Following on from the great work being done by the databox project team which recently appeared in BBC News, about the work (BBC R&D) have done with it including the living room of the future and BBC Box project. I was impressed to learn about the Dada wiki.
The Defense Against the Dark Artefacts (DADA) project is a collaboration between the Universities of Cambridge, Nottingham, and Imperial, addressing challenges in security and privacy related to smart home devices. These challenges result from the current, widely-adopted approaches in which cloud services underpin home IoT devices, where network infrastructure protection is minimal and little or no isolation is provided between attached devices and the data traffic they carry.
It addresses these challenges by:
- designing and implementing mechanisms for device traffic monitoring with a precise look at packet traces and device profiles;
- applying learning technologies to detect devices’ abnormal behavior;
- introducing techniques for dealing with traffic anomalies and restoring home network operability;
- putting the homeowner in the center of management by informing them of possible security threats and offering a choice of defences.
This although I used the wrong technology, this was what I was pointing towards in my blog titled your home needs a blockchain. All the things in Human Data Interaction – Legibility, Agency and Negotiatability all apply if Dada was a databox application.
Interestingly Dada isn’t the only one in this field. Recently Princeton released IOT inspector to do something similar.
Today, we release Princeton IoT Inspector, a open-source tool that lets you inspect IoT traffic in your home network right from the browser. With a one-click install process, you can watch how your IoT devices watch you within minutes of setup.
However IOT inspector is a tool for inpection, while Dada is a tool and place to upload data for analysis to benefit the research community. Of course you don’t have to upload the data and maybe do the analysis locally (this would fit the Databox model perfectly). There is a privacy policy of course, but I expect this will be expanded in the near future.
We understand that any uploaded device trace might contain personal application data. While we need to analyse the uploaded traces to extract IoT features in order to form ML training datasets, we do not aim to analyse nor store your personal data. Therefore, the processed traces are anonymised and all sensitive application payload is removed before the actual analysis starts.
After analysis is done, our servers store the anonymised trace and the extracted features such as packet headers, addresses, ports and payload size (but not the payload itself).
Of course uploading the data for research purposes could be incredible useful. For example imagine you bought a device which is already in the Dada database. You check the device and it seems to be sending a lot of traffic odd places. You check the version number, firmware, etc but its consuming a lot of traffic which is odd. Maybe it was hacked/hijacked? With a public database, its possible to check. Even better with a databox application, it could be done automaticlly if the user(s) allow it.
Some of you maybe thinking this is insane stuff but can I remind you of the house that spied on me and the follow up which armed people with tools.
Even Mozilla went as far as to create a buyers guide to help people choose IOT devices with more information that whats usually available to you in the shop or without proper research. Now theres loads of stories about IOT hijacking by hackers (hummmm possible) and more likely from the companies who make the hardware to bring new features…
