情報処理学会 第81回全国大会講演要旨

In the Internet of Thing (IoT) environment, objects are connected together on a network to share data, However, some of the IoT devices are developed and deployed with poor security consideration. As a result these devices became a target of attacks. In this paper, we will propose a framework for automated End-to-End penetration testing for IoT network. Penetration testing is used to check and identify the risks of a network. The existing penetration testing deployed based on the expert testers who have the knowledge to perform a manual test using many tools, but this kind of manual Pen-test cause some problem such as high cost and low efficiency. Moreover, the existing penetration test doesn’t consider End-to-End test for a system. Due to such shortages our framework will test the network automatically and from End-to-End (i.e., End devices, wireless communication between devices and the control unit, then communication to cloud server, and finally communication from the cloud to end user through mobile app or webpage). The proposed framework will automatically gather the information of the target IoT network and then preform various kinds of penetration testing through the network. Then it will summarize the results of Pen-test and gives the recommendations to secure a system.