Towards Practical and Formal Security Risk Analysis of IoT (Internet of Things) Applications

We present the initial results of developing a security risk analyzer for Internet of Things (IoT) applications that analyses both evitable and inevitable yet known and unknown cyber-attacks and as a result produces the adversarial strategies (multi-stages of attack) that can compromise the application. Our risk analyzer is rigorous and qualitative, performing technical analysis, as well as quantitative yet useful, identifying sub-attacks and their quantitative risks. In contrast, conventional security risk analyzers either provide too specific risk assessment or provide a too generic risk assessment of a given application. Such analyzers are typically not practical against constantly changing attacks of the variable extent and complex modern IoT applications. We demonstrate the usability of our methodology through the detection of an example attack model from a real-world incident in real-time.