With the remarkable growth of the Internet and communication technologies over the past few decades, Internet of Things (IoTs) is enabling the ubiquitous connectivity of heterogeneous physical devices with software, sensors, and actuators. IoT networks are naturally two-layer with the cloud and cellular networks coexisting with the underlaid device-todevice (D2D) communications. The connectivity of IoTs plays an important role in information dissemination for missioncritical and civilian applications. However, IoT communication networks are vulnerable to cyber attacks including the denialof- service (DoS) and jamming attacks, resulting in link removals in IoT network. In this work, we develop a heterogeneous IoT network design framework in which a network designer can add links to provide additional communication paths between two nodes or secure links against attacks by investing resources. By anticipating the strategic cyber attacks, we characterize the optimal design of secure IoT network by first providing a lower bound on the number of links a secure network requires for a given budget of protected links, and then developing a method to construct networks that satisfy the heterogeneous network design specifications. Therefore, each layer of the designed heterogeneous IoT network is resistant to a predefined level of malicious attacks with minimum resources. Finally, we provide case studies on the Internet of Battlefield Things (IoBT) to corroborate and illustrate our obtained results
Due to the increasing cyber threats, IoT security becomes a critical concern nowadays @cite_34 . Depending on the potential of cyber attackers, IoT networks face heterogeneous types of attacks @cite_5 . For example, attackers can target the edge computing nodes in IoT, e.g., RFID readers and sensor nodes. Some typical adversarial scenarios include the node replication attack by replicating one node's identification number @cite_24 , DoS by battery draining, sleep deprivation, and outage attacks @cite_19 @cite_2 . The attackers can also launch attacks through the IoT communication networks. Quintessential examples include the eavesdropping attack where the attacker captures the private information over the channel, and utilizes the information to design other tailored attacks @cite_33 . Another example is the data injection attack where the attacker can inject fraudulent packets into IoT communication links through insertion, manipulation, and replay techniques @cite_4 . In our work, we focus on the jamming and DoS attacks which lead to the link removal in IoT communication networks.
@cite_4 @cite_33 @cite_24 @cite_19 @cite_2 @cite_5 @cite_34
2736486587 2889885925 2754804809 2853090665
With the remarkable growth of the Internet and communication technologies over the past few decades, Internet of Things (IoTs) is enabling the ubiquitous connectivity of heterogeneous physical devices with software, sensors, and actuators. IoT networks are naturally two-layer with the cloud and cellular networks coexisting with the underlaid device-todevice (D2D) communications. The connectivity of IoTs plays an important role in information dissemination for missioncritical and civilian applications. However, IoT communication networks are vulnerable to cyber attacks including the denialof- service (DoS) and jamming attacks, resulting in link removals in IoT network. In this work, we develop a heterogeneous IoT network design framework in which a network designer can add links to provide additional communication paths between two nodes or secure links against attacks by investing resources. By anticipating the strategic cyber attacks, we characterize the optimal design of secure IoT network by first providing a lower bound on the number of links a secure network requires for a given budget of protected links, and then developing a method to construct networks that satisfy the heterogeneous network design specifications. Therefore, each layer of the designed heterogeneous IoT network is resistant to a predefined level of malicious attacks with minimum resources. Finally, we provide case studies on the Internet of Battlefield Things (IoBT) to corroborate and illustrate our obtained results The evolution and sophistication of cyber-attacks need resilient and evolving cybersecurity schemes. As an emerging technology, the Internet of Things (IoT) inherits cyber-attacks and threats from the IT environment despite the existence of a layered defensive security mechanism. The extension of the digital world to the physical environment of IoT brings unseen attacks that require a novel lightweight and distributed attack detection mechanism due to their architecture and resource constraints. Architecturally, fog nodes can be leveraged to offload security functions from IoT and the cloud to mitigate the resource limitation issues of IoT and scalability bottlenecks of the cloud. Classical machine learning algorithms have been extensively used for intrusion detection, although scalability, feature engineering efforts, and accuracy have hindered their penetration into the security market. These shortcomings could be mitigated using the deep learning approach as it has been successful in big data fields. Apart from eliminating the need to craft features manually, deep learning is resilient against morphing attacks with high detection accuracy. This article proposes an LSTM network for distributed cyber-attack detection in fog-to-things communication. We identify and analyze critical attacks and threats targeting IoT devices, especially attacks exploiting vulnerabilities of wireless communications. The conducted experiments on two scenarios demonstrate the effectiveness and efficiency of deeper models over traditional machine learning models. Security experts have demonstrated numerous risks imposed by Internet of Things (IoT) devices on organizations. Due to the widespread adoption of such devices, their diversity, standardization obstacles, and inherent mobility, organizations require an intelligent mechanism capable of automatically detecting suspicious IoT devices connected to their networks. In particular, devices not included in a white list of trustworthy IoT device types (allowed to be used within the organizational premises) should be detected. In this research, Random Forest, a supervised machine learning algorithm, was applied to features extracted from network traffic data with the aim of accurately identifying IoT device types from the white list. To train and evaluate multi-class classifiers, we collected and manually labeled network traffic data from 17 distinct IoT devices, representing nine types of IoT devices. Based on the classification of 20 consecutive sessions and the use of majority rule, IoT device types that are not on the white list were correctly detected as unknown in 96 of test cases (on average), and white listed device types were correctly classified by their actual types in 99 of cases. Some IoT device types were identified quicker than others (e.g., sockets and thermostats were successfully detected within five TCP sessions of connecting to the network). Perfect detection of unauthorized IoT device types was achieved upon analyzing 110 consecutive sessions; perfect classification of white listed types required 346 consecutive sessions, 110 of which resulted in 99.49 accuracy. Further experiments demonstrated the successful applicability of classifiers trained in one location and tested on another. In addition, a discussion is provided regarding the resilience of our machine learning-based IoT white listing method to adversarial attacks. This paper presents an adversarial machine learning approach to launch jamming attacks on wireless communications and introduces a defense strategy. In a cognitive radio network, a transmitter senses channels, identifies spectrum opportunities, and transmits data to its receiver in idle channels. On the other hand, an attacker may also sense channels, identify busy channels and aim to jam transmissions of legitimate users. In a dynamic system with complex channel, traffic and interference characteristics, the transmitter applies some pre-trained machine learning algorithm to classify a channel as idle or busy. This classifier is unknown to the attacker that senses a channel, captures the transmitter's decisions by tracking the acknowledgments and applies deep learning (in form of an exploratory attack, i.e., inference attack) to build a classifier that is functionally equivalent to the one at the transmitter. This approach is shown to support the attacker to reliably predict successful transmissions based on the sensing results and effectively jam these transmissions. Then, a defense scheme is developed against adversarial deep learning by exploiting the sensitivity of deep learning to training errors. The transmitter deliberately takes a small number of wrong actions (in form of a causative attack, i.e., poisoning attack, launched against the attacker) when it accesses the spectrum. The objective is to prevent the attacker from building a reliable classifier. For that purpose, the attacker systematically selects when to take wrong actions to balance the conflicting effects of deceiving the attacker and making correct transmission decisions. This defense scheme successfully fools the attacker into making prediction errors and allows the transmitter to sustain its performance against intelligent jamming attacks.