{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T14:15:53Z","timestamp":1779200153731,"version":"3.51.4"},"reference-count":39,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2019,9,25]],"date-time":"2019-09-25T00:00:00Z","timestamp":1569369600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The development and deployment of highly dynamic, cyber+connected operational environments, such as smart homes, smart cities, and smart transportation systems, is increasing. The security analysis of such dynamic environments necessitates the use of dynamic risk assessment methodologies and the modeling of dynamically changing states. In this paper, we focus on the smart home environment, where the deployment of IoT devices increase the attack surface. We examine existing dynamic risk assessment methodologies, and by leveraging a smart home reference architecture we identify the security risks of a smart home\u2019s physical and communication viewpoints, taking into consideration also dynamic operational aspects. Further, we develop a smart home network topology generator and a graph-based attack model to study dependencies among dynamically changing states and the propagation of a malware infection.<\/jats:p>","DOI":"10.3390\/fi11100207","type":"journal-article","created":{"date-parts":[[2019,9,26]],"date-time":"2019-09-26T03:06:51Z","timestamp":1569467211000},"page":"207","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["Threat Analysis for Smart Homes"],"prefix":"10.3390","volume":"11","author":[{"given":"Georgios","family":"Kavallieratos","sequence":"first","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nabin","family":"Chowdhury","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sokratis","family":"Katsikas","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"},{"name":"Open University of Cyprus, 33 Giannou Kranidioti, Latsia 2220, Cyprus"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vasileios","family":"Gkioulos","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Stephen","family":"Wolthusen","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"},{"name":"Information Security Group, Royal Holloway University of London, Egham TW20 0EX, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2019,9,25]]},"reference":[{"key":"ref_1","unstructured":"Stuckenschmidt, H. (2003, January 9\u201311). Ontology-based information in dynamic environments. Proceedings of the 2003 Twelfth IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WET ICE 2003), Linz, Austria."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"759","DOI":"10.1016\/j.egypro.2017.03.238","article-title":"Insights on smart home concept and occupants\u2019 interaction with building controls","volume":"111","author":"Fabi","year":"2017","journal-title":"Energy Procedia"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Suryadevara, N.K., and Mukhopadhyay, S.C. (2015). Smart Homes: Design, Implementation and Issues, Springer.","DOI":"10.1007\/978-3-319-13557-1"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Ali, B., and Awad, A.I. (2018). Cyber and Physical Security Vulnerability Assessment for IoT-Based Smart Homes. Sensors, 18.","DOI":"10.3390\/s18030817"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1145\/2398356.2398377","article-title":"Computer security and the modern home","volume":"56","author":"Denning","year":"2013","journal-title":"Commun. ACM"},{"key":"ref_6","unstructured":"L\u00e9vy-Bencheton, C., Darra, E., T\u00e9tu, G., Dufay, G., and Alattar, M. (2015). Security and Resilience of Smart Home Environments Good Practices and Recommendations, Technical Report."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1291","DOI":"10.1109\/TNN.2005.853425","article-title":"Spatial-temporal modeling of malware propagation in networks","volume":"16","author":"Chen","year":"2005","journal-title":"IEEE Trans. Neural Netw."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Kavallieratos, G., Gkioulos, V., and Katsikas, S.K. (2019, January 29\u201331). Threat Analysis in Dynamic Environments: The Case of the Smart Home. Proceedings of the 2019 15th International Conference on Distributed Computing in Sensor Systems (DCOSS), Santorini, Greece.","DOI":"10.1109\/DCOSS.2019.00060"},{"key":"ref_9","unstructured":"Merrick, J.R., van Dorp, J.R., Mazzuchi, T.A., and Harrald, J.R. (2001, January 9\u201312). Modeling risk in the dynamic environment of maritime transportation. Proceedings of the 33rd Conference on Winter Simulation, Arlington, VA, USA."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/TDSC.2011.34","article-title":"Dynamic security risk management using bayesian attack graphs","volume":"9","author":"Poolsappasit","year":"2012","journal-title":"IEEE Trans. Depend. Secure Comput."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Puppala, G., and Pasupuleti, S.K. (2018). Dynamic Security Risk Assessment in Cloud Computing Using IAG. Progress in Computing, Analytics and Networking, Springer.","DOI":"10.1007\/978-981-10-7871-2_11"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Liu, C., Zhang, Y., Zeng, J., Peng, L., and Chen, R. (2012, January 29\u201331). Research on Dynamical Security Risk Assessment for the Internet of Things inspired by immunology. Proceedings of the 8th International Conference on Natural Computation (ICNC), Chongqing, China.","DOI":"10.1109\/ICNC.2012.6234533"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Naumov, S., and Kabanov, I. (2016, January 2\u20134). Dynamic framework for assessing cyber security risks in a changing environment. Proceedings of the 2016 International Conference on Information Science and Communications Technologies (ICISCT), Tashkent, Uzbekistan.","DOI":"10.1109\/ICISCT.2016.7777406"},{"key":"ref_14","unstructured":"(2012). HMG IA Standard Numbers 1 & 2-Supplement, Standard No. 1 & 2 Supplement Technical Risk Assessment and Risk Treatment, Technical Report."},{"key":"ref_15","unstructured":"\u00c1lvarez, A., Gonz\u00e1lez, S., D\u00edaz, R., Arce, C.H., Machnicki, D., Cernivec, A., Zitnik, A., Refsdal, A., Biasibetti, A.L., and Poidomani, S. (2015). D5.2-WISER REAL-Time Assessment Infrastructure, CYBERWISER.eu. Technical Report, WISER Project."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Collen, A., Nijdam, N., Augusto-Gonzalez, J., Katsikas, S., Giannoutakis, K., Spathoulas, G., Gelenbe, E., Votis, K., Tzovaras, D., and Ghavami, N. (2018). GHOST: Safe-guarding home IoT environments with personalised real-time risk control. International ISCIS Security Workshop, Springer.","DOI":"10.1007\/978-3-319-95189-8_7"},{"key":"ref_17","unstructured":"Pandey, P., Collen, A., Nijdam, N., Anagnostopoulos, M., Katsikas, S., and Konstantas, D. (2019, January 4\u20135). Towards automated threat based risk assessment for cyber security in smart homes. Proceedings of the 18th European Conference on Cyber Warfare and Security (ECCWS 2019), Coimbra, Portugal."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Schiefer, M. (2015, January 18\u201320). Smart home definition and security threats. Proceedings of the 2015 9th International Conference on IT Security Incident Management & IT Forensics, Magdeburg, Germany.","DOI":"10.1109\/IMF.2015.17"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"719","DOI":"10.1016\/j.future.2015.09.003","article-title":"A risk analysis of a smart home automation system","volume":"56","author":"Jacobsson","year":"2016","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Tong, J., Sun, W., and Wang, L. (2013, January 26\u201329). An information flow security model for home area network of smart grid. Proceedings of the IEEE 3rd Annual International Conference on Cyber Technology in Automation, Control and Intelligent Systems (CYBER), Nanjing, China.","DOI":"10.1109\/CYBER.2013.6705489"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Beckers, K., Fa\u00dfbender, S., Heisel, M., and Suppan, S. (2014). A threat analysis methodology for smart home scenarios. International Workshop on Smart Grid Security, Springer.","DOI":"10.1007\/978-3-319-10329-7_7"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1109\/COMST.2008.4564479","article-title":"Network topologies: Inference, modeling, and generation","volume":"10","author":"Haddadi","year":"2008","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1145\/964725.633040","article-title":"Network Topology Generators: Degree-based vs. Structural","volume":"32","author":"Tangmunarunkit","year":"2002","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Al-Mohannadi, H., Mirza, Q., Namanya, A., Awan, I., Cullen, A., and Disso, J. (2016, January 22\u201324). Cyber-Attack Modeling Analysis Techniques: An Overview. Proceedings of the 2016 IEEE 4th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW), Vienna, Austria.","DOI":"10.1109\/W-FiCloud.2016.29"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Wang, P.F., Meng, S., Zhang, H., and Wang, J.C. (2010, January 30\u201331). Markov Model of Malicious Code Propagation. Proceedings of the 2010 International Conference on Innovative Computing and Communication and 2010 Asia-Pacific Conference on Information Technology and Ocean Engineering, Macao, China.","DOI":"10.1109\/CICC-ITOE.2010.72"},{"key":"ref_26","first-page":"10","article-title":"The Industrial Internet of Things, Volume G1: Reference Architecture","volume":"G1","author":"Lin","year":"2017","journal-title":"Ind. Internet Consort."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1109\/MS.2016.20","article-title":"Reference architectures for the internet of things","volume":"33","author":"Weyrich","year":"2016","journal-title":"IEEE Softw."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Chauhan, M.A., and Babar, M.A. (2017). Using Reference Architectures for Design and Evaluation of Web of Things Systems: A Case of Smart Homes Domain. Manag. Web Things, 205\u2013228.","DOI":"10.1016\/B978-0-12-809764-9.00009-3"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Hu, C., Chen, S., Guo, L., Chootong, C., and Hui, L. (2017, January 1\u20134). Home care with IoT support: Architecture design and functionality. Proceedings of the 10th International Conference on Ubi-Media Computing and Workshops (Ubi-Media), Pattaya, Thailand.","DOI":"10.1109\/UMEDIA.2017.8074155"},{"key":"ref_30","unstructured":"(2018). Internet of Things (IoT)\u2014Reference Architecture, International Organization for Standardization. Standard."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Ghirardello, K., Maple, C., Ng, D., and Kearney, P. (2018). Cyber Security of Smart Homes: Development of a Reference Architecture for Attack Surface Analysis, IET.","DOI":"10.1049\/cp.2018.0045"},{"key":"ref_32","unstructured":"Vidalis, S. (2004). A Critical Discussion of Risk and Threat Analysis Methods and Methodologies, School of Computing, University of Glamorgan. Technical Report CS-04-03."},{"key":"ref_33","unstructured":"(2018). Information Technology\u2014Security Techniques\u2014Information Security Risk Management, International Organization for Standardization. Standard."},{"key":"ref_34","first-page":"1607","article-title":"Threat Modelling Methodologies: A Survey","volume":"26","author":"Hussain","year":"2014","journal-title":"Sci. Int."},{"key":"ref_35","unstructured":"Shostack, A. (2014). Threat Modeling: Designing for Security, Wiley."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Kavallieratos, G., Katsikas, S., and Gkioulos, V. (2019). Cyber-Attacks Against the Autonomous Ship. Computer Security. SECPRE 2018, CyberICPS 2018, Springer.","DOI":"10.1007\/978-3-030-12786-2_2"},{"key":"ref_37","unstructured":"Vulnerabilities, C. (2018, November 20). Exposures (CVE). Available online: cve.mitre.org."},{"key":"ref_38","unstructured":"(2018, November 24). National Vulnerability Database, Available online: https:\/\/nvd.nist.gov\/."},{"key":"ref_39","unstructured":"(2018, November 24). OMNeT++, version 5.4.1. Available online: https:\/\/omnetpp.org\/."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/11\/10\/207\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:24:17Z","timestamp":1760189057000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/11\/10\/207"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,9,25]]},"references-count":39,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2019,10]]}},"alternative-id":["fi11100207"],"URL":"https:\/\/doi.org\/10.3390\/fi11100207","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,9,25]]}}}