Jinyue Song, Tianbo Gu, Yunjie Ge et al.

In recent years, there is an emerging trend that some computing services are moving from cloud to the edge of the networks. Compared to cloud computing, edge computing can provide services with faster response, lower expense, and more security. The massive idle computing resources closing to the edge also enhance the deployment of edge services. Instead of using cloud services from some primary providers, edge computing provides people with a great chance to actively join the market of computing resources. However, edge computing also has some critical impediments that we have to overcome. In this paper, we design an edge computing service platform that can receive and distribute the computing resources from the end-users in a decentralized way. Without centralized trade control, we propose a novel hierarchical smart contract-based decentralized technique to establish the trading trust among users and provide flexible smart contract interfaces to satisfy users. Our system also considers and resolves a variety of security and privacy challenges when utilizing the encryption and distributed access control mechanism. We implement our system and conduct extensive experiments to show the feasibility and effectiveness of our proposed system.