Traffic Measurements for Cyber Security

Traffic-Aware Patching for

Cyber Security in Mobile IoT
Shin-Ming Cheng, Pin-Yu Chen, Ching-Chao Lin, and Hsu-Chun Hsiao

Abstract These features include constrained resources, het- The authors propose
erogeneous links, and vulnerable usability, which a novel traffic-aware
The various types of communication technol- are discussed as follows. patching scheme to select
ogies and mobility features in IoT on one hand Resource-Constrained IoT Devices: Compared important intermediate
enable fruitful and attractive applications, but to the intermediate nodes located at the end side nodes to patch, which
on the other hand facilitate malware propaga- of the infrastructure with wired connectivity, IoT
tion, thereby raising new challenges in handling devices designed to perform simple sensing and applies to the IoT system
IoT-empowered malware for cyber security. actuation operations have limited computation with limited patching
Compared to the malware propagation control and communication capabilities. In this case, the resources and response
scheme in traditional wireless networks, where algorithm and mechanism applied on IoT devic- time constraint. Experi-
nodes can be directly repaired and secured, in es are relatively simple. As a result, the attacker ments on real-world trace
IoT, compromised end devices are difficult to can spend much less resources to break into IoT
patch. Alternatively, blocking malware via patch- devices, rendering them the targets of malicious datasets in IoT networks
ing intermediate nodes turns out to be a more users. For example, due to the overhead of certif- are conducted to demon-
feasible and practical solution. Specifically, patch- icate management and public key cryptography, strate the advantage of
ing intermediate nodes can effectively prevent the many existing IoT devices fail to support state- the proposed traffic-aware
proliferation of malware propagation by securing of-the-art secure communication protocols (e.g., patching scheme in
infrastructure links and limiting malware propaga- SSL/TLS). Therefore, the adversary can eavesdrop
tion to local device-to-device dissemination. This on sensitive sensor data and even manipulate alleviating malware
article proposes a novel traffic-aware patching data without being detected. Another example is propagation.
scheme to select important intermediate nodes to that IoT devices often have limited entropy sourc-
patch, which applies to the IoT system with lim- es, which results in weak cryptographic keys that
ited patching resources and response time con- can be predicted by the attacker. Moreover, since
straint. Experiments on real-world trace datasets in most IoT devices run on embedded Linux operat-
IoT networks are conducted to demonstrate the ing systems (OSs), the attacker can easily create
advantage of the proposed traffic-aware patching IoT malware by recompiling existing Linux mal-
scheme in alleviating malware propagation. ware for other instruction set architectures.
Heterogeneity: In order to support different
Introduction kinds of IoT applications, IoT devices are often
By integrating the ability to sense the physical equipped with heterogeneous communication
world and the privilege of availing communication and computation capabilities for the purpose of
capabilities, the Internet of Things (IoT) enables seamless operations. However, the heterogeneity
close interactions between humans and machines. and potentially vast amount of IoT devices facilitate
IoT generally consists of numerous IoT end devic- the fabrication of identity and hiding of malware.
es for sensing and action, intermediate nodes with Moreover, as shown in Fig. 1, compromised IoT
wired connectivity for data relaying, and appli- devices might disseminate malware via heteroge-
cation servers in the cloud for data control and neous communication links as described below.
analysis. Typically, IoT devices can communicate Infrastructure Links: IoT malware can propa-
with each other with minimal human intervention gate using infrastructure-based communication
and build an autonomous and complex network. technologies, such as GSM/GPRS/UMTS/LTE and
As the boundary between machines and humans WLAN, via intermediate nodes, such as access
gets blurry, adversaries in cyberspace can threat- point (AP), base station (BS), or gateway. In par-
en human users’ safety and privacy in the physical ticular, IoT malware inherits the threats caused
world. Obviously, the growing popularity of devic- by computer malware. Similar to computer mal-
es with rich wireless communication capabilities ware, most IoT malware families today scan the IP
has made IoT attractive to digital viruses and mali- address space for vulnerable victims and spread
cious contents. Consequently, in recent years the via the Internet. Due to the widespread use of
security issues in IoT have been an ever increasing weak login credentials and the fact that many
concern [1–3]. IoT devices are Internet-accessible, some botnets
From an adversary’s perspective, the unique have allegedly harvested more than one mil-
features of IoT facilitate the exploitation of devic- lion infected IoT devices (http://thehackernews.
es as well as the propagation of IoT malware. com/2016/10/iot-dyn-ddos-attack.html).

Shin-Ming Cheng and Ching-Chao Lin are with National Taiwan University of Science and Technology; Digital Object Identifier:
Pin-Yu Chen is with IBM Thomas J. Watson Research Center; Hsu-Chun Hsiao is with National Taiwan University. 10.1109/MCOM.2017.1600993

IEEE Communications Magazine • July 2017 0163-6804/17/$25.00 © 2017 IEEE 29

 of leveraging intermediate nodes to improve IoT
IoT object/node/device WLAN AP security has appeared in the recent commercial
Intermediate node product F-Secure SENSE (https://community.f-se-
BLE cure.com/t5/F-Secure-SENSE/What-are-the-cur-
BLE
rent-protection/ta-p/82972). However, its main
BLE purpose is to block malicious websites and IoT
NFC botnet masters instead of considering securing
Wi-Fi
WLAN AP Direct Wi-Fi WLAN AP important infrastructure links between IoT devic-
Direct es and intermediate nodes. On the other hand,
Cellular BS the idea behind IoT Sentinel [6] is similar to our
WLAN AP
BLE solution, where the types of IoT devices are iden-
NFC tified by intermediate nodes, and the communi-
WLAN AP
Device-to-device links Infrastructure links cations of vulnerable IoT devices are constrained
by enabling enforcement of rules. Different from
Figure 1. IoT platform with infrastructure and device-to-device links. our solution, software-defined networking (SDN)
is exploited in IoT Sentinel for network flow isola-
tion and prevention of malware propagation.
Device-to-Device Links: IoT malware could With limited efforts and resources, an operator
exploit proximity-based wireless media such as might not be able to patch all intermediate nodes
Bluetooth Low Energy (BLE), WiFi Direct, and but only a portion of them. One naive method
near field communication (NFC) to infect the is to simply patch those intermediate nodes in a
devices in the vicinity [4]. In this case, IoT mal- random order. However, a smarter approach is
ware is stored and forwarded by taking advan- to protect the most important node first, as sug-
tage of mobility and ubiquity. For example, Colin gested by the framework of network robustness
O’Flynn in Black Hat USA 2016 as well as Ronen analysis [7, 8]. This article proposes a traffic-aware
and Shamir [5] discussed the possibility of a light patching scheme, where the operator patches the
bulb worm, which allows a reprogrammed bulb to intermediate nodes sequentially in descending
re-flash nearby bulbs. importance order. In particular, an intermediate
Usability: Security is only as strong as its weak- node that could have contact with a large number
est link, and the weakest link, in many cases, is the of IoT devices will be protected first. Moreover,
humans who implement, operate, and use the sys- such a volume-based patching approach is effec-
tem. For example, a proven secure cryptographic tive against the current infamous distributed deni-
primitive, if implemented or used incorrectly, can al of service (DDoS) attacks launched by IoT bots.
still be circumvented. Moreover, users may choose By leveraging a real-world trace dataset con-
to ignore or even bypass a security mechanism if taining communication history over device-to-
it prevents (e.g., due to slow performance, badly device and infrastructure links, we conduct an
designed user interface, and unclear instructions) extensive experiment to demonstrate the effect of
the users from doing what they mean to do. Since constraining malware propagation via infrastruc-
IoT devices often lack convenient input and out- ture links. To the best of the authors’ knowledge,
put interfaces, the original security features might this article is the first work discussing the control
be bypassed by non-professional IT users, thereby of malware propagation from the perspective of
increasing the possibility and risk of human errors infection paths, which could avail the damage
and facilitating the spreading of malware [2]. estimation caused by the malware and improve
Obviously, software updates and patch- the development of attack detection methods for
ing are necessary to prevent IoT devices from IoT networks.
being compromised. A single software flaw will
make a tremendous range of IoT devices vulner- How to Compromise IoT Devices
able to attacks since software components are IoT devices are an attractive attack target for
reused in different devices (http://blog.senr.io/ cybercriminals: IoT devices often employ weak
blog/400000-publicly-available-iot-devices-vul- security measures, and their compromise can
nerable-to-single-flaw). However, without a lead to privacy breaches and safety threats in the
friendly user interface (UI) through which to be real world. The insecurity of existing IoT devic-
alerted about security updates, most users forget es has been highlighted repeatedly by security
to update software installed in IoT devices and researchers and practitioners. Recently, several
leave them out of date. In addition, without basic malware families were found to target vulnerable
programming knowledge and security awareness, IoT devices (e.g., routers, IP cameras, and CCTVs)
users might be unwilling to take a manual-down- and form botnets for DDoS. It is estimated that
load-and-install approach for software updating. some IoT botnets comprise more than one million
As a result, it is critical to design a reasonable solu- infected devices, and thus can generate high-vol-
tion to prevent the occurrence of large-scale mal- ume DDoS traffic even without amplification.
ware propagation among trillions of unpatched, For example, in September 2016, an IoT botnet
insecure, and even compromised IoT devices. called Mirai crippled a website with 620 Gb/s of
Instead of patching resource-constrained and attack traffic, which is almost twice as much as
UI-unfriendly compromised IoT devices directly, the biggest DDoS attack witnessed in 2015. Later,
this article introduces a more feasible solution, in October 2016, the same botnet attacked the
where operators could only patch or recover IoT Dyn DNS service provider, taking down a large
devices via infrastructure (i.e., securing the inter- portion of websites in North America, includ-
mediate nodes). In this case, a patched AP, BS, ing GitHub, Twitter, Netflix, and so on (https://
or gateway could stop the malware propagation www.us-cert.gov/ncas/alerts/TA16-288A). At DEF
by patching via infrastructure links. The concept CON 2016, security researchers showed a proof-

30 IEEE Communications Magazine • July 2017

of-concept IoT ransomware that demands ran- (e.g., privacy, legacy devices, and lack of incen-
som for a hacked smart thermostat, which will tives) will linger and even exacerbate when IoT devices are an
be set to a high temperature without timely pay- attempting to patch IoT devices. attractive attack target
ment (https://www.pentestpartners.com/blog/ for cybercriminals: IoT
thermostat-ransomware-a-lesson-in-iot-security/). Modeling of IoT Malware
As attackers are finding creative ways to mon- The topic of modeling malware/virus spreading devices often employ
etize infected IoT devices, it is inevitable to see has been investigated in a traditional scenario weak security measures,
an increase of new IoT malware families that are where computers or laptops are not connected
more destructive and contagious than ever. to the Internet. Since the spread of epidemics and their compromise
IoT malware can propagate via infrastructure among people is similar to the spread of mal- can lead to privacy
links and/or device-to-device links. We discuss ware over networks, the current literature adopts breaches and safety
both cases in this section. the idea from epidemiological models to build
the models for malware on the assumption of a threats in the real
Compromising IoT Devices via Infrastructure Links homogeneous infection path [10]. In the mobile world. The insecurity
Many of the IoT malware families today propa- environment, malware can propagate via intermit-
gate via infrastructure links, particularly the Inter- tently connected networks by taking advantage of of existing IoT devices
net. Moreover, they share a common infection opportunistic encounters [11]. Wang et al. [12] has been highlighted
and spreading pattern: The attacker harvests new study spreading patterns of mobile phone viruses, repeatedly by security
vulnerable IoT devices through address space which may traverse through multimedia messag-
scanning. This scanning can be performed by ing services (MMS) or Bluetooth by simulations. researchers and
external servers, such as command and control Cheng and Chen [13] further model malware practitioners.
(C&C) servers, or by the compromised devices. propagation in generalized social networks con-
The attacker targets Telnet- or SSH-accessible sisting of delocalized and localized links.
devices that use default or weak login creden- From the discussion of the previous section,
tials and thus can easily obtain root access per- we understand that in practice patching com-
mission by brute-force password cracking. Once promised IoT devices is difficult to achieve. Con-
the attacker gets the shell of the hacked device, sequently, the current formulation of malware
the malware payload is downloaded and installed. propagation and the control model [14] cannot
IoTPOT [2], an IoT honeypot project, observed be applied directly in the IoT field. Typically, in
at least four IoT malware families that can prop- one of the most famous susceptible-infection-re-
agate via Telnet. In addition to cracking weak cover (SIR) models, the malware is assumed to
passwords, some malware also exploits software be detected and repaired at each node, which
vulnerabilities. For example, CCTV-targeting reflects the transition from “infected” state to
RADIATION malware exploits ShellShock and “recovered” state. Regarding the IoT device that
some known CCTV vulnerabilities to spread from detects the malware, instead of directly patching
device to device. it, it is more feasible to patch on the infrastructure
side to prevent further spreading of malware. In
Compromising IoT Devices via Device-to-Device Links this case, compromised IoT devices located in
Malware can also propagate in proximity via the coverage area of the patched intermediate
device-to-device links in addition to infrastruc- nodes are controlled, that is, malware cannot be
ture links. Cabir and Commwarror are examples propagated via patched intermediate nodes. As
of mobile worms that spread via Bluetooth and a result, the infrastructure links can be regard-
infect mobile phones running the Symbian OS. ed as “recovered” while the compromised IoT
Although we have not witnessed device-to- device remains “infected,” using the terminology
device IoT malware in the wild, it is theoretically of the SIR model. The observation that malware
possible. For example, researchers pointed out control in IoT environment can be cast as a “link
the possibility of light bulb worms that spread recovery” problem instead of a “node recovery”
to nearby bulbs via Zigbee [5] and worms that problem motivates a different development of
infect wearable trackers and then spread to modeling and formulation.
others by Bluetooth (http://www.theregister.
co.uk/2015/10/21/fitbithack/). Moreover, since Feasible Patching Schemes in the
proximity-based wireless interfaces are often
always on, and users have no control to disable IoT Environment
them, it would be difficult to contain malware This section proposes patching schemes for the
propagation given the large attack surface. IoT environment, where we can only control infra-
Regardless of how malware propagates, the structure links but not the compromised nodes
risk of self-replicating IoT malware is amplified by themselves. The patching scheme consists of sev-
unpatched IoTs. Patching vulnerable IoT devices eral phases. In the detecting phase, infrastructure
nevertheless remains extremely expensive and far leverages a traditional intrustion detection system
from successful in practice. In 2015, Charlie Miller (IDS) or firewall to identify the existence of mal-
and Chris Valasek demonstrated remote exploita- ware or a compromised node. Once malicious
tion of a Jeep, which forced Chrysler to recall and code is found to be propagated from the com-
patch 1.4 million vehicles (https://www.wired. promised IoT devices, the patching phase starts
com/2015/07/hackers-remotely-kill-jeep-high- to analyze the malware and patches the interme-
way/). Cui and Stolfo [9] discovered more than diate nodes according to a patching sequence to
540,000 publicly accessible devices using default prevent the large-scale propagation of malware.
root passwords — an old but persistent vulnerabil- In practice, intermediate nodes are capable of
ity since the invention of password-based authen- performing resource-intensive tasks and thus can
tication. Worse yet, the problems encountered support over-the-air (OTA) update mechanisms. In
when patching computers and mobile phones the patching phase, such OTA mechanisms allow

IEEE Communications Magazine • July 2017 31

 Step 1 Device d

BS 2
Device d
Device-to-device links
BS 3
Infrastructure links Device e
Compromised device
Normal device Device d Device d

BS 2 BS 2
Device a Device a
BS 3 Device c BS 3 Device
De c
Device e Device e

Step 2 Step 3

Figure 2. Illustration of malware propagation under the infrastructure patch scheme.

For example, in step 2 of Fig. 2, device c under

Input: The set of intermediate nodes, SAP; The time to start patching, tp; The percentage unpatched BS 3 could infect device d controlled
of patched intermediate nodes, p by unpatched BS 2 via infrastructure links. More-
1: If currentTime < tp then over, device a moving from patched BS 1 to
2: Collect traffic information for each intermediate node unpatched BS 2 could propagate malware via
3: else device-to-device links freely.
4: If currentTime  tp then Algorithm 1 describes the detailed steps in
5: Sort intermediate nodes according to the the patching phase. With limited resources and
6: importance metric in descending traffic order efforts, the operator could provide a fixed amount
7: Patch top p % SAP of patches on the intermediate nodes (e.g., p per-
8: end if centage). To alleviate the propagation from the
9: end if infrastructure links, the p percent most import-
ant intermediate nodes will be chosen for patch-
ing. It is similar to the idea of protecting the most
Algorithm 1. Traffic-aware patching. important node to maintain network robustness
[7]. As a result, we introduce the traffic monitor-
the administrator to remotely install required ing duration (lines 1 and 2, Algorithm 1) for evalu-
update on the intermediate nodes, thereby ensur- ating the importance of intermediate nodes. From
ing timely mitigation of compromised nodes. In the monitored results, the proposed traffic-aware
addition, since intermediate nodes are significant- patching scheme sorts the intermediate nodes
ly fewer than IoT devices, the administrator can in descending order according to the traffic vol-
also manually patch legacy intermediate nodes umes (lines 5 and 6, Algorithm 1), and the top p
that do not support OTA update. percent intermediate nodes are patched (line 7,
Figure 2 describes an example of how a com- Algorithm 1).
promised device propagates malware in an IoT Obviously, the proposed volume-based
environment with patched and unpatched inter- patching is effective against attacks that gener-
mediate nodes. For the devices located in the ate a large number of traffic volume (e.g., DDoS
coverage area of the patched intermediate nodes, attacks). The patched intermediate nodes could
two possible operations are executed. prevent the redirection of malicious traffic intro-
Compromised devices can distribute malware duced by the DDoS attack launched by the IoT
via device-to-device links but not infrastructure botnets.
links. As shown in step 1 of Fig. 2, the compro-
mised device propagates malware to devices b Performance Evaluation
and c in the vicinity. However, in step 2 of Fig. In this section, we implement the proposed traf-
2, device b cannot propagate malware via infra- fic-aware patching scheme and compare its per-
structure link since the malware is blocked at the formance with a randomized patching scheme on
patched BS. real-life traffic traces collected from a mobile social
Normal devices can only be compromised via network consisting of 59 users (devices) and 1751
device-to-device links since the malware propa- APs [15]. In this network, each user can communi-
gated from infrastructure will be identified and cate with other users through two types of links: an
blocked by the patched intermediate nodes. For infrastructure link via (possibly multiple) APs and a
example, in step 3 of Fig. 2, device d propagates direct device-to-device link to users within transmis-
malware from BS 2 to BS 1; however, the patched sion range. These two types of links among users
BS 1 will not relay the malware to any device in its are similar to the illustration of mobile IoT in Fig. 1.
coverage area. As mentioned previously, in this experiment infra-
For the devices located in the coverage area structure links can be made secure via patching,
of the unpatched intermediate nodes, there whereas direct device-to-device links are vulnerable
are no means to prevent malware propagation. to potential security threats.

32 IEEE Communications Magazine • July 2017

 Following the vulnerability analysis of transmis-
sion attacks in [3], we simulate the propagation
dynamics of self-replication malicious codes by 80
first randomly selecting a user in the network as
70
the initially compromised device. Then, using the

Fraction of compromized users (%)

actual traces of communication patterns provid- 60
ed by the dataset [15], each infected device can
100 50
compromise its contact through an infrastructure
link with probability  inf, and can compromise 100 40
50
its contact through a direct device-to-device link 90
80 30
with probability dir. Specifically, if one of the APs 70
0
in the communication path between one infect- 50
60
P s (%
) 20
d A
ed device and its contact has been successfully 0
Pat 20 40 40 t c h e
ch 30 n of pa 10
patched, malware propagation is in vain due to tim 60 80 20 Frac
tio
e ( 100
enhanced security. s) 10 0
For traffic-aware patching, we are interested
in investigating the trade-offs between the time Figure 3. Fraction of compromised users with respect to different patch time
spent on analyzing traffic volume (i.e., the traf- and patched APs under the traffic-aware patching scheme. linf = 0.00004
fic monitoring duration) and the time instance and ldir = 0.00001.
to patch APs (i.e., the patch time). As described
in the previous section, given a fixed amount
of patches, the proposed traffic-aware patching
scheme sorts the APs in descending order accord-
ing to the traffic volume in the traffic monitoring 35
duration, and provides patches to the top APs.
Intuitively, longer traffic monitoring duration bet- 30
ter specifies the important APs in communicat-
Fraction of compromized users (%)

ing devices. However, longer traffic monitoring 25

duration also leads to more exploits in security
vulnerabilities due to later patch time. As a result, 40
20
given a fixed amount of patches, we aim to study 30
20 100
the nontrivial optimal patch time that collects suf- 90
15
10 80
ficient traffic information for patching while mini- 70
mizing the security risks. 0 60 )
50 APs (% 10
Figure 3 shows the fraction of compromised Pat 0
20 40 p a t c hed
ch o f
users with respect to different patch time and tim
40
60 30 tion
e( 80 20 Frac 5
patched APs under the traffic-aware patching s 100
) 10
scheme. To demonstrate the effectiveness of the
proposed traffic-aware patching scheme, Fig. 4
further compares the difference of compromised Figure 4. Performance comparison of traffic-aware patching scheme vs. the
users between the no-patching scheme and the no-patching scheme. This figures shows the difference of compromised
traffic-aware scheme. It can be observed that users between the no-patching scheme and the traffic-aware scheme. linf =
the best patching strategy that leads to a max- 0.00004 and ldir = 0.00001. The results are averaged over 500 trials.
imal decrease in the number of compromised
users compared to the no-patching scheme is to
monitor the traffics for 40 seconds and then pro- better than random patching in the regime of a
vide patches to all APs. Note that 100 percent few patched APs (e.g., below 30 percent). More-
patched APs (i.e., securing all infrastructure links) over, given a fixed fraction of patched APs, for
with patch time 0 may not be the optimal patch traffic-aware patching, there is at least one patch
strategy since the malicious codes are still able to time that leads to either better or identical per-
propagate through direct device-to-device links. formance compared to random patching, which
To further understand the effect of traffic-aware suggests the robustness and reliability of the
patching, for a given fraction of patched APs, Fig. proposed patching scheme. Even in the regime
5 shows the optimal patch time that leads to the of many patched APs (e.g., above 90 percent),
lowest total number of compromised users. We the performance of traffic-aware patching is still
observe that if one is able to patch more APs, late superior to random patching, which suggests the
patch time can have better performance, which importance of patching APs with high traffic vol-
suggests that traffic volumes are indeed important ume for enhanced security.
information for patching.
For fair comparison, we also compare the per- Some Ongoing Challenges and
formance of traffic-aware patching with random
patching. Random patching provides immediate Open Research Questions
patches (i.e., has patch time 0 ) and randomly Here we discuss several ongoing challenges and
selects a fraction of APs to patch. Figure 6 shows open research questions related to IoT malware
the difference between the fraction of compro- propagation and patching.
mised users under random patching to that of Transfer Learning for Optimal Patch Time:
traffic-aware patching, where larger positive val- In the experiments, we find that the patch time
ues imply that traffic-aware patching is more effec- is crucial to preventing malware propagation.
tive in securing the network and vice versa. We How to design and simulate realistic testbeds to
observe that traffic-aware patching is significantly assist in determining the optimal patch time and

IEEE Communications Magazine • July 2017 33

 the topology of intermediate nodes, in order to
100 100 design a more effective importance metric for
determining the patching sequence. For exam-
ple, the betweenness metric could be leveraged,
which is defined as the fraction of all shortest
paths passing through the node among all short-

Fraction of compromized users (%)

est paths between each node pair in the network.
Patching via Path-Based Traffic Patterns: The
Optimal patch time (s)

proposed traffic-aware patching scheme only con-

siders the one-hop traffic information in terms of
50 50 the traffic volume from IoT devices to interme-
diate nodes. The patching scheme could benefit
from the knowledge beyond one-hop informa-
tion, such as the path-based end-to-end traffic pat-
terns. However, path-based traffic patterns are
relatively difficult to collect or acquire compared
to one-hop traffic information.
How to Achieve (Virtual) Patching: IoT devices
often lack user-friendly interfaces and are left unat-
0
0 20 40 60 80 100
0 tended after installation. As a consequence, users
Fraction of patched APs (%) have trouble knowing whether a device is hacked,
and even if they do, they may find it challenging to
Figure 5. Optimal patch time and the corresponding number of compromised manually patch the device: they need to retrieve
users given patched APs. linf = 0.00004 and ldir = 0.00001. The results are updated firmware online, access the hacked
averaged over 500 trials. device, install the firmware, and so on. Thus, auto-
matic patching is needed to secure IoT at scale.
One promising direction is for IoT devices to
support firmware OTA (FOTA), as most PCs and
0.15 mobile phones do nowadays. However, an effi-
cient and secure FOTA for IoT remains an open
challenge due to the heterogeneity of IoT net-
0.1 works. For example, transport security and code
Fraction of compromized users (%)

signing are required to ensure the authenticity

0.2
of the updated firmware. The IoT gateway might
0.05
help reduce the overhead by caching and offload-
0 100 ing the security check. Moreover, the human fac-
90 tors need to be taken into consideration as well.
80 0
70 As in the PC and mobile phone worlds, forcing
–0.2 60 ( )
%
software update without explicit user consent can
50 APs
t c hed
0
Pat 20 40 40 of p
a
−0.05 be disastrous. It can even be life-threatening if the
ch 60 30 tion
tim 80 20 Frac update happens at the wrong time (e.g., updating
e ( 100
s) 10 a vehicle while driving).

Concluding Remarks
Figure 6. Performance comparison between random patching and traffic-aware This article considers the security threats incurred
patching in terms of the difference between the fraction of compromised by the heterogeneous links of IoT and designs
users under random patching to that of traffic-aware patching. linf = a novel patching scheme to alleviate malware
0.00004 and ldir = 0.00001. The results are averaged over 500 trials. propagation. Instead of the impractical solution
of directly patching compromised IoT devices,
to enable transfer learning for defending real-life we propose to patch important intermediate
unknown security threats are ongoing challenges. nodes based on the traffic volumes to prevent
Predictive Malware Propagation Models for major security exploits and to avoid catastroph-
Mobile IoT: In this article, we have addressed ic malware propagation. With the proposed
patching issues in mobile IoT as link recovery traffic-aware patching scheme, malware propaga-
instead of node recovery, where the latter has tion is restricted to direct device-to-device con-
been extensively studied in traditional wireless nection, and therefore the damage of malware
networking scenarios. How to establish effective propagation can be significantly reduced. We
mathematical models for predicting malware conduct experiments in an IoT environment to
propagation dynamics in mobile IoT that take into demonstrate the effectiveness of the proposed
account the traffic-aware and random patching traffic-aware patching scheme, and we also dis-
schemes are new research challenges. cuss some ongoing research challenges and open
Various Importance Metrics for Intermedi- research questions related to IoT patching.
ate Nodes: The proposed scheme simply applies The proposed traffic-aware patching scheme
traffic volume as the metric to determine the and the experimental results bring new insights to
importance of intermediate nodes and the patch- IoT security. For instance, the infeasibility of direct
ing sequence. It can be regarded as protecting patching on IoT devices calls for new IoT malware
the entire network by patching a relatively small models and security assessment approaches. The
fraction of intermediate nodes with the highest experimental results can assist in developing new
degree metric. The operator could consider more attack detection techniques and patching strate-
information about intermediate nodes, such as gies for preventing malware propagation.

34 IEEE Communications Magazine • July 2017

 Obviously, the resource-constrained, user-un- [9] A. Cui and S. J. Stolfo, “A Quantitative Analysis of the Insecu-
rity of Embedded Network Devices: Results of a Wide-Area The resource-con-
friendly, and heterogeneous features of IoT devic- Scan,” Proc. ACSAC 2010, Dec. 2010, pp. 97–106.
es hinder the security design and development for [10] S. Peng, S. Yu, and A. Yang, “Smartphone Malware and Its strained, user-unfriend-
IoT. However, the experimental results indicate a Propagation Modeling: A Survey,” IEEE Commun. Surveys & ly, and heterogeneous
promising method to secure the entire IoT system Tutorials, vol. 16, no. 2, Apr. 2014, pp. 952–41.
[11] S. Tanachaiwiwat and A. Helmy, “Encounter-Based Worms: features of IoT devices
by patching intermediate nodes. In summary, we Analysis and Defense,” Ad Hoc Net., vol. 7, no. 7, Sept.
provide the following two guidelines for how to 2009, pp. 1414–30. hinder the security
consider cyber security when designing IoT sys- [12] P. Wang et al., “Understanding the Spreading Patterns of
design and develop-
tems accordingly Mobile Phone Viruses,” Science, vol. 324, no. 5930, May
2009, pp. 1071–75. ment for IoT. However,
•The consideration of intermediate nodes that [13] S.-M. Cheng et al., “On Modeling Malware Propagation in
bridge the gap between resource-constrained IoT Generalized Social Networks,” IEEE Commun. Lett., vol. 15, the experimental results
devices and powerful IoT application servers is no. 1, Jan. 2011, pp. 25–27.
necessary when designing cyber security for IoT. [14] P.-Y. Chen, S.-M. Cheng, and K.-C. Chen, “Optimal Con- indicate a promising
trol of Epidemic Information Dissemination over Net-
By shifting computation-consuming, security relat- works,” IEEE Trans. Cybernetics, vol. 44, no. 12, Dec. 2014, method to secure the
ed functionalities (e.g., flow identification, filter- pp. 2316–28. entire IoT system by
ing, and isolation) to intermediate nodes, they [15] W. Dong, B. Lepri, and A. Pentland, “Modeling the Co-Evo-
can play the role of onsite guards. In particular, lution of Behaviors And Social Relationships Using Mobile patching intermediate
Phone Data,” Proc. MUM 2011, Dec. 2011, pp. 134–43.
the flexibility and reconfigurability of intermedi- nodes.
ate nodes could easily introduce patches and Biographies
updates to mitigate the IoT malware propagation S hin -M ing C heng [S’05, M’07] received his B.S. and Ph.D.
or attacks in a timely manner. degrees in computer science and information engineering from
•The future cyber security solution for IoT National Taiwan University, Taipei, in 2000 and 2007, respec-
should take into consideration that adversaries tively. He was a postdoctoral research fellow at the Graduate
Institute of Communication Engineering, National Taiwan Uni-
might leverage IoT devices with unpatched vul- versity, from 2007 to 2012. Since 2012, he has been with the
nerabilities to propagate malware via device-to-de- Department of Computer Science and Information Engineering,
vice links. In other words, the security mechanisms National Taiwan University of Science and Technology, Taipei,
developed for IoT shall coexist with insecure, as an assistant professor. His current research interests include
mobile networks, wireless communication, cyber security, and
unpatched legacy IoT devices with uncontrolled complex networks. He was a recipient of the IEEE PIMRC 2013
device-to-device channels. A notification mech- Best Paper Award and the 2014 ACM Taipei/Taiwan Chapter K.
anism is suggested to help users identify the IoT T. Li Young Researcher Award.
devices at risk and further deny possible device-
Pin-Yu Chen [S’10, M’16] received his B.S. degree in electri-
to-device connections. cal engineering and computer science (undergraduate honors
program) from National Chiao Tung University, Taiwan, in
Acknowledgment 2009, his M.S. degree in communication engineering from
This work was supported in part by the Taiwan National Taiwan University in 2011, and his Ph.D. degree in
electrical engineering and computer science and M.A. degree
Information Security Center (TWISC), Academia in statistics from the University of Michigan Ann Arbor in
Sinica, and the Ministry of Science and Technolo- 2016. He is currently a research scientist of AI Foundations
gy, Taiwan, under grants MOST 104-2923-E-011- Group at IBM Thomas J. Watson Research Center. His
006-MY2, 105-2221-E-002-146-MY2, and research interest is graph data analytics and their applications
to data mining, machine learning, and cyber security. He is a
105-2218-E-001-001. member of the Tau Beta Pi Honor Society and the Phi Kappa
Phi Honor Society, and was the recipient of the Chia-Lun Lo
References Fellowship from the University of Michigan Ann Arbor. He
[1] J. Granjal, E. Monteiro, and J. Silva, “Security for the Inter- was also the recipient of the IEEE GLOBECOM 2010 GOLD
net of Things: A Survey of Existing Protocols and Open Best Paper Award and several travel grants, including IEEE
Research Issues,” IEEE Commun. Surveys & Tutorials, vol. 17, ICASSP 2014 (NSF), IEEE ICASSP 2015 (SPS), IEEE Security
July 2015, pp. 1294–1312. and Privacy Symposium 2016, Graph Signal Processing Work-
[2] Y. Minn et al., “IoTPOT: Analysing the Rise of IoT Compro- shop 2016, and ACM KDD 2016.
mises,” Proc. USENIX Wksp. 2015, Aug. 2015.
[3] P.-Y. Chen et al., “Decapitation via Digital Epidemics: A Ching-Chao Lin received his B.S. degree in computer science
Bio-Inspired Transmissive Attack,” IEEE Commun. Mag., vol. and information engineering from National Taiwan University
54, no. 6, June 2016, pp. 75–81. of Science and Technology in 2015. He is currently working
[4] G. Zyba et al., “Defending Mobile Phones from Proximi- toward an M.S. degree in computer science and information
ty Malware,” Proc. IEEE INFOCOM 2009, Apr. 2009, pp. engineering at the National Taiwan University of Science and
1503–11. Technology. His research interests include cyber security and
[5] E. Ronen and A. Shamir, “Extended Functionality Attacks wireless networks.
on IoT Devices: The Case Of Smart Lights,” Proc. IEEE S&P
Europe 2016, Mar. 2016. Hsu-Chun Hsiao is an assistant professor in the Department
[6] M. Miettinen et al., “IoT Sentinel: Automated Device-Type of Computer Science and Information Engineering, and the
Identification for Security Enforcement in IoT,” CoRR, vol. Graduate Institute of Networking and Multimedia at National
abs/1611.04880v2, 2016. Taiwan University. She also holds an adjunct assistant research-
[7] P.-Y. Chen and S.-M. Cheng, “Sequential Defense against er position in the Center of Information Technology and Inno-
Random and Intentional Attacks in Complex Networks,” vation at Academia Sinica. She completed her B.S. (2006)
Phys. Rev. E, vol. 91, Feb. 2015, p. 022805. and M.S. (2008) at National Taiwan University, and her Ph.D.
[8] P.-Y. Chen and A. O. Hero, “Assessing and Safeguarding at Carnegie Mellon University (2014). Her research interests
Network Resilience to Nodal Attacks,” IEEE Commun. Mag., include network security, anonymity and privacy, and applied
vol. 52, no. 11, Nov. 2014, pp. 138–43. cryptography.

IEEE Communications Magazine • July 2017 35