Emerging Internet of Things (IoT) platforms provide sophisticated
capabilities to automate IoT services by enabling occupants to create
trigger-action rules. Multiple trigger-action rules can physically interact
with each other via shared environment channels, such as temperature, humidity,
and illumination. We refer to inter-rule interactions via shared environment
channels as a physical inter-rule vulnerability. Such vulnerability can be
exploited by attackers to launch attacks against IoT systems. We propose a new
framework to proactively discover possible physical inter-rule interactions
from user requirement specifications (i.e., descriptions) using a deep learning
approach. Specifically, we utilize the Transformer model to generate
trigger-action rules from their associated descriptions. We discover two types
of physical inter-rule vulnerabilities and determine associated environment
channels using natural language processing (NLP) tools. Given the extracted
trigger-action rules and associated environment channels, an approach is
proposed to identify hidden physical inter-rule vulnerabilities among them. Our
experiment on 27983 IFTTT style rules shows that the Transformer can
successfully extract trigger-action rules from descriptions with 95.22%
accuracy. We also validate the effectiveness of our approach on 60 SmartThings
official IoT apps and discover 99 possible physical inter-rule vulnerabilities.

提出使用深度学习方法从用户需求描述中主动发现可能的物理互规则相互作用的新框架，并利用 Transformer 模型从描述中生成触发 - 动作规则，通过自然语言处理工具发现两种类型的物理互规则漏洞并确定相应的环境通道，进一步提出一种方法来识别其中的隐藏物理互规则漏洞。在 27983 个 IFTTT 样式规则的实验中，Transformer 能够以 95.22% 的准确率从描述中提取触发 - 动作规则，同时在 60 个 SmartThings 官方物联网应用程序上验证了我们方法的有效性，并发现了 99 个可能的物理互规则漏洞。