Automatic Actionable Information Processing and Trust Management towards Safer Internet of Things

Area of Science:

• Cybersecurity
• Information Science
• Computer Engineering

Background:

• Internet of Things (IoT) security is critical across various sectors, including healthcare, industry, and urban infrastructure.
• Current research and development in IoT security are insufficient, leaving users vulnerable to threats.
• A centralized repository for IoT vulnerabilities and exploits is needed but currently lacking.

Purpose of the Study:

• To develop and publicly release a database of information on Internet of Things (IoT) vulnerabilities and exploits, named VARIoT (Vulnerability and Attack Repository for IoT).
• To investigate methods for obtaining, standardizing, aggregating, and correlating vulnerability data.
• To enhance and select relevant IoT data for the repository.

Main Methods:

• Information acquisition from diverse existing vulnerability databases.
• Data standardization, aggregation, and correlation techniques.
• Implementation of trust management and AI-based meta-information extraction for data enhancement.

Main Results:

• Existing vulnerability databases offer varied information scopes, with no single comprehensive source available.
• Significant discrepancies exist in the timeliness of vulnerability information across different sources.
• Aggregating data from multiple sources demonstrably enhances the actionable value of vulnerability information.

Conclusions:

• A unified, aggregated database is essential for a comprehensive view of IoT vulnerabilities.
• Advanced methods like trust management and AI-driven meta-information extraction can improve data completeness, usefulness, and reliability.
• The VARIoT project's approach provides a beneficial framework for enhancing IoT security through improved vulnerability data management.