Adaptive security for resource constraint devices

#The disclosure generally relates to a security method, and more specifically, to a method for protecting a computing resource constrained device against cyberattacks. The disclosure relates further to a security system for protecting a computing resource constrained device against cyberattacks, and a computer program product.

#The development of the EDVAC system in 1948 is often cited as the beginning of the computer era. Since that time, computer systems have evolved into extremely complicated devices. Today's computer systems typically include a combination of sophisticated hardware and software components, application programs, operating systems, processors, buses, memory, input/output devices, and so on. As advances in semiconductor processing and computer architecture push performance higher and higher, even more advanced computer software has evolved to take advantage of the higher performance of those capabilities, resulting in computer systems today that are much more powerful than just a few years ago.

#Big Data is one application of these new capabilities. Big Data has yielded impressive results, allowing derivation of new and surprising insights to arrive from ploughing through previously unmanageable amounts of data (e.g., data generated by so-called Internet of Things (IoT) devices), thereby drawing conclusions from otherwise unintelligible patterns.

#The drawings included in the present application are incorporated into, and form part of, the specification. They illustrate embodiments of the present disclosure and, along with the description, serve to explain the principles of the disclosure. The drawings are only illustrative of certain embodiments and do not limit the disclosure.

#FIG. 1 shows a block diagram of an embodiment of one method for providing protection of a computing resource constrained device against cyberattacks, consistent with some embodiments.

#FIG. 2 shows a block diagram of components instrumental for executing the proposed method and supporting the proposed security system, consistent with some embodiments.

#While the invention is amenable to various modifications and alternative forms, specifics thereof have been shown by way of example in the drawings and will be described in detail. It should be understood, however, that the intention is not to limit the invention to the particular embodiments described. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

#Aspects of the present disclosure relate to a security method; more particular aspects relate to protecting a computing resource constrained device against cyberattacks. While the present disclosure is not necessarily limited to such applications, various aspects of the disclosure may be appreciated through a discussion of various examples using this context.

#In the context of this disclosure, the following conventions, terms and/or expressions may be used: The term “computing resource constrained device” may denote, e.g., an edge device in a computing network environment. The device may be equipped with, e.g., batteries so that energy saving techniques may be used. It may also comprise reducing computing power, etc., or shutting down non-used peripheral components. Very often edge devices comprise price-effective hardware delivering only the lowest amount of compute power required by the task at hand. Therefore, such devices may be configured to have just the amount of computing resources to fulfill the dedicated purpose of the device. Spare resources are typically not installed. Hence, there are constraints in the amount of compute power of such devices. The term “security threat” may denote a possible danger that might exploited to breach the security of an information technology system, and therefore, cause possible harm. The term may relate to the technical area of computer security and may describe a potential attack, a non-allowed access, a potential destruction or manipulation of data in computer or storage systems by an intruder or intruder system, or a take-over of control of the computer, storage or communication system. The security threats may originate from a cyberattack. The term “cyberattack” may denote an attempt to access a computing device, e.g., an IoT or edge device (or any other computing device) connected to a data network. A cyberattack may happen as a single security threat, i.e., single cyberattack, or a series of such single cyberattacks, of which most do not represent a real danger for a specific device. The term “cyberattack chain”—sometimes also denoted as “cyber kill chain”—may denote a sequence of sub-attacks to a computer or similar system. Each stage of the sequence builds on the previous one. For example, there exist theoretical models with seven and eighteen stages, respectively, of a sequence or chain of cyberattacks. In the course of this disclosure, the terms “sequence of partial cyberattacks,” “cyberattack chain,” or “cyber kill chain” may be used synonymously. Such cyberattack chains may particularly be dangerous for computing power constrained devices because such devices may not have the computing power or the required memory to follow up on a sequence of partial attacks. The terms “threat intelligence data” or “cyber threat intelligence data” may denote information from cyber threat intelligence systems about threats and threat actors that helps mitigate harmful events in cyberspace. Cyber threat intelligence sources may comprise open source intelligence, social media intelligence, human intelligence, technical intelligence, or intelligence from the deep and dark web. Providers of cyber threat intelligence data may comprise IT vendors and government organizations, who may cooperate and exchange intrusion data of information about cyber risks to protect IT systems from security attacks. The term “indicator of compromise” (IoC) may denote, in computer forensics and IT security, an artifact observed on, e.g., a network or in an operating system that with high confidence indicates a computer intrusion. Typical IoCs may comprise virus signatures and IP addresses, MD5 hashes of malware files, and/or URLs or domain names of botnet commands and control servers. After IoCs have been identified in a process of incident response and computer forensics, they can be used for early detection of future attack attempts using intrusion detection systems and antivirus software. Known indicators may be exchanged within the industry. IoCs may be used to detect a cyberattack early on. They may also be used to identify partial cyberattack chains, e.g., as early as during the first or second wave of the chain. The term “relevance of the cyberattack chain” may denote an importance of a specific cyberattack or security threat—in particular, of a cyberattack chain—for the given resource constraint device e.g., if the device is not operatively active for or with a SQL database, the relevance of a cyberattack chain aiming to undermine the integrity of the SQL database—e.g., an SQL injection—can be seen as low or non-existent. The term “security measure” may denote an action or function to counteract on cyberattacks or in order to detect such cyberattacks or attack attempts. Furthermore, the security measure may be defined as relevant if the security measure mitigates known threats to assets of the device that are, in principle, vulnerable to the threats. Relevance for a newly discovered security issue might be extremely high, even if there have no hits/findings been recorded to date. In this case, the value of the given security measure may be very high in anticipation of an impending, possible attack. More details on the dependencies to the security measure value calculation are described in the context of FIG. 2. The term “response to the IoC” may refer to an activity that the device and/or its operating software may undertake to counteract a security threat. This may comprise a deletion, or at least isolation or suppression, of received data or signals. The term “resource consumption” may denote the amount of computing resources and/or energy required to perform a specific, typically predefined, task. The term “benefit value” may denote the sum of values over all IoCs. This may require a base relevance (e.g., =1) for all IoCs not comprised in the threat intelligence feed. For example, each port scan detected and blocked by a firewall originating from an Internet Protocol (IP) address not listed as an IoC, adds a base value to the security measure firewall. The term “susceptibility value” may denote a value that rates the applicability of a cyberattack chain to the environment by comprising the components of the environment, and it may be expressed by the detections of IoCs related to the cyberattack.