# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 3 Approach
### Generate System-Call Dependency Graph (ScD Graph) and Calculate Importance Factor (IF)
For example, the edge connecting _SendSensorDataToEdge_ from the Physical Layer with _CollectSensorData_ from the Edge Layer is crucial for the control flow and seamless operation  
Figure 7: Call graph of IoT-based smart irrigation system (testbed). of our IoT system; it also represents a potential attack surface for attackers targeting the Edge Layer by manipulating sensor data from the Physical Layer. We have assigned higher priority to those edges than to the edges managing the control flow within a single layer. So, the weight is assigned to the edge \(e_{ij}\) connecting the nodes \(v_{i}\)_and_\(v_{j}\), as follows:  
\[w(e_{ij})=L_{P}+L_{E}+L_{C}+L_{A}+L_{N}\]  
Here,  
\(L_{P}=1\)_if either or both_\(v_{i}\)_and_\(v_{j}\)_are the process in Physical layer, otherwise_\(0\). \(L_{E}=1\)_if either or both_\(v_{i}\)_and_\(v_{j}\)_are the process in Edge layer, otherwise_\(0\). \(L_{C}=1\)_if either or both_\(v_{i}\)_and_\(v_{j}\)_are the process in Cloud layer, otherwise_\(0\). \(L_{A}=1\)_if either or both_\(v_{i}\)_and_\(v_{j}\)_are the process in Application layer, otherwise_\(0\). \(L_{N}=1\)_if either or both_\(v_{i}\)_and_\(v_{j}\)_are the process in Network layer, otherwise_\(0\). For example, in our testbed's call graph, there is an edge, \(e_{DecidetoTriggerActuator}-\)_ShowAnalysisResult&TriggerDecision_, connecting nodes \(v_{DecidetoTriggerActuator}\) and \(v_{ShowAnalysisResult&TriggerDecision}\). This _DecidetoTriggerActuator_ node is a process from the Cloud Layer and _ShowAnalysisResult&TriggerDecision_ is a process from the Application Layer. So, the weight of that edge, \(e_{DecidetoTriggerActuator-ShowAnalysisResult&TriggerDecision}\) will be  
\[w(e_{DecidetoTriggerActuator-ShowAnalysisResult&TriggerDecision})=0+0+1+1+0=2\]  
The call graph serves as the foundational structure for calculating the _IF_ of each process in the IoT system. To derive _IF_ values systematically, we developed a procedural approach leveraging the PageRank algorithm [28], which evaluates node importance based on incoming links, their respective PageRank scores, and the number of outgoing connections. The standard PageRank formula used is:  
\[PR\ (u)=\ \frac{1-\alpha}{N}+\alpha\sum_{v\in ln(u)}\frac{PR\ (v)}{d_{v}}\]  
Here \(PR(u)\) is the PageRank value of node \(u\),  
\(\alpha\) is Damping factor (in my method, there is no random teleportation, just pure link-following. So, I consider \(\alpha=1\)),  
\(N\) is the total number of nodes in the graph,  
\(\ln(u)\) is the set of nodes linking to node \(u\), incoming node to \(u\),  
\(d_{v}\) is out-degree (number of outgoing links) of node \(v\). Since our call graph is a weighted, directed graph, we extended this model using the Weighted PageRank algorithm [25]. This approach better captures the varying significance of edges by incorporating edge weights. For each node, edge weights are normalized by the total weight of all outgoing edges from that node. The formula for the Weighted PageRank becomes  
\[WPR\ (u)=\ \frac{1-\alpha}{N}+\alpha\sum_{v\in ln(u)}WPR\ (v)\frac{w\ (v,\ u)}{\sum\limits_{z\ \epsilon\ out(v)}w(v,\ z)}\]  
Here \(WPR(u)\) is the weighted PageRank of node \(u\),  
\(w(v,u)\) is the weight of the edge from node \(v\) to node \(u\),  
and \(\sum\limits_{z\ \epsilon\ out(v)}w(v,\ z)\) is the total weight of all outgoing edges from node \(v\). By applying this algorithm to the call graph, we calculated the _IF_ for each process, treating each process as a graph node. The resulting importance of scores reflects how central a process is to system continuity and overall resilience. A higher _IF_ indicates a more critical process in sustaining secure and functional operations.