# multiple layers of fuzzy logic to quantify vulnerabilies in iot

**Authors:** Mohammad Shojaeshafiei, Letha Etzkorn, Michael Anderson  
**arXiv:** [2007.07155](https://arxiv.org/abs/2007.07155)  
**Date:** 2020-07-14  
**Summary page:** https://www.summarizepaper.com/en/paper/2007.07155v1/

## Key points

- Quantification of vulnerabilities in network systems and IoT is a contentious issue in network security.
- Extensive research has been conducted, but ambiguities and uncertainties persist in the process.
- A study was conducted to investigate vulnerability quantification within the Department of Transportation (DOT) as a proof of concept.
- Security requirements were identified using Security Quality Requirements Engineering (SQUARE).
- Established security standards like NIST SP-800 and ISO 27001 were used to map out security factors relevant to the DOT's network infrastructure.
- A Multi-layered Fuzzy Logic (MFL) approach based on Goal question Metrics (GQM) was proposed to enhance the quantification process.
- The methodology aims to provide a comprehensive framework for assessing network security and IoT vulnerabilities, particularly focusing on mobile devices within the DOT environment.
- Combining established security standards with innovative approaches like MFL offers a robust framework for evaluating and addressing vulnerabilities within complex network systems.

## Summary

The quantification of vulnerabilities in network systems has been a contentious issue in the realm of network security and IoT. Despite extensive research in this area, there remain numerous ambiguities and uncertainties surrounding the process. To address this challenge, a study was conducted to investigate the quantification of vulnerability within the Department of Transportation (DOT) as a proof of concept. The analysis began by identifying security requirements using Security Quality Requirements Engineering (SQUARE) for eliciting security needs. Subsequently, established security standards like NIST SP-800 and ISO 27001 were utilized to map out security factors and sub-factors relevant to the DOT's network infrastructure. To further enhance the quantification process, a Multi-layered Fuzzy Logic (MFL) approach was proposed. This methodology is based on Goal question Metrics (GQM) and aims to provide a comprehensive framework for assessing network security and IoT vulnerabilities, particularly focusing on mobile devices within the DOT environment. By combining established security standards with innovative approaches like MFL, they offer a robust framework for evaluating and addressing vulnerabilities within complex network systems such as those found in governmental entities like the Department of Transportation.