## 6 STRIDE and LINDDUN Analysis of Threats in the Smart Home Domain  
This section focuses on our analysis of the impact of filtering on the four scenarios (see Section 5) and their data flows from the Smart Home domain. We identify possible attacks and their impacts using the modified versions of STRIDE per element for security and LINDDUN per element for privacy-related threats. Threat analysis was performed by manually analysing each component involved in the scenario, possible attack vectors, and their impact. We believe that since the scenarios used are generalised architectures typical for Smart Home, the results can be applied to create filtering rules regardless of how they are produced, manually by the user, by copying, or by AI (see Section 2.5). Figure 10: Data Flow Diagram of Scenario \(\delta\) (indirect control). Figure 9: Data Flow Diagram of Scenario \(\gamma\) (guest access). In order to clearly present the results of our threat analysis, we provide comprehensive tables for each scenario that include possible threats and related impacts and reflect the influence of filtering. Each threat (spoofing, tampering, likability, etc.) is presented in the form of a table. Several tables are combined with each other with respect to the analysis technique (STRIDE or LINDDUN). In general, there are the following columns (see Figure 11):  
_Threat Target_ is a device or communication line that is the subject of a threat (e.g., Smart Home Device, Smart Hub, CS \(\rightarrow\) SHD, etc.). _Threat Impact_ includes the possible influence of the threat on the _Threat Target_ (e.g., a device can receive a malicious firmware update). _Attack Vectors_ contain one or more possible attack vectors leafing to the associated _Threat Impact_ (e.g., an attacker being able to send the malicious firmware by impersonating the update server using stolen credentials). In order to visualise the impact of filtering, a traffic-light-coloured rating with four scales is used:  
_No or only low_ (grey) influence means that the application of filtering either has absolutely no effect on the fulfilment of the attack or has such a negligible effect that the attack is still successful and has the same impact as without filtering. On the other end of the scale, a _High_ (green) influence of filtering is determined when, if it is applied, the attack cannot be successfully completed or the impact of a successful attack is negligible. Based on these ratings, the influence on STRIDE and LINDDUN impacts in the tables is aggregated using the minimum level that was assessed for any of the vectors leading to it (see the impacts in the second column as shown in Figure 11). For compactness, the impacts and attack vectors are symbolised by a sequence of three characters, which can be seen in Appendix A in Tables A1 and A2 for STRIDE and Tables A3 and A4 for LINDDUN. Note that we skipped the _Information Disclosure_ threat in LINDDUN modelling to avoid unnecessary redundancy, as that threat is already included in STRIDE. Additionally, the _Non-Repudiation_ threat of LINDDUN is not present while the _Repudiation_ threat of STRIDE is. In our evaluation, we assume that non-repudiation (non-repudiation is the goal to which repudiation is the threat in STRIDE terminology) has a higher priority from a security point of view than plausible deniability. (Plausible deniability is the goal to which non-repudiation is the threat in the LINDDUN terminology. This assumption can be challenged. For example, from a privacy perspective, a resident may want to hide their  
Figure 11: Explanation of the STRIDE and LINDDUN threat tables used to show the impact and attack vectors and colour coding to indicate the potential positive impact of filtering in this scenario. actions from others; e.g., if a teenager is leaving their parent's house late at night but wants to hide this from his parents.