{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T06:47:13Z","timestamp":1764226033002,"version":"build-2065373602"},"reference-count":97,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2025,2,10]],"date-time":"2025-02-10T00:00:00Z","timestamp":1739145600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Bavarian State Ministry of Science and Arts (BayStMWK)"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Every year, more and more electronic devices are used in households, which certainly leads to an increase in the total number of communications between devices. During communication, a huge amount of information is transmitted, which can be critical or even malicious. To avoid the transmission of unnecessary information, a filtering mechanism can be applied. Filtering is a long-standing method used by network engineers to segregate and thus block unwanted traffic from reaching certain devices. In this work, we show how to apply this to the Internet of Things (IoT) Smart Home domain as it introduces numerous networked devices into our daily lives. To analyse the positive influence of filtering on security and privacy, we offer the results from our in-depth STRIDE and LINDDUN analysis of several Smart Home scenarios before and after the application. To show that filtering can be applied to other IoT domains, we offer a brief glimpse into the domain of smart cars.<\/jats:p>","DOI":"10.3390\/fi17020077","type":"journal-article","created":{"date-parts":[[2025,2,12]],"date-time":"2025-02-12T11:08:51Z","timestamp":1739358531000},"page":"77","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Segmentation and Filtering Are Still the Gold Standard for Privacy in IoT\u2014An In-Depth STRIDE and LINDDUN Analysis of Smart Homes"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7256-0387","authenticated-orcid":false,"given":"Henrich C.","family":"P\u00f6hls","sequence":"first","affiliation":[{"name":"Chair of IT-Security, University of Passau, 94032 Passau, Germany"}]},{"given":"Fabian","family":"K\u00fcgler","sequence":"additional","affiliation":[{"name":"Chair of IT-Security, University of Passau, 94032 Passau, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9847-7656","authenticated-orcid":false,"given":"Emiliia","family":"Geloczi","sequence":"additional","affiliation":[{"name":"Chair of Computer Engineering, University of Passau, 94032 Passau, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9650-7698","authenticated-orcid":false,"given":"Felix","family":"Klement","sequence":"additional","affiliation":[{"name":"Chair of Computer Engineering, University of Passau, 94032 Passau, Germany"}]}],"member":"1968","published-online":{"date-parts":[[2025,2,10]]},"reference":[{"key":"ref_1","unstructured":"Plume (2024, November 30). Plume IQ 1H 2022 Smart Home Market Report. Available online: https:\/\/plumestrong.plume.com\/1h-report\/p\/1."},{"key":"ref_2","unstructured":"Joshi, S. (2023, June 15). 70 IoT Statistics to Unveil the Past, Present, and Future of IoT. Available online: https:\/\/learn.g2.com\/{IoT}-statistics."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Giusto, D., Iera, A., Morabito, G., and Atzori, L. (2010). An Overview of Privacy and Security Issues in the Internet of Things. The Internet of Things, Springer.","DOI":"10.1007\/978-1-4419-1674-7"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Raymond, J.F. (2001). Traffic analysis: Protocols, attacks, design issues, and open problems. Proceedings of the Designing Privacy Enhancing Technologies, Springer.","DOI":"10.1007\/3-540-44702-4_2"},{"key":"ref_5","unstructured":"Danezis, G., and Clayton, R. (2007). Introducing traffic analysis. Digital Privacy: Theory, Technologies, and Practices, Auerbach Publications."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1007\/s40860-019-00075-0","article-title":"What it takes to boost Internet of Things privacy beyond encryption with unobservable communication: A survey and lessons learned from the first implementation of DC-net","volume":"5","author":"Staudemeyer","year":"2019","journal-title":"J. Reliab. Intell. Environ."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Staudemeyer, R.C., P\u00f6hls, H.C., and W\u00f3jcik, M. (2018, January 12\u201315). The road to privacy in IoT: Beyond encryption and signatures, towards unobservable communication. Proceedings of the 7th workshop on IoT-SoS: Internet of Things Smart Objects and Services (WOWMOM SOS-IOT 2018), Chania, Greece.","DOI":"10.1109\/WoWMoM.2018.8449779"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"107770","DOI":"10.1016\/j.chb.2023.107770","article-title":"The digital harms of Smart Home Devices: A systematic literature review","volume":"145","author":"Kemp","year":"2023","journal-title":"Comput. Hum. Behav."},{"key":"ref_9","unstructured":"Hnatyuk, K. (2024, November 29). Internet of Things (IoT) Statistics: 2022\/2023. Available online: https:\/\/marketsplash.com\/Internet-of-things-statistics."},{"key":"ref_10","unstructured":"Souppaya, M., Montgomery, D., Polk, T., Ranganathan, M., Dodson, D., Barker, W., Johnson, S., Kadam, A., Pratt, C., and Thakore, D. (2021). Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD), National Institute of Standards and Technology."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"P\u00f6hls, H.C., Petschkuhn, B., R\u00fcckert, J., and M\u00f6ssinger, M. (2014, January 1\u20133). Aggregation and Perturbation in Practice: Case-Study of Privacy, Accuracy and Performance. Proceedings of the 19th IEEE International Workshop on Computer Aided Modelling Analysis and Design of Communication Links and Networks (CAMAD 2014), Athens, Greece.","DOI":"10.1109\/CAMAD.2014.7033231"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Elicegui, I., Carrasco, J., Escribano, C.P., Gato, J., Becerra, A., and Politis, A. (2022). Usage-Based Automotive Insurance. Big Data and Artificial Intelligence in Digital Finance: Increasing Personalization and Trust in Digital Finance Using Big Data and AI, Springer International Publishing.","DOI":"10.1007\/978-3-030-94590-9_17"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1016\/j.erss.2017.09.037","article-title":"\u201cHome is where the smart is\u201d? Evaluating Smart Home research and approaches against the concept of home","volume":"37","author":"Darby","year":"2018","journal-title":"Energy Res. Soc. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bugeja, J., Jacobsson, A., and Davidsson, P. (2016, January 17\u201319). On Privacy and Security Challenges in Smart Connected Homes. Proceedings of the 2016 European Intelligence and Security Informatics Conference (EISIC), Uppsala, Sweden.","DOI":"10.1109\/EISIC.2016.044"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Sivaraman, V., Gharakheili, H.H., Vishwanath, A., Boreli, R., and Mehani, O. (2015, January 19\u201321). Network-level security and privacy control for smart-home IoT devices. Proceedings of the 2015 IEEE 11th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), Abu Dhabi, United Arab Emirates.","DOI":"10.1109\/WiMOB.2015.7347956"},{"key":"ref_16","unstructured":"Apthorpe, N., Reisman, D., and Feamster, N. (2017). Closing the Blinds: Four Strategies for Protecting Smart Home Privacy from Network Observers. arXiv."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A., and Tarkoma, S. (2017, January 5\u20138). IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. Proceedings of the 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Atlanta, GA, USA.","DOI":"10.1109\/ICDCS.2017.283"},{"key":"ref_18","unstructured":"Apthorpe, N., Reisman, D., and Feamster, N. (2017). A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Schiefer, M. (2015, January 18\u201320). Smart Home Definition and Security Threats. Proceedings of the 2015 Ninth International Conference on IT Security Incident Management IT Forensics, Magdeburg, Germany.","DOI":"10.1109\/IMF.2015.17"},{"key":"ref_20","unstructured":"(2024). (FDIS Final Draft) Cybersecurity\u2014IoT Security and Privacy\u2014Guidelines for IoT-Domotics (Standard No. ISO\/IEC 27403)."},{"key":"ref_21","unstructured":"(2022). Cybersecurity \u2014 IoT Security and Privacy \u2014 Guidelines (Standard No. ISO\/IEC 27400)."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Greer, C., Burns, M.J., Wollman, D.A., and Griffor, E.R. (2019). Cyber-Physical Systems and Internet of Things, National Institute of Standards and Technology. Special Publication (NIST SP).","DOI":"10.6028\/NIST.SP.1900-202"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"261","DOI":"10.1007\/s10796-014-9489-2","article-title":"The Internet of Things\u2014A survey of topics and trends","volume":"17","author":"Whitmore","year":"2015","journal-title":"Inf. Syst. Front."},{"key":"ref_24","unstructured":"Barrera, D., Molloy, I., and Huang, H. (2017). IDIoT: Securing the Internet of Things like it\u2019s 1994. arXiv."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Notra, S., Siddiqi, M., Habibi Gharakheili, H., Sivaraman, V., and Boreli, R. (2014, January 29\u201331). An experimental study of security and privacy risks with emerging household appliances. Proceedings of the 2014 IEEE Conference on Communications and Network Security, San Francisco, CA, USA.","DOI":"10.1109\/CNS.2014.6997469"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Hong, J., Levy, A., Riliskis, L., and Levis, P. (2018, January 17\u201320). Don\u2019t Talk Unless I Say So! Securing the Internet of Things with Default-Off Networking. Proceedings of the 2018 IEEE\/ACM Third International Conference on Internet-of-Things Design and Implementation (IoTDI), Orlando, FL, USA.","DOI":"10.1109\/IoTDI.2018.00021"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"110697","DOI":"10.1016\/j.jss.2020.110697","article-title":"A systematic literature review of model-driven security engineering for cyber\u2013physical systems","volume":"169","author":"Geismann","year":"2020","journal-title":"J. Syst. Softw."},{"key":"ref_28","unstructured":"Shostack, A. (2014). Threat Modelling: Designing for Security, John Wiley & Sons."},{"key":"ref_29","unstructured":"Kohnfelder, L., and Garg, P. (2025, January 19). The Threats to Our Products. April 1999. Available online: https:\/\/shostack.org\/files\/microsoft\/The-Threats-To-Our-Products.docx."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Khan, R., McLaughlin, K., Laverty, D., and Sezer, S. (2017, January 26\u201329). STRIDE-based threat modelling for cyber-physical systems. Proceedings of the 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe), Turin, Italy.","DOI":"10.1109\/ISGTEurope.2017.8260283"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/s00766-010-0115-7","article-title":"A privacy threat analysis framework: Supporting the elicitation and fulfillment of privacy requirements","volume":"16","author":"Deng","year":"2011","journal-title":"Requir. Eng."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1307","DOI":"10.1109\/PROC.1978.11141","article-title":"The Evolution of Packet Switching","volume":"66","author":"Roberts","year":"1978","journal-title":"Proc. IEEE"},{"key":"ref_33","unstructured":"(1999). Wireless LAN Medium Access Control and Physical Layer Specifications (Standard No. IEEE 802.11)."},{"key":"ref_34","unstructured":"Bellovin, S.M. (2025, January 19). Distributed Firewalls. ;login:, Available online: https:\/\/www.cs.columbia.edu\/~smb\/papers\/distfw.pdf."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Maglogiannis, I., Iliadis, L., Papaleonidas, A., and Chochliouros, I. (2023, January 14\u201317). Ensuring Reliability in Smart Building IoT Operations Through Real-Time Holistic Data Treatment. Proceedings of the Artificial Intelligence Applications and Innovations, AIAI 2023 IFIP WG 12.5 International Workshops, Le\u00f3n, Spain.","DOI":"10.1007\/978-3-031-34171-7"},{"key":"ref_36","unstructured":"Cuellar, J. (2014, January 26). Redactable Signatures to Control the Maximum Noise for Differential Privacy in the Smart Grid. Proceedings of the 2nd Workshop on Smart Grid Security (SmartGridSec 2014), Munich, Germany. Available online: http:\/\/link.springer.com\/chapter\/10.1007\/978-3-319-10329-7_6\/fulltext.html."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"1334","DOI":"10.1109\/PROC.1983.12775","article-title":"The OSI reference model","volume":"71","author":"Day","year":"1983","journal-title":"Proc. IEEE"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Klement, F., P\u00f6hls, H.C., and Spielvogel, K. (2020, January 3\u20135). Towards Privacy-Preserving Local Monitoring and Evaluation of Network Traffic from IoT Devices and Corresponding Mobile Phone Applications. Proceedings of the IEEE 3rd Workshop on Internet of Things Security and Privacy (WISP 2020) Held in Conjunction with Global IoT Summit 2020 (GIOTS 2020), Dublin, Ireland.","DOI":"10.1109\/GIOTS49054.2020.9119507"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Klement, F., P\u00f6hls, H.C., and Katzenbeisser, S. (2022, January 30). Man-in-the-OBD: A modular, protocol agnostic firewall for automotive dongles to enhance privacy and security. Proceedings of the 5th International Workshop on Attacks and Defenses for Internet-of-Things (ADIoT 2022) in Conjunction with ESORICS, Copenhagen, Denmark. Lecture Notes in Computer Science (LNCS).","DOI":"10.1007\/978-3-031-21311-3_7"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Klement, F., P\u00f6hls, H.C., and Katzenbeisser, S. (2022, January 2\u20133). Change Your Car\u2019s Filters: Efficient Concurrent and Multi-Stage Firewall for OBD-II Network Traffic. Proceedings of the 2022 IEEE 27th International Workshop on Computer Aided Modelling and Design of Communication Links and Networks (CAMAD), Paris, France.","DOI":"10.1109\/CAMAD55695.2022.9966902"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/35.312843","article-title":"Network firewalls","volume":"32","author":"Bellovin","year":"1994","journal-title":"IEEE Commun. Mag."},{"key":"ref_42","unstructured":"Sanders, C. (2017). Practical Packet Analysis, 3E: Using Wireshark to Solve Real-World Network Problems, No Starch Press."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Serror, M., Henze, M., Hack, S., Schuba, M., and Wehrle, K. (2018, January 27\u201330). Towards In-Network Security for Smart Homes. Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES 2018), Hamburg, Germany.","DOI":"10.1145\/3230833.3232802"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Anselmi, G., Mandalari, A.M., Lazzaro, S., and De Angelis, V. (2023, January 2\u20136). COPSEC: Compliance-Oriented IoT Security and Privacy Evaluation Framework. Proceedings of the 29th Annual International Conference on Mobile Computing and Networking (ACM MobiCom \u201923), Madrid, Spain.","DOI":"10.1145\/3570361.3615747"},{"key":"ref_45","unstructured":"European Parliament and the Council of the European Union (2025, January 19). Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95\/46\/EC (General Data Protection Regulation). Official Journal of the European Union, L 119. 4 May 2016, pp. 1\u201388, Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=oj:JOL_2016_119_R_TOC."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"100827","DOI":"10.1016\/j.measen.2023.100827","article-title":"A comprehensive review of AI based Intrusion Detection System","volume":"28","author":"Sowmya","year":"2023","journal-title":"Meas. Sens."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Rakotondravony, N., P\u00f6hls, H.C., Pfeifer, J., and Harrison, L. (July, January 29). Viz4NetSec: Visualizing Dynamic Network Security Configurations of Everyday Interconnected Objects in Home Networks. Proceedings of the HCI for Cybersecurity, Privacy and Trust: 6th International Conference, HCI-CPT 2024, Held as Part of the 26th HCI International Conference, HCII 2024, Washington, DC, USA. Proceedings, Part II; LNCS.","DOI":"10.1007\/978-3-031-61382-1_11"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Geloczi, E., P\u00f6hls, H.C., Klement, F., Posegga, J., and Katzenbeisser, S. (2024, January 14\u201318). Unveiling the Shadows: An Approach towards Detection, Precise Localization, and Effective Isolation of Concealed IoT Devices in Unfamiliar Environments. Proceedings of the 23rd Workshop on Privacy in the Electronic Society (WPES \u201924), Salt Lake City, UT, USA.","DOI":"10.1145\/3689943.3695040"},{"key":"ref_49","unstructured":"Lyu, M., and Lau, L. (2000, January 25\u201327). Firewall security: Policies, testing and performance evaluation. Proceedings of the 24th Annual International Computer Software and Applications Conference (COMPSAC2000), Taipei, Taiwan."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Hamed, H., and Al-Shaer, E. (2006, January 21\u201324). Dynamic rule-ordering optimization for high-speed firewall filtering. Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security (ASIACCS \u201906), Taipei, Taiwan.","DOI":"10.1145\/1128817.1128867"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Molina-Markham, A., Shenoy, P., Fu, K., Cecchet, E., and Irwin, D. (2010, January 2). Private Memoirs of a Smart Meter. Proceedings of the 2nd ACM BuildSys \u201910, Zurich, Switzerland.","DOI":"10.1145\/1878431.1878446"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Enev, M., Gupta, S., Kohno, T., and Patel, S.N. (2011, January 17\u201321). Televisions, video privacy, and powerline electromagnetic interference. Proceedings of the ACM CCS, Chicago, IL, USA.","DOI":"10.1145\/2046707.2046770"},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Jacobsson, A., Boldt, M., and Carlsson, B. (2014, January 27\u201329). On the Risk Exposure of Smart Home Automation Systems. Proceedings of the 2014 International Conference on Future Internet of Things and Cloud, Barcelona, Spain.","DOI":"10.1109\/FiCloud.2014.37"},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"719","DOI":"10.1016\/j.future.2015.09.003","article-title":"A risk analysis of a Smart Home automation system","volume":"56","author":"Jacobsson","year":"2016","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Geneiatakis, D., Kounelis, I., Neisse, R., Nai-Fovino, I., Steri, G., and Baldini, G. (2017, January 22\u201326). Security and privacy issues for an IoT based Smart Home. Proceedings of the 2017 40th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, Croatia.","DOI":"10.23919\/MIPRO.2017.7973622"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"398","DOI":"10.1016\/j.cose.2018.07.011","article-title":"A taxonomy of cyber-physical threats and impact in the Smart Home","volume":"78","author":"Heartfield","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Ciancarini, P., Litvinov, S., Messina, A., Sillitti, A., and Succi, G. (2018, January 7\u20138). AntibIoTic: Protecting IoT Devices Against DDoS Attacks. Proceedings of the 5th International Conference in Software Engineering for Defence Applications, Rome, Italy.","DOI":"10.1007\/978-3-319-70578-1"},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/MSP.2016.54","article-title":"HbbTV Security and Privacy: Issues and Challenges","volume":"14","author":"Ghiglieri","year":"2016","journal-title":"IEEE Secur. Priv."},{"key":"ref_59","unstructured":"Gebhardt, J., Massoth, M., Weber, S., and Wiens, T. (2014, January 24\u201328). Ubiquitous Smart Home control on a Raspberry Pi embedded system. Proceedings of the UBICOMM 2014\u20148th International Conference on Mobile Ubiquitous Computing, Systems, Services and Technologies, Rome, Italy. Available online: https:\/\/www.thinkmind.org\/articles\/ubicomm_2014_6_30_10109.pdf."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Haar, C., and Buchmann, E. (2019, January 1\u20134). FANE: A Firewall Appliance for the Smart Home. Proceedings of the 2019 Federated Conference on Computer Science and Information Systems (FedCSIS), Leipzig, Germany.","DOI":"10.15439\/2019F177"},{"key":"ref_61","unstructured":"European Parliament and the Council of the European Union (2025, January 19). Regulation (EC) No. 715\/2007 of the European Parliament and of the Council of 20 June 2007 on Type Approval of Motor Vehicles with Respect to Emissions from Light Passenger and Commercial Vehicles (Euro 5 and Euro 6) and on Access to Vehicle Repair and Maintenance Information, Available online: https:\/\/www.legislation.gov.uk\/eur\/2007\/715."},{"key":"ref_62","unstructured":"Robert Bosch GmbH (1991). CAN Specification, Robert Bosch GmbH. Available online: http:\/\/esd.cs.ucr.edu\/webres\/can20.pdf."},{"key":"ref_63","unstructured":"(2015). Road Vehicles\u2014Controller Area Network (CAN)\u2014Part 1: Data Link Layer and Physical Signalling (Standard No. Standard ISO 11898-1)."},{"key":"ref_64","unstructured":"Wen, H., Chen, Q.A., and Lin, Z. (2020, January 12\u201314). Plug-N-Pwned: Comprehensive Vulnerability Analysis of OBD-II Dongles as A New Over-the-Air Attack Surface in Automotive IoT. Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), Online."},{"key":"ref_65","first-page":"405","article-title":"Security, Vulnerability and Protection of Vehicular On-board Diagnostics","volume":"10","author":"Yadav","year":"2016","journal-title":"Int. J. Secur. Its Appl."},{"key":"ref_66","unstructured":"Keegan, J., and Ng, A. (2025, January 19). Who Is Collecting Data from Your Car?. Available online: https:\/\/themarkup.org\/the-breakdown\/2022\/07\/27\/who-is-collecting-data-from-your-car."},{"key":"ref_67","doi-asserted-by":"crossref","unstructured":"El Basiouni El Masri, A., Artail, H., and Akkary, H. (2017, January 21\u201323). Toward self-policing: Detecting drunk driving behaviours through sampling CAN bus data. Proceedings of the 2017 International Conference on Electrical and Computing Technologies and Applications (ICECTA), Ras Al Khaimah, United Arab Emirates.","DOI":"10.1109\/ICECTA.2017.8252037"},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Nirmali, B., Wickramasinghe, S., Munasinghe, T., Amalraj, C.R.J., and Bandara, H.M.N.D. (2017, January 15\u201316). Vehicular data acquisition and analytics system for real-time driver behaviour monitoring and anomaly detection. Proceedings of the 2017 IEEE International Conference on Industrial and Information Systems (ICIIS), Peradeniya, Sri Lanka.","DOI":"10.1109\/ICIINFS.2017.8300417"},{"key":"ref_69","doi-asserted-by":"crossref","unstructured":"Srinivasan, A. (2018, January 3\u20135). IoT Cloud Based Real Time Automobile Monitoring System. Proceedings of the 2018 3rd IEEE International Conference on Intelligent Transportation Engineering, Singapore.","DOI":"10.1109\/ICITE.2018.8492706"},{"key":"ref_70","first-page":"13","article-title":"Security and privacy in vehicular communications: Challenges and opportunities","volume":"10","author":"Bernardini","year":"2017","journal-title":"Veh. Commun."},{"key":"ref_71","unstructured":"Hoppe, T., Kiltz, S., and Dittmann, J. (2008, January 22\u201325). Security Threats to Automotive CAN Networks\u2014Practical Examples and Selected Short-Term Countermeasures. Proceedings of the 27th International Conference on Computer Safety, Reliability, and Security (SAFECOMP \u201908), Newcastle upon Tyne, UK."},{"key":"ref_72","unstructured":"Studnia, I., Nicomette, V., Alata, E., Deswarte, Y., Ka\u00e2niche, M., and Laarouchi, Y. (2013, January 24\u201327). Security of embedded automotive networks: State of the art and a research proposal. Proceedings of the SAFECOMP 2013\u2014Workshop CARS (2nd Workshop on Critical Automotive Applications: Robustness & Safety) of the 32nd International Conference on Computer Safety, Reliability and Security, Toulouse, France."},{"key":"ref_73","unstructured":"Wolf, M., Weimerskirch, A., and Paar, C. (2024, December 19). Security in Automotive Bus Systems. Available online: https:\/\/api.semanticscholar.org\/CorpusID:16502503."},{"key":"ref_74","unstructured":"Semiconductors, N. (2024, December 19). Automotive Gateway: A Key Component to Securing the Connected Car. Available online: https:\/\/www.nxp.com\/docs\/en\/white-paper\/AUTOGWDEVWPUS.pdf."},{"key":"ref_75","unstructured":"Robert Bosch GmbH (2024, December 19). Bosch Central Gateway. Available online: www.bosch-mobility-solutions.com\/en\/products-and-services\/passenger-cars-and-light-commercial-vehicles\/connectivity-solutions\/central-gateway\/."},{"key":"ref_76","unstructured":"(2024, December 19). Karamba Security. Available online: https:\/\/karambasecurity.com."},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"Rizvi, S., Willett, J., Perino, D., Vasbinder, T., and Marasco, S. (2017, January 22\u201323). Protecting an Automobile Network Using Distributed Firewall System. Proceedings of the Second International Conference on Internet of Things, Data and Cloud Computing (ICC \u201917), Cambridge, UK.","DOI":"10.1145\/3018896.3056791"},{"key":"ref_78","unstructured":"The European Parliament and the Council of the European Union (2025, January 19). Directive 1995\/46\/EC of the European Parliament and of the Council\u2014On the Protection of Individuals with Regard to the Processing of Personal Data on the Free Movement of Such Data. Official Journal of the European Union, L 281. 23 November 1995, pp. 31\u201350, Available online: https:\/\/eur-lex.europa.eu\/eli\/dir\/1995\/46\/oj\/eng."},{"key":"ref_79","unstructured":"EU Article 29 Data Protection Working Party (WP 223) (2025, January 19). Opinion 8\/2014 on the Recent Developments on the Internet of Things. 16 September 2014, Available online: https:\/\/ec.europa.eu\/justice\/article-29\/documentation\/opinion-recommendation\/files\/2014\/wp223_en.pdf."},{"key":"ref_80","unstructured":"European Union Agency for Cybersecurity, Domingo-Ferrer, J., Hansen, M., Hoepman, J., Le M\u00e9tayer, D., Tirtea, R., Schiffner, S., and Danezis, G. (2025, January 19). Privacy and Data Protection by Design\u2014From Policy to Engineering, Available online: https:\/\/data.europa.eu\/doi\/10.2824\/38623."},{"key":"ref_81","unstructured":"Ontario (2025, January 19). Office of the Information and Privacy Commissioner; Cavoukian, A. Privacy by Design\u2014The 7 Foundational Principles\u2014Implementation and Mapping of Fair Information Practices. Toronto, ON, Canada, 2009. Available online: https:\/\/privacy.ucsc.edu\/resources\/privacy-by-design---foundational-principles.pdf."},{"key":"ref_82","doi-asserted-by":"crossref","unstructured":"Kung, A., Kargl, F., Suppan, S., Cuellar, J., P\u00f6hls, H.C., Kapovits, A., McDonnell, N.N., and Martin, Y.S. (2017). A privacy engineering framework for the Internet of things. Data Protection and Privacy: (In) Visibilities and Infrastructures, Springer.","DOI":"10.1007\/978-3-319-50796-5_7"},{"key":"ref_83","unstructured":"Ernst & Young (2025, January 19). Data Loss Prevention Keeping Your Sensitive Data out of the Public Domain. Insights on Governance, Risk and Compliance. EYG no. AU0969. Available online: https:\/\/cloudsynergyinc.com\/assets\/pdfs\/Data-Loss-Prevention.pdf."},{"key":"ref_84","doi-asserted-by":"crossref","first-page":"7","DOI":"10.1016\/S1361-3723(09)70139-3","article-title":"Recognising and addressing \u2018security fatigue\u2019","volume":"2009","author":"Furnell","year":"2009","journal-title":"Comput. Fraud. Secur."},{"key":"ref_85","doi-asserted-by":"crossref","first-page":"521","DOI":"10.1111\/isj.12319","article-title":"When enough is enough: Investigating the antecedents and consequences of information security fatigue","volume":"31","author":"Cram","year":"2021","journal-title":"Inf. Syst. J."},{"key":"ref_86","unstructured":"P\u00f6hls, H.C., and Rakotondravony, N. (2020, January 19\u201324). Dynamic Consent: Physical Switches and Feedback to Adjust Consent to IoT Data Collection. Proceedings of the Distributed, Ambient and Pervasive Interactions: 8th International Conference, DAPI 2020, Held as Part of the 22nd HCI International Conference, HCII 2020, Copenhagen, Denmark. Proceedings 22."},{"key":"ref_87","doi-asserted-by":"crossref","first-page":"104","DOI":"10.1109\/35.968819","article-title":"Home networking with Universal Plug and Play","volume":"39","author":"Miller","year":"2001","journal-title":"IEEE Commun. Mag."},{"key":"ref_88","unstructured":"Hunt, T. (2024, December 19). Data from Connected CloudPets Teddy Bears Leaked and Ransomed, Exposing Kids\u2019 Voice Messages. Available online: https:\/\/www.troyhunt.com\/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages\/."},{"key":"ref_89","doi-asserted-by":"crossref","unstructured":"Sivaraman, V., Chan, D., Earl, D., and Boreli, R. (2016, January 18\u201320). Smart-Phones Attacking Smart-Homes. Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec \u201916), Darmstadt, Germany.","DOI":"10.1145\/2939918.2939925"},{"key":"ref_90","doi-asserted-by":"crossref","first-page":"2027","DOI":"10.1109\/COMST.2016.2548426","article-title":"A Survey of Man In The Middle Attacks","volume":"18","author":"Conti","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_91","unstructured":"Amazon.com (2024, December 19). Understand the Smart Home Skill API|Alexa Skills Kit. Available online: https:\/\/developer.amazon.com\/de\/docs\/smarthome\/understand-the-smart-home-skill-api.html."},{"key":"ref_92","doi-asserted-by":"crossref","unstructured":"Evans, C., Palmer, C., and Sleevi, R. (2024, December 19). Public Key Pinning Extension for HTTP. RFC 7469. 2015. Available online: https:\/\/doi.org\/10.17487\/RFC7469.","DOI":"10.17487\/RFC7469"},{"key":"ref_93","unstructured":"Cheng, H., and Avnur, R. (1998). Traffic Analysis of SSL Encrypted Web Browsing, University of Berkeley. Project Paper."},{"key":"ref_94","doi-asserted-by":"crossref","unstructured":"Lyu, M., Sherratt, D., Sivanathan, A., Gharakheili, H.H., Radford, A., and Sivaraman, V. (2017, January 18\u201320). Quantifying the Reflective DDoS Attack Capability of Household IoT Devices. Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec \u201917), Boston, MA, USA.","DOI":"10.1145\/3098243.3098264"},{"key":"ref_95","unstructured":"Gong, Z., Luo, X., Chen, J., Lei, J., and Wang, F.L. (2011). Defense against DNS Man-In-The-Middle Spoofing. Proceedings of the Web Information Systems and Mining, Springer."},{"key":"ref_96","doi-asserted-by":"crossref","unstructured":"Bauer, K., Gonzales, H., and McCoy, D. (2008, January 7\u20139). Mitigating Evil Twin Attacks in 802.11. Proceedings of the 2008 IEEE International Performance, Computing and Communications Conference, Austin, TX, USA.","DOI":"10.1109\/PCCC.2008.4745081"},{"key":"ref_97","doi-asserted-by":"crossref","first-page":"2093","DOI":"10.1109\/JIOT.2018.2883344","article-title":"AI-Based Two-Stage Intrusion Detection for Software Defined IoT Networks","volume":"6","author":"Li","year":"2019","journal-title":"IEEE Internet Things J."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/2\/77\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:30:12Z","timestamp":1760027412000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/2\/77"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,10]]},"references-count":97,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2025,2]]}},"alternative-id":["fi17020077"],"URL":"https:\/\/doi.org\/10.3390\/fi17020077","relation":{},"ISSN":["1999-5903"],"issn-type":[{"type":"electronic","value":"1999-5903"}],"subject":[],"published":{"date-parts":[[2025,2,10]]}}}