Red Teaming the Connected World (RETCON)

RETCON explores creative approaches to understanding how AI at the edge can help bolster security, resilience, and privacy within IoT-rich environments by extending and supporting emerging kinds of red teams.

Both artificial intelligence and IoT introduce new challenges to privacy, security and resilience of connected environments. For instance, AI methods can be used to increase the precision and scale of attacks, by automating aspects such as intelligence gathering, target selection, and attack execution. Second, IoT devices greatly increase the amount of data captured about people, which can, in turn, result in data leaks and significant privacy risks.

At the same time, less has been explored about how AI techniques and IoT devices could used to bolster and improve privacy and security of individual users. RETCON explores this angle, by taking the metaphor of the “red team”: a team of experts brought in to proactively help identify weaknesses in systems and organisations. RETCON explores the idea of new kinds of red teams enhanced by AI: “bot red teams” where AI systems embedded within IoT proactively serve a red-team role to increase resilience, and AI-supported red teams in which AI methods support human-red teams to increase efficiency and effectiveness.

RETCON will design and prototype AI-enabled methods to play the role of the adversary to test and improve the resilience of various IoT-rich contexts, such as the smart home. Using deepfake technology, such AI might even ‘pretend to be human’ to test the resilience of individuals against phishing attacks. RETCON will look at the challenges and potential for the use of privacy preserving AI methods in regulatory red teams, such towards enabling ICO red teams to ascertain data protection compliance. RETCON provides benefit to other projects, such as testing and improving the design patterns generated through the RIoTE project. The RETCON project will also work with other PETRAS projects, such as the UncanAI project (Lancaster).

DEFINITIONS:
Red team: Red team refers to a friendly attack on a system that is used to test the defences of digital infrastructure. This methodology is used to strengthen the defence from a real-world attack.

Deepfake: A piece of synthetic media, such as video or audio recording, created by a machine learning algorithm that realistically impersonates or recreates the likeness of a person using real data as training data.

The RETCON poster displayed at the PETRAS Academic Conference | Networking Research Showcase on 16 June 2022:

Publications

[1]      Radanliev, Petar., De Roure, David., and Van Kleek, Max, “Cyber-risks from Using IoT Devices for Managing COVID-19″, IEEE IoT Newsletter, 2021. https://iot.ieee.org/newsletter/january-2021/cyber-risks-from-using-iot-devices-for-managing-covid-19

[2]      Radanliev, Petar., De Roure, David., Walton, Rob., Van Kleek, Max., Montalvo, Rafael Mantilla., Santos, Omar., Maddox, La’Treall T., and Cannady, Stacy, “COVID-19 what have we learned? The rise of social machines and connected devices in pandemic management following the concepts of predictive, preventive and personalized medicine,” EPMA Journal, vol. 11, no. 3. Springer, pp. 311–332, 01-Sep-2020. https://doi.org/10.1007/s13167-020-00218-x

[3]      Radanliev, Petar., De Roure, David., Van Kleek, Max., Santos, Omar., and Ani, Uchenna, “Artificial intelligence in cyber physical systems,” AI Soc., vol. 1, pp. 1–14, Aug. 2020. https://doi.org/10.1007/s00146-020-01049-0

Dr Petar Radanliev has written a blog post about this publication here: https://petras-iot.org/update/artificial-intelligence-in-cyber-physical-systems/

[4]      Radanliev, Petar., De Roure, David., and Van Kleek, Max, “Digitalization of COVID-19 Pandemic Management and Cyber Risk from Connected Systems – IEEE Internet of Things,” IEEE Internet of Things Newsletter, 14-May-2020. https://iot.ieee.org/newsletter/may-2020/digitalization-of-covid-19-pandemic-management-and-cyber-risk-from-connected-systems

[5]      Radanliev, Petar., Roure, David De., Page, Kevin., Nurse, Jason R.C., Montalvo, Rafael Mantilla., Santos, Omar., Maddox, La’Treall., and Burnap, Pete, “Cyber risk at the edge: current and future trends on cyber risk analytics and artificial intelligence in the industrial internet of things and industry 4.0 supply chains,” Cybersecurity, Springer Nat., vol. 3, no. 13, pp. 1–21, 2020. https://doi.org/10.1186/s42400-020-00052-8

[6]      Radanliev, Petar., De Roure, David., Nurse, Jason R. C., Mantilla Montalvo, Rafael., Cannady, Stacy., Santos, Omar., Maddox, La’Treall., … Maple, Carsten, “Future developments in standardisation of cyber risk in the Internet of Things (IoT),” SN Appl. Sci., vol. 2, no. 2, pp. 1–16, Feb. 2020. https://doi.org/10.1007/s42452-019-1931-0

Dr Petar Radanliev has written a blog post about this publication here: https://petras-iot.org/update/covid-19-what-have-we-learned-the-rise-of-social-machines-and-connected-devices-in-pandemic-management/