An Automated Framework For Investigating Security and Privacy of Internet-of-Military-Things Devices

The number of connected Internet of Things (IoT) devices is expected to reach 25 billion by 2022. With widespread use of these devices, addressing security and privacy issues of these devices is crucial for future growth potential. Currently, large number of IoT devices have security and privacy issues and there is limited work in this area. Commodity IoT devices and specially designed military IoT (IoMT) devices can be use used in military settings. An easy to use framework needs to be developed to secure IoMT devices so that they can be safely used by the military. In this project, an automated framework for investigating security and privacy of IoMT devices is developed. An IoMT device is connected to a testbed that implements the framework by capturing and analyzing packets exchanged. The framework produces a report with the issues discovered, and a specification for lightweight intrusion detection for the device. Proposed framework is developed in multiple stages. First, a modular framework with well-defined modules that works by capturing and investigating layer 2 and layer 3 packets is developed and a testbed that can be used to capture packets and enable the modular framework is designed. Potential security and privacy issues are identified and a basic understanding of the devices is available in this stage. Second, the framework is automated to investigate a large set of devices. When a device is connected, relevant modules are automatically selected and executed and a report is produced with minimal user intervention. Module executions are optimized in this stage to reduce the amount of time testing each device and to test multiple devices concurrently. Third, based on the experience we gain from executing the framework on large set of devices, we plan to develop a device specific lightweight intrusion detection system. A lightweight intrusion detection system is necessary since IoMT devices are mass produced, and each unit is essentially identical, one vulnerability can be used to exploit millions of devices. The PI believes this project will be a major step to make IoMT devices secure for military use. The proposed research will advance the state of knowledge in IoMT security in two important ways. First, it develops a framework that can be applied to investigate security and privacy of various types of IoMT devices with little effort spent on each device. Second, a lightweight intrusion detection system for IoMT devices will be developed. Such a framework is necessary for widespread deployment of these devices. The PI believes he is well positioned to make progress on this demanding problem, as he draws on his expertise on this area.