# \"Network Sentiment\" Framework to Improve Security and Privacy for Smart Home
## 3 SHIELD System
It is worth noticing that the probe points should be connected to a master IDS engine through a secure side-channel, and that the load balancing between the master IDS and the probes depends on the side-channel congestion and the energy consumption of each device. Even if this is an important point, we will not further analyze it, leaving a full analysis to a future paper. In the security system for a smart home, hereafter called SHIELD system, the (SCN) is the element in the ISP network that is responsible for (a) firewalling the ISP and users networks from attacks originating from the outside of the ISP network, (b) analyzing the traffic to spot suspicious traffic and (c) collecting all the data from the ISP IDS. The network element responsible for protecting the home network side is the (SH). From a logical point of view, the entities are two, the SHIELD Firewall and the SHIELD IDS Aggregator. The first is responsible for filtering the traffic from and to the ISP, while the second controls and harmonizes all the different IDSs present in the SH network. The SH is responsible for (i) correctly configuring the IDS to match the threats that are meaningful for the Smart Home environment (e.g., by silencing the alarms for patched devices), (ii) activating security countermeasures (e.g., firewall rules, to block further communications from the attacked sensor) for actively exploited vulnerabilities. Figure 1: SHIELD Architecture. The 'core' of the SHIELD architecture is the (SLU). This entity receives all the (anonymized) IDSs alarms and warnings from all the SH in the ISP domain. The SLU focuses on discovering various relations between individual warnings/alerts and, according to alert correlation scores, it can change the _Network Sentiment_ level and take various countermeasures, e.g., modify the firewalls configurations, block further communications from the attacked IP address, up to block further communications between the attacked Smart Home domain and Internet. In the SLU, the _Network Sentiment_ processor analyzes similarities scores among different smart home networks, in order to implement preemptive countermeasures in these networks. As a matter of fact, it is more than possible that an attack will propagate to smart home networks 'close' to the network under attack, as shown in Figure 2.  
The SLU logic is presented in Figure 3, where it is outlined the different behavior with respect to an ongoing attack (_Alarm_) and to a possible attack (_Warning_). The first triggers an immediate reaction, while the second is evaluated according to the frequency of similar warning alerts, and the presence of similar warnings sent by different users. The SLU evaluates the attack type, the possible outcomes, and can select the most appropriate mitigation techniques, eventually modifying the ISP-level firewall rules. However, the most important element of the SLU is, in our opinion, the capability to propagate the _Network Sentiment_, i.e., the overall status of the network with respect to on going attacks, to the different SH units. This feature enables a _preemptive_ security approach, where a SH is 'immunized' from an attack that did target another SH (Figure 2). Moreover, the SLU can issue periodic or triggered warnings (e.g., e-mails, messages on the SH display, on application etc.) to inform the users about the firewalling decisions, how to improve the network security, etc. In this way, the users should be able to customize the system to better suit their needs. As an example a non-technical user could aim for maximum automatic protection, while a skilled user could decide to ignore some threats and planned actions (at his own risk). Figure 2: SHIELD blocks interaction.