通过数据水晶球了解IoT安全性：我们现在的位置和未来的发展方向
Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be
摘要：
受消费者物联网市场繁荣的启发，许多设备制造商、初创公司和技术巨头都已进入这一领域。不幸的是，物联网令人兴奋的实用性和快速的市场化是以牺牲隐私和安全为代价的。行业报告和学术工作揭示了许多对物联网系统的攻击，导致隐私泄露，财产损失和大规模可用性问题。为了减轻这种威胁，已经提出了一些解决方案。然而，目前尚不清楚它们对物联网生态系统的影响。在这项工作中，我们的目标是对物联网领域报告的攻击和防御进行全面研究，以找出我们所知道的，目前的研究不足之处以及如何向前迈进。为此，我们首先构建了一个工具包，该工具包使用语义分析搜索大量在线数据，以识别3000多篇与物联网相关的文章。此外，通过使用机器学习技术对这些收集到的数据进行聚类，我们能够将学术观点与行业和其他来源的研究结果进行比较，试图了解它们之间的差距，物联网安全风险的趋势以及需要进一步关注的新问题。我们通过提出物联网生态系统的分类并将物联网安全组织成五个问题领域来系统化这一过程。我们使用这种分类法作为信标，来评估我们定义的许多属性中的每个物联网工作。我们的评估显示，相关的安全和隐私问题远未解决。我们将讨论如何将每个建议的解决方案应用于一个问题领域，并强调其优势，假设和限制。我们强调物联网供应商需要一个安全框架，并讨论了将安全责任转移到外部或集中式实体的趋势。我们还确定了开放的研究问题，并为安全的物联网生态系统提供了建议。
英文摘要：
Inspired by the boom of the consumer IoT market, many device manufacturers, start-up companies and technology giants have jumped into the space. Unfortunately, the exciting utility and rapid marketization of IoT, come at the expense of privacy and security. Industry reports and academic work have revealed many attacks on IoT systems, resulting in privacy leakage, property loss and large-scale availability problems. To mitigate such threats, a few solutions have been proposed. However, it is still less clear what are the impacts they can have on the IoT ecosystem. In this work, we aim to perform a comprehensive study on reported attacks and defenses in the realm of IoT aiming to find out what we know, where the current studies fall short and how to move forward. To this end, we first build a toolkit that searches through massive amount of online data using semantic analysis to identify over 3000 IoT-related articles. Further, by clustering such collected data using machine learning technologies, we are able to compare academic views with the findings from industry and other sources, in an attempt to understand the gaps between them, the trend of the IoT security risks and new problems that need further attention. We systemize this process, by proposing a taxonomy for the IoT ecosystem and organizing IoT security into five problem areas. We use this taxonomy as a beacon to assess each IoT work across a number of properties we define. Our assessment reveals that relevant security and privacy problems are far from solved. We discuss how each proposed solution can be applied to a problem area and highlight their strengths, assumptions and constraints. We stress the need for a security framework for IoT vendors and discuss the trend of shifting security liability to external or centralized entities. We also identify open research problems and provide suggestions towards a secure IoT ecosystem.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
