# \"Network Sentiment\" Framework to Improve Security and Privacy for Smart Home  
Department of Information Engineering, Universita di Firenze, Via di Santa Marta 3, 50139 Firenze, Italy; [EMAIL_ADDRESS] (T.P. ); [EMAIL_ADDRESS] (F.N.) Department of Information Engineering, Universita di Firenze, Via di Santa Marta 3, 50139 Firenze, Italy; [EMAIL_ADDRESS] (T.P. ); [EMAIL_ADDRESS] (F.  
Unfortunately, the obvious security approaches are not really feasible: (i) upgrading the software of the vulnerable appliances is often impossible (the end-users have often limited capabilities), (ii) substituting them with more secure devices is not a viable solution (too expensive for Home scenario), and (iii) blocking their traffic preemptively might prevent their functionality altogether. Moreover, classical security approaches (i.e., the use of restrictive rules for firewalls, strong authentication system to access the network, e.g., IEEE 802.1X) are designed for those attacks which are not in the interior network while the IoT devices are vulnerable to intrusion both from Internet than from wireless attacks originated from inside the smart home network. To make effective the connections of resource-constrained IoT devices the IPv6 over Low-Power Wireless Personal Area Networks (6 LoWPAN) are standardized [6], empowered by protocols such as 6 LoWPAN adaptation layer [7], Routing Protocol for Low Power and Lossy Networks [8] and the Constrained Application Protocol (CoAP) [9; 10]. The 6 LoWPAN network uses compressed IPv6 protocol for networking and IEEE 802.15.4 as data-link and physical layers protocol. Each layer in 6 LoWPAN can be vulnerable to security threats and, unfortunately, standard preventive security mechanisms, such as cryptography and authentication, cannot detect all possible attacks, such as insider attacks (e.g., routing attacks) or a guy who uses a legal key but has malicious intent. As consequence, (IDS)s specifically designed for IoT are necessary as a second line of defense to provide more security awareness and to add some dynamic threat protection functionalities to a network. All these actions are not easy for a normal user, and they limit the network usability. For these reasons the network security is often neglected in many domestic networks, and even in some enterprise ones. We believe that the network itself must adaptively react to new threats, increasing the security measures when there is an effective, on going, vulnerability exploitation, and relaxing the rules when there is no real threat. In the following, we will call the dynamic threat evaluation as _network sentiment analysis_. With respect to this, the paper shows an architecture, called SHIELD, with a distributed firewalls and threat analysis system. One part of the security infrastructure must be as close as possible to the user, potentially at the user's premises, and another part in the (ISP) network. Our contribution over the state of the art is about the way these elements should be integrated. In the past the firewalls acted as separate entities. We argue that all the user firewalls and IDSs should be part of an integrated ecosystem, reacting dynamically to new and ongoing threats. In this vision, the whole system should be orchestrated by a coordinator hosted by the ISP (or by any secure and trusted provider), which is responsible for evaluating the risk measure of each user and of the ISPs as a whole. In this vision, if the network sentiment level of a smart home network is increased due to the risk of attack, this information can be propagated to the nearby smart home networks (e.g., in the different apartments in the same building) which can take counteractions automatically establishing a real time Intrusion Prevention System (IPS).