# Securing the Future of Web-Enabled IoT: A Critical Analysis of Web of Things Security
## 1 Introduction  
The Web of Things (WoT) extends the Internet of Things (IoT) by integrating web technologies with everyday objects, enabling them to communicate and interact via the web. This integration facilitates seamless connectivity and control, enhancing user experiences and creating new opportunities for innovation. The WoT leverages standard web protocols, such as HTTP, WebSockets, and RESTful APIs, to allow devices to interact over the web, making these devices more accessible and easier to manage. However, this integration also introduces significant security challenges, as the web-based nature of the WoT expands the attack surface and exposes devices to web-specific threats [1, 2]. The security aspects of the WoT are multifaceted, encompassing a broad spectrum of threats including unauthorized access, data breaches, and denial of service (DoS) attacks. Unauthorized access can occur when attackers exploit vulnerabilities in web interfaces or authentication mechanisms to gain control over devices [3, 4]. Data breaches may result from weak encryption practices or insufficient access controls, leading to the exposure of sensitive information [5, 6]. DoS attacks can disrupt the normal operation of WoT devices by overwhelming them with traffic or exploiting vulnerabilities in network protocols [7]. Additionally, the dynamic and heterogeneous nature of WoT environments, which often include devices with varying capabilities and security standards, exacerbates these security issues [8]. Traditional security measures designed for conventional web applications or IoT devices may not be sufficient to address the unique challenges posed by the WoT [9]. This complexity necessitates the development of specialized security solutions tailored to the specific requirements of the WoT [10]. Despite the growing importance of the WoT, there is a significant gap in comprehensive research focusing on its unique security challenges. Most existing studies tend to conflate the WoT with the IoT, overlooking the specific vulnerabilities introduced by the integration of web technologies [11; 12]. This oversight can lead to inadequate threat models and insufficient defenses, leaving WoT systems vulnerable to attacks. Furthermore, there is a lack of standardized approaches to threat enumeration and defense mechanisms tailored specifically for the WoT, which complicates efforts to secure these systems effectively [13]. This paper aims to fill this gap by providing a critical analysis of WoT security. The contributions of this research are as follows:  
* Threat analysis: we identify and analyze different approaches to threat enumeration in WoT, highlighting common misconceptions that distort classifications;
* Architectural models: we propose an abstract architectural model for the WoT using UML, offering precise analysis and design tools compared to traditional block diagrams or TOSCA models;
* Sequence diagram for WoT use cases: we introduce a sequence diagram for the \"Adjust Irrigation\" use case, showcasing how an IoT moisture sensor interacts with other components within the WoT architecture. This diagram highlights the flow of information and control in a typical WoT scenario;
* Attack modeling: we extend our modeling efforts by introducing a Man-in-the-Middle (MitM) attack in a use case \"adjust irrigation\". The sequence diagram illustrates how an attacker can intercept and manipulate communication between components;
* Survey of defenses: we review and assess proposed defenses against identified threats to obtain a global view of current security levels and detect possible weaknesses;
* Research directions: we discuss directions for future research to improve and extend various aspects of WoT security and identify missing defenses. The rest of the paper is structured as follows. Section 2 provides an overview of IoT and WoT technologies, and a background on architectural modeling using patterns and reference architecture.