VetIoT: On Vetting IoT Defenses Enforcing Policies at Runtime

Akib Jawad Nafis, Omar Chowdhury, Endadul Hoque

Research output: Chapter in Book/Entry/PoemConference contribution


Smart homes are powered by numerous programmable IoT platforms. Despite tremendous innovations, these platforms often suffer from safety and security issues. One class of defense solutions dynamically enforces safety and security policies, which essentially capture the expected behavior of the IoT system. While many proposed works were built on this runtime approach, they all are under-vetted. The primary reason lies in their evaluation approach. They are mostly self-evaluated in isolation using a virtual testbed combined with manually orchestrated test scenarios that rely on user interactions with the platform's UI. Such hand-crafted and non-uniform evaluation setups are limiting not only the reproducibility but also a comparative analysis of their efficacy results. Closing this gap in the traditional way requires a huge upfront manual effort, which causes the researchers turn away from any large-scale comparative empirical evaluation. Therefore, in this paper, we propose a highly-automated uniform evaluation platform, dubbed VetIoT, to vet the defense solutions that hinge on runtime policy enforcement. Given a defense solution, VetIoT easily instantiates a virtual testbed inside which the solution is empirically evaluated. VetIoT replaces manual UI-based interactions with an automated event simulator and manual inspection of test outcomes with an automated comparator. We developed a fully-functional prototype of VetIoT and applied it on three runtime policy enforcement solutions: Expat, Patriot, and IoTguard. VetIoT reproduced their individual prior results and assessed their efficacy results via stress testing and differential testing. We believe VetIoT can foster future research/evaluation.

Original languageEnglish (US)
Title of host publication2023 IEEE Conference on Communications and Network Security, CNS 2023
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9798350339451
StatePublished - 2023
Event2023 IEEE Conference on Communications and Network Security, CNS 2023 - Orlando, United States
Duration: Oct 2 2023Oct 5 2023

Publication series

Name2023 IEEE Conference on Communications and Network Security, CNS 2023


Conference2023 IEEE Conference on Communications and Network Security, CNS 2023
Country/TerritoryUnited States


  • Evaluation
  • IoT Security
  • Testbed

ASJC Scopus subject areas

  • Artificial Intelligence
  • Computer Networks and Communications
  • Computer Vision and Pattern Recognition
  • Safety, Risk, Reliability and Quality


Dive into the research topics of 'VetIoT: On Vetting IoT Defenses Enforcing Policies at Runtime'. Together they form a unique fingerprint.

Cite this