Pattern-of-Life Modeling in Smart Homes

Smart home devices are relatively inexpensive, readily available, and easily integrated into homes. However, retailers provide smart home devices with little scrutiny in regards to device security or known vulnerabilities. This paper presents a smart home architecture designed with commercially available devices used to investigate Internet of Things data leakage in the wild. Additionally, a pattern-of-life analysis tool was developed to exhibit how an eavesdropper can use traffic from a smart home to classify devices, identify events, track users, and gain physical access to a home. The tool was evaluated through five-days of experimentation in which 17 of 18 devices were classified, 95% of 343 events were identified, and users were tracked with near 100% accuracy. This information, combined with a discovered Bluetooth low energy lock vulnerability, were used to gain unfettered access to the home while the user was away. Furthermore, a mitigation technique was created to introduce spoofed wireless traffic sent on behalf of devices within the home to hinder an eavesdropper’s ability to classify devices, identify events, and track users. During an additional five-day experiment, security devices were concealed, 221 false events were introduced per day, and the user appeared always home. Finally, this paper provides security recommendations to manufacturers and users to help defend against vulnerabilities and create a safer smart home environment.