# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### App Analyses  
Apps are important platforms for users to view and control device statuses. While bringing convenience to users, apps also increase new attack surfaces. Researchers have paid attention to security problems in apps, such as information leakage and unauthorized access.  
Previous studies have revealed various security faults, which allow malicious smart home apps to possess more privileges than in the original design, in the Samsung SmartThings platform. HoMonit [51] leverages side-channel inference capabilities to monitor SmartApps from encrypted wireless traffic. It compares the SmartApps activities inferred from the encrypted traffic with their expected behaviors obtained from their source code or UI interfaces and provides a dataset of 60 misbehaving SmartApps. After analyzing 181 official SmartApps, HoMonit finds 60 malicious SmartApps, which either perform overprivileged accesses or conduct event-spoofing attacks.  
SAINT [52] is a static taint analysis tool for sensitive information tracking in SmartThings apps. SAINT first translates IoT source code into an intermediate representation (IR) and then identifies sensitive sources and sinks to detect sensitive data flows. After being tested on IoTBench, an IoT-specific test corpus containing 168 official and 62 third-party SmartThings apps, SAINT flags out 138 apps that leak at least one kind of sensitive data.  
IoTMon [53] is a framework that guarantees safe interaction controls across apps. It leverages static program analysis and the natural language processing (NLP) technique to analyze intra-app actions and identify all interaction chains. IoTMon also assesses the inter-app interaction chains for their safety risk. The authors evaluated IoTMon on 185 official apps and found 162 unknown inter-app interaction chains, 37 of which posed high risks to physical environment security.  
IoTGuard [54] is a framework that protects users from dangerous and harmful device states with three components: code instruments, data collectors, and security services. IOTGUARD first inserts extra logic to characterize an app's information at runtime. Then, the data collector stores the app's information in a dynamic model that represents the individual or unified behavior of the app depending on whether the app interacts with other apps. Finally, when receiving an app's information, the security service checks if the app's action passes a policy and decides to notify the app with a rejecting or passing message. IOTGUARD was evaluated on 65 real-world targets, and it enforced 11 policies and blocked 16 abnormal device states in 11 (17%) apps.  
[PERSON] et al. [55] proposed a semantic framework to study cross-app interaction security. They presented an extensional condition as well as a syntactic condition for safe cross-app interactions. Moreover, they introduced a flow-sensitive security-type system to guarantee the confidentiality and integrity of implicit interactions and priorities. Finally, the authors used commercial apps to prove the practical effectiveness of the proposed framework.  
To discover IoT devices' vulnerabilities caused by component reuse, [PERSON] et al. [56] automatically analyzed mobile companion apps on a large scale. They collected apps from the Google Play store and then leveraged device interface analysis, imprint analysis, and fuzzy hash analysis to detect similar devices from four aspects: software, hardware, protocol, and backend services. Finally, they marked 324 devices spanning 73 vendors as potentially vulnerable, and 164 devices were confirmed, with an accuracy of approximately 50%.