  Broadly defined as the Internet of Things (IoT), the growth of commodity
devices that integrate physical processes with digital systems have changed the
way we live, play and work. Yet existing IoT platforms cannot evaluate whether
an IoT app or environment is safe, secure, and operates correctly. In this
paper, we present Soteria, a static analysis system for validating whether an
IoT app or IoT environment (collection of apps working in concert) adheres to
identified safety, security, and functional properties. Soteria operates in
three phases; (a) translation of platform-specific IoT source code into an
intermediate representation (IR), (b) extracting a state model from the IR, (c)
applying model checking to verify desired properties. We evaluate Soteria on 65
SmartThings market apps through 35 properties and find nine (14%) individual
apps violate ten (29%) properties. Further, our study of combined app
environments uncovered eleven property violations not exhibited in the isolated
apps. Lastly, we demonstrate Soteria on MalIoT, a novel open-source test suite
containing 17 apps with 20 unique violations.
