Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices

Pascal Oser; Felix Theodor Engelmann; Stefan  Lüders; Frank Kargl

Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices

Pascal Oser
, Felix Theodor Engelmann
, Stefan Lüders
, Frank Kargl

Center for Information Security and Trust

Ulm University
European Organization for Nuclear Research

Research output: Conference Article in Proceeding or Book/Report chapter › Article in proceedings › Research › peer-review

Abstract

IoT devices are present in many, especially corporate and sensitive, networks and regularly introduce
security risks due to slow vendor responses to vulnerabilities and high difficulty of patching. In this paper, we
want to evaluate to what extent the development of future risk of IoT devices due to new and unpatched
vulnerabilities can be predicted based on historic information. For this analysis, we build on existing prediction
algorithms available in the SAFER framework (prophet and ARIMA) which we evaluate by means of a large
data-set of vulnerabilities and patches from 793 IoT devices. Our analysis shows that the SAFER framework
can predict a correct future risk for 91 % of the devices, demonstrating its applicability. We conclude that this
approach is a reliable means for network operators to efficiently detect and act on risks emanating from IoT
devices in their networks.

Original language	English
Title of host publication	Security and Trust Management : 18th International Workshop, STM 2022
Publication date	28 Sept 2022
Publication status	Published - 28 Sept 2022
Event	International Workshop on Security and Trust Management - Copenhagen, Denmark Duration: 29 Sept 2022 → 29 Sept 2022 Conference number: 18 https://link.springer.com/book/10.1007/978-3-031-29504-1

Workshop

Workshop	International Workshop on Security and Trust Management
Number	18
Country/Territory	Denmark
City	Copenhagen
Period	29/09/2022 → 29/09/2022
Internet address	https://link.springer.com/book/10.1007/978-3-031-29504-1

Keywords

IoT Security
Vulnerability Prediction
SAFER Framework
Risk Assessment
Patch Management

Access to Document

https://arxiv.org/pdf/2209.03826.pdf

Cite this

@inproceedings{01595414ff654b7d9b3fab12a6da00b4,

title = "Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices",

abstract = "IoT devices are present in many, especially corporate and sensitive, networks and regularly introduce security risks due to slow vendor responses to vulnerabilities and high difficulty of patching. In this paper, we want to evaluate to what extent the development of future risk of IoT devices due to new and unpatched vulnerabilities can be predicted based on historic information. For this analysis, we build on existing prediction algorithms available in the SAFER framework (prophet and ARIMA) which we evaluate by means of a large data-set of vulnerabilities and patches from 793 IoT devices. Our analysis shows that the SAFER framework can predict a correct future risk for 91 \% of the devices, demonstrating its applicability. We conclude that this approach is a reliable means for network operators to efficiently detect and act on risks emanating from IoT devices in their networks.",

keywords = "IoT Security, Vulnerability Prediction, SAFER Framework, Risk Assessment, Patch Management, IoT Security, Vulnerability Prediction, SAFER Framework, Risk Assessment, Patch Management",

author = "Pascal Oser and Engelmann, \{Felix Theodor\} and Stefan L{\"u}ders and Frank Kargl",

year = "2022",

month = sep,

day = "28",

language = "English",

booktitle = "Security and Trust Management",

note = "International Workshop on Security and Trust Management, STM ; Conference date: 29-09-2022 Through 29-09-2022",

url = "https://link.springer.com/book/10.1007/978-3-031-29504-1",

}

TY - GEN

T1 - Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices

AU - Oser, Pascal

AU - Engelmann, Felix Theodor

AU - Lüders, Stefan

AU - Kargl, Frank

N1 - Conference code: 18

PY - 2022/9/28

Y1 - 2022/9/28

N2 - IoT devices are present in many, especially corporate and sensitive, networks and regularly introduce security risks due to slow vendor responses to vulnerabilities and high difficulty of patching. In this paper, we want to evaluate to what extent the development of future risk of IoT devices due to new and unpatched vulnerabilities can be predicted based on historic information. For this analysis, we build on existing prediction algorithms available in the SAFER framework (prophet and ARIMA) which we evaluate by means of a large data-set of vulnerabilities and patches from 793 IoT devices. Our analysis shows that the SAFER framework can predict a correct future risk for 91 % of the devices, demonstrating its applicability. We conclude that this approach is a reliable means for network operators to efficiently detect and act on risks emanating from IoT devices in their networks.

AB - IoT devices are present in many, especially corporate and sensitive, networks and regularly introduce security risks due to slow vendor responses to vulnerabilities and high difficulty of patching. In this paper, we want to evaluate to what extent the development of future risk of IoT devices due to new and unpatched vulnerabilities can be predicted based on historic information. For this analysis, we build on existing prediction algorithms available in the SAFER framework (prophet and ARIMA) which we evaluate by means of a large data-set of vulnerabilities and patches from 793 IoT devices. Our analysis shows that the SAFER framework can predict a correct future risk for 91 % of the devices, demonstrating its applicability. We conclude that this approach is a reliable means for network operators to efficiently detect and act on risks emanating from IoT devices in their networks.

KW - IoT Security

KW - Vulnerability Prediction

KW - SAFER Framework

KW - Risk Assessment

KW - Patch Management

KW - IoT Security

KW - Vulnerability Prediction

KW - SAFER Framework

KW - Risk Assessment

KW - Patch Management

M3 - Article in proceedings

BT - Security and Trust Management

T2 - International Workshop on Security and Trust Management

Y2 - 29 September 2022 through 29 September 2022

ER -

Evaluating the Future Device Security Risk Indicator for Hundreds of IoT Devices

Abstract

Workshop

Keywords

Access to Document

Fingerprint

Cite this