# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 2 Background  
The advent of the IoT has transformed interactions between humans and the physical world by enabling seamless connectivity among heterogeneous devices [1]. However, the dynamic and distributed nature of IoT environments presents significant challenges to secure system management [29]. The integration of resource-constrained devices, diverse communication protocols, and vendor-specific technologies has significantly expanded the attack surface [4; 29]. Common vulnerabilities stem from unsecured communication channels, physically exposed devices, and inconsistent security practices--particularly in remote or under-resourced deployments. These risks are further exacerbated by dependence on third-party services and the lack of standardized security policies. IoT systems typically follow a multi-layered architecture, each layer responsible for distinct operational functions--from data sensing to processing, transmission, and end-user services [30; 31]. A common five-layer architecture includes the following:  
* Perception (or Physical) Layer: Houses sensing devices and collects raw data. * Edge/Fog Layer: Offers localized computing resources to reduce latency and offload processing from the cloud. * Cloud Layer: Manages large-scale data processing, analysis, and storage using heterogeneous cloud services [31]. * Network (or Transport) Layer: Ensures data transmission between layers. * Application Layer: Delivers services and interfaces to end users. While this layered architecture improves scalability and performance, it also introduces security risks at each level. For example, the Perception Layer is vulnerable to node capture, replay attacks, eavesdropping, and physical tampering. The Network Layer faces threats such as DDoS attacks, man-in-the-middle attacks, spoofing, Sybil, and sinkhole attacks [32]. Numerous studies have emphasized security as one of the most critical and unresolved challenges in IoT systems [33; 34]. Given these challenges, there is a clear need for adaptive and robust security frameworks that can not only protect data and infrastructure but also respond effectively to the evolving threat landscape in IoT environments. Recent literature underscores the critical need to embed _security awareness_ into IoT systems to address the growing complexity and evolving threat landscape [35]. _Security awareness_ builds upon the concept of system self-awareness by enabling autonomous systems to detect and reason about changes in both environmental conditions and internal states--and to assess how these changes impact the system's security posture [6; 7; 8; 9; 10]. Achieving this requires continuous monitoring of functional, network, and environmental attributes, along with dynamic assessment of their variations to generate actionable insights. These insights are vital for implementing adaptive and resilient security responses capable of mitigating emerging threats [36]. In [37], the authors introduce Prov-IoT, an IoT provenance model that captures the complete lifecycle of data records by documenting their processing and aggregation alongside embedded security metadata. This metadata encompasses evidence of active security controls, communication security protocols, user authentication methods, as well as device configuration and software information. The resulting data provenance graph illustrates the transformation of data from its origin through various modifications, processing steps, and eventual aggregation into its final form. While the model emphasizeslinking security information to contextual details such as user-data relationships, device identities, timestamps, locations, or environmental factors, it falls short of specifying how these contextual elements can be integrated effectively to provide comprehensive insights for validating the data's trustworthiness. Another research group developed a Security Awareness and Protection System for 5G-enabled Smart Healthcare [38], grounded in a predefined threat model specific to 5G networks.