Abraham Rodríguez-Mota

Distributing Computing in the Internet of Things: Cloud, Fog and Edge Computing Overview

The main postulate of the Internet of things (IoT) is that everything can be connected to the Internet, at anytime, anywhere. This means a plethora of objects (e.g. smart cameras, wearables, environmental sensors, home appliances, and vehicles) are ‘connected’ and generating massive amounts of data. The collection, integration, processing and analytics of these data enable the realisation of smart cities, infrastructures and services for enhancing the quality of life of humans. Nowadays, existing IoT architectures are highly centralised and heavily rely on transferring data processing, analytics, and decision-making processes to cloud solutions. This approach of managing and processing data at the cloud may lead to inefficiencies in terms of latency, network traffic management, computational processing, and power consumption. Furthermore, in many applications, such as health monitoring and emergency response services, which require low latency, delay caused by transferring data to the cloud and then back to the application can seriously impact their performances. The idea of allowing data processing closer to where data is generated, with techniques such as data fusion, trending of data, and some decision making, can help reduce the amount of data sent to the cloud, reducing network traffic, bandwidth and energy consumption. Also, a more agile response, closer to real-time, will be achieved, which is necessary in applications such as smart health, security and traffic control for smart cities. Therefore, this chapter presents a review of the more developed paradigms aimed to bring computational, storage and control capabilities closer to where data is generated in the IoT: fog and edge computing, contrasted with the cloud computing paradigm. Also an overview of some practical use cases is presented to exemplify each of these paradigms and their main differences.

Improving Android Mobile Application Development by Dissecting Malware Analysis Data

The explosive growth of mobile technology has brought uncountable benefits to consumers, but it also presents new concerns and provides a platform for cybercrime. In the case of devices running the Android Operating System (OS), concerns have raised as Android has become a major OS in the market. Moreover, even though there have been efforts from Google and the Open Handset Alliance (OHA), among others, towards reducing the impact of security threats in Android, malicious attacks continue to increase in frequency and complexity. Interestingly, bad software development practices still are being considered a major surface attack provider, mainly due to the lack of knowledge or misuse of Android security features. Therefore, this work presents a Web tool, named GARMDROID, aimed to provide security information that will helps Android developers to identify insecure development aspects, saving them from the nuisances associated to the learning of specialized security analysis tools and techniques.

Towards a 2-hybrid Android malware detection test framework

Current pervasive usage of mobile devices around the world has rose big security and data protection concerns both into the application development process as into the data security field. Although the long way of development in PC security malware treatment in the computer science and industrial areas, mobile devices security research and development have proved that in this area malware treatment goes far beyond PC malware analysis and prevention techniques replication. In this context, this paper provides a description of a current open-ended project aimed to produce a 2-hybrid malware detection test framework. Based on the current trends of hybrid malware analysis, in this work the term 2-hybrid implies both a local(host)-remote(server/cloud) implementation and a static-dynamic analysis approach.

GARMDROID: IoT Potential Security Threats Analysis through the Inference of Android Applications Hardware Features Requirements

Applications and services based on the Internet of Things (IoT) are increasingly vulnerable to disruption from attack or information theft. Developers and researchers attempt to prevent the growth of such disruption models, mitigate and limit their impact. Meeting these challenges requires understanding the characteristics of things and the technologies that empower the IoT since traditional protection mechanisms are not enough. Moreover, as the growth in mobile device market is pushing the deployment of the IoT, tools and mechanisms to evaluate, analyze and detect security threats in these devices are strongly required. In this context, this paper presents a web tool, named GARMDROID, aimed to help IoT software developers and integrators to evaluate IoT security threats based on the visualization of Android application hardware requests. This procedure is based on the static analysis of permissions requested by Android applications.

Security Oriented Methodology for Designing Internet of Things Systems

The current increasing number of services and systems developed for the Internet of Things (IoT) involve several challenges in interconnectivity, heterogeneous networks and security. Security is one of the most important issues to consider in IoT systems because most of the critical information such as passwords, identities or even personal information could be exposed by an attacker. This proposal is a security methodology for IoT systems that defines a process to establish rules, mechanisms and controls in every stage of IoT systems development. This methodology has three main parts: definition of the system and its abstraction model, security modelling attached to the general model, system implementation and continuous security review. The whole methodology has more specific steps including our security model extension called IoTsec that is a model-based visual security oriented representation of IoT systems which can be used as an extension of an abstract model of an IoT system to model security.

Accelerometer Based Body Area Network Sensor Authentication

In recent years, the increasing number of wearable sensors by humans can serve for many purposes like emergency care, health care remote monitoring, personal entertainment and communication. In the case of health care applications, wearable sensors enable long-term continuous physiological monitoring without disturbing day to day activities, which is important for the treatment and management of many chronic illnesses, neurological disorders, and mental health issues. Examples include: diabetes, autism spectrum disorder (ASD), depression, drug addiction, and anxiety disorders. In general, wearable sensors can be used individually or as networked systems. In any case, sensors communication and authentication are key aspects in the deployment of these systems. A Wireless Body Area Network (WBAN) is created by wearing small sensors on the human body. To ensure authentication in on-body sensor networks, a mechanism which intuitively proves that all the communicating nodes are trusted ones is required. In order to achieve sensor authentication, in this paper a technological approach where accelerometer data gathered from sensors are used to distinguish whether or not the devices are carried on the same individual’s body, is presented. This system detects this situation by calculating the correlations between embedded accelerometers in a cellphone and accelerometer sensors. We evaluate our method over a dataset of fifteen wearers with sensors in various positions on their body.

Reassessing Android Malware Analysis: From Apps to IoT System Modelling

Applications based on the Internet of Things (IoT) are increasingly vulnerable to disruption from cyber attacks. Developers and researchers attempt to prevent the growth of such disruption models, mitigate and limit their impact. This requires the understanding and characterization of things and the technologies that empower the IoT. Futhermore, tools to evaluate, analyze and detect security threats in IoT devices are strongly required. This paper presents a web tool, named GARMDROID, aimed to help IoT software developers and integrators to evaluate IoT security threats based on the visualization of Android application hardware requests. This procedure is based on the static analysis of permissions requested by Android applications. A mapping from the malware analysis data obtained to a SysML block definition diagram is also briefly described. This mapping shows how data can be used to model IoT systems under different proposals such as Model Integrated Mechatronics (MIM) and UML4IoT.

Short range, >100Kbits/s, visible light communication protocol design for high-gamma smartphones

High gamma smartphones based on Android operating system support the development of third-party applications. This kind of devices include subsystems such as sensors and actuators which can be used for diverse purposes. One example is the implementation of short range visible light communication (VLC) channels where the built-in light-emitting diode (LED) is the transmitter, and the complementary metal-oxide semiconductor (CMOS) camera works as the receiver. A major challenge for this communication channel is the modulation bandwidth of the light source which is limited to a few MHz, and the availability of a line-of-sight. The camera shutter is limited to a few frames per second (30 or 60 fps) for a few bits per second transmission, but the Rolling Shutter effect could allow the enhancement of the bit rate. In this work, we propose a VLC protocol design for the use of the built-in camera and the flash LED in order to implement a short range VLC channel, for high gamma mobile-to-mobile devices based on Android. The design is based on On-Off Keying (OOK) modulation for initially transmitting a few bits. Based on the rolling shutter effect in the CMOS image sensor, bright and dark fringes can be observed within each received frame, and the data can then be retrieved. Furthermore, two thresholding schemes for high fluctuation and large extinction ratio (ER) variations in each frame, are explored. Full protocol design and short range (5 cm), >100 kbits/s, VLC demonstration and image processing results will be included in the presentation.

Native malware detection in smartphones with android OS using static analysis, feature selection and ensemble classifiers

The use of Smartphones (SPs)with Android Operating System (AOS) has reached unprecedented popularity. This is due to the many features that these devices offer as Internet connection, storage of information as well as the ability to perform diverse online transactions. As a result, these devices have become the main target of malware attacks that try to exploit the security vulnerabilities of AOS.Therefore, in order to mitigate these attacks, methods for malware analysis and detection are needed.In this work a method for analysis and detection of malware, which can run natively in the device, is proposed. The approach can analyze applications already installed on the device, monitor new apps installations or updates. Static analysis is used to determine the permissions, hardware and software features requested by applications. An application being analyzed is classified as malware or benign using a model based on ensemble machine learning classifiers and feature selection algorithms. To validate the proposed method, 1377 malware samples and 1377 benign samples, collected from different sources, were used.Results show that the proposed approach detects malware with 96.26%of accuracy. Additional tests were conducted in three different SPs devices to validate malware detection performance in a real environment andto obtain an average execution time. Results of these tests show that the proposed method detects malware with 94.48% of accuracy, getting the analysis results of an application in 35milliseconds.

Towards IoT cybersecurity modeling: From malware analysis data to IoT system representation

The heterogeneous nature of the Internet of Things (IoT) represents a big challenge in many different technical and scientific areas, among them Security. In this sense, security becomes an extremely complex problem as it is present in every aspect of the IoT ecosystem, from sensors and data acquisition hardware to front-end software applications and sophisticated user devices. This complexity expands as there is not consensus among all stakeholders towards the definition of general technical standards, specifications, system representations and use policies. In this context, this paper presents a state of intention for a research project oriented to construct a set of tools to characterize security attack surfaces for IoT systems solutions. The proposed research includes the development of a visual grammar aimed to depict IoT systems at a high-abstraction level together with the construction of objects profiles, which in conjunction will provide building blocks and mechanisms to evaluate or identify insecure IoT scenarios.