# Securing the Future of Web-Enabled IoT: A Critical Analysis of Web of Things Security
## 4 Threat Modeling
### Threats Enumeration  
Threat enumeration can be organized in several ways:  
* By Type: Threats can be categorized based on their nature, such as misuse of resources or malicious insiders [38]. These types of threats typically impact multiple parts of a system and are not confined to specific architectural locations.
* By Architectural Layers: This method involves analyzing threats at specific levels within the system architecture, as well as interlevel threats where vulnerabilities at lower levels facilitate attacks at higher levels. A detailed model of the system architecture is required for this approach [35].
* By System Components: Identifying threats within specific components, such as user interfaces or system controllers, necessitates a precise architectural model. This method focuses on pinpointing vulnerabilities in distinct parts of the system [1].
* STRIDE Method: This approach categorizes threats in system components using six categories: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. STRIDE employs data flow graphs to describe the system architecture but may overlook threats that align with attacker goals [24]. While STRIDE provides a structured way of categorizing threats, it may not fully capture the unique interaction-based threats in the WoT, particularly those specific to interconnected web devices. However, STRIDE remains beneficial for identifying classic web-related threats such as denial of service (DoS) and information disclosure.
* Attacker Goals in User Applications: This systematic method analyzes each activity within an object-oriented (O-O) use case to determine potential subversions. While it can generate numerous threats, it requires a class diagram of the system architecture to be effective [42]. This approach is especially valuable for the WoT, as it enables the identification of threats that are directly related to attacker objectives within a user application context. This is particularly relevant in WoT environments whereinteraction with devices occurs across various user applications, making it crucial to model how an attacker might aim to exploit each user-facing activity.  
Our approach combines elements from these methods to provide a holistic view of threats, ensuring that we cover both general and WoT-specific threat vectors. By leveraging the architectural layer and component-based categorizations alongside STRIDE and attacker goals, we can create a comprehensive enumeration of threats, accounting for both technical vulnerabilities and attacker objectives. This approach emphasizes the relevance of each threat type to the unique challenges in the WoT, rather than strictly categorizing threats as WoT-specific versus general.  
Further, these methods can be combined; for instance, threats can be categorized by type and architectural layers. Although no single method guarantees the identification of all threats in a system, systematic methods like use case analysis could provide a comprehensive approach. However, the use case method has not been widely applied to find threats in WoT environments. We plan to feature this in our future works.