Preventing vulnerable configurations in sensor-based devices
Aspects of the invention include a computer-implemented method, including performing simulations of a form of cyber-attack based on different input parameters to determine a respective time to perform each cyber-attack on a plurality of features of a sensor-based device. Additionally, performing simulations of a plurality of mitigating processes for each cyber-attack based on different input parameters to determine a respective time to perform each mitigating process. An associated risk level of each cyber-attack is determined based at least in part on the simulations. A mitigation process is selected based at least in part on the associated risk levels.
1. A computer-implemented method comprising:
performing, using a processor, simulations of a form of cyber-attack based on a first set of different input parameters to determine a respective time to perform each cyber-attack on a plurality of features of a sensor-based device;
performing, using the processor, simulations of a plurality of mitigating processes for each cyber-attack based on a second set of different input parameters to determine a respective time to perform each mitigating process;
determining an associated risk level of each cyber-attack based at least in part on the simulations;
building a list of possible mitigation processes based on a comparison of the respective times to perform each cyber-attack and the respective times to perform each mitigating process;
receiving, from the sensor-based device, usage data for each of the plurality of features, wherein the usage data for a respective feature defines a percentage usage of the respective feature;
modifying the list of possible mitigation processes to ignore each feature having a percentage usage above a predetermined threshold;
selecting a mitigation process from the modified list of possible mitigation processes based at least in part on the associated risk levels; and
completing, by the processor, the mitigation process selected from the modified list by modifying code of the sensor-based device.
2. The computer-implemented method of claim 1 , wherein the mitigation process comprises disabling a feature of the sensor-based device.
3. The computer-implemented method of claim 1 further comprising:
providing a list of features and associated risk-levels.
4. The computer-implemented method of claim 1 further comprising:
retrieving a configuration file and a firmware file from the sensor; and
using parameters retrieved from the configuration file and the firmware file to perform the simulations.
5. The computer-implemented method of claim 1 further comprising:
determining a probability of the cyber-attack occurring, wherein the associated risk-level is based at least in part on the probability.
6. The computer-implemented method of claim 1 , wherein the first set of different input parameters of the form of cyber-attack comprise variation in resources used to perform the cyber-attack.
7. The computer-implemented method of claim 1 , wherein the second set of different input parameters of the mitigation processes comprise variation in resources used to perform the mitigation processes.
8. A system comprising:
a memory having computer readable instructions; and
one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:
performing, using a processor, simulations of a form of cyber-attack based on a first set of different input parameters to determine a respective time to perform each cyber-attack on a plurality of features of a sensor-based device;
performing, using the processor, simulations of a plurality of mitigating processes for each cyber-attack based on a second set of different input parameters to determine a respective time to perform each mitigating process;
determining an associated risk level of each cyber-attack based at least in part on the simulations;
building a list of possible mitigation processes based on a comparison of the respective times to perform each cyber-attack and the respective times to perform each mitigating process;
receiving, from the sensor-based device, usage data for each of the plurality of features, wherein the usage data for a respective feature defines a percentage usage of the respective feature;
modifying the list of possible mitigation processes to ignore each feature having a percentage usage above a predetermined threshold;
selecting a mitigation process from the modified list of possible mitigation processes based at least in part on the associated risk levels; and
completing, by the processor, the mitigation process selected from the modified list by modifying code of the sensor-based device.
9. The system of claim 8 , wherein the mitigation process comprises disabling a feature of the sensor-based device.
10. The system of claim 8 , the operations further comprising:
providing a list of features and associated risk-levels.
11. The system of claim 8 , the operations further comprising:
retrieving a configuration file and a firmware file from the sensor; and
using parameters retrieved from the configuration file and the firmware file to perform the simulations.
12. The system of claim 8 , the operations further comprising:
determining a probability of the cyber-attack occurring, wherein the associated risk-level is based at least in part on the probability.
13. The system of claim 8 , the operations further comprising:
determining a usage of each feature of the sensor, wherein the selected mitigation process is based at least in part on the usage.
14. The system of claim 8 , wherein the first set of different input parameters of the form of cyber-attack comprise variation in resources used to perform the cyber-attack.
15. The system of claim 8 , wherein the second set of different input parameters of the mitigation processes comprise variation in resources used to perform the mitigation processes.
16. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:
performing, using a processor, simulations of a form of cyber-attack based on a first set of different input parameters to determine a respective time to perform each cyber-attack on a plurality of features of a sensor-based device;
performing, using the processor, simulations of a plurality of mitigating processes for each cyber-attack based on a second set of different input parameters to determine a respective time to perform each mitigating process;
determining an associated risk level of each cyber-attack based at least in part on the simulations;
building a list of possible mitigation processes based on a comparison of the respective times to perform each cyber-attack and the respective times to perform each mitigating process;
receiving, from the sensor-based device, usage data for each of the plurality of features, wherein the usage data for a respective feature defines a percentage usage of the respective feature;
modifying the list of possible mitigation processes to ignore each feature having a percentage usage above a predetermined threshold;
selecting a mitigation process from the modified list of possible mitigation processes based at least in part on the associated risk levels; and
completing, by the processor, the mitigation process selected from the modified list by modifying code of the sensor-based device.
17. The computer-program product of claim 16 , wherein the mitigation process comprises disabling a feature of the sensor-based device.
18. The computer-program product of claim 16 , the operations further comprising:
providing a list of features and associated risk-levels.
19. The computer-program product of claim 16 , the operations further comprising:
retrieving a configuration file and a firmware file from the sensor; and
using parameters retrieved from the configuration file and the firmware file to perform the simulations.