32 cloud based service the frameworks clou d based

3.2 Cloud-Based Service
The framework’s clou d-based service is responsible for the
collection and affiliation of CVEs to specific devices, and for the
generation and representation of vulnerability mitigation policies.
This module is built upon the concept of “the wisdom of the
crowds.” Namely, CVEs are collected from the data sources of
vulnerabilities as opposed to a single expert. In a similar manner,
vulnerability mitigation policies (for each CVE) are generated
based on the collective opinion of a group of experts and general
world knowledge. The basic assumption is that people will have to
generate new vulnerability mitigation policies for every new CVE,
which is feasible, considering the way that new CVEs and their
mitigations are generated today. This module collects CVEs and
associates them with relevant devices. Consequently, the IoT
security appliance can be configured with information regarding a
vulnerable IoT device and request the relevant vulnerability
mitigation policies directly from the cloud service.
3.3 Synchronization and Communication
Mechanisms
The IoT security appliance starts the communication by
subscribing to the cloud service, providing details about the device
it is supposed to protect (i.e., device type, vendor, OS, etc.). Based
on such information, the cloud service publishes the relevant
vulnerability mitigation policies for the appliance. Every new CVE
and vulnerability mitigation policy that will be registered by the
cloud-based service is next broadcasted to all of the relevant
registered appliances. Hence, keeping them updated and
synchronized with the cloud service. In addition, when an
appliance detects an exploitation attempt from a new IP source, it
alerts the cloud service about the exploit. Based on this, the cloud
service can learn about the association between an attacker’s
source IP and the victim's device. For example, when the same IP
source attempts to exploit the same type of device multiple times,
the cloud service can utilize this information to fine-tune its
vulnerability mitigation policies for this set of devices (e.g., by
Session 6: Building Blocks for Next Gen Defense IoT S&P'17, November 3, 2017, Dallas, TX, USA
73

marking the attacker’s IP as suspicious or propagating an alert for
the cloud service maintenance team).
4 PROOF OF CONCEPT
In this section, we demonstrate our proposed framework operation
by preventing a botnet (called Mirai) from infecting an IP camera.
Our demonstration focuses on the stage after the appliance obtains
the relevant vulnerability mitigation policies from the cloud.
Hence, the demonstration does not include a cloud service module,
instead, we manually install the policies on the appliance. In order
to infect the camera, an attacker should first exploit a specific
remote code execution vulnerability on the camera. By exploiting
this vulnerability, the attacker can initiate the Telnet service on
the camera and then run the botnet scan, which tries to infect
vulnerable devices. This section is composed of three phases as