Sensors

Research

Jump to: Review

22 pages, 1719 KiB

Open AccessArticle

Detecting Unusual Repetitive Patterns of Behavior Indicative of a Loop-Based Attack in IoT

by Asmaa Munshi

Sensors 2024, 24(23), 7534; https://doi.org/10.3390/s24237534 - 26 Nov 2024

Viewed by 114

Abstract

Given the high risk of Internet of Things (IoT) device compromise, it is crucial to discuss the attack detection aspect. However, due to the physical limitations of IoT, such as battery life and sensing and processing power, the widely used detection techniques, such [...] Read more.

Given the high risk of Internet of Things (IoT) device compromise, it is crucial to discuss the attack detection aspect. However, due to the physical limitations of IoT, such as battery life and sensing and processing power, the widely used detection techniques, such as signature-based or anomaly-based detection, are quite ineffective. This research extracted loop-based cases from the transmission session dataset of “CTU-IoT-Malware-Capture-7-1” (“Linux, Mirai”) and implemented a loop-based detection machine learning approach. The research employed nine machine learning models to illustrate how the loop patterns of the datasets can facilitate detection. The results of this study indicate that the XGBoost model achieves the best performance in terms of “Accuracy: 8.85%”, “Precision: 96.57% (Class)”, “Recall: 96.72% (Class 1)”, and “F1-Score: 6.24%”. The XGBoost model demonstrated exceptional performance across all metrics, indicating its capability in handling large IoT datasets effectively. It provides not only high accuracy but also strong generalization, which is crucial for detecting intricate and diverse patterns of malicious behavior in IoT networks. Its precision and recall performance further highlight its robustness in identifying both attack and normal activity, reducing the chances of false positives and negatives, making it a superior choice for real-time IoT threat detection. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

23 pages, 938 KiB

Open AccessArticle

An Efficient Flow-Based Anomaly Detection System for Enhanced Security in IoT Networks

by Ibrahim Mutambik

Sensors 2024, 24(22), 7408; https://doi.org/10.3390/s24227408 - 20 Nov 2024

Viewed by 328

Abstract

The growing integration of Internet of Things (IoT) devices into various sectors like healthcare, transportation, and agriculture has dramatically increased their presence in everyday life. However, this rapid expansion has exposed new vulnerabilities within computer networks, creating security challenges. These IoT devices, often [...] Read more.

The growing integration of Internet of Things (IoT) devices into various sectors like healthcare, transportation, and agriculture has dramatically increased their presence in everyday life. However, this rapid expansion has exposed new vulnerabilities within computer networks, creating security challenges. These IoT devices, often limited by their hardware constraints, lack advanced security features, making them easy targets for attackers and compromising overall network integrity. To counteract these security issues, Behavioral-based Intrusion Detection Systems (IDS) have been proposed as a potential solution for safeguarding IoT networks. While Behavioral-based IDS have demonstrated their ability to detect threats effectively, they encounter practical challenges due to their reliance on pre-labeled data and the heavy computational power they require, limiting their practical deployment. This research introduces the IoT-FIDS (Flow-based Intrusion Detection System for IoT), a lightweight and efficient anomaly detection framework tailored for IoT environments. Instead of employing traditional machine learning techniques, the IoT-FIDS focuses on identifying unusual behaviors by examining flow-based representations that capture standard device communication patterns, services used, and packet header details. By analyzing only benign traffic, this network-based IDS offers a streamlined and practical approach to securing IoT networks. Our experimental results reveal that the IoT-FIDS can accurately detect most abnormal traffic patterns with minimal false positives, making it a feasible security solution for real-world IoT implementations. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

34 pages, 1788 KiB

Open AccessArticle

Enabling Design of Secure IoT Systems with Trade-Off-Aware Architectural Tactics

by Cristian Orellana, Francisco Cereceda-Balic, Mauricio Solar and Hernán Astudillo

Sensors 2024, 24(22), 7314; https://doi.org/10.3390/s24227314 - 15 Nov 2024

Viewed by 396

Abstract

The increasing use of the Internet of Things (IoT) in homes and industry brings significant security and privacy challenges, while also considering trade-off for performance, energy consumption, and processing capabilities. Few explicit and specific guidelines exist to help architects in considering these trade-offs [...] Read more.

The increasing use of the Internet of Things (IoT) in homes and industry brings significant security and privacy challenges, while also considering trade-off for performance, energy consumption, and processing capabilities. Few explicit and specific guidelines exist to help architects in considering these trade-offs while designing secure IoT systems. This article proposes to address this situation by extending the well-known architectural tactics taxonomies with IoT-specific trade-offs; to preserving auditability, the trade-offs address the quality characteristics of the ISO 25010:2023 standard. The proposed technique and catalog are illustrated with the design of the Nunatak environmental monitoring system. The proposal was empirically validated with a controlled experiment, where a balanced mix of 12 novice and expert practitioners had to design a secure IoT Environmental Monitoring System; they used similar architectural tactics catalogs, with versus without trade-off information. Results suggest that having this information yield significant improvements in decision-making effectiveness (Precision) and usefulness (F1-Score), particularly benefiting less experienced designers. Wider adoption of trade-off-aware catalogs of architectural tactics will allow systematic, auditable design of secure IoT systems, and especially so by novice architects. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

16 pages, 1556 KiB

Open AccessArticle

Maintaining Cyber Resilience in the Reconfigurable Networks with Immunization and Improved Network Game Methods

by Maxim Kalinin, Evgeny Pavlenko, Georgij Gavva and Maxim Pakhomov

Sensors 2024, 24(22), 7116; https://doi.org/10.3390/s24227116 - 5 Nov 2024

Viewed by 523

Abstract

The paper proposes a technique for protecting reconfigurable networks that implements topology rebuilding, which combines immunization and network gaming methods, as a solution for maintaining cyber resilience. Immunization presumes an adaptive set of protective reconfigurations destined to ensure the functioning of a network. [...] Read more.

The paper proposes a technique for protecting reconfigurable networks that implements topology rebuilding, which combines immunization and network gaming methods, as a solution for maintaining cyber resilience. Immunization presumes an adaptive set of protective reconfigurations destined to ensure the functioning of a network. It is a protective reconfiguration aimed to preserve/increase the functional quality of the system. Network nodes and edges are adaptively reorganized to counteract an invasion. This is a functional component of cyber resilience. It can be implemented as a global strategy, using knowledge of the whole network structure, or a local strategy that only works with a certain part of a network. A formal description of global and local immune strategies based on hierarchical and peer-to-peer network topologies is presented. A network game is a kind of the well-defined game model in which each situation generates a specific network, and the payoff function is calculated based on the constructed networks. A network game is proposed for analyzing a network topology. This model allows quickly identifying nodes that require disconnection or replacement when a cyber attack occurs, and understanding which network sectors might be affected by an attack. The gaming method keeps the network topology resistant to unnecessary connections. This is a structural component of cyber resilience. The basic network game method has been improved by using the criterion of maximum possible path length to reduce the number of reconfigurations. Network optimization works together with immunization to preserve the structural integrity of the network. In an experimental study, the proposed method demonstrated its effectiveness in maintaining system quality within given functional limits and reducing the cost of system protective restructuring. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

21 pages, 5170 KiB

Open AccessArticle

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

by Ming Liu, Qichao Yang, Wenqing Wang and Shengli Liu

Sensors 2024, 24(20), 6507; https://doi.org/10.3390/s24206507 - 10 Oct 2024

Viewed by 1081

Abstract

The exponential growth of encrypted network traffic poses significant challenges for detecting malicious activities online. The scale of emerging malicious traffic is significantly smaller than that of normal traffic, and the imbalanced data distribution poses challenges for detection. However, most existing methods rely [...] Read more.

The exponential growth of encrypted network traffic poses significant challenges for detecting malicious activities online. The scale of emerging malicious traffic is significantly smaller than that of normal traffic, and the imbalanced data distribution poses challenges for detection. However, most existing methods rely on single-category features for classification, which struggle to detect covert malicious traffic behaviors. In this paper, we introduce a novel semi-supervised approach to identify malicious traffic by leveraging multimodal traffic characteristics. By integrating the sequence and topological information inherent in the traffic, we achieve a multifaceted representation of encrypted traffic. We design two independent neural networks to learn the corresponding sequence and topological features from the traffic. This dual-feature extraction enhances the model’s robustness in detecting anomalies within encrypted traffic. The model is trained using a joint strategy that minimizes both the reconstruction error from the autoencoder and the classification loss, allowing it to effectively utilize limited labeled data alongside a large amount of unlabeled data. A confidence-estimation module enhances the classifier’s ability to detect unknown attacks. Finally, our method is evaluated on two benchmark datasets, UNSW-NB15 and CICIDS2017, under various scenarios, including different training set label ratios and the presence of unknown attacks. Our model outperforms other models by 3.49% and 5.69% in F1 score at labeling rates of 1% and 0.1%, respectively. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

18 pages, 3424 KiB

Open AccessArticle

Architecture for Enhancing Communication Security with RBAC IoT Protocol-Based Microgrids

by SooHyun Shin, MyungJoo Park, TaeWan Kim and HyoSik Yang

Sensors 2024, 24(18), 6000; https://doi.org/10.3390/s24186000 - 16 Sep 2024

Viewed by 968

Abstract

In traditional power grids, the unidirectional flow of energy and information has led to a decrease in efficiency. To address this issue, the concept of microgrids with bidirectional flow and independent power sources has been introduced. The components of a microgrid utilize various [...] Read more.

In traditional power grids, the unidirectional flow of energy and information has led to a decrease in efficiency. To address this issue, the concept of microgrids with bidirectional flow and independent power sources has been introduced. The components of a microgrid utilize various IoT protocols such as OPC-UA, MQTT, and DDS to implement bidirectional communication, enabling seamless network communication among different elements within the microgrid. Technological innovation, however, has simultaneously given rise to security issues in the communication system of microgrids. The use of IoT protocols creates vulnerabilities that malicious hackers may exploit to eavesdrop on data or attempt unauthorized control of microgrid devices. Therefore, monitoring and controlling security vulnerabilities is essential to prevent intrusion threats and enhance cyber resilience in the stable and efficient operation of microgrid systems. In this study, we propose an RBAC-based security approach on top of DDS protocols in microgrid systems. The proposed approach allocates roles to users or devices and grants various permissions for access control. DDS subscribers request access to topics and publishers request access to evaluations from the role repository using XACML. The overall implementation model is designed for the publisher to receive XACML transmitted from the repository and perform policy decision making and enforcement. By applying these methods, security vulnerabilities in communication between IoT devices can be reduced, and cyber resilience can be enhanced. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

17 pages, 425 KiB

Open AccessEditor’s ChoiceArticle

Strengthening Privacy and Data Security in Biomedical Microelectromechanical Systems by IoT Communication Security and Protection in Smart Healthcare

by Francisco J. Jaime, Antonio Muñoz, Francisco Rodríguez-Gómez and Antonio Jerez-Calero

Sensors 2023, 23(21), 8944; https://doi.org/10.3390/s23218944 - 3 Nov 2023

Cited by 24 | Viewed by 4854

Abstract

Biomedical Microelectromechanical Systems (BioMEMS) serve as a crucial catalyst in enhancing IoT communication security and safeguarding smart healthcare systems. Situated at the nexus of advanced technology and healthcare, BioMEMS are instrumental in pioneering personalized diagnostics, monitoring, and therapeutic applications. Nonetheless, this integration brings [...] Read more.

Biomedical Microelectromechanical Systems (BioMEMS) serve as a crucial catalyst in enhancing IoT communication security and safeguarding smart healthcare systems. Situated at the nexus of advanced technology and healthcare, BioMEMS are instrumental in pioneering personalized diagnostics, monitoring, and therapeutic applications. Nonetheless, this integration brings forth a complex array of security and privacy challenges intrinsic to IoT communications within smart healthcare ecosystems, demanding comprehensive scrutiny. In this manuscript, we embark on an extensive analysis of the intricate security terrain associated with IoT communications in the realm of BioMEMS, addressing a spectrum of vulnerabilities that spans cyber threats, data manipulation, and interception of communications. The integration of real-world case studies serves to illuminate the direct repercussions of security breaches within smart healthcare systems, highlighting the imperative to safeguard both patient safety and the integrity of medical data. We delve into a suite of security solutions, encompassing rigorous authentication processes, data encryption, designs resistant to attacks, and continuous monitoring mechanisms, all tailored to fortify BioMEMS in the face of ever-evolving threats within smart healthcare environments. Furthermore, the paper underscores the vital role of ethical and regulatory considerations, emphasizing the need to uphold patient autonomy, ensure the confidentiality of data, and maintain equitable access to healthcare in the context of IoT communication security. Looking forward, we explore the impending landscape of BioMEMS security as it intertwines with emerging technologies such as AI-driven diagnostics, quantum computing, and genomic integration, anticipating potential challenges and strategizing for the future. In doing so, this paper highlights the paramount importance of adopting an integrated approach that seamlessly blends technological innovation, ethical foresight, and collaborative ingenuity, thereby steering BioMEMS towards a secure and resilient future within smart healthcare systems, in the ambit of IoT communication security and protection. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

Review

Jump to: Research

28 pages, 1300 KiB

Open AccessReview

A Review of IoT Firmware Vulnerabilities and Auditing Techniques

by Taimur Bakhshi, Bogdan Ghita and Ievgeniia Kuzminykh

Sensors 2024, 24(2), 708; https://doi.org/10.3390/s24020708 - 22 Jan 2024

Cited by 9 | Viewed by 5743

Abstract

In recent years, the Internet of Things (IoT) paradigm has been widely applied across a variety of industrial and consumer areas to facilitate greater automation and increase productivity. Higher dependability on connected devices led to a growing range of cyber security threats targeting [...] Read more.

In recent years, the Internet of Things (IoT) paradigm has been widely applied across a variety of industrial and consumer areas to facilitate greater automation and increase productivity. Higher dependability on connected devices led to a growing range of cyber security threats targeting IoT-enabled platforms, specifically device firmware vulnerabilities, often overlooked during development and deployment. A comprehensive security strategy aiming to mitigate IoT firmware vulnerabilities would entail auditing the IoT device firmware environment, from software components, storage, and configuration, to delivery, maintenance, and updating, as well as understanding the efficacy of tools and techniques available for this purpose. To this effect, this paper reviews the state-of-the-art technology in IoT firmware vulnerability assessment from a holistic perspective. To help with the process, the IoT ecosystem is divided into eight categories: system properties, access controls, hardware and software re-use, network interfacing, image management, user awareness, regulatory compliance, and adversarial vectors. Following the review of individual areas, the paper further investigates the efficiency and scalability of auditing techniques for detecting firmware vulnerabilities. Beyond the technical aspects, state-of-the-art IoT firmware architectures and respective evaluation platforms are also reviewed according to their technical, regulatory, and standardization challenges. The discussion is accompanied also by a review of the existing auditing tools, the vulnerabilities addressed, the analysis method used, and their abilities to scale and detect unknown attacks. The review also proposes a taxonomy of vulnerabilities and maps them with their exploitation vectors and with the auditing tools that could help in identifying them. Given the current interest in analysis automation, the paper explores the feasibility and impact of evolving machine learning and blockchain applications in securing IoT firmware. The paper concludes with a summary of ongoing and future research challenges in IoT firmware to facilitate and support secure IoT development. Full article

(This article belongs to the Special Issue IoT Cybersecurity)

► Show Figures

Figure 1

Journal Menu

Journal Browser

IoT Cybersecurity

Share This Special Issue

Special Issue Editors

Special Issue Information

Benefits of Publishing in a Special Issue

Published Papers (8 papers)

Research

Review

Further Information

Guidelines

MDPI Initiatives

Follow MDPI