A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> III. RELATED WORK <s> IoT is an intelligent collaboration of tiny sensors and devices giving new challenges to security and privacy in end to end communication of things. Protection of data and privacy of things is one of the key challenges in the IoT. Lack of security measures will result in decreased adoption among users and therefore is one of the driving factors in the success of the IoT. This paper gives an overview, analysis and taxonomy of security and privacy challenges in IoT. Finally, Security Model for IoT has been proposed. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> III. RELATED WORK <s> This paper is a first attempt to define a set of security vulnerabilities for the Internet of Things (IoT), in a corporate environment, in order to classify various connected objects based on a taxonomy that was previously proposed. The IoT is a complex infrastructure that we divide in four parts (objects, transport, storage, interfaces). It needs protection and supervision. The object and its ecosystem are surrounded with other devices that can become entry points or targets of attacks, even if they are protected from the outer world but not from their local environment. We study the impact of attacks (such as OS reprogramming that has been recently published) on connected thermostats and their possible consequences on their environment, as a first approach to a threat analysis for the IoT. <s> BIB002
The methodology followed to execute the conducted survey is illustrated here for the purpose of evaluating the research works that have been done in literature and to determine if the topic has been completely investigated. As IoT vision and its security is relatively new, our concentration was on the publications that were released in the period 2000-2017. These publications include books, journals, conferences, websites, white-papers, and reports. Fig. 5 provides the time period of this survey, and the number of published papers at each layer of the proposed reference model in that period. Perception, network, cloud, and edge computing layers are represented in Fig. 5 as a, b, c, and d bar charts, respectively. According to Fig. 5 , the key observation is that there has been an increase in the number of published papers addressing security attacks on all layers nearly from 2006 to 2015. This is, in our opinion, because of the rapid growth of IoT in a huge number of application domains such as critical infrastructure systems and the appearance of different attacks that threaten human lives and hamper the realization of IoT, which require a lot of research to be solved. As samples of our searching keywords, we have used "IoT security", "IoT countermeasures", "IoT security challenges", "attacks on IoT", "IoT security goals", "IoT privacy". Although a huge number of research works have conducted to address security attacks of IoT systems in the state-of-theart, handful of papers have attempted to investigate IoT attacks in a comprehensive approach, the most popular of which are the following: In BIB002 , authors have proposed a new approach of addressing IoT threats and attacks based on a four-layer model composed of objects, interfaces, storage, and transport. Although this paper described some attacks on these levels, it did not comprehend all possible attacks. For example, firmware tampering has only been discussed as an example of physical attacks against IoT objects. In  In  , IoT architecture has been divided into four layers: 1) application layer; 2) adaptation or support layer; 3) network layer; and 4) perception layer. Even though this approach described security threats in each layer, it lacks a comprehensive set of attacks of each layer. For example, it identified security attacks against IoT network in high level without analyzing the attacks against each network protocol. Furthermore, it uncovered the relationship between IoT attacks and their compromised security goals. IoT ecosystem presented in  has been divided into three levels, namely back-end system, network, and front-end sensors. The authors did not identify all attacks for each level. For example, only two types of attacks, management of the code and replacement of operator, have been identified in the network layer. The authors in BIB001 divided IoT attack taxonomy into six categories, namely storage management, identity management, dynamic biding, physical threats, communication threat, and embedded security. However, security attacks have been identified at high level in each category. Only three types of attacks on communication, denial of service, spoofing, and network injection, have been introduced. 