{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T22:41:58Z","timestamp":1782945718404,"version":"3.54.5"},"reference-count":64,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/access.2021.3138768","type":"journal-article","created":{"date-parts":[[2021,12,27]],"date-time":"2021-12-27T21:01:18Z","timestamp":1640638878000},"page":"1775-1789","source":"Crossref","is-referenced-by-count":19,"title":["Riding the IoT Wave With VFuzz: Discovering Security Flaws in Smart Homes"],"prefix":"10.1109","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6424-9054","authenticated-orcid":false,"given":"Carlos Kayembe","family":"Nkuba","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9990-7953","authenticated-orcid":false,"given":"Seulbae","family":"Kim","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sven","family":"Dietrich","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5831-0787","authenticated-orcid":false,"given":"Heejo","family":"Lee","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Worldwide Internet of Things Forecast, 2020\u20132024","year":"2021"},{"key":"ref2","volume-title":"Sigma Designs Ships 100 Millionth Z-Wave Chipset Module","year":"2021"},{"key":"ref3","volume-title":"Smart Home Control on One App","year":"2021"},{"key":"ref4","volume-title":"The Smart Home is Powered by Z-Wave","year":"2021"},{"key":"ref5","first-page":"1","article-title":"Security evaluation of the Z-wave wireless protocol","volume":"24","author":"Fouladi","year":"2013","journal-title":"BlackHat USA"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26567-4_13"},{"key":"ref7","first-page":"163","article-title":"Z-wave network reconnaissance and transceiver fingerprinting using software-defined radios","volume-title":"Proc. Int. Conf. Cyber Warfare Secur.","author":"Hall"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/LCNW.2015.7365922"},{"key":"ref9","first-page":"1","article-title":"A universal controller to take over a Z-wave network","volume-title":"Proc. Black Hat Eur.","author":"Rouch"},{"key":"ref10","first-page":"6","article-title":"Carols of the Z-wave security layer; or, robbing keys from Peter to unlock Paul","volume":"12","author":"Badenhop","year":"2016","journal-title":"PoC or GTFO"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.04.004"},{"key":"ref12","volume-title":"Breaking bulbs briskly by bogus broadcasts","author":"Hall","year":"2016"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.10.003"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.pmcj.2020.101211"},{"key":"ref15","article-title":"Crushing the wave - new Z-wave vulnerabilities exposed","author":"Boucif","year":"2020","journal-title":"arXiv:2001.08497"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2016.02.002"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3285030"},{"key":"ref18","volume-title":"Z-Wave Products","year":"2021"},{"key":"ref19","volume-title":"CVE-2018-19982","year":"2021"},{"key":"ref20","volume-title":"CVE-2018-19983","year":"2021"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.religion.2008.12.001"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2017.8170867"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/NAPS.2017.8107363"},{"issue":"11","key":"ref24","first-page":"58","article-title":"A survey: DDOS attack on Internet of Things","volume":"10","author":"Sonar","year":"2014","journal-title":"Int. J. Eng. Res. Develop."},{"key":"ref25","volume-title":"Internet Denial of Service: Attack and Defense Mechanisms (Radia Perlman Computer Networking and Security)","author":"Mirkovic","year":"2004"},{"key":"ref26","author":"Zalewski","year":"2021","journal-title":"American Fuzzy Lop"},{"key":"ref27","volume-title":"The CERT Division","year":"2021"},{"key":"ref28","author":"Nkuba","year":"2021","journal-title":"Proof-of-Concept Attack Scenarios"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23166"},{"key":"ref31","author":"Wright","year":"2021","journal-title":"River Loop Security: Killerbee"},{"key":"ref32","article-title":"Development of a fuzzing tool for the 6LoWPAN protocol","author":"Bernardini","year":"2011"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"ref34","volume-title":"beSTORM Black Box Testing","year":"2021"},{"key":"ref35","volume-title":"Fuzzing Test Suites","year":"2021"},{"key":"ref36","article-title":"Constrained application protocol (CoAP), draft-ietf-core-COAP-13","author":"Shelby","year":"2012"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/COMSWA.2008.4554519"},{"key":"ref38","first-page":"1099","article-title":"FIRM-AFL: High-throughput greybox fuzzing of IoT firmware via augmented process emulation","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Zheng"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"ref41","first-page":"1","article-title":"Bringing software defined radio to the penetration testing community","volume-title":"Proc. Black Hat USA Conf.","author":"Picod"},{"key":"ref42","author":"Hall","journal-title":"EZ-Wave"},{"key":"ref43","article-title":"A practical wireless exploitation framework for Z-wave networks","author":"Hall","year":"2016"},{"key":"ref44","volume-title":"Z-Wave Global Regions","year":"2021"},{"key":"ref45","volume-title":"Z-Wave Device Class Specification","year":"2021"},{"key":"ref46","author":"Klein","year":"2021","journal-title":"What is Z-Wave Long Range and How Does it Differ from Z-Wave?"},{"key":"ref47","volume-title":"Short Range Narrow-Band Digital Radiocommunication Transceivers-PHY and MAC Layer Specifications","year":"2021"},{"key":"ref48","volume-title":"Z-Wave Essentials","author":"Paetz","year":"2018"},{"key":"ref49","volume-title":"Z-Wave Specification","year":"2021"},{"key":"ref50","volume-title":"Z-Wave Transport-Encapsulation Command Class Specification","year":"2021"},{"key":"ref51","first-page":"1","article-title":"Announcing the advanced encryption standard (AES)","volume":"197","year":"2001","journal-title":"Federal Inf. Process. Standards Publication"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5084"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/11745853_14"},{"key":"ref54","volume-title":"Z-Shave.Exploiting Z-Wave Downgrade Attacks","year":"2021"},{"key":"ref55","first-page":"1","article-title":"Hawatcher: Semantics-aware anomaly detection for appified smart Homes","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Fu"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00051"},{"key":"ref57","volume-title":"Z-Wave Alliance Announces New Security Requirements for All Z-Wave Certified IoT Devices","year":"2021"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev.2016.043"},{"key":"ref59","author":"Ossmann","year":"2021","journal-title":"HackRF One"},{"key":"ref60","volume-title":"YARD Stick One-a Sub-1 GHz Wireless Test Tool Controlled by Your Computer","year":"2021"},{"key":"ref61","author":"Ryherd","year":"2021","journal-title":"What is the Difference Between Z-Wave and Z-Wave Plus?"},{"key":"ref62","author":"Helin","year":"2021","journal-title":"Radamsa: A General Purpose Fuzzer"},{"key":"ref63","volume-title":"Fuzzing","year":"2021"},{"key":"ref64","volume-title":"CWE Vulnerability Enumeration: A Community-Developed List of Common Software Security Weaknesses","year":"2021"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9668973\/09663293.pdf?arnumber=9663293","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T00:30:05Z","timestamp":1704846605000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9663293\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":64,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3138768","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}