SPECIAL SECTION ON SECURITY AND PRIVACY IN APPLICATIONS AND SERVICES FOR FUTURE

INTERNET OF THINGS

Received March 10, 2017, accepted April 11, 2017, date of publication April 24, 2017, date of current version May 17, 2017.
Digital Object Identifier 10.1109/ACCESS.2017.2696031

IoTRiskAnalyzer : A Probabilistic Model Checking

Based Framework for Formal Risk Analytics
of the Internet of Things
MUJAHID MOHSIN, MUHAMMAD USAMA SARDAR,
OSMAN HASAN (Senior Member, IEEE), AND ZAHID ANWAR
School of Electrical Engineering and Computer Science, National University of Sciences and Technology, Islamabad 44000, Pakistan
Corresponding author: Mujahid Mohsin ([email protected])

ABSTRACT The Internet of Things (IoT) is being deployed for a plethora of use-case scenarios. In any
deployment, a number of configuration choices are available that achieve the mission goal. However,
IoT security incidents have demonstrated that different configurations are vulnerable to varied risk levels.
We propose the IoTRiskAnalyzer framework to formally and quantitatively analyze these risks using
probabilistic model checking. IoTRiskAnalyzer takes vulnerability scores, candidate IoT configurations,
and attacker’s capabilities as inputs. It then generates the system and threat models to compute attack
likelihood and attacker cost for each configuration. Evaluation indicates that IoTRiskAnalyzer is efficient
and automatically prioritizes the input configurations on the basis of risk exposure.

INDEX TERMS IoT risk analytic, formal risk modeling, probabilistic model checking, Markov decision
process, threat assessment, secure configuration planning, PRISM model checker.

I. INTRODUCTION largest known attacks till date, as they recruited millions of

The recent years have witnessed an explosive proliferation of connected things as ‘thing-bots’. Other studies highlighted
the Internet of Things (IoT); thanks to its ever-rising accept- vulnerabilities in the Zigbee [8] and Z-Wave [9] implemen-
ability and express-pace advancements in its enabling tech- tations (two of the most popular IoT protocols), capable of
nologies. The future IoT prospects are also being nurtured inducing rapidly spreading IoT worms and causing other
by an overwhelming growth predictions, estimating more digital and physical security threats.
than 50 Billion connected ‘things’ [1], [2], generating $ 7.1 The modern day IoT systems are ‘‘riddled with vul-
Trillions of market revenues [3] and producing 44 Zettabytes nerabilities and there are no good ways to patch them’’
of data [4], by the year 2020. due to a number of practical reasons, as highlighted by
This exponential IoT growth has also opened new Bruce Schneier [10]. Moreover, some vulnerabilities either
doors for the attackers to conduct malicious activities, as cannot be completely countered (such as wireless jamming)
unprofessionally-configured and poorly-protected IoT sys- or require dedicated security controls with specialized man-
tems can facilitate their nefarious goals. Gartner, Inc. [5] agement skill set and prohibitive budget overheads (such as
predicts that by the year 2020, more than 25 percent of the firewalls). These limitations have led the IoT planners and
cyber attacks in enterprises will involve IoT and many of consumers to live with such vulnerabilities for long periods,
the recent security breach incidents, research studies and even stretching up the useful life of these systems.
practical demonstrations endorse this claim. For example, It is noteworthy that the risk of exploiting IoT vulnera-
in a proof-of-concept attack analysis of leading smart home bilities largely depends on system configurations. Thus, an
products [6], the cyber-security researchers demonstrated that optimal configuration can be used to significantly reduce
their framework design can be exploited to create spare door the likelihood of system-level attacks. An IoT architect has
keys, steal existing keys and force fire alarms to go off. several configuration choices in terms of device and technol-
A number of recently unfolded Distributed Denial of Ser- ogy selection, connectivity and redundancy, each serving the
vice (DDoS) attack incidents [7] were ranked amongst the same mission goal but with varied risk levels. Therefore, it is

2169-3536
2017 IEEE. Translations and content mining are permitted for academic research only.
5494 Personal use is also permitted, but republication/redistribution requires IEEE permission. VOLUME 5, 2017
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

important to comprehend, quantify and analyze such risks achieve the system-level attack objectives. The framework
for subsequent configuration optimizations from a security thus produces an ordered set of configurations, prioritized on
viewpoint. the basis of risk exposure probabilities to different system-
System-level risk analysis mainly relies on likelihood of level attack scenarios.
exploitation of a given set of vulnerabilities, computed on
the basis of well-established risk analysis models, and is, B. PAPER ORGANIZATION
therefore, probabilistic in nature. Moreover, in a hostile IoT The rest of the paper is organized as follows: Section II covers
scenario, environmental events and attacker behavior (such the existing work in the relevant domains. In Section III,
as her preferences and sequence of exploiting vulnerabilities) we present a background of probabilistic model checking
are mostly unpredictable, thus making pure deterministic and the PRISM tool. Section IV gives an overview of
analysis unrealistic. On the other hand, simulation-driven IoT the research approach used by IoTRiskAnalyzer. Section V
risk assessment approaches [11], [12] cannot exhaustively presents a small-scale case study of a home security system,
quantify and analyze the risk exposure scores for complex and which is used to explain the working of our framework.
safety-critical IoT systems, owing to the incomplete coverage Lastly, Section VI explains the implementation and eval-
of all possible input vectors. Citing these requirements in this uation aspects and Section VII concludes the paper while
work, we present a novel probabilistic model checking [13] identifying some directions for the future work.
based framework called IoTRiskAnalyzer, developed using
a Markov Decision Process (MDP) [14] model. A formal II. RELATED WORK
model-driven verification approach, as utilized by IoTRisk- To the best of our knowledge, this is the first formal frame-
Analyzer, offers a powerful means to verify all possible work to probabilistically quantify the risk of exposures to
behaviors of reference model using a finite state space and complex system-level attacks on IoT systems, as a func-
thus, can precisely assess the cause and degree of security tion of individual device-level vulnerabilities and attacker
risks. The MDP models generated by our framework are used behavior. Nevertheless, our framework leverages existing
in the PRISM model checker [15] to automatically analyze efforts towards IoT-specific risk analysis and the use of for-
the system-level risk profiles. PRISM, an MDP-supported mal techniques for analyzing the security and consistency of
model checker, has already been extensively employed to the IoT systems. This section critically analyzes the existing
verify the security and safety aspects of a wide variety of efforts in the associated fields.
systems, including aerodynamics [16], smart grid [17] and
secure product design [18]. A. IoT-SPECIFIC RISK ANALYSIS
Our earlier work, IoTSAT [19], utilized Satisfiability Mod- With the rise in IoT-specific security breach incidents, the
ulo Theories (SMT) [20] to formally model and analyze field of risk assessment and management for IoT related
the threat resiliency and tactics for generic IoT systems. threats has also emerged as a dedicated research area.
SMT solvers primarily follow a constraint satisfaction Liu et al. [21] proposed a dynamic risk assessment method-
approach and therefore, cannot precisely capture the prob- ology for the IoT, inspired by the artificial immune system.
abilistic nature of risk-assessment and temporal behaviors Their approach computed the changing risk value of an IoT
of threat verification, as demonstrated by IoTRiskAnalyzer. system based on attack intensity as measured by different
On the other hand, the SMT models, being highly expressive attack detection agents. Roman et al. [22] discussed the secu-
due to the rich set of supported theories, can be used to accu- rity risks being contributed by the ever-increasing influx of
rately model the low-level details of complex IoT systems. IoT devices. The authors critically analyzed such emerging
Consequently, the formalisms adopted by IoTSAT and risks, their root causes, and viable mitigation techniques.
IoTRiskAnalyzer are complimentary in nature and both the Podgórski et al. [23], besides presenting a comprehensive
frameworks can be used in conjunction to plan, verify and literature review of related fields, also proposed a conceptual
develop a holistic security picture for complex IoT systems. framework for risk management in the domain of occupa-
tion safety and health under smart working environments.
A. PAPER CONTRIBUTIONS Djemame et al. [24] presented an implementation of a risk
The key contribution of this work is to present a framework, assessment framework for cloud service eco-systems with
i.e. IoTRiskAnalyzer, to realistically model and formally ver- capabilities to identify, evaluate and mitigate the risks. Their
ify the risk exposure to complex IoT Systems. As explained key contribution is the risk assessment model, comprising
further in Section IV, IoTRiskAnalyzer takes as input: (1) a of four risk categories, namely technical, policy, legal and
set of software, hardware, data and communication vulner- general. The literature, discussed above, dictates that the IoT
ability scores from relevant IoT security literature, (2) a set systems follow a dynamic and formidable risk posture, which
of candidate IoT configurations for achieving a mission and can be tackled using diverse approaches. However, none of
(3) the attacker behavior and capabilities. For each candidate these efforts employed a formal model checking based veri-
configuration, the framework generates the system and threat fication approach for risk analysis.
models, which are utilized to formally compute the likelihood A questionnaire-driven empirical study is another way of
and attacker cost for exploiting individual vulnerabilities to quantifying the security risks. Chang et al. [25] utilized this

VOLUME 5, 2017 5495

 M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

approach to investigate enterprise risk factors for govern- proposed an approach to formally verify the correctness, reli-
ing the risk of IoT environments. Other works [26], [27] ability and safety of smart environments at the design stage,
conducted empirical risk analyses for smart home automa- using model checking. Coronato and Pietro [39] extended
tion systems. Still, other methodologies employed sce- Ambient Logic and Ambient Calculous to formally specify
nario [27], [28] and product-based [29] approaches for the requirements and verify their correctness in safety-critical
characterizing risks. These efforts focus on risk analysis of ubiquitous and pervasive systems.
individual devices or general category of devices and their The research contributions discussed above aim to verify
findings are based on expert opinions, experiences or domain- the anticipated behavior of targeted systems under non-
specific security incidents. Use of formal methods for auto- malicious situations. Therefore, these efforts do not cover
mated risk assessment, as presented by IoTRiskAnalyzer, can the threat analytics and risk verification for active adver-
leverage and extend such manual methods to automatically sarial attacks. Contrarily, the system model generated by
reason about risk applicability and countermeasures, not only IoTRiskAnalyzer is based on an assumption that the input IoT
on individual IoT entities but also for complex and large-scale configurations are consistent and stable under non-malicious
IoT systems. scenarios and can only be compromised by an active adver-
sary through the exploitation of components’ vulnerabilities,
B. FORMAL APPROACHES TOWARDS IoT SECURITY as formalized by the threat model.
Corno and Sanaullah [30] surveyed and critically analyzed
the research contributions towards design-time formal veri- III. BACKGROUND
fication for smart environments. The authors categorized the A. PROBABILISTIC MODEL CHECKING
surveyed papers based on various factors and formalisms and Model checking [40] is a well-recognized and widely-
concluded that ‘‘no surveyed technique maintains a holistic adopted formal technique to verify functional, safety, secu-
[modeling] perspective’’. Another indirect inference from rity and reliability requirements in a number of application
their work is that the existing efforts mostly focus on formally domains. The key idea is to model the system as a state tran-
verifying the correctness and stability of entity interactions sition and express the desired system properties as formulas
and controls and a very limited literature exists towards the in temporal logic. The main benefit of model checking is the
use of formal methods for security analytic and risk verifica- automatic verification of the properties of interest. In case a
tion of such systems. property does not hold for a given model of the system, it also
Mundhenk et al. [31] proposed system-level security anal- provides a counter trace for debugging.
ysis of smart automotive architectures using a Continuous- Probabilistic model checking [13] is an advanced model
Time Markov Chain (CTMC) [32] model. Their approach checking technique in which uncertainties and randomized
was focused at design-time system verification, with a behaviors of stochastic systems are modeled by assigning
premise that specific vulnerabilities are not known a pri- probability values to the transitions in the state transition
ori. Moreover, CTMC being purely stochastic, cannot model model of the targetted system. The behavior of proba-
the non-deterministic behavior of attacker, as demonstrated bilistic systems can be modeled as discrete-time Markov
by our work. A model checking approach was used by chains (DTMCs), CTMCs [32] or MDPs [14]. DTMC and
Kang et al. [33] for performing security property verification CTMC are used for modeling the systems where the events
of a water treatment system. The scope of their research did are discrete and continuous, respectively, with respect to time.
not cover risk verification and concentrated on exploring a MDP is used to model the non-deterministic behavior of the
particular system, and is not generalizable. Furthermore, their systems.
work examined malicious alteration of sensing and actuation Since the attacker behavior and the IoT environmental
data only, and did not cater for the networking aspects and events are non-deterministic in nature, we have modeled our
associated attack patterns, as demonstrated by our frame- system as an MDP. Each transition in MDP from the current
work. Prior works in this area encompass static analysis of state to the next state is probabilistic and depends on the
security considerations in Computer Supported Cooperative current state of the system. Mathematically, the probability
Work (CSCW) systems [34] and a formal analysis technique of the transition from a current state S to a next state S 0 is
to uncover stealthy attacks in cyber-physical systems, while expressed as [41]:
utilizing the verification engine of Matlab/Simulink [35].
Pa (S, S 0 ) = Pr (St+1 = S 0 |St = S, at = a)
C. FORMAL APPROACHES TOWARDS IoT CONSISTENCY
Use of formal techniques for proving the consistency of IoT where Pr represents the probability to transition from state S
systems is another popular research area. Guilly et al. [36] to S 0 and a denotes the corresponding action, which triggered
extended the Event Condition Action (ECA) language in that transition. The transition probabilities of all the state tran-
Timed Automata for isolating system anomalies and safety sitions is represented by a Transition Probability Matrix P.
hazards in smart home applications. Augusto and Hornos [37] The probability of the next state is then expressed as [41]:
leveraged Linear Temporal Logic (LTL) to model and verify
the behavior of smart systems. Corno and Sanaullah [38] Pr (S 0 ) = Pr (S) ∗ P

5496 VOLUME 5, 2017

M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

A variety of probabilistic model checkers, such as where Path-Prop is a path property using temporal oper-
MRMC [42], Vesta [43], Ymer [44], PRISM [15] and ators X (next state), U (until), F (eventually), G (globally),
ETMCC [45], are available to formally model and verify W (weak-until), R (release) and their complex combinations.
those systems, which exhibit random or probabilistic behav- The property mentioned above represents the maximum prob-
iors. We choose the PRISM model checker because of its ability that Path-Prop is satisfied by the paths from the
support for MDP models (not all probabilistic model checkers current state, for all possible resolutions of nondetermin-
support MDP) and time and memory efficiency as compared ism [14]. The minimum probability is computed similarly, by
to the other available tools [46]. using the PRISM keyword Pmin.

B. PRISM MODEL CHECKER

PRISM facilitates several categories of probabilistic
models, such as DTMCs, CTMCs [32], MDPs [14],
probabilistic automata (PAs) [47], probabilistic timed
automata (PTAs) [48] as well as extensions of these models
with rewards (or costs), referred to as continuous or discrete-
time Markov reward models and priced PTAs. The system
models are formally encoded in the PRISM language, which
is a state-driven language, founded on Alur’s Reactive Mod-
ules formalism [49]. The PRISM language primarily consists
of modules and variables. The encoded model comprises
of a concurrent composition of independent yet interacting
modules. A module consists of local variables and guarded
commands. At any given time, the values assigned to these FIGURE 1. IoTRiskAnalyzer.

variables represent the state of the modules and the guarded

commands mimic the behavior of these modules. The local IV. IoTRiskAnalyzer : RESEARCH APPROACH
state of independent modules is integrated to determine the The proposed approach, followed by IoTRiskAnalyzer, is
holistic state of the entire model. The syntax of a PRISM depicted in Figure 1. Firstly, a Markov model is devel-
command is as follows: oped based on the system and threat models. The system
model captures the behavior of: (i) A set of candidate
[act] Guard ⇒ Pr_1 : Update_1 IoT configurations, defining IoT entities and their net-
+ ... work, functional and environmental coupling requirements.
(ii) Operational policies (user-defined), depicting the rules
+ Pr_n : Update_n;
based on which the sensing data is processed and actua-
where act refers to an optional synchronization label and the tion commands are triggered. The threat model formally
Guard represents a predicate, which can be defined using all defines the non-deterministic nature of attacker (i.e. attacker
the variables contained in the model (inclusive of variables behavior) while exploiting a chain of vulnerabilities to
from other modules). The Update expression assigns new achieve the attack objectives. This behavior is enriched by
values to the module variables and Pr represents a proba- the attacker capabilities and vulnerability exploitation scores
bility (or rate) value assigned to the corresponding transition of individual IoT components. These vulnerability scores can
taken by the module, after the Guard condition is met. Non- be extracted from well-established and widely accepted risk
determinism can be modeled by using the same Guard for assessment models, which quantify the exploitation probabil-
multiple PRISM commands, so that all of them are enabled ities for such vulnerabilities.
at the same time (whenever their common pre-condition is After the generation of the Markov model in IoTRiskAn-
met) and only one of them is non-deterministically selected. alyzer, the appropriate properties for risk verification are
In order to verify and analyze the behavior of a given specified. These properties are developed using Probabilistic
system, the desired functionality has to be expressed as Computation Tree Logic (PCTL), after translating the identi-
a property in a suitable probabilistic logic using property fied system-level threats into attack objectives and punctuat-
specification language. The property specification language ing them with realistic attacker capabilities. These properties
used by PRISM is founded on temporal logic and subsumes are then checked against the Markov model to extract veri-
LTL, PCTL* and PCTL [50] for MDPs. The Pmin and fied risk reports using the principles of probabilistic model
Pmax operators are used to reason about the minimum and checking. The reports can be analyzed to answer different
maximum probabilities over all possible resolutions of non- questions such as: ‘‘What is the maximum likelihood of an
determinism. They can be used to verify quantitative proper- attack within the defined attacker’s capabilities? Which con-
ties that take the form: figuration offers the maximum protection against a range of
threats? or which policy suits best the input configurations
Pmax=? [ Path-Prop ] from a security viewpoint?’’

VOLUME 5, 2017 5497

 M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

A. SYSTEM MODEL the threat classifications and relations, formally defined in our
The proposed framework generates a dedicated system model earlier work [19]. This paper classifies IoT threats as context
for each IoT configuration, where every candidate configu- (sensing), trigger (controlling) and actuation threats and then
ration uniquely defines the network, policy, functional and formally relates them as an interconnected threat propagation
environmental relationships of registered IoT entities. tree. The reference threat model [19] is based on the fact that
Mathematically, an IoT system configuration is defined as the attacker can meet her end objectives in multiple ways by
a quadruple < F, N , L, P > where: exploiting the vulnerable assets in conjunction with the intrin-
sic IoT couplings. However, for meaningful risk analysis,
F Environmental Features; IoTRiskAnalyzer extends this threat model by evaluating the
N Nodes pre-defined threat relationships in the light of (i) component
N = {(H ∪ G) ∧ (H ∩ G = ∅)} where; vulnerabilities, (ii) their exploitation probabilities and
G = Network devices (gateways, routers) and (iii) a non-deterministic attacker behavior with finite capa-
bilities. Our threat model is, therefore, composed of the
H = {S ∪ C ∪ D ∪ M } are Hosts, where; following building blocks.
S = Sensors
C = Controllers 1) VULNERABILITY SET (V) AND MAPPINGS (VM)
D = Cloud Servers (Aggregators) The threat model receives a finite set of vulnerabilities
V (|V | = Z ) and a Vulnerability Mapping (VM ) function,
M = Actors | M = {(A ∪ R) ∧ (A ∩ R = ∅)} where;
relating the IoT entities with the corresponding vulnerabili-
A = Controllable Actuating Devices (Actuators) ties, hosted by them.
R = Response Actors VM (bi ) : bi ⇒ M(V )
L Links | L ⊆ N × N ; bi ∈N ∪L

P A set of operational policies where 2) VULNERABILITY EXPLOITATION SCORES (E)

each policy is a set of rules; Each vulnerability (vi ∈ V ) is assigned a normalized value
and a set of entity mappings, including; of Vulnerability Exploitation Score (ei ∈ E | 0 < ei ≤ 1).
Network Mapping (NM): Defines the link to device map- The data regarding these scores is obtained from the widely
pings to form a connected graph, comprising of Nodes acknowledged risk assessment studies, which takes into
(bi ∈ N ) and connected by Links (li ∈ L) as edges. account several metrics, such as how similar vulnerabili-
ties are exploited in the past, type and difficulty of access
NM (bi ) : bi ⇒ M(L) required, strengths of respective security barriers (encryption,
bi ∈N
authentication, etc.) required to be compromised and avail-
Policy Mapping (PM): Defines a one-to-one mapping of ability of attack code and tools needed for exploitation.
Controllers (C) and Response Actors (R) to the corresponding
policy set pi ∈ P hosted by them. 3) VULNERABILITY TO THREAT MAPPING (TM)
PM (bi ) : bi ⇒ M(P) Each vulnerability induces a specific type of Threat(s) (set T ).
bi ∈C∪R We use the threat definitions from our previous work [19]
Functional Mapping (FM): Defines the functional rela- and align them to the corresponding set of vulnerabilities (V ),
tionships among the IoT devices in accordance with the using the mapping function TM .
corresponding policy defined by PM . TM (bi ) : bi ⇒ M(T )
bi ∈V
FM (bi ) : bi ⇒ M(C ∪ D)
bi ∈H 4) ATTACKER CAPABILITY (Cap)
Environment Mapping (EM): Defines the relationship of We assume a non-global adversary with finite capabilities.
Sensors and Controllable Actuating Devices (later referred as The attacker is mainly interested in active attacks (such
actuators) to the corresponding environmental feature fi ∈ F, as modification, fabrication and disruption), which she can
which they observe or impact, respectively. achieve by compromising only a limited and pre-defined set
of IoT entities, through the exploitation of their respective
EM (bi ) : bi ⇒ M(F)
bi ∈S∪A vulnerabilities. The permissible threat vectors strictly follow
the vulnerability definitions and vulnerability to threat map-
B. THREAT MODEL pings (TM ). The term ‘attacker capability (Cap)’ is defined
For a given scenario, the techniques followed by an attacker as the maximum number of vulnerabilities, which can be
to achieve her objectives rely on: (i) IoT vulnerabilities and exploited by an attacker (0 < Cap ≤ Z ). Our framework
their exploitation probabilities, (ii) attacker capabilities and supports assigning a constant Cap value or can even evaluate
priorities and (iii) the IoT system and policy configurations system security against a sweeping value of Cap, within the
defined by the system model. Our threat model is built upon defined limits.

5498 VOLUME 5, 2017

M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

FIGURE 2. An overview of the MDP modules.

5) ATTACKER BEHAVIOR link and gateway modules, in accordance with the functional
The generic behavior of the attacker is depicted in Figure 3 as (FM ) and network (NM ) mappings, defined by the system
a finite state machine. This behavioral modeling is based on a model. The controller modules also implement the respective
probabilistic nature of exploitation of individual vulnerabili- operational policies (P) and accordingly, issue the commands
ties and a non-deterministic approach of the attacker towards for the actuator (A) modules, while following the functional
their exploitation. We assume a reasonable threat model, in mappings defined among them. The actuators, in turn, change
which the attacker is aware of the system vulnerabilities. the linked features as per their respective environment map-
She may attempt an exploit but fail or even choose not to pings. The response actor (R) modules represent authorized
target a known vulnerability, based on her preferences, such external agencies, which can access and respond to the sens-
as conserving resources, avoiding detection or paying the ing data stored in the cloud (D), through the corresponding
required cost. APIs.
Hence, at a given entry point, the choice of whether an
attacker attempts to exploit this vulnerability is modeled as
a non-deterministic decision. If a vulnerability (vi ) is targeted
by an attacker, there is a probability ei that it will be exploited
and 1 − ei that the exploit will fail. For each attempted exploit
the attacker has to pay an overhead, modeled as the Cost
variable (0 ≤ Cost ≤ Cap). It is initialized with zero and
is sequentially incremented with each exploit attempted by
the attacker.

C. MARKOV MODEL
The proposed framework models the IoT architecture, along
with the attacker components, as an MDP. We utilize a mod-
ular approach for generating the Markov model as depicted
in Figure 2.
IoTRiskAnalyzer generates dedicated modules for different
IoT entities, as defined by the system model. The feature mod- FIGURE 3. Attacker FSM.
ules (one for each feature fi ∈ F) model the non-deterministic
nature of environmental features being observed or impacted A dedicated attacker module is used to model the non-
by the system. Each fi ∈ F refers to a unique and physically deterministic attack behavior. It injects the threat vectors to
non-overlapping feature such as temperature, humidity and vulnerable system modules in accordance with the threat
motion. The sensor modules (one for each sensor si ∈ S) definitions and mappings (TM ), while following the attacker
define the concurrent sensing behavior, where each sensor behavior defined in Figure 3.
can observe a single feature (as per environment mappings A typical IoT system is composed of both the sequential
EM ), however, multiple sensors can be deployed to observe and concurrent elements. Concurrency occurs due to the
the same feature (e.g., having multiple smoke sensors in the parallel sensing, actuation, controlling and communication
same room). The sensed values are then communicated to aspects of multiple entities; whereas the sequential behavior
the respective controllers (C) and cloud modules (D) via the originates due to the inherent dependencies and interaction

VOLUME 5, 2017 5499

 M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

requirements (such as a controller can issue actuation com- The vulnerability analysis of the procured components
mands only after receiving the desired observations from reveals a few weaknesses in individual modules, as labeled
sensors). To address this aspect, we have used synchroniza- in Figure 4. The selected vulnerabilities have repeatedly been
tion labels for modeling concurrency and flags and counters discovered in several practically deployed home automation
for the sequential flow. devices [6], [8], [27], [51], [52]. The vulnerability labels as
well as their exploitation probabilities (after normalization)
V. CASE STUDY: A HOME SECURITY SCENARIO
are extracted from the empirical risk analysis study of smart
In order to illustrate the verification methodology used by our
home systems, presented by Jacobsson et al. [26], and are
framework, we consider a typical home security automation
given in Table 1. This work [26], presented a categorization
scenario where a tenant, who is a frequent out-of-town trav-
of the smart home system vulnerabilities with reference to
eler, wishes to automate his house. The tenant is especially
the attack surface (hardware, software, data, communication
concerned about the physical security and safety of his prop-
and human) and entry points (device, gateway, cloud, API
erty during his absence in this scenario.
and Apps) and assigned risk likelihood scores to each of the
identified vulnerabilities. Table 1 also enumerates the threats
associated with these vulnerabilities, in coherence with the
threat classifications and mappings (TM ), explained in the
leveraged literature [19], [26].

TABLE 1. Vulnerabilities, their exploitation probabilities and associated

threats for the considered scenario.

FIGURE 4. Smart home example scenario (Config-1).

Figure 4 portrays a basic system configuration of the

planned automation system, comprising of two sensors TABLE 2. Identified attacks, their impacts and pre-conditions for the
(smoke (S1) and door (S2)) and two actuators (door considered scenario.
lock (A1) and fire alarm (A2)). The data from the sensors
is processed by the mobile apps, installed on the smartphone
controller (C1) of the tenant. The same information is also
accessible to the law enforcement and emergency response
agencies (response actors), through respective cloud APIs, as
shown in Figure 4. The controller (C1) is used to implement
local policies, governing the behavior of smart home services.
Similarly, emergency response policies are also established
at respective agencies as a part of a safe-city project. For this
scenario, we consider that the traveling tenant is interested The IoT architect wishes to configure the system in such a
in analyzing the risks associated with two services, namely way that it offers maximum resistance to all possible attack
physical security and fire-response. The initial set of service scenarios, in the order prioritized by the tenant. The list of
policies is introduced below: identified attacks are summarized in Table 2. It mentions
• Controller Policy (C1-P1): If smoke is reported by the two high-impact attacks (theft and missed both alarms), one
smoke sensor (S1) then the alarm (A2) is activated and medium-impact attack (missed either alarm) and two low-
the door (A1) is unlocked to facilitate fire-fighting and impact attacks (false alarm and compromised evacuation),
evacuation measures. prioritized by the tenant based on the attack consequences.
• Police Response Policy (R1-P1): If the door-lock is For example, in case of a fire incident, the attack where both
armed (house is unoccupied) and the door sensor (S2) the actors (A2 and R2) failed to respond is graded more severe
reports an open door (through the cloud module D-S2), than the ‘missed either alarm’ attack (i.e. exactly one of the
then a signal is transmitted to the police-petrol to inves- two actors respond to the fire).
tigate a potential theft situation.
• Fire Response Policy (R2-P1): If smoke is reported by A. MODEL GENERATION
S1 (through D-S1), then a fire-tender has to be sent to The formal system and threat models of the example sce-
tackle the situation. nario are generated by IoTRiskAnalyzer, through instantiation

5500 VOLUME 5, 2017

M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

of the generic modules, described in Section IV. We have

released the reusable and formally verifiable PRISM code
of this example as an open-source [53]. This source code
can be adapted for general understanding, training and risk
verification of similar smart home architectures through min-
imal tweaks. The model generation consumes the following
information: (i) System configurations given in Figure 4,
(ii) Operational policies of controller (C1) and response Listing 2. Sample attack properties.
actors (R1, R2), stated above and (iii) Component vul-
nerabilities, their exploitability scores and threat mappings, 1) System Properties are used to verify the soundness
as summarized in Table 1. The sensing elements are mod- of our MDP model (e.g., deadlock freeness and state
eled using sensor_smoke_S1 and sensor_door_S2 reachability).
modules, which transmit their observations to C1 and 2) Attack Properties are defined to get the maximum
the respective cloud modules through gateway_G1 and likelihood of satisfying the pre-conditions (Table 2),
corresponding links’ modules. The actuation commands which can achieve the corresponding attack objectives.
by C1 are transmitted (using associated network com- Some of the attack properties are presented in Listing 2.
ponents) and acted upon (by actuator_door_A1 and Property-1 verifies the likelihood of theft, where an
actuator_alarm_A2 modules), in parallel. The response attacker is able to unlock the door while blocking the alarm,
actors of this scenario are modeled by two modules, even if there is no smoke. Similarly, Property-2 and
namely police and fire_deptt, each implementing Property-3 verify the likelihood of ‘compromised evacu-
their respective policies. ation’ and ‘missed either alarm’ attacks, respectively.

Listing 1. Commands for L4 jamming (attacker module).

The attacker module models the non-deterministic FIGURE 5. Alternate configurations of example scenario.
attacker behavior of exploiting the identified vulnerabilities
(Table 1), as described in Figure 3. For instance, the PRISM VI. EVALUATION AND IMPLEMENTATION
commands to model the jamming of the link L4 are given In this section, we present and analyze the verification results
in Listing 1. Here, the variable link_L4_Jam represents of the example scenario (Section V), with an aim to establish
the status of the link L4. G1_A1A2_Tx_flag is the flag that the risk exposure scores significantly depend on the
for sequential flow, representing whether or not the Gate- candidate system configurations as well as the operational
way G1 has sent the data to actuators A1 and A2. The policies. To achieve this, we evaluated three candidate config-
counter variable is used for logical ordering of the possible urations, using our IoTRiskAnalyzer framework. We denote
attacks and cost defines the total number of vulnerabilities the reference configuration (Figure 4) as Config-1, and
attempted, which is always less than the attacker capability present the architecture of other two configurations in
(cap variable). The first command models the scenario when Figure 5. In Config-2, the location of the smoke sensor (S1)
an attacker attempts to jam the link L4 with the success proba- has been changed to form a mesh network over the Zigbee
bility of 0.4, while the second command captures the situation technology. This configuration does not require any extra
when the attacker chooses not to attempt the L4 jamming. budget as it only involves connectivity adjustments (NM )
The antecedent (left-hand side) of the implication specifies of existing devices. Contrary to that, we have introduced a
the satisfying conditions for the activation of that command redundancy in Config-3 by adding a new smoke sensor (S3),
and it is same for both the commands in Listing 1 to model which works on the Z-wave technology. The correspond-
the non-determinism. ing policies (i.e. C1-P1 and R2-P1) for Config-3 were also
changed as; ‘‘Config-3P1: Unlock the door and send the
B. FORMALIZING PROPERTIES fire-tender only if both sensors (S1 and S3) report smoke but
As a next step, the scenario-specific formal model is tested trigger alarm if any of the two sensors report smoke’’. The
against suitable properties, developed using the PCTL logic. security of all these three configurations was tested against
We classify these properties as system and attack properties, attacks mentioned in Table 2, by defining suitable properties
as defined below: as demonstrated in Listing 2.

VOLUME 5, 2017 5501

 M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

FIGURE 6. Verified risk exposure scores (Config-3 utilizes Config-3P1 policy).

A. EXPERIMENTAL RESULTS • Config3-P3: If the smoke is reported by any of the two

1) RISK Vis-à-Vis SYSTEM CONFIGURATION sensors then both the door (A1) and the alarm (A2) are
Based on the input MDP model and customized PCTL prop- actuated.
erties, as discussed in Section V, our framework generated S1 ∪ S3 ⇒ A1 ∩ A2
the risk exposure scores to different attacks in the form of
comparative graphs. The results are plotted in Figure 6. The Figure 7 plots the verified risk-scores of these three policies
results revealed that Config-2 is more resilient to theft and with reference to the threats under consideration and the
‘missed either alarm’. The main reason behind this finding changing attacker cost. The results revealed that there are
is that if the attacker chooses to jam the Link L5 to block no chances of theft for policy P1 (even with a very power-
the fire alarm, she will not be able to modify the sensing ful attacker, i.e., cost=4), through the exploitation of the
values at the gateway as well (because S1 values will also known set of vulnerabilities. Moreover, P1 poses a minimum
fail to reach G1). Contrarily, Config-2 is more risk-prone risk exposure to the other high-impact attack as well (i.e.,
towards compromised evacuation and missing both alarms in Missed both alarms). However, this policy is relatively more
case of fire, due to the additional dependency of S1 over A2 risk-prone to the medium and low-impact attacks. Contrarily,
for transmitting its observations. Config-3 is observed to be policy P2 extends a maximum resilience against the medium
more resilient against both the high-impact attacks due to the and low-impact attacks but has worst scores for both the
introduced redundancy (Sensor S3). high-impact attacks. In the case of Policy P3, the attacker
is required to exploit at least two vulnerabilities to meet
2) RISK Vis-à-Vis OPERATIONAL POLICY the objectives of both the high-impact attacks and hence,
Next, we evaluated the impact of different C1 policies over this policy offers good resistance against a weak adversary
the threat-resiliency for Config-3. To achieve this, we evalu- (i.e. Cap = 1). It is also noteworthy that the risk exposure
ated the following three C1 policies: for some attacks is independent of the attacker capabilities
• Config-3P1: If smoke is reported by any of the two (e.g., ‘compromised evacuation’ for P2 and P3).
sensors (S1 or S3) then the alarm (A2) is triggered but B. DISCUSSION
the door (A1) is unlocked, only if both the sensors report The emerging IoT systems comprise of complex functional
smoke. couplings and cascaded dependencies and host several safety-
critical services. Security analysis of such critical systems
S1 ∩ S3 ⇒ A1; S1 ∪ S3 ⇒ A2 cannot rely on manual or simulation-driven approaches, due
to their incomplete coverage. IoTRiskAnalyzer offers a prov-
• Config3-P2: If the smoke is reported by any of the two able risk verification framework, through exhaustive testing
sensors then the door (A1) is opened but the alarm (A2) of all possible behaviors of input system and threat models,
is activated only if both the sensors report the presence including the ‘corner-cases’, which may otherwise be over-
of smoke. looked by the traditional approaches.
We utilized IoTRiskAnalyzer for verifying the risk expo-
S1 ∪ S3 ⇒ A1; S1 ∩ S3 ⇒ A2 sure of different IoT configurations while manipulating

5502 VOLUME 5, 2017

M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

FIGURE 7. Impact of policy on risk exposure.

the input parameters, such as connectivity, redundancy, model checker. This model can then be analyzed against suit-
vulnerable entry points and operational policies. During our able system and attack properties, using the PRISM tool. Our
experiments, IoTRiskAnalyzer exposed several such complex framework utilizes the default Hybrid engine of PRISM Ver-
attack vectors, which were otherwise difficult to comprehend sion 4.3.1 for verification of input model. It employs the mod-
through traditional approaches. The key findings of these ule renaming feature of PRISM, where ever applicable, for
experiments are summarized here: ensuring modeling scalability, as the generic system modules
1) Given a known set of vulnerabilities, the amount of can be utilized to model multiple instances of similar entities.
risk to system-level security threats vary significantly The performance of IoTRiskAnalyzer directly depends on
with system and policy configurations (as clear from the system size, the complexity of configuration require-
Figures 6 and 7). ments and the number of vulnerabilities and policies. To opti-
2) Introducing redundancy must equally be comple- mize the performance of IoTRiskAnalyzer, we implemented
mented by implementing a right set of policies for model-abstractions and model-decompositions at different
reducing risk exposure. As a counter-example, consider layers, as discussed ahead.
that in case of theft, the risk scores for Config3-P2 The role of a given component in a model generated by
were even higher than both the Configs-1 and 2, IoTRiskAnalyzer depends on: (a) Whether the component
despite the introduction of redundancy. contains any vulnerability or (b) Whether the component
3) Some candidate system and policy configurations offer actively transforms the state due to functional requirements.
a risk-tradeoff for different attack situations. These We applied an abstraction by omitting the modules not sat-
situations can be scrutinized through attack impact isfying the above-stated requirements. For example, in our
analysis, as demonstrated by our work. For example, reference scenario, router R1 and links L1 and L2 were
Config-3 is a preferred solution for the designer as not modeled, since they were transparent for the system and
it offers less risk to both high-impact attacks, despite inaccessible to the attacker. Another level of abstraction was
being weak against the medium-impact attack (i.e., applied over individual modules based on the policy. For
‘missed either alarm’). Moreover, within Config-3, example, a realistic temperature sensor may require a range
P1 is the preferred policy, owing to its minimum risk of integers to precisely model its behavior. However, if the
scores for the high-impact attacks. policy requires the decision to be made only at a threshold
4) Due to the inherent functional dependencies among IoT of 77◦ F, then the sensor can be modeled to observe and report
devices, individual vulnerabilities may be exploited to boolean values (i.e., T > 77 and T ≤ 77).
cause a cascaded impact. For example, a secure actu- In addition to abstractions, model-decompositions were
ator can be compromised by exploiting a vulnerable performed by splitting large system models into multiple
sensor, just because its controller is dependent upon the independent sub-systems, based on different types of entity-
context information produced by that sensor. mappings, as defined in Section IV. These abstractions and
decompositions considerably reduced the state space and
C. IMPLEMENTATION
significantly improved the performance. As an example, the
We have used the Java API for implementing the IoTRiskAna- framework, while running on a Core-i7 machine with 8 GB of
lyzer framework. The API reads the input IoT configurations RAM, consumed small fractions of seconds, both for model
from a text file and automatically generates the MDP model, construction and property verification, for all configurations
in compliance with the language syntax used by the PRISM of our case study.
VOLUME 5, 2017 5503
 M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

VII. CONCLUSION [17] M. Q. Ali and E. Al-Shaer, ‘‘Probabilistic model checking for AMI
In this paper, we presented IoTRiskAnalyzer, which is a novel intrusion detection,’’ in Proc. IEEE SmartGridComm, Oct. 2013,
pp. 468–473.
framework for automated verification and probabilistic quan- [18] S. Ouchani, O. A. Mohamed, and M. Debbabi, ‘‘A security risk assessment
tification of attack likelihoods against generic IoT system framework for SysML activity diagrams,’’ in Proc. IEEE 7th Int. Conf.
configurations. The reports delivered by IoTRiskAnalyzer can Softw. Secur. Rel., Jun. 2013, pp. 227–236.
[19] M. Mohsin, Z. Anwar, G. Husari, E. Al-Shaer, and M. A. Rahman,
help IoT engineers to select the best possible system and ‘‘IoTSAT: A formal framework for security analysis of the Internet
policy configurations from a security standpoint. The frame- of Things (IoT),’’ in Proc. IEEE Conf. Commun. Netw. Secur. (CNS),
work can also assist in analyzing the impact of component- Oct. 2016, pp. 180–188.
[20] L. de Moura and N. Bjørner, ‘‘Satisfiability modulo theories: Introduction
level vulnerabilities over system-level threats. In the future, and applications,’’ Commun. ACM, vol. 54, no. 9, pp. 69–77, Sep. 2011.
we plan to integrate and extend the contributions made by [21] C. Liu, Y. Zhang, J. Zeng, L. Peng, and R. Chen, ‘‘Research on dynamical
the IoTSAT [19] and IoTRiskAnalyzer frameworks, towards security risk assessment for the Internet of Things inspired by immunol-
budget constrained security planning of IoT systems. This ogy,’’ in Proc. IEEE 8th Int. Conf. Natural Comput. (ICNC), May 2012,
pp. 874–878.
envisaged tool-chain will assist non-expert IoT designers to [22] R. Roman, P. Najera, and J. Lopez, ‘‘Securing the Internet of Things,’’
plan, verify and optimize the security of their configurations, Computer, vol. 44, no. 9, pp. 51–58, Sep. 2011.
within the affordable budget, after putting minimal technical [23] D. Podgórski, K. Majchrzycka, A. Dabrowska, G. Gralewicz, and
M. Okrasa, ‘‘Towards a conceptual framework of OSH risk management
efforts. in smart working environments based on smart PPE, ambient intelligence
and the Internet of Things technologies,’’ Int. J. Occupat. Safety Ergon.,
REFERENCES vol. 23, no. 1, pp. 1–20, 2016.
[24] K. Djemame, D. Armstrong, M. Kiran, and M. Jiang, ‘‘A risk assessment
[1] H. Sundmaeker, P. Guillemin, P. Friess, and S. Woelfflé, Eds., Vision and framework and software toolkit for cloud service ecosystems,’’ in Cloud
Challenges for Realising the Internet of Things. rue Mercier, Luxembourg: Computing. Wilmington, DE, USA: Xpert Publishing Services, 2011,
Publications Office of the European Union, 2010. [Online]. Available: pp. 119–126.
http://www.eurolibnet.eu/3/72/&for=show&tid=7944
[25] S.-I. Chang, A. Huang, L.-M. Chang, and J.-C. Liao, ‘‘Risk factors of
[2] D. Evans. The Internet of Things—How the next evolution of the Internet
enterprise internal control: Governance refers to Internet of Things (IoT)
is changing everything. Cisco, Inc., accessed on Mar. 9, 2017. [Online].
environment,’’ in Proc. RISK, 2016, pp. 1–11.
Available: http://www.cisco.com/web/about/ac79/docs/innov/IoT_IBSG_
[26] A. Jacobsson, M. Boldt, and B. Carlsson, ‘‘A risk analysis of a smart home
0411FINAL.pdf
automation system,’’ Future Generat. Comput. Syst., vol. 56, pp. 719–733,
[3] D. Lund, C. MacGillivray, V. Turner, and M. Morales, ‘‘Worldwide and
Mar. 2016.
regional Internet of Things (IoT) 2014–2020 forecast: A virtuous circle
[27] D. Barnard-Wills, L. Marinos, and S. Portesi, ‘‘Threat landscape and good
of proven value and demand,’’ Int. Data Corp., Framingham, MA, USA,
practice guide for smart home and converged media,’’ Eur. Union Agency
Tech. Rep. IDC#248451, Dec. 2014, doi: 10.2824/33134.
Netw. Inf. Secur., Heraklion, Greece, Tech. Rep., Dec. 2014.
[4] V. Turner, J. F. Gantz, D. Reinsel, and S. Minton, ‘‘The digital universe of
opportunities: Rich data and the increasing value of the Internet of Things,’’ [28] T. Denning, T. Kohno, and H. M. Levy, ‘‘Computer security and the modern
IDC Anal. Future, Framingham, MA, USA, Tech. Rep., 2014. home,’’ Commun. ACM, vol. 56, no. 1, pp. 94–103, 2013.
[5] Gartner, Inc. (2016). Gartner Says Worldwide IoT Security Spending to [29] D. Pishva and K. Takeda, ‘‘Product-based security model for smart
Reach $ 348 Million in 2016, accessed no Mar. 9, 2017. [Online]. Avail- home appliances,’’ IEEE Aerosp. Electron. Syst. Mag., vol. 23, no. 10,
able: http://www.gartner.com/newsroom/id/3291817 pp. 32–41, Oct. 2008.
[6] E. Fernandes, J. Jung, and A. Prakash, ‘‘Security analysis of emerging [30] F. Corno and M. Sanaullah, ‘‘Design-time formal verification for smart
smart home applications,’’ in Proc. IEEE Symp. Secur. Privacy, May 2016, environments: An exploratory perspective,’’ J. Ambient Intell. Humanized
pp. 636–654. Comput., vol. 5, no. 4, pp. 581–599, 2014.
[7] K. Angrishi. (Feb. 2017). ‘‘Turning Internet of Things (IoT) into [31] P. Mundhenk, S. Steinhorst, M. Lukasiewycz, S. A. Fahmy, and
Internet of Vulnerabilities (IoV): IoT Botnets.’’ [Online]. Available: S. Chakraborty, ‘‘Security analysis of automotive architectures using prob-
https://arxiv.org/abs/1702.03681 abilistic model checking,’’ in Proc. ACM/EDAC/IEEE Design Autom.
[8] E. Ronen, C. O’Flynn, A. Shamir, and A.-O. Weingarten. (Nov. 2016). Conf., Jun. 2015, pp. 1–6.
IoT Goes Nuclear: Creating a ZigBee Chain Reaction, accessed on [32] V. Kulkarni, Modeling and Analysis of Stochastic Systems. London, U.K.:
Mar. 9, 2017. [Online]. Available: https://eprint.iacr.org/2016/1047 Chapman & Hall, 1995
[9] B. Fouladi and S. Ghanoun, ‘‘Security evaluation of the Z-wave wireless [33] E. Kang, S. Adepu, D. Jackson, and A. P. Mathur, ‘‘Model-based security
protocol,’’ Black Hat USA, vol. 1, pp. 1–6, Aug. 2013. analysis of a water treatment system,’’ in Proc. 2nd Int. Workshop Softw.
[10] B. Schneier. The Internet of Things is Wildly Insecure-and Often Eng. Smart Cyber-Phys. Syst., 2016, pp. 22–28.
Unpatchable, accessed on Mar. 9, 2017. [Online]. Available: https:// [34] T. Ahmed and A. R. Tripathi, ‘‘Static verification of security require-
www.schneier.com/essays/archives/2014/01/the_internet_of_thin.html ments in role based CSCW systems,’’ in Proc. 8th ACM Symp. Access
[11] M. Hamdi and H. Abie, ‘‘Game-based adaptive security in the Internet Control Models Technol. (SACMAT), New York, NY, USA, 2003,
of Things for eHealth,’’ in Proc. IEEE Int. Conf. Commun., Jun. 2014, pp. 196–203. [Online]. Available: http://doi.acm.org/10.1145/775412.
pp. 920–925. 775438
[12] R. Zheng et al., ‘‘An IoT security risk autonomic assessment algorithm,’’ [35] N. Trcka, M. Moulin, S. Bopardikar, and A. Speranzon, ‘‘A formal
Indonesian J. Electr. Eng. Comput. Sci., vol. 11, no. 2, pp. 819–826, 2013. verification approach to revealing stealth attacks on networked control
[13] T. Nipkow, ‘‘Advances in probabilistic model checking,’’ in Software systems,’’ in Proc. 3rd Int. Conf. High Conf. Netw. Syst. (HiCoNS),
Safety and Security: Tools for Analysis and Verification, vol. 33. New York, NY, USA, 2014, pp. 67–76. [Online]. Available: http://doi.
Amsterdam, The Netherlands: IOS Press, 2012, pp. 126–151. acm.org/10.1145/2566468.2566484
[14] M. Puterman, Markov Decision Processes: Discrete Stochastic Dynamic [36] T. L. Guilly, J. H. Smedegard, T. Pedersen, and A. Skou, ‘‘To do and not to
Programming. Hoboken, NJ, USA: Wiley, 1994 do: Constrained scenarios for safe smart house,’’ in Proc. IEEE Int. Conf.
[15] M. Kwiatkowska, G. Norman, and D. Parker, ‘‘PRISM 4.0: Verification of Intell. Environ. (IE), Jul. 2015, pp. 17–24.
probabilistic real-time systems,’’ in Computer Aided Verification (Lecture [37] J. C. Augusto and M. J. Hornos, ‘‘Software simulation and verifica-
Notes in Computer Science), vol. 6806. Berlin, Germany: Springer, 2011, tion to increase the reliability of Intelligent Environments,’’ Adv. Eng.
pp. 585–591. Softw., vol. 58, pp. 18–34, Apr. 2013. [Online]. Available: http://dblp.uni-
[16] M. U. Sardar, N. Afaq, K. A. Hoque, T. T. Johnson, and O. Hasan, trier.de/db/journals/aes/aes58.html#AugustoH13
‘‘Probabilistic formal verification of the SATS concept of operation,’’ in [38] F. Corno and M. Sanaullah, ‘‘Modeling and formal verification of smart
NASA Formal Methods, vol. 9690. New York, NY, USA: Springer, 2016, environments,’’ Secur. Commun. Netw., vol. 7, no. 10, pp. 1582–1598,
pp. 191–205. 2014. [Online]. Available: http://dx.doi.org/10.1002/sec.794

5504 VOLUME 5, 2017

M. Mohsin et al.: IoTRiskAnalyzer: Probabilistic Model Checking-Based Framework for Formal Risk Analytics of the IoT

[39] A. Coronato and G. D. Pietro, ‘‘Formal specification and verification MUHAMMAD USAMA SARDAR received the
of ubiquitous and pervasive systems,’’ ACM Trans. Auto. Adapt. Syst., B.Sc. degree in electronics engineering from the
vol. 6, no. 1, p. 9, 2011. [Online]. Available: http://dblp.uni-trier.de/db/ Ghulam Ishaq Khan Institute of Engineering Sci-
journals/taas/taas6.html#CoronatoP11 ences and Technology, Pakistan, in 2009, and
[40] C. Baier, J.-P. Katoen, and K. G. Larsen, Principles of Model Checking. the M.S. degree (Hons.) in electrical engineer-
Cambridge, MA, USA: MIT Press, 2008 ing from the National University of Sciences and
[41] U. Pervez, A. Mahmood, O. Hasan, K. Latif, and A. Gawanmeh, Technology (NUST), Pakistan, in 2015. He was a
‘‘Improvement strategies for device interoperability middleware using for-
Researcher with the Chair of Embedded Systems,
mal reliability analysis,’’ Scalable Comput., Pract. Exper., vol. 17, no. 3,
Karlsruhe Institute of Technology, Germany. He is
pp. 150–170, 2016.
[42] J.-P. Katoen, I. S. Zapreev, E. M. Hahn, H. Hermanns, and D. N. Jansen, currently a Research Assistant with the System
‘‘The ins and outs of the probabilistic model checker MRMC,’’ Perform. Analysis and Verification Laboratory, NUST. His main research interests
Eval., vol. 68, no. 2, pp. 90–104, 2011. include probabilistic model checking-based formal verification of safety-
[43] K. Sen, M. Viswanathan, and G. Agha, ‘‘VESTA: A statistical model- critical systems. His research work has resulted in publications at top inter-
checker and analyzer for probabilistic systems,’’ in Proc. 2nd Int. Conf. national forums, such as the Journal of Parallel and Distributed Computing
Quant. Eval. Syst., vol. 5. Sep. 2005, pp. 251–252. and the NASA Formal Methods Symposium.
[44] H. L. Younes, ‘‘Ymer: A statistical model checker,’’ in Computer Aided
Verification, vol. 3576. Berlin, Germany: Springer, 2005, pp. 429–433.
[45] H. Hermanns, J.-P. Katoen, J. Meyer-Kayser, and M. Siegle, ‘‘ETMCC:
Model checking performability properties of Markov chains,’’ in Proc.
DSN, 2003, p. 673.
[46] D. N. Jansen, J.-P. Katoen, M. Oldenkamp, M. Stoelinga, and I. Zapreev,
‘‘How fast and fat is your probabilistic model checker? An experimental
performance comparison,’’ in Hardware and Software: Verification and OSMAN HASAN (S’07–M’11–SM’14) received
Testing, vol. 4899. Berlin, Germany: Springer, 2008, pp. 69–85. the B.Eng. degree (Hons.) from the University of
[47] R. Segala and N. Lynch, ‘‘Probabilistic simulations for probabilistic pro- Engineering and Technology, Pakistan, in 1997,
cesses,’’ Nordic J. Comput., vol. 2, no. 2, pp. 250–273, 1995. and the M.Eng. and Ph.D. degrees from Concor-
[48] D. Beauquier, ‘‘On probabilistic timed automata,’’ Theor. Comput. Sci., dia University, Montreal, Canada, in 2001 and
vol. 292, no. 1, pp. 65–84, 2003. 2008, respectively. He was an ASIC Design Engi-
[49] R. Alur and T. A. Henzinger, ‘‘Reactive modules,’’ Formal Methods Syst. neer with LSI Logic Corporation, Ottawa, Canada,
Design, vol. 15, no. 1, pp. 7–48, 1999. from 2001 to 2003, and a Research Associate with
[50] A. Bianco and L. de Alfaro, ‘‘Model checking of probabilistic and non-
Concordia University, Montreal, Canada, from
deterministic systems,’’ in Foundations of Software Technology and The-
2008 to 2009. He is currently an Assistant Pro-
oretical Computer Science, vol. 1026. Berlin, Germany: Springer, 1995,
pp. 499–513. fessor with the School of Electrical Engineering and Computer Science,
[51] S. Curtis. Home Invasion 2.0: How Criminals Could Hack Your House, National University of Sciences and Technology (NUST), Islamabad, Pak-
accessed on Mar. 9, 2017. [Online]. Available: http://www.telegraph. istan. He is the Founder and Director of the System Analysis and Verification
co.uk/technology/internet-security/10218824/Home-invasion-2.0-how- Laboratory, NUST, which mainly focuses on the design and formal verifi-
criminals-could-hack-your-house.html cation of safety-critical systems, including e-health and digital systems. He
[52] C. B. Review. Veracode Warns IoT a Pathway for Cybercrime, accessed is a member of the ACM, the Association for Automated Reasoning, and
on Mar. 9, 2017. [Online]. Available: http://www.cbronline.com/ the Pakistan Engineering Council. He was a recipient of several awards and
news/internet-of-things/consumer/veracode-warns-iot-a-pathway-for- distinctions, including the Pakistan’s Higher Education Commission’s Best
cybercrime-4548343 University Teacher in 2010 and the Best Young Researcher Award in 2011,
[53] M. Mohsin, M. U. Sardar, O. Hasan, and Z. Anwar. IoTRiskAna- and the President’s Gold Medal for the best teacher of the University from
lyzer, accessed on Mar. 9, 2017. [Online]. Available: https://github.com/ NUST in 2015.
mujahidmohsin/IoTRiskAnalyzer

MUJAHID MOHSIN received the M.S. degree ZAHID ANWAR received the Ph.D. and M.S.
(Hons.) in information security from the National degrees in computer sciences from the University
University of Sciences and Technology (NUST), of Illinois at Urbana–Champaign, USA, in 2008
Pakistan, in 2010, where he is currently pursuing and 2005, respectively. He was a Software Engi-
the Ph.D. degree in computer and communication neer and a Researcher with IBM, Intel, Motorola,
security, under the supervision of Dr. Z. Anwar. the National Center for Supercomputing Appli-
He was a Researcher with CERN and the Cyber cations, xFlow Research, and CERN on projects
Defense and Network Assurability Center, Univer- related to information security and data analytics.
sity of North Carolina at Charlotte, USA. He is also He was a Post-Doctoral Fellow with Concordia
a Research Assistant with the Systems Research University, Canada, and a Faculty Member with
Group, NUST. His current research interests include automated security the University of North Carolina at Charlotte, USA, Fontbonne University,
analytics, the Internet of Things security, formal methods, and actionable USA, and the National University of Sciences and Technology (NUST),
cyber threat intelligence. He was a recipient of the Ph.D. Scholarship from Pakistan. He is currently the Laboratory Director of the Systems Research
the Higher Education Commission, Pakistan, and the Rector’s NUST High Group, NUST.
Achiever Certificate in 2015.

VOLUME 5, 2017 5505