The widespread adoption of IoT devices and applications in smart homes has transformed the way we engage with our living environments. While enabling seamless automation and intelligent functionalities, interactions between different IoT applications, typically through trigger-condition-action (TCA) rules, may introduce new interaction threats due to rule conflicts, which sometimes lead to severe security and safety risks. However, existing detection and defense approaches often tackle specific threat categories in isolation, thereby failing to deliver a holistic perspective and robust, comprehensive protection. In this paper, we present InteractionShield, a novel framework that systematically detects and resolves rule conflicts by leveraging a logic analysis model based on event relations. The InteractionShield framework formalizes event relationships, detects event interferences, and classifies rule conflicts. It generates risk scores and conflict rankings to enable comprehensive conflict detection and risk assessment. To address the identified interaction threats, an optimization-based approach is employed to mitigate risks while maintaining system functionality. Evaluated on large-scale real-world IoT datasets, InteractionShield effectively enhances system reliability, offering a robust solution for detecting and resolving rule conflicts in smart environments.

The increasing use of the Internet of Things (IoT) technology has made our lives convenient, however, it also poses new security and privacy threats. In this work, we study a new type of privacy threat enabled by cross-app chains built among multiple seemingly benign IoT apps. We find that interactions among apps could leak privacy-sensitive information, e.g., users' identification, location and tracking, activity patterns, etc. To tackle this challenge, we introduce PrivacyGuard, which extracts cross-app chains in the form of trigger-condition-action rules and identifies the corresponding privacy leakage risk with an inference probability. PrivacyGuard supports a fine-grained categorization of privacy threats to generate detailed alerts about privacy leakages. We evaluated PrivacyGuard on a dataset with 2,101 SmartApps, 2,788 IFTTT rules, and 2,086 OpenHAB rules, respectively. The results show that PrivacyGuard could uncover hidden privacy leaks that existing studies fail to detect. For example, 7.67% chains constructed by two seemingly benign IoT apps could leak at least one type of privacy information, while over 80% of the leaks involved privacy information regarding Localization & Tracking and Activity Profiling.

Ethics is an important criterion for security research. This work presents the current status and trends that security researchers have taken to address ethical concerns in their studies from a data perspective. In particular, we created a dataset of 3,756 papers published in three top-tier conferences between 2010 and 2022, among which 963 papers were identified with ethical concerns. With this dataset, we provided answers to three questions regarding the current practices and trends: (1) What is the landscape of ethical considerations in security research? For example, how many security research projects have raised ethical concerns in their studies, and which research areas are likely to cause ethical risks and concerns? (2) What are the current practices to address these ethical risks? And (3) What are the important factors impacting the ethical awareness of researchers?