Systems and methods for simulating events and attack vectors associated with embedded devices using injectable grammar
Systems and methods are provided for creating simulations and attack vectors related to events surrounding embedded and/or Internet of Things (IoT) devices using injectable grammar. According to one implementation, a server, arranged in a network environment, includes a processing device and a memory device configured to store a management program having logic. The logic enables the processing device to perform a step of incorporating a grammar template into the management program. The management program includes a grammar template that simulates events associated with the embedded devices, and is configured to manage the definition of the associated events. The logic further enables the processing device to perform a step of executing the grammar template in the network environment, yet outside of a sandbox environment, to simulate the events associated with the embedded devices.
1 . A server arranged in a network environment, the server comprising:
a processing device; and
a memory device configured to store a management program having logic that enables the processing device to perform steps of
incorporating a grammar template into the management program, wherein the management program is configured to manage events originating from embedded devices deployed in the network environment, and wherein the grammar template is configured to simulate events associated with the embedded devices by defining a base grammar and injecting randomization components into the base grammar, and
cause execution of the grammar template by transmitting the grammar template from the server to one or more embedded devices deployed in the network environment and causing each of the one or more embedded devices outside of a sandbox environment, to locally execute the grammar template to simulate the events associated with the embedded devices.
2 . The server of claim 1 , wherein the grammar template includes the base grammar and an extension, and wherein the extension is configured to inject randomization components into the base grammar.
3 . The server of claim 1 , wherein the management program includes a simulation module configured to simulate the events associated with the embedded devices according to the grammar template.
4 . The server of claim 3 , wherein the simulation module includes a device simulator configured to simulate events associated with a deployment of the embedded devices in the network environment.
5 . The server of claim 3 , wherein the simulation module includes an attack simulator configured to simulate events associated with a mock attack on embedded devices deployed in the network environment.
6 . The server of claim 5 , wherein the attack simulator is configured to receive telemetry data from one or more of the embedded devices being exposed to the mock attack to determine whether the management program is able to identify the mock attack and respond appropriately.
7 . The server of claim 1 , wherein the management program includes a monitoring module configured to monitor the embedded devices when the embedded devices are deployed within or outside a perimeter of the network environment.
8 . The server of claim 7 , wherein the monitoring module is configured to receive information from each of the embedded devices related to one or more of a) an identifier of the embedded device, b) an identifier of an electronic device in which the embedded device is housed, c) telemetry data of the electronic device, d) an alert related to one or more issues with the electronic device, and e) registration information.
9 . The server of claim 1 , further comprising a network interface enabling access to the Internet, wherein each embedded device is a computing system housed within an electronic or electromechanical device, and wherein each embedded device is configured to detect operating metrics of the respective electronic or electromechanical device and transmit the operating metrics to the network interface via the Internet.
10 . The server of claim 9 , wherein the embedded devices are associated with Internet of Things (IoT) devices.
11 . The server of claim 1 , wherein the server is part of a Trust Service Provider (TSP).
12 . A non-transitory computer-readable medium configured to store computer logic having instructions that, when executed, cause one or more processing devices to:
incorporate a grammar template into a management program, wherein the management program is configured to manage embedded devices deployed in a network environment, and wherein the grammar template is configured to simulate events associated with the embedded devices by defining a base grammar and injecting randomization components into the base grammar; and
cause execution of the grammar template by transmitting the grammar template from the server to one or more embedded devices deployed in the network environment and causing each of the one or more embedded devices, outside of a sandbox environment, to locally execute the grammar template to simulate the events associated with the embedded devices.
13 . The non-transitory computer-readable medium of claim 12 , wherein the grammar template includes the base grammar and an extension, and wherein the extension is configured to inject randomization components into the base grammar.
14 . The non-transitory computer-readable medium of claim 12 , wherein the management program includes a simulation module configured to simulate the events associated with the embedded devices according to the grammar template.
15 . The non-transitory computer-readable medium of claim 14 , wherein the simulation module includes a deployment simulator configured to simulate events associated with a deployment of the embedded devices in the network environment.
16 . The non-transitory computer-readable medium of claim 14 , wherein the simulation module includes an attack simulator configured to simulate events associated with a mock attack on embedded devices deployed in the network environment.
17 . The non-transitory computer-readable medium of claim 16 , wherein the attack simulator is configured to receive telemetry data from one or more of the embedded devices being exposed to the mock attack to determine whether the management program is able to identify the mock attack and respond appropriately.
18 . A method comprising the steps of:
incorporating a grammar template into a management program of a server, wherein the management program is configured to manage embedded devices deployed in a network environment, and wherein the grammar template is configured to simulate events associated with the embedded devices by defining a base grammar and injecting randomization components into the base grammar, and
cause execution of the grammar template by transmitting the grammar template from the server to one or more embedded devices deployed in the network environment and causing each of the one or more embedded devices outside of a sandbox environment, to locally execute the grammar template to simulate the events associated with the embedded devices.
19 . The method of claim 18 , wherein the management program includes a monitoring module configured to monitor the embedded devices when the embedded devices are deployed within or outside the network environment, and wherein the monitoring module is configured to receive information from each of the embedded devices related to one or more of a) an identifier of the embedded device, b) an identifier of an electronic device in which the embedded device is housed, c) telemetry data of the electronic device, d) an alert related to one or more issues with the electronic device, and e) registration information.
20 . The method of claim 18 , wherein each embedded device is a computing system housed within an electronic or electromechanical device, and wherein each embedded device is configured to detect operating metrics of the respective electronic or electromechanical device and transmit the operating metrics to the management program via the Internet.