# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 3 Materials and Methods
### Descriptive Study I  
This second phase identifies the relationships between the \(11\) factors, proposed by the research clarification, with the risk value. To accomplish this goal, we used the concurrence-table option of ATLAS TI and found a relationship between the \"Severity\" code and the \"Type of attack\" code. We can also observed a relationship between the code \"Type of attack\" and the code \"Severity\", and with the code \"Vulnerabilities\". In addition, it is possible to observe a relationship between the code \"Vulnerabilities\" and the code \"Type of attack\" (see Figure 6). We can observe that the attack surface is associated with elements such as the size of the network (number of nodes or devices), the interfaces and links, and the security elements of the IoT system components (see, Figure 7). Based on the SLR, we could not find more references to the relationships between factors. The DRM methodology proposes, in the descriptive study phase I, the use of empirical studies such as experimentation to fill this gap in the literature review. To address experimentation, we define a set of research items with their respective coding in Table 5. The research items were based on the \(11\) factors of IoT devices from the previous phase and defined as hypotheses to test. The coding of research item was proposed according to the relationships between the factors of IoT devices. For instance, the code \"S-A\" represents the relationship between severity and application domain. The code \"S-A-P\" is the relationship between severity, application domain, and pillars. We grouped the research items into three proposed theoretical constructors related to risk--severity, susceptibility and risk behaviors--to address the contribution of the factors of the IoT device and their relationships with other factors of IoT devices with the security risk value. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Proposals**\(\backslash\)**Factors** & **[PERSON]** & **[PERSON]** & **[PERSON]** & **[PERSON]** & **[PERSON]** \\ \hline Application & Partially & Not covered & Not covered & Not covered & Not covered \\ domain & Covered & & & & \\ \hline Attack surface & Covered & Covered & Covered & Covered & Covered \\ \hline Interdependency & Covered & Covered & Not covered & Not covered & Not covered \\ \hline Scalability & Not covered & Not covered & Not covered & Not covered & Not covered \\ \hline Severity & Covered & Not covered & Not covered & Not covered & Covered \\ \hline Susceptibility & Not covered & Not covered & Not covered & Not covered & Not covered \\ \hline Type of attack & Not covered & Not covered & Covered & Covered & Covered \\ \hline Type of device & Covered & Not covered & Not covered & Not covered & Not covered \\ \hline Type of & & & & & \\ information & Not covered & Not covered & Not covered & Not covered & Not covered \\ \hline Uncertainty & Not covered & Not covered & Not covered & Not covered & Covered \\ \hline Vulnerabilities & Not covered & Not covered & Not covered & Covered & Not covered \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Analysis of the factors of IoT devices that are covered by the proposals of IoT risk methodologies. Figure 7: Components of attack surface in IoT systems according to quality analysis using Atlas TI. The experiments developed have the goal of generating an understanding of the behavior of IoT devices against security events, to analyze their contribution to the three proposed theoretical constructs of risk value: severity, susceptibility, and risk behaviors. For this reason, we propose two experiments to simulate security attacks on a small IoT system such as a smart home, and on a big IoT system such as a smart city, to analyze the behavior of IoT devices, the susceptibility to attacks, and the severity of the attacks. Then we propose a third experiment to evaluate the behavior, susceptibility, and severity of IoT device in response to diverse types of attacks.