Relevance of the research. The development of the Internet of Things (IoT), cyber-physical systems, edge computing, and the Industrial Internet of Things (IIoT) is accompanied by increasing complexity in modern information and communication systems. IoT environments bring together devices with different purposes, computing capabilities, and communication protocols. Their composition, configuration, and connections between components may change during operation. At the same time, the range of cyber threats capable of affecting both individual devices and the environment as a whole continues to grow.
The dissertation addresses the scientific problem of developing and improving methods and models for context-adaptive information security risk assessment in IoT environments during security audits. The proposed solution combines intelligent context-aware device classification, the formation of contextual risk profiles, and fuzzy risk assessment. The risk level is also determined with consideration of a previously calculated hidden compromise risk indicator.
The aim of the research is to develop and improve methods and models for context-adaptive information security risk assessment in IoT environments that account for device characteristics, operating conditions, and the current security state and can be used during security audits.
To achieve this aim, approaches to IoT device classification, vulnerability detection, anomalous activity analysis, and risk assessment were analyzed.
A model for forming a device’s contextual risk profile based on the results of intelligent context-aware classification was developed. A risk assessment method based on Mamdani fuzzy inference was improved by incorporating the hidden compromise risk indicator, BackdoorRisk
An approach to building an information technology for the coordinated use of the model and method was defined. The proposed solutions were evaluated using open IoT security datasets and programmatically generated contextual risk scenarios.
The scientific novelty of the results is as follows:
– A model for forming an IoT device’s contextual risk profile based on the results of intelligent context-aware classification was developed for the first time. The model classifies a device according to five criteria: its level of embedded intelligence, security characteristics, interaction architecture, functional context, and the dynamic nature of the environment. The classification results for each criterion are retained in the profile without being reduced to a single numerical value.
– A method for context-adaptive information security risk assessment in IoT environments based on Mamdani fuzzy inference was improved. The method jointly considers seven input parameters: asset criticality, threat level, vulnerability level, attacker capability, likelihood of threat occurrence, severity of impact, and the previously calculated hidden compromise risk indicator, BackdoorRisk. Context-dependent parameters are refined using the device profile and data on the current security state. BackdoorRisk is supplied to the system as a separate input parameter.
– The approach to building an information technology for information security risk assessment in IoT environments was further developed. The approach uses a device’s contextual risk profile together with data on its current security state to form the input parameters for fuzzy risk assessment.
The practical significance of the results lies in the software implementation of an information security risk assessment module for IoT environments and a separate experimental procedure for classifying network events. The module was implemented in MATLAB using the Fuzzy Logic Toolbox. It processes seven previously calculated input parameters, performs Mamdani fuzzy inference, and determines the RiskLevel value and corresponding risk category. The experimental classification of network events was studied separately as a means of obtaining information about activity in an IoT environment.
Implementation of the results. The results of the dissertation research have been implemented in the operations of LUMIERE ELECTRO LLC, ARKADA FINANCE LLC, and ATRIYA COMPANY LLC for information security analysis, risk assessment, and anomalous network activity analysis. Some of the results are also used in the educational process at Chernihiv Polytechnic National University in the training of cybersecurity and computer science specialists.
The results make it possible to assess risk with consideration of an IoT device’s characteristics, its contextual risk profile, and the current security state. The proposed approach to building the information technology establishes a procedure for the combined use of the developed model and improved method during IoT security audits.
