# Threat Analysis for Smart Homes +
## 2 Related Work  
Several risk assessment methodologies for dynamic environments have appeared in the literature. [PERSON] et al. [9] proposed a risk modeling method for maritime transport. The authors considered simulations, expert judgment and available data, and proposed a method which handles multiple scenarios reflecting past, present and future operating procedures of the vessel's ICT systems. [PERSON] et al. [10] developed a framework for dynamic risk management that uses Bayesian attack graphs to address security issues in a network system. [PERSON] et al. [11] proposed a dynamic risk assessment system using an improved attack graph to assess dynamic risks in cloud computing, and proposed appropriate mitigation techniques. The authors used the Common Vulnerability Scoringsystem to initiate each node's score in the attack graph. The Dynamical Risk Assessment Method for IoT inspired by AIS (DRAMIA) dynamic risk assessment method for the IoT was proposed by [PERSON] et al. [12]. DRAMIA consists of attack detection agents and sub-systems of dynamic risk assessment, which adopt immune system principles in order to dynamically change the attack detectors and estimate the risk according to the detection results of all attack detection agents. [PERSON] et al. [13] introduced a dynamic framework to assess cyber risks in continuously changing environments. However, this work is in a preliminary stage. The National technical authority for information assurance in the UK proposed a technical risk assessment and risk treatment standard [14] that is able to assess risks in dynamic systems or services where components are being regularly upgraded or replaced. A risk assessment engine for assessing cyber risks in real-time was also proposed by the WISER-Wide-Impact cyber Security framework project [15]. Specifically, machine-reliable risk assessment algorithms have been developed in order to facilitate the risk identification in dynamic environments. These algorithms take as inputs the business configuration, the vulnerability assessment, the network constraints and the application layer of the environment, to estimate the cyber risk. The aforementioned risk engines could in principle be used to assess risks in the smart home ecosystem. Dynamic risk assessment tailored specifically to smart home environments has been addressed within the EU project GHOST-Safe--Guarding Home IoT Environments with Personalized Real-time Risk Control [16]. The project has proposed a dynamic risk assessment model for real-time security and risk assessment on the ongoing activities over the network of a smart home, which may be implemented by means of a real time risk engine. Consequently, the risk assessment's results remain valid since the engine is able to dynamically identify changes in the environment and to re-assess the risk taking into consideration these changes [17]. The security of the smart home ecosystem has been studied in several works that seek to identify potential vulnerabilities, threats and risks in this dynamic environment. [PERSON] [18] demonstrated the challenges that risk analysis poses in a smart home installation, due to the heterogeneous nature of the IoT devices. [PERSON] et al. [19] applied an information security risk assessment approach in the development phase of smart home automation systems. The authors identified nine low and four high level risks, and concluded that humans represent the highest risk exposure in smart home automation systems. Further, a risk framework for the smart home was proposed by [PERSON] et al. [5]. This framework focuses on the feasibility of an attack on the system, the attractiveness of the system as a compromised platform, and the damage caused by performing a successful attack. Its drawback is that it examines particular devices of the smart home and does not consider the data flows or the cloud services that are also crucial parts of the smart home's ecosystem. The security of the information flow in the Home Area Network (HAN) of a smart grid was examined by [PERSON] et al. [20].