Human-as-a-Sensor: Where the IoT and Physical Safety Meet

April 9, 2018

The security of the Internet of Things (IoT) is a constant topic of discussion, with the focus typically on the devices it connects. However, IoT also intersects with the worlds of law enforcement and public safety, and that connection has been growing in recent years.

Though not yet well known, the Human-as-a-Sensor (HaaS) paradigm is one worth focusing on. Unlike much of what we talk about with IoT, HaaS doesn’t rely on automated sensors at all — instead, it’s based on people reporting incidents they witness through mobile apps. Law enforcement is then able to aggregate this data in order to build a better sense of the emergencies at hand, and which ones to respond to first.

As you might expect, this technology is not without its cybersecurity threats. A team of researchers from the University of Greenwich set out to determine the exact ways in which cybercriminals can manipulate HaaS, and how law enforcement can ensure that it gets credible real-time information. You can find the full paper on IEEE Xplore here, but three of the key threats are listed below.

How Human-as-a-Sensor Can Be Manipulated

Location spoofing
“Would-be attackers are able to send false reports that would appear to originate from any specific physical location of their choice.” This can throw responders off the trail of the crime.
DDoS attacks
“Network-based denial of service attacks against mobile devices can result in crime report messages being queued or dropped completely when network connectivity is lost or saturated.”
GPS spoofing
“Here, the location is spoofed not programatically, but by generating fake GPS signals using a software-defined radio (SDR) transmitter.”

As for how to combat these threats, the researchers had a few ideas. Doing so isn’t simple, determining whether a device is under attack or not doesn’t give law enforcement a sense of whether any of the data is useful. “A more practical approach would be to utilize the class probability of a report (i.e., the likeliness of the device being under attack / an attacker or not) to evaluate a mobile device’s cyber trustworthiness,” states the IEEE Xplore paper.

The trick, according to the researchers, is to score reports based on features of the mobile device that can be monitored in real time. For example, CPU and RAM usage can be a clue – random upticks when the phone isn’t being used are red flags. Location accuracy is another since location services can be compared to Wi-Fi and Bluetooth information.

Read the full paper to learn about the other detection methods they identified, and what role machine learning is playing in facilitating emergency response.

FOR MORE INFORMATION
Assessing the cyber-trustworthiness of human-as-a-sensor reports from mobile devices. The Human-as-a-Sensor (HaaS) paradigm, where it is human users rather than automated sensor systems that detect and report events.