Attacks In Internet Of Things Research Articles

Hybrid CNN Approach for Unknown Attack Detection in Edge-Based IoT Networks

INTRODUCTION: In the constantly growing Internet of Things (IoT), device security is crucial. As IoT gadgets pervade our lives, detecting unforeseen assaults is crucial to protecting them. Behavioral analysis, machine learning, and collaborative intelligence may be needed to protect against new dangers. This short discusses the need of detecting unexpected IoT attacks and essential security strategies for these interconnected environments.OBJECTIVES: This research uses the BoT-IoT dataset to create an enhanced IoT intrusion detection system. The goals are to optimize a CNN architecture for effective pattern recognition, address imbalanced data, and evaluate model performance using precision, recall, F1-score, and AUC-ROC measures. Improving IoT ecosystem reliability and security against unknown assaults is the ultimate goal.METHODS: The proposed methods use the BoT-IoT dataset to create a comprehensive IoT intrusion detection system. This involves tuning a Convolutional Neural Network (CNN) architecture to improve pattern recognition. Oversampling and class weighting address imbalanced data issues. RESULTS: The comprehensive evaluation of our innovative unknown attack detection method shows promise, suggesting it may be better than existing methods. A high accuracy, precision, recall, and f-measure of 98.23% were attained using an advanced model and feature selection methods. This achievement was achieved by using features designed to identify unknown attacks in the dataset, proving the proposed methodology works.CONCLUSION: This research presents an improved IoT Intrusion Detection System using the BoT-IoT dataset. The optimised Convolutional Neural Network architecture and imbalanced data handling approaches achieved 98.23% accuracy.

IoT Attack Detection using Machine Learning and Deep Learning in Smart Home

The Internet of Things (IoT) has revolutionized the traditional Internet, pushing past its former boundaries by implementing smart linked gadgets. The IoT is steadily becoming a staple of everyday life, having been implemented into various diverse applications, such as cities, smart homes, and transportation. However, despite the technological advancements that the IoT brings, various new security risks have also been introduced due to the development of new types of attacks. This prevents current intelligent IoT applications from adaptively learning from other intelligent IoT applications, which leaves them in a volatile state. In this paper, we conducted a structured literature review (SLR) on Smart Home's IoT attack detection using machine learning and deep learning. Four journal databases were used to perform this review: IEEE, Science Direct, Association for Computing Machinery (ACM), and SpringerLink. Sixty articles were selected and studied, where we noted the various patterns and techniques present in the framework of the selected research. We also took note of the different machine learning and deep learning methods, the types of attacks, and the Network layers present in Smart Home. By conducting an SLR, we analyzed the numerous techniques of IoT attack detection for smart homes proposed by various theoretical studies. We enhanced the studied literature by proposing a new solution for better IoT attack detection in smart homes.

PIoT-blockchain-enabled security framework for strengthening IoT device identity and data access

The Internet of Things (IoT) connects billions of devices, but concerns about data security and device identification have grown. This study introduces Proof of IoT (PIoT), a novel consensus method using blockchain-based smart contracts to ensure secure data transfer and device authentication in IoT networks. PIoT employs NuCypher-based security computations for authentication and data updating, ensuring only authorized parties access blockchain-recorded information. A reward-based filtering mechanism identifies malicious nodes, bolstering consensus integrity. Simulations demonstrate PIoT's superior performance compared to conventional methods, showing a 74.7% and 96.8% improvement over LPBFT and DAC4SH Consensus, respectively. PIoT enhances blockchain security under IoT by 15% compared to DAC4SH. Beyond facilitating secure IoT device communication, this approach mitigates various IoT attacks, offering a comprehensive solution to emerging IoT security challenges. ABBREVIATION: DAC4SH, Data access control scheme for smart home; DDoS, Distributed denial of service; DoS, Denial of Service; DTLS, Datagram Transport Layer Security; IoT, Internet of Things; LPBFT, Lightweight Particle Byzantine fault tolerance; MAC, Message authentication code; MITM, Man in the Middle; PBFT, Practical Byzantine Fault Tolerance; PIoT, Proof of IoT; TLS, Transport Layer Security

A lightweight logisticsed chaotic S-box encryption for IoT enabled smart health care applications

<p>The Internet of Things (IoT) acts as the major enabler for realizing more intelligent devices and establishes a new dimension of communication between humans and machines using the Internet. These intelligent devices find their role in numerous domains namely health care, automation, smart homes & other people-assisted applications. Although sensor-driven gadgets have significantly improved people’s daily lives, the majority of IoT systems have been plagued by security backlogs, which results in privacy issues. Recently, Advanced Encryption Standard (AES) provides immense light of research in maintaining security and privacy among IoT health care devices. But encrypted data generated still needs to be improvised to defend against the various IoT attacks. The proposed scheme is implemented in the IoT infrastructure that consists of real-time health care sensors interfaced with the ESP8266. Extensive experimentation has been carried out to evaluate the proposed schemes and S-box tests are conducted and analyzed. Additionally, the efficacy of the suggested methods is evaluated with regard to of time and memory usage in comparison to the other encryption schemes already in use. Experimental findings demonstrate that the suggested L-DAL-SBoX has outperformed the other existing algorithms and finds its strong place in IoT security.</p>

An efficient deep learning mechanisms for IoT/Non-IoT devices classification and attack detection in SDN-enabled smart environment

In recent years, the development of Internet of Things (IoT) applications has increased, resulting in higher demands for sufficient bandwidth, data rates, latency, and quality of service (QoS). In advanced communications, managing network resources for allocating IoT services and identifying the exact IoT devices connected to a network is a major concern. The existing studies have introduced various methods for classifying IoT devices in a network. However, the previous studies faced challenges like limited attributes, low efficiency, inappropriate features, and computational complexities. Also, the existing studies failed to concentrate on IoT/Non-IoT classification along with attack detection. Detecting attacks on IoT devices is critical for making network services more effective. Thus, the proposed study introduces an efficient IoT device classification and attack detection mechanism using software defined networking (SDN)-enabled fiber-wireless access networks internet of things (FiWi IoT) architecture. Initially, an effective resource allocation process is performed to mitigate the delay constraint issues by introducing a hybrid parallel neural network-based dynamic bandwidth allocation (DBA) method. Then, the input traffic information is gathered from the resource-efficient SDN-enabled FiWi IoT network, and the input data is pre-processed to eliminate unwanted noises using min-max normalization and standardization. Next, the essential attributes are extracted to attain enhanced classification performance. To reduce the feature dimensionality problem and thereby solve complexity issues, the most optimal features are selected by a new chaotic seagull optimization (CSO) approach. After that, IoT/non-IoT classification is performed using a transformer-driven deep intelligent model. Finally, the attacks are detected and classified by introducing a novel slice attention-based deep capsule autoencoder (SA_DCAE) model. For experimentation, the Python 3.7.0 tool is used in this work, and the performance of proposed classifiers is measured by evaluating varied matrices. Also, the comparison analysis proves the superiority of the proposed techniques to other existing methods.

Anomaly detection in IoT-based healthcare: machine learning for enhanced security

Internet of Things (IoT) integration in healthcare improves patient care while also making healthcare delivery systems more effective and economical. To fully realize the advantages of IoT in healthcare, it is imperative to overcome issues with data security, interoperability, and ethical considerations. IoT sensors periodically measure the health-related data of the patients and share it with a server for further evaluation. At the server, different machine learning algorithms are applied which help in early diagnosis of diseases and issue alerts in case vital signs are out of the normal range. Different cyber attacks can be launched on IoT devices which can result in compromised security and privacy of applications such as health care. In this paper, we utilize the publicly available Canadian Institute for Cybersecurity (CIC) IoT dataset to model machine learning techniques for efficient detection of anomalous network traffic. The dataset consists of 33 types of IoT attacks which are divided into 7 main categories. In the current study, the dataset is pre-processed, and a balanced representation of classes is used in generating a non-biased supervised (Random Forest, Adaptive Boosting, Logistic Regression, Perceptron, Deep Neural Network) machine learning models. These models are analyzed further by eliminating highly correlated features, reducing dimensionality, minimizing overfitting, and speeding up training times. Random Forest was found to perform optimally across binary and multiclass classification of IoT Attacks with an approximate accuracy of 99.55% under both reduced and all feature space. This improvement was complimented by a reduction in computational response time which is essential for real-time attack detection and response.

DDoS Attack Detection Using ML/DL Techniques

The increasing integration of IoT devices has heightened the vulnerability of networks to sophisticated and evolving cyber threats, particularly DDoS attacks, which can severely disrupt service availability. Leveraging machine learning algorithms, this research aims to enhance the proactive identification of anomalous patterns indicative of DDoS attacks within IoT environments. By employing a combination of feature extraction, classification, and ensemble learning methods, the proposed model demonstrates promising results in distinguishing between normal network behaviour and malicious activities associated with DDoS attacks. The study contributes to the advancement of security measures in IoT networks, offering a proactive and adaptive solution to mitigate the impact of DDoS attacks, ultimately bolstering the resilience of interconnected systems in the evolving landscape of cyber threats. This study presents a novel approach for the detection of Distributed Denial of Service (DDoS) attacks in Internet of Things (IoT) networks using machine learning techniques.

ML-DDoS: A Blockchain-Based Multilevel DDoS Mitigation Mechanism for IoT Environments

Distributed denial of service (DDoS) attacks as well as botnet-based attacks are among the most important security vulnerabilities in Internet of Things (IoT) environments. Most of the existing research approaches use centralized defense mechanisms to prevent DDoS attacks in IoT environments. However, it is important to provide a reliable and scalable solution to prevent DDoS attacks. Combining technologies such as distributed blockchain-based mechanisms and smart contracts facilitates the construction of a trusted distributed framework that can defend against DDoS attacks in IoT. In this article, we have proposed a multilevel DDoS mitigation approach (ML-DDoS) to protect IoT devices and other computing resources or machines using the blockchain-based framework. The core concept of the proposed system is to use a device-based verification mechanism using blockchain and exclude malicious devices from IoT environments. The proposed framework was developed using Hyperledger Caliper (a blockchain benchmark tool) and its performance was evaluated using three benchmark applications. Compared to the state of the art, the results show that the proposed framework achieves up to 35% improvement in throughput, up to 40% improvement in latency, and up to 25% better utilization of CPU.

A survey of security challenges, attacks in IoT

A network of linked devices that can gather, process, and exchange data is known as the Internet of Things (IoT). It delivers several benefits such as convenience, efficiency and automation. However, IoT also poses significant security concerns that necessity to be describe like the heterogeneity and diversity of IoT devices with different hardware, software and communication protocols. Now a days the large scale and complexity of IoT systems, which may involve multiple stakeholders, domains and layers. The limited resources and capabilities of IoT devices, which may affect their ability to perform security functions such as encryption, authentication and update. The vital and evolving features of IoT environments, which may introduce new threats and vulnerabilities over time. These challenges require novel and holistic approaches to ensure that privacy and security of IoT systems and its users. With the develop of security standards and best practices for IoT devices and systems it should include Implementation of security by design and security by default principles for IoT development and deployment by adopting risk-based and adaptive security mechanisms for IoT management, operation and enhanced security awareness and education among IoT users and stakeholders.

A long short-term memory based approach for detecting cyber attacks in IoT using CIC-IoT2023 dataset

The growth of Internet of Things (IoT) gadgets has ushered in a new era of connectedness and convenience, but it has also sparked worries about security flaws. Long Short-Term Memory (LSTM) networks are used in this research's use of intrusion detection as a novel strategy to strengthen IoT security. The proposed LSTM-based model excels in detecting both known and evolving cyber-attack patterns with an accuracy rate of 98.75% and an F1 score of 98.59% in extensive experimental evaluations using the vast CIC-IoT2023 dataset, representing a varied array of IoT network traffic scenarios. This research contributes significantly to IoT security while addressing the urgent need for adaptable intrusion detection systems to defend against changing cyber threats. It is an essential step toward ensuring IoT technology's long-term development and dependability in a world that is becoming more interconnected.

Stories from a Customized Honeypot for the IoT

<p>Since the inception of the Internet of Things (IoT), the security measures implemented on its devices have been too weak to ensure the appropriate protection of the data that they handle. Appealed by this, cybercriminals continuously seek out for vulnerable units to control, leading to attacks spreading through networks and infecting a high number of devices. On top of that, while the IoT has evolved to provide a higher degree of security, the techniques used by attackers have done so as well, which has led to the need of continuously studying the way in which these attacks are performed to gather significant knowledge for the development of the pertinent security measures. In view of this, we analyze the state of IoT attacks by developing a high-interaction honeypot for SSH and Telnet services that simulates a custom device with the ARM architecture. This study is carried out in two steps. Firstly, we analyze and classify the interaction between the attacker and the devices by clustering the commands that they sent in the compromised Telnet and SSH sessions. Secondly, we study the malware samples that are downloaded and executed in each session and classify them based on the sequence of system calls that they execute at runtime. In addition, apart from studying the active data generated by the attacker, we extract the information that is left behind after a connection with the honeypot by inspecting the metadata associated with it. In total, more than 1,578 malicious samples were collected after 9,926 unique IP addresses interacted with the system, with the most downloaded malware family being Hajime, with 70.5% of samples belonging to it, and also detecting others such as Mirai, Gafgyt, Dofloo and Xorddos.</p> <p> </p>

Security aspects in IoT based cloud computing

Cloud computing offers a flexible framework in which data and resources are spread across different locations and can be accessed from various industrial environments. This technology has revolutionized the way resources such as data, services, and applications are used, stored, and shared in industrial applications. Over the past decade, industries have rapidly embraced cloud computing due to its advantages of enhanced accessibility, cost reduction, and improved performance. Moreover, the integration of cloud computing has led to significant advancements in the field of the Internet of Things (IoT). However, this quick shift to the cloud has also introduced various security concerns and challenges. Traditional security solutions are not always suitable or effective for cloud-based systems. Despite the continuous use of complex cyber weapons, efforts have been made in recent years to address the security issues and concerns associated with cloud platforms. The rapid progress of deep learning (DL) in the field of artificial intelligence (AI) has provided opportunities to tackle these security challenges in the cloud. The research presented in this study encompasses a comprehensive survey of the enabling architecture, services, configurations, and security models for cloud-based IoT. It also categorizes the security concerns in IoT within four major categories (data, network and service, applications, and people-related security issues) and provides a detailed discussion on each category. Furthermore, the study examines the latest advancements in cloud-based IoT attacks, analyzes significant security issues within each category, and presents the limitations from a broader perspective encompassing general, artificial intelligence, and deep learning aspects.

MRFM: A timely detection method for DDoS attacks in IoT with multidimensional reconstruction and function mapping

To address the slow response time of existing detection modules to the Internet of Things (IoT) Distributed Denial of Service (DDoS) attacks, along with their low feature differentiation and poor detection performance, we propose MRFM, a timely detection method with multidimensional reconstruction and function mapping. Firstly, we employ a queue mechanism to capture and store incoming network traffic data within a predefined time frame. Subsequently, we introduce a multidimensional reconstruction neural network model, specifically designed to reconstruct quantitative features based on their respective indices by adjusting the loss function. This process is followed by the computation of multidimensional reconstruction errors and the transformation of vectors into mapping features, thereby augmenting the disparities among various types of traffic data and promoting the similarity within the same category of traffic data. Lastly, we extract frequency information from the qualitative feature matrix using information entropy calculations, enriching the feature profile of individual traffic instances. The experimental results on two benchmark datasets show that MRFM can effectively detect different types of DDoS attacks. Notably, MRFM consistently outperforms other existing methods, exhibiting an average metric improvement of up to 9.61 %.

Deep Learning-Inspired IoT-IDS Mechanism for Edge Computing Environments.

The Internet of Things (IoT) technology has seen substantial research in Deep Learning (DL) techniques to detect cyberattacks. Critical Infrastructures (CIs) must be able to quickly detect cyberattacks close to edge devices in order to prevent service interruptions. DL approaches outperform shallow machine learning techniques in attack detection, giving them a viable alternative for use in intrusion detection. However, because of the massive amount of IoT data and the computational requirements for DL models, transmission overheads prevent the successful implementation of DL models closer to the devices. As they were not trained on pertinent IoT, current Intrusion Detection Systems (IDS) either use conventional techniques or are not intended for scattered edge-cloud deployment. A new edge-cloud-based IoT IDS is suggested to address these issues. It uses distributed processing to separate the dataset into subsets appropriate to different attack classes and performs attribute selection on time-series IoT data. Next, DL is used to train an attack detection Recurrent Neural Network, which consists of a Recurrent Neural Network (RNN) and Bidirectional Long Short-Term Memory (LSTM). The high-dimensional BoT-IoT dataset, which replicates massive amounts of genuine IoT attack traffic, is used to test the proposed model. Despite an 85 percent reduction in dataset size made achievable by attribute selection approaches, the attack detection capability was kept intact. The models built utilizing the smaller dataset demonstrated a higher recall rate (98.25%), F1-measure (99.12%), accuracy (99.56%), and precision (99.45%) with no loss in class discrimination performance compared to models trained on the entire attribute set. With the smaller attribute space, neither the RNN nor the Bi-LSTM models experienced underfitting or overfitting. The proposed DL-based IoT intrusion detection solution has the capability to scale efficiently in the face of large volumes of IoT data, thus making it an ideal candidate for edge-cloud deployment.

A Hybrid Intrusion Detection Model to Alleviate Denial of Service and Distributed Denial of Service Attacks in Internet of Things

The Internet of Things (IoT) refers to a network of interconnected smart devices. The growth of IoT devices has increased the vulnerability of the network to attacks, such as Denial of Service (DoS) and Distributed Denial of Service (DDoS). Denial-of-Service (DoS) attacks are malicious activities aimed at rendering a computer network, system, or online service unavailable to legitimate users. This research addresses the growing vulnerability of IoT networks to DoS/DDoS attacks by developing a hybrid intrusion detection model to detect these attacks. The model integrates Kalman Filter (KF) with Artificial Neural Network (KF-ANN), Random Forest (KF-RF), Support Vector Machine (KF-SVM) and K-Nearest Neighbor (KF-KNN) machine learning models. The Kalman filter is an efficient tool for estimating the state of a system especially in the midst of uncertainty. Kalman filter was used to estimate the state of the system while the machine learning models were used to make predictions based on the estimated state to detect attacks in IoT. The model was tested using the DoS/DDoS Message Queueing Telemetry Protocol (MQTT) IoT dataset. Results shows Receiver Operative Curve Area Under the Curve (ROC-AUC) of 0.99% for KF-ANN and KF-RF, 0.98% and 0.97% for KF-KNN and KF-SVM. Detection accuracy of approximately 0.96%, 0.94% and 93% for KF-RF and KF-ANN, KF-KNN and KF-SVM respectively

A comprehensive survey on IoT attacks: Taxonomy, detection mechanisms and challenges

The Internet of Things (IoT) has set the way for the continuing digitalization of society in various manners during the past decade. The IoT is a vast network of intelligent devices exchanging data online. The security component of IoT is crucial given its rapid expansion as a new technology paradigm since it may entail safety-critical procedures and the online storage of sensitive data. Unfortunately, security is the primary challenge when adopting Internet of Things (IoT) technologies. As a result, manufacturers’ and academics’ top priority now is improving the security of IoT devices. A substantial body of literature on the subject encompasses several issues and potential remedies. However, most existing research fails to offer a comprehensive perspective on attacks inside the IoT. Hence, this survey aims to establish a structure to guide researchers by categorizing attacks in the taxonomy according to various factors such as attack domains, attack threat type, attack executions, software surfaces, IoT protocols, attacks based on device property, attacks based on adversary location and attacks based on information damage level. This is followed by a comprehensive analysis of the countermeasures offered in academic literature. In this discourse, the countermeasures proposed for the most significant security attacks in the IoT are investigated. Following this, a comprehensive classification system for the various domains of security research in the IoT and Industrial Internet of Things (IIoT) is developed, accompanied by their respective remedies. In conclusion, the study has revealed several open research areas pertinent to the subject matter.

Using Supervised Learning to Detect Command and Control Attacks in IoT

The rapid proliferation of internet of things (IoT) devices has ushered in a new era of technological development. However, this growth has also exposed these devices to various cybersecurity risks, including command and control (C&C) attacks. C&C attacks involve unauthorized entities taking control of IoT devices to carry out malicious activities. Traditional cybersecurity measures often fall short in addressing these evolving threats. To enhance IoT security and counter C&C threats, this study explores the potential of supervised learning, a subfield of machine learning. Supervised learning, a method that utilizes past data to train machine learning models capable of independently identifying patterns indicative of C&C threats in real time, offers additional protection to IoT networks. This article delves into the advantages and drawbacks of this approach, considering factors such as the need for well-defined labeled datasets, resource constraints of IoT devices, and ethical considerations surrounding data security.

IoT intrusion detection system using ensemble classifier and hyperparameter optimization using tuna search algorithm

<p>The Internet of Things (IoT) is a dynamic and delightful research field in this emerging technology. It can be globally connected with many IoT devices and exchange a large amount of data. However, the threats also developed and misguided the entire network’s behaviour. This article proposes an Intrusion Detection System (IDS) using the proposed ensemble classifier along with the Tuna Swarm Optimization (TSO) to fine-tune the hyperparameters and help to enhance the detection accuracy of attacks that take place in IoT environment. Here, the publicly available message queue telemetry transport (MQTT) network dataset is used to classify the given data into the following categories: SlowlTe, malformed, brute force, flood, DoS, and legitimate. Initially, the dataset is pre-processed to remove possible outliers, then data balancing is performed using the Synthetic Minority Oversampling Technique (SMOTE) technique and features are extracted with the help of Recursive Feature Elimination (RFE). Finally, ensemble classifier along with the optimized parameters using TSO helps in detecting the attacks in IoT attacks. The proposed TSO-ensemble classifier achieved a classification accuracy of 99.12%. In contrast, the classification accuracy of the existing Improved Vulture Starvation-based African Vultures Optimization (IVS-AVOA) and Convolutional Neural Network Long Short-Term Memory (CNN-LSTM) have achieved a classification accuracy of 96.61% and 98.94% respectively.</p>

A Systematic Review of IoT Security: Research Potential, Challenges, and Future Directions

The Internet of Things (IoT) encompasses a network of physical objects embedded with sensors, software, and data processing technologies that can establish connections and exchange data with other devices and systems via the Internet. IoT devices are incorporated into various products, ranging from ordinary household items to complex industrial appliances. Despite the increasing demand for IoT, security concerns have impeded its development. This article systematically reviews IoT security research, focusing on vulnerabilities, challenges, technologies, and future directions. It surveys 171 recent publications in the field, providing a comprehensive discussion on the development status, challenges, and solutions in IoT. The article outlines IoT architecture patterns and typical features, evaluates existing limitations, and explores strategies for enhancing IoT security. Additionally, the article delves into known IoT attacks and discusses the security countermeasures and mechanisms to address these challenges. It explores the functional requirements of IoT security and explores related technologies and standards. Finally, the article discusses potential future research directions in IoT security.

Confronting the Threat: Analysis of the Impact of MaDIoT Attacks in Two Power System Models

The increasing penetration of Internet of Things (IoT) devices at the consumer level of power systems also increases the surface of attack for the so-called Manipulation of Demand through IoT (MaDIoT) attacks. This paper provides a comparison of the impact that MaDIoT attacks could have on power systems with different characteristics, such as the IEEE 39-Bus (New England) and the PST-16 system (simplified European model), by assuming that the attacker does not have advanced knowledge of the grid. The results for the IEEE 39-Bus system expand and complement the results obtained by previous work. The simulation results show that these systems present significant differences between them with respect to the success probability of an attack, being in general much higher for the IEEE 39-Bus system. In the PST-16 system, the required number of bots to obtain a certain success probability varies depending on the area attacked. However, a high probability of success does not necessarily mean a high impact on the system. This paper shows that the response to the high-impact MaDIoT attacks of the two models considered is very different as the initial impact of the attack on the system also differs, mainly affecting rotor angles in the PST-16 system, and the frequency in the IEEE 39-Bus.