A Combined Approach to Safety and Security of IoT by applying Fault Tree Analysis and Attack Trees with Minimal Cut Sets

Mohammad Rezaul Karim, Sohag Kabir, Ci Lei, Raluca Lefticaru, Mohammad Abdul Baset

Submitted : 2025-03-10, Published : 2025-05-09.

Abstract

The rapid proliferation of Internet of Things (IoT) systems introduces complex safety and security challenges, as traditional frameworks often treat these aspects separately, overlooking critical interdependencies. This study proposes a unified methodology integrating Fault Tree Analysis (FTA) and Attack Trees (AT) with Minimal Cut Sets (MCS) to holistically assess IoT safety and security. FTA systematically identifies root causes of system failures, while AT models attack vectors and their probabilities. By deriving MCS—minimal combinations of safety faults and security breaches—the approach reveals critical scenarios where failures and attacks interact, enabling prioritized mitigation. Applied to a real-world IoT dataset (BoTNeTIoT-L01), the framework identified key vulnerabilities, such as Data_Corruption (safety probability: 0.005) linked to Mirai attacks (security probability: 0.01), demonstrating how integrated MCS enhance risk visibility. Quantitative analysis (mean safety: 0.005, variance: 0.000006) confirmed the methodology’s effectiveness in capturing interdependencies across IoT layers (Perception, Network, Data Processing, Application). Results emphasize that combined safety-security analysis prevents isolated risk assessments, offering actionable insights for resilient IoT design. The study concludes that integrating FTA-AT-MCS bridges existing gaps in IoT dependability, enabling targeted resource allocation and adaptive strategies against evolving threats. This approach advances IoT ecosystems’ safety, security, and trustworthiness in interconnected environments.

Keywords

Fault Trees Analysis (FTA); Attack Trees (AT); Internet of Things (IoT); Safety, Security, Risk Assessment; Threat Modeling.

References

C. de Villiers, S. Kuruppu, dan D. Dissanayake, “A (New) Role for Business–Promoting the United Nations’ Sustainable Development Goals through the Internet-of-Things and Blockchain Technology,” J. Bus. Res., vol. 131, pp. 598–609, 2021. https://doi.org/10.1016/j.jbusres.2020.11.066

Z. Allam, S. E. Bibri, D. S. Jones, D. Chabaud, dan C. Moreno, “Unpacking the ‘15-Minute City’ via 6G, IoT, and Digital Twins: Towards a New Narrative for Increasing Urban Efficiency, Resilience, and Sustainability,” Sensors, vol. 22, no. 4, art. 1369, Feb. 2022. https://doi.org/10.3390/s22041369

T. Katika, F. K. Konstantinidis, T. Papaioannou, A. Dadoukis, S. N. Boleirakis, G. Tsimiklis, dan A. Amditis, “Exploiting Mixed Reality in a Next-Generation IoT Ecosystem of a Construction Site,” in Proc. IEEE Int. Conf. Imaging Syst. and Techniques (IST), 2022, pp. 1–6. https://doi.org/10.1109/IST55454.2022.9827726

M. Mobasshir, “IoT Ecosystem: Functioning Framework, Hierarchy of Knowledge, and Intelligence,” in Artificial Intelligence-Based Internet of Things Systems, 2022, pp. 47–76. https://doi.org/10.1007/978-3-030-87059-1_2

Y. Wu, HN. Dai, H. Wang, Z. Xiong, S. Guo, “A Survey of Intelligent Network Slicing Management for Industrial IoT: Integrated Approaches for Smart Transportation, Smart Energy, and Smart Factory,” IEEE Commun. Surveys Tuts., vol. 24, no. 2, pp. 1175–1211, 2022. https://doi.org/10.1109/COMST.2022.3158270

A. E. Omolara, A. Alabdulatif, O. I. Abiodun, M. Alawida, A. Alabdulatif, dan H. Arshad, “The Internet of Things Security: A Survey Encompassing Unexplored Areas and New Insights,” Comput. & Security, vol. 112, art. 102494, 2022. https://doi.org/10.1016/j.cose.2021.102494

A. M. Ashraf, W. Imran, dan L. Vechot, “Analysis of the Impact of a Pandemic on the Control of the Process Safety Risk in Major Hazards Industries Using a Fault Tree Analysis Approach,” J. Loss Prevent. Process Ind., vol. 74, art. 104649, 2022. https://doi.org/10.1016/j.jlp.2021.104649

S. U. R. Malik, A. Anjum, S. A. Moqurrab, dan G. Srivastava, “Towards Enhanced Threat Modelling and Analysis Using a Markov Decision Process,” Comput. Commun., vol. 194, pp. 282–291, 2022. https://doi.org/10.1016/j.comcom.2022.07.038

R. Maciel, J. Araujo, C. Melo, P. Pereira, J. Dantas, dan P. Maciel, “Impact Evaluation of DDoS and Malware Attack Using IoT Devices,” in Distributed Denial of Service Attacks: Concepts, Mathematical and Cryptographic Solutions, vol. 6, 2021, p. 1. https://doi.org/10.1515/9783110619751-001

F. O. Ehiagwina, O. O. Kehinde, A. S. Nafiu, L. O. Afolabi, dan I. S. Olatinwo, “Fault Tree Analysis and its Modifications as Tools for Reliability and Risk Analysis of Engineering Systems–An Overview,” Int. J. Res. Publ. Rev., vol. 3, no. 1, pp 383-396, 2025.

A. Wieland, “Dancing the Supply Chain: Toward Transformative Supply Chain Management,” J. Supply Chain Manag., vol. 57, no. 1, pp. 58–73, 2021. https://doi.org/10.1111/jscm.12209

X. Zhou, W. Liang, W. Li, K. Yan, S. Shimizu, I. Kevin, dan K. Wang, “Hierarchical Adversarial Attacks Against Graph-Neural-Network-Based IoT Network Intrusion Detection System,” IEEE Internet Things J., vol. 9, no. 12, pp. 9310–9319, 2021. https://doi.org/10.1109/JIOT.2021.3130434

T. A. Ahanger, A. Aljumah, dan M. Atiquzzaman, “State-of-the-Art Survey of Artificial Intelligent Techniques for IoT Security,” Comput. Netw., vol. 206, art. 108771, 2022. https://doi.org/10.1016/j.comnet.2022.108771

B. Ghimire dan D. B. Rawat, “Recent Advances on Federated Learning for Cybersecurity and Cybersecurity for Federated Learning for Internet of Things,” IEEE Internet Things J., vol. 9, no. 11, pp. 8229–8249, 2022. https://doi.org/10.1109/JIOT.2022.3150363

A. T. Atieh, “Establishing Efficient IT Operations Management through Efficient Monitoring, Process Optimization, and Effective IT Policies,” Empirical Quests Manag. Essences, vol. 1, no. 1, pp. 1–12, 2021.

A. Corallo, M. Lazoi, M. Lezzi, dan P. Pontrandolfo, “Cybersecurity Challenges for Manufacturing Systems 4.0: Assessment of the Business Impact Level,” IEEE Trans. Eng. Manag., vol. 70, no. 11, pp. 3745–3765, 2023. https://doi.org/10.1109/TEM.2021.3084687

A. Abdulhamid, S. Kabir, I. Ghafir, dan C. Lei, “Dependability of the Internet of Things: Current Status and Challenges,” in Proc. 2022 Int. Conf. Electr., Comput., Commun. and Mechatronics Eng. (ICECCME), 2022, pp. 1–6. https://doi.org/10.1109/ICECCME55909.2022.9987845

S. Kriaa, M. Bouissou, dan Y. Laarouchi, “A New Safety and Security Risk Analysis Framework for Industrial Control Systems,” Proc. Inst. Mech. Eng., Part O: J. Risk Reliab., vol. 233, no. 2, pp. 151–174, 2019. https://doi.org/10.1177/1748006X18765885

F. Ihirwe, D. Di Ruscio, K. Di Blasio, S. Gianfranceschi, dan A. Pierantonio, “Supporting Model-Based Safety Analysis for Safety-Critical IoT Systems,” J. Comput. Lang., art. 101243, 2023. https://doi.org/10.1016/j.cola.2023.101243

G. Abbas, A. Mehmood, M. Carsten, G. Epiphaniou, dan J. Lloret, “Safety, Security and Privacy in Machine Learning Based Internet of Things,” J. Sensor Actuator Netw., vol. 11, no. 3, art. 38, 2022. https://doi.org/10.3390/jsan11030038

X. Yang, L. Shu, Y. Liu, G. P. Hancke, M. A. Ferrag, dan K. Huang, “Physical Security and Safety of IoT Equipment: A Survey of Recent Advances and Opportunities,” IEEE Trans. Ind. Inform., vol. 18, no. 7, pp. 4319–4330, 2022. https://doi.org/10.1109/TII.2022.3141408

V. Mahor, R. Rawat, A. Kumar, B. Garg, dan K. Pachlasiya, “IoT and Artificial Intelligence Techniques for Public Safety and Security,” in Smart Urban Computing Applications, River Publishers, 2023, pp. 111–126.

S. Rekha, L. T. Thirupathi, S. Renikunta, dan R. Gangula, “Study of Security Issues and Solutions in Internet of Things (IoT),” Mater. Today: Proc., vol. 80, pp. 3554–3559, 2023. https://doi.org/10.1016/j.matpr.2021.07.295

A. Souri, A. Hussien, M. Hoseyninezhad, dan M. Norouzi, “A Systematic Review of IoT Communication Strategies for an Efficient Smart Environment,” Trans. Emerg. Telecommun. Tech., vol. 33, no. 3, e3736, 2022. https://doi.org/10.1002/ett.3736

S. Bhattacharyya dan A. Cheliyan, “Optimization of a Subse a Production System for Cost and Reliability Using Its Fault Tree Model,” Reliab. Eng. Syst. Saf., vol. 185, pp. 213–219, 2019. https://doi.org/10.1016/j.ress.2018.12.030

K. Aslansefat, S. Kabir, Y. Gheraibia, dan Y. Papadopoulos, “Dynamic Fault Tree Analysis: State-of-the-Art in Modeling, Analysis, and Tools,” in Reliability Management and Engineering, CRC Press, 2020, pp. 73–112.

M. Bilgen dan N. Altin, “An Overview on Reliability Analysis and Evaluation Methods Applied to Smart Grids,” Gazi Univ. J. Sci. Part C Des. Technol., vol. 9, pp. 645–660, 2021.

P. Niloofar dan S. Lazarova-Molnar, “Fusion of Data and Expert Knowledge for Fault Tree Reliability Analysis of Cyber-Physical Systems,” in Proc. 2021 5th Int. Conf. System Reliability and Safety (ICSRS), Palermo, Italy, 24–26 Nov. 2021, pp. 92–97.

A. A. Musa, A. Hussaini, W. Liao, F. Liang, dan W. Yu, “Deep Neural Networks for Spatial-Temporal Cyber-Physical Systems: A Survey,” Future Internet, vol. 15, art. 199, 2023. https://doi.org/10.3390/fi15060199

S. Kabir, “A Fuzzy Data-Driven Reliability Analysis for Risk Assessment and Decision Making Using Temporal Fault Trees,” Decis. Anal. J., vol. 8, art. 100265, 2023. https://doi.org/10.1016/j.dajour.2023.100265

D. M. Gabbay, R. Horne, S. Mauw, dan L. van der Torre, “Attack-Defence Frameworks: Argumentation-Based Semantics for Attack-Defence Trees,” in Graphical Models for Security: 7th Int. Workshop, GraMSec 2020, Boston, MA, USA, 22 June 2020, pp. 143–165.

P. J. Brooke dan R. F. Paige, “Fault Trees for Security System Design and Analysis,” Comput. Secur., vol. 22, pp. 256–264, 2003. https://doi.org/10.1016/S0167-4048(03)00313-4

Neha dan A. Maurya, “Cyber Attack Modeling Recent Approaches: A Review,” in Proc. 3rd Int. Conf. Computing, Communications, and Cyber-Security, Virtual, 26–28 May 2023, pp. 871–882.

Alaa Alhowaide, “IoT Data Set,” Kaggle, 14 Mar. 2025. [Online]. Available: https://www.kaggle.com/datasets/azalhowaide/iot-dataset-for-intrusion-detection-systems-ids

http://dx.doi.org/10.28989/avitec.v7i2.2918

Article Metrics

Abstract view: 0 times

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.

Refbacks

  • There are currently no refbacks.