# \"Network Sentiment\" Framework to Improve Security and Privacy for Smart Home
## 3 SHIELD System  
In a Smart Home each Internet-connected device has its own peculiar security and availability requirements. There are still a number of issues to be addressed, particularly in the IoT network section, related to the devices deployment and initialization. As mentioned in the Introduction, we believe that the real problem is to have a dynamic security protection system able to react to possible threats by reconfiguring in real-time the security defenses of the network (e.g., firewalls). As a matter of facts, the main problem with traffic filtering is the user. If the firewall is too restrictive, the user (if he/she is an expert) will disable (or circumvent) it. If the firewall is too restrictive, it is useless. Moreover, the vast majority of the users do not have the technical skills to understand the firewall configuration and to autonomously update the firewall rules if a new threat is discovered. A common approach is to protect the user with an ISP-level firewall, but this architecture is not scalable and it does not adapt to the needs of different users. Moreover, the attack could be originated from inside the Smart Home network thanks, e.g., to an infected mobile device. For this reason we think that it is mandatory to provide both types of protection: at ISP level and in the user's premises. Therefore it is necessary the use of IDSs to add end-to-end threats protection to the smart home network and the Internet [29]. Signature-based and anomaly behaviour-based IDSs are extremely useful, but they are even more difficult to configure for the end-user. Moreover, any IDS kind is subject to a lot of false warnings, either false positives or about attacks that cannot succeed (e.g., an attack aimed at a type of device that is not in the network). In order to avoid an excessive computational complexity on the IDS, only the relevant threats for a given network should be trapped, plus the ones that are believed to be actively being exploited by attackers. As a consequence, IDS as well must be dynamically configured in response to on going threats. Moreover, signature and anomaly based IDSs analyze usually data traffic while new IDS should be specifically designed for IoT smart home environment where the attacks can also be the altering, e.g., of the reported data from sensors, or the controls of actuators. In 6 LoWPAN networks, 6 LoWPAN border routers (6 LBR) are used to integrate the WSN with Internet and thanks to their resources availability they can support intrusion detection system and generate alerts. As consequence, a hybrid topology for IDSs can be envisaged where detection capability are distributed and with a central unit responsible for decision operations and countermeasures. For this reason, we propose to adopt the architecture outlined in Figure 1. This architecture is designed to guarantee the interoperability with existing Internet standards and the communications of sensing devices with other Internet components in the context of future IoT distributed applications. In Figure 1, we outlined the three major components of a Smart Home environment: devices connected by high-bandwidth wireless networks (typically Wi-Fi), devices connected through cables (Ethernet, Power Line Communications, etc. ), and IoT devices--in the figure the IoT devices are represented as IEEE 802.15.4 nodes, but other standards are possible. Furthermore, IoT devices can be differentiated according to their role and their security/reliability requirements [30]. Each device type and every connection technology needs its own particular detection approach. As an example, wired connections need only a wiretap on the main switch (usually the home gateway), while special receivers will be needed for wireless connections (e.g., high gain antennas). To detect attacks in multihops networks (e.g., IEEE 802.15.4) it is possible to use multiple probing point on special nodes.