Integration and evaluation of intrusion detection for CoAP in smart city applications

Abstract

Abstract — The Constrained Application Protocol (CoAP) is a promising candidate for future smart city applications that run on resource-constrained devices. However, additional security means are mandatory to cope with the high security requirements of smart city applications. We present a framework to evaluate lightweight intrusion detection techniques for CoAP applications. This framework combines an OMNeT++ simulation with C/C++ application code that also runs on real hardware. As the result of our work, we used our framework to evaluate intrusion detection techniques for a smart public transport application that uses CoAP. Our first evaluations indicate that a hybrid IDS approach is a favorable choice for smart city applications. Index Terms — Smart city; Critical Infrastructure protection; Intrusion detection; Simulation; OMNeT++ I. I NTRODUCTION Smart city applications such as smart buildings, or smart public transport can improve our everyday life and comfort. City administrations, businesses, and citizens will benefit from easier information sharing as well as optimized processes applied to smart city applicationand control. Nevertheless, security and safety are essential requirements Application Protocol (CoAPfor smart city applications since they may operate on Critical Infrastructures. For their task, smart city applications interact with various networks and devices. A smart city application may send data over public networks such as the internet, cellular networks, networks that belong to different operators, or self-organized wireless sensor networks. The devices used in these networks vary from large cloud and network servers, through customer equipment, down to small sensor nodes. This heterogeneous structure poses a variety of challenges, in particular applying security to such systems. Therefore, the protection of smart city applications is essential since they will form parts of Critical Infrastructures. Protection must preferably be made equally available on small sensor nodes as well as on powerful servers.