10.1.2.1 Sensing Layer

In most of the scenarios just described, hackers were able to do the most damage when they gained access to sensors like baby monitors or pacemakers. So, it is critical to have sensors protected and monitored so that one can either prevent the intrusion or alert the user when there is one, in the fastest possible time. The possible threats at the sensing layer are the following:

• Unauthorized access to data
• Denial of service attack
• Malware on the device to send wrong information
• Malware on the device to send data to the wrong party
• Information gathering or data leakage leading to planned attacks

10.1.2.2 Network Layer

The availability, manageability, and scalability of the network are crucial for the operation of IoT. If the monitoring applications are not able to get data in time, IoT devices are rendered useless. Hence, hackers target networks more often to cripple the effectiveness of smart systems. Attacking the network by sending a lot of data at once to congest the network and pave the way to denial of service attacks is very common.

10.1.2.3 Service Layer

The service layer acts as a bridge between the hardware layer at the bottom and the interface layer at the top. An attack on the service layer impacts critical functions such as device management and information management, leading to the end users not being serviced. Privacy protection, access control, user authentication, communication security, data integrity, and data confidentiality are vital aspects of service layer security.

10.1.2.4 Interface Layer

In many ways, the interface layer is the most vulnerable part of the IoT ecosystem because this layer is at the top and is a gateway to all the other layers below. If there is a compromise in the authentication and authorization mechanisms of the interface, the ripple effects could permeate to the edge. The end user is a possible attack mechanism since attackers could gain sensitive information via phishing or other similar attacks. The web and the app interfaces can be subject to frequent attacks like SQL injection, cross‐site scripting, known default credentials, insecure password recovery mechanism and so forth.

OWASP (Open Web Application Security Project) has a very neat summarization of the attack surface areas for IoT [16] and is a handy reference (see Table 10.1).

10.1.3.1 Information Privacy

Privacy is a comprehensive term, and historically it has meant media, place, communication, body privacy. Today, the term is increasingly used to mean information privacy. Privacy was defined by Westin in 1968 as “the claim of individuals, to determine for themselves when, how, and to what extent information about them is communicated” [22].

Ziegeldort et al. in their paper on privacy in IoT [23], concretized the definition as follows. Privacy in the Internet of Things is the threefold guarantee that addresses these subjects:

1. Awareness of privacy risks imposed by smart things and services surrounding the data subject.
2. Individual control over the collection and processing of personal information by the surrounding smart things.
3. Awareness and control of subsequent use and dissemination of personal information by those entities to any entity outside the subject's control sphere.

Ziegeldort et al. [23] also defined a reference model to quickly understand and analyze the privacy concerns regarding anything that is interconnected anywhere via a network. The reference model contained four main types of entities: (i) smart things; (ii) subject; (iii) infrastructure; and (iv) services. It includes five types of information flows: (i) interaction; (ii) collection; (iii) processing; (iv) dissemination; and (v) presentation.

10.1.3.2 Categorization of IoT Privacy Issues

Ziegeldort et al. [23] also categorized the privacy threats (see Figure 10.3) into the following: (i) identification; (ii) localization and tracking; (iii) profiling; (iv) privacy‐violating interaction and presentation; (v) lifecycle transitions; (vi) inventory attack; and (vii) linkage.

10.1.4.1 Introduction to DDoS

A denial of service (DoS) attack is a cyberattack where an attacker makes a network resource unavailable by interrupting services of a machine connected to the Internet. It is typically accomplished by flooding the target machine with fake requests in order to overload the system. A distributed denial of service (DDoS) attack is one that uses multiple network resources as the source of the attack. A DDoS is mainly intended not only as a method to multiply the capabilities of a single attacker but also to conceal the identity of the attacker and thwart mitigation efforts. Most botnets use compromised computer resources without the owner's knowledge. In the CIA (confidentiality, integrity, availability) triad of information security, DDoS attack falls in the availability category. Figure 10.4 depicts how an attacker could initiate one attack and transform it into a multitude of attacks on a victim [24].

Though the motivations for DDoS can be multiple – extortion, hacktivism, cyberterrorism, personal vendetta, business rivalry, etc. – the impact is very severe in many instances. It can cause damage to reputation, huge revenue loss, and tens of thousands of hours of lost productivity. The scale of DDoS attacks has continued to rise over recent years, by 2016 exceeding a terabit per second.

10.1.4.2 Timeline of Notable DoS Events [25]

• 1988: Robert Tappan Morris launches a self‐replicating worm that spreads uncontrollably throughout the Internet and causes a massive unintentional DoS.
• 1997: The “AS 7007 incident,” is the first notable BGP hijacking and results in a massive DoS to significant portions of the Internet.
• 1999: Creation of trin00, TFN, and Stacheldraht botnets. The first instance of a botnet DDoS attack was a trin00 attack on the University of Minnesota.
• 2000: Michael Calce (aged 15) launched successful DoS attacks against Yahoo!, Fifa.com, Amazon.com, Dell, E*TRADE, eBay, and CNN.
• 2004: Hackers on 4chan develop the Low Orbit Ion Cannon (LOIC), a DDoS tool that would be used extensively by Anonymous and other groups to launch DDoS attacks.
• 2007: A series of DDoS attacks target various Estonian organizations. These attacks are notable as the first government‐sponsored DDoS attacks, since Russian government was suspected to be behind them.
• 2008: Hacktivist collective Anonymous launches its first significant DDoS attack, successfully targeting the Church of Scientology.
• 2009: Launch of a coordinated DDoS attack targeting Facebook, Google Blogger, LiveJournal, and Twitter targeting a Georgian blogger critical of Russia.
• 2010: Hacktivist collective Anonymous launches “Operation Avenge Assange” targeting banks that froze donations to Wikileaks.
• 2013: A massive DDoS attack targeting anti‐spam organization Spamhaus.org breaks records with traffic peaking at 300 Gbps.
• 2014: The hacking group Lizard Squad initiates successful DDoS attacks against the Sony Playstation Network and Microsoft Xbox Live.
• 2015: A network security hardware manufacturer reports a DDoS attack more than 500 Gbps against an unnamed customer.
• 2017: On October 21, a large‐scale DDoS attack on Dyn [26], which is a primary provider of DNS services to many companies, took down many high‐profile websites like Twitter, Pinterest, Reddit, GitHub, Amazon, Verizon, Comcast, and so forth.

10.1.4.3 Reason for the Recent Success of the DDoS Attacks

The most recent DDoS attack on Dyn [26] was made possible by the large number of unsecured IoT devices, such as home routers and surveillance cameras. The attackers employed thousands of such devices that had been infected with malicious code to form a botnet. The devices themselves were not powerful, but collectively they generated a massive amount of traffic to overwhelm targeted servers. The moment someone places a device on the Internet without changing the default password, it gets added to the army of vulnerable machines used for DDoS attacks. A report from welivesecurity.com [27] mentions that ESET tested more than 12,000 home routers to find 15% of them being unsecured. In the article “10 things to know about October 21 IoT DDoS attack” [28], Stephen Cobb lists default password as the leading cause. A mashable.com report in 2014 [29] mentions that 73,000 webcams were discovered in the Internet because people did not change default passwords.

To summarize, one could attribute the success of recent DDoS attacks despite decades of research and tools to mitigate, to the following:

• The proliferation of IoT devices.
• Increase in the number devices on the Internet with default passwords, and this could be due to the increase of nonsavvy technology users of smart devices.

10.1.4.4 Directions for Prevention of Specific Attacks on IoT Devices

As mentioned, in many instances above, IoT devices are growing at an alarming pace, and it is imminent that the devices be made secure. The attacks increasingly have a crippling effect on the economy and have become the new currency of global warfare. With this in mind, the US Senate introduced legislation in August 2017 [30] to improve the cybersecurity of IoT devices.

Specifically, if enacted, the Internet of Things (IoT) Cybersecurity Improvement Act of 2017 [31] would:

• Require vendors of Internet‐connected devices purchased by the federal government to ensure their devices are patchable, rely on industry standard protocols, do not use hard‐coded passwords, and do not contain any known security vulnerabilities.
• Direct the Office of Management and Budget (OMB) to develop alternative network‐level security requirements for devices with limited data processing and software functionality.
• Direct the Department of Homeland Security's National Protection and Programs Directorate to issue guidelines regarding cybersecurity coordinated vulnerability disclosure policies to be required by contractors providing connected devices to the US government.
• Exempt cybersecurity researchers engaging in good‐faith research from liability under the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act when engaged in research pursuant to adopted coordinated vulnerability disclosure guidelines.
• Require each executive agency to inventory all Internet‐connected devices in use by the agency.

10.1.4.5 Steps to Prevent Attacks on IoT Devices

The overarching strategy to secure IoT devices should be twofold: reduce the number of devices that can be abused and convince the would‐be attackers like hacktivists on the gravity of the situation. Also, there needs to be a global strategy to punish the guilty. There have been multiple efforts to reduce the number of devices that can be abused. The Cybersecurity Improvement Act mentioned above, alerts sent out by the Department of Homeland Security, WaterISAC's 10 Basic Cybersecurity measures [32], are few initiatives from the government toward this. Here are the top four actions recommended by US‐CERT [33] in the wake of the latest attacks:

1. Ensure all default passwords are changed to strong passwords. (Default usernames and passwords for most devices can easily be found on the Internet, making devices with default passwords extremely vulnerable.)
2. Update IoT devices with security patches as soon as patches become available.
3. Disable Universal Plug and Play (UPnP) on routers unless absolutely necessary.
4. Purchase IoT devices from companies with a reputation for providing secure devices.

10.2.2.1 Classification

• Logistic regression. Predictions are mapped to be between 0 and 1 through the logistic function.
• Classification tree. The data are repeatedly split into separate branches to arrive at the output label.
• Support vector machine (SVM). In SVM, the program views the data elements as points in an n‐dimensional space. The algorithm finds a hyperplane (decision boundary) that maximizes the distance between closest points of separate classes.
• Naïve Bayes. In Naïve Bayes, the model is a probability table that gets created using the probability of occurrences of training data. The algorithm predicts the new output by looking up the probabilities of the input variables and using conditional probability.
• K‐nearest neighbors (KNN). In KNN, the algorithm predicts the class by searching through the training set for K most similar neighbors of the new input.

10.2.2.2 Regression

• Linear regression. In linear regression, the algorithm creates a model by fitting a straight line (or a hyperplane for n‐dimensions) through the data.
• Regression tree / decision tree. In regression tree, the data are repeatedly split into separate branches to arrive at the output.
• K‐nearest neighbors. In KNN, the algorithm predicts the value by searching through the training set for K most similar neighbors of the new input and summarizing the outputs.

10.2.2.3 Clustering

• K‐means. In K‐means, the algorithm creates clusters based on geometric distances between points. At the outset, the algorithm randomly assigns the data points to k clusters, computes centroids for each cluster, computes points closest to each centroid and then re‐computes the centroids. The algorithm repeats the process till there are no more improvements possible. The clusters tend to be globular for K‐means.
• DBSCAN. In DBSCAN (Density‐based spatial clustering of applications with noise), clusters are created based on density. The algorithm makes an n‐dimensional sphere of radius epsilon for each data point and counts the number of points inside the sphere. If the number is less than min_points, the algorithm disregards the point. If not, it computes the centroid for the sphere and continues the same process.
• Hierarchical clustering. The algorithm starts with n clusters for n data points. It combines two nearest clusters to create a new cluster. The algorithm repeats the process until only one cluster remains. One can view the result as a dendrogram with the height representing the distance between the clusters. If we can imagine a horizontal line that traverses the dendrogram vertically, the maximum distance it covers without intersecting another cluster gives the minimum distance between clusters. The number of vertical lines cut gives the number of clusters.

10.2.2.4 Dimensionality Reduction

• PCA. A principal component is a normalized linear combination of the variables in a dataset. In PCA (principal component analysis), the objective is to orthogonally project data points onto an L dimensional linear subspace that has the maximal projected variance. For PCA, the variable values need to be numerical. Hence, categorical variables are converted to numerical.
• CCA. Canonical correlation analysis (CCA) deals with two or more variables, and its objective is to find a corresponding pair of highly cross‐correlated linear subspaces so that within one of the subspaces there is a correlation between each component and a single component from the other subspace.

10.2.2.5 Combining Models (Ensemble ML)

In many instances, a single type of algorithm may not be able to give optimal results due to the variety of the types of data or other reasons. In these cases, different algorithms are combined to give more accurate predictions than individual models.

• CART. In classification and regression trees (CART), The data repeatedly split into separate branches to arrive at the output label or value. Though the trees used for regression and those used for classification have some similarities, they differ in some respects, e.g., the algorithm to determine where to split.
• Random forests. In random forests, instead of training a single tree, a multitude of trees are trained. The algorithm outputs a class that is the mode of the training classes or the mean of the training values.
• Bagging. Bootstrap aggregation, also called bagging, is a general procedure that can be used to reduce the variance for an algorithm that has high variance. CART/decision tree is an algorithm that has a high variance and is sensitive to training data.

10.2.2.6 Artificial Neural Networks

Artificial neural networks (ANNs) are computing systems that model neural networks and brain in humans. ANN contains units called neurons. Neurons are connected to each other via synapses and communicate signals to each other. Each neuron receives inputs from other neurons connected to it and computes an output to be transmitted upstream. Each input signal has a corresponding weight, and the neuron applies a function to the weighted sum of the inputs it gets. Feed forward neural networks (FFNN), also known as multilayer perceptrons (MLP), is the most common type of neural networks in practical applications. There are other types of ANNs such as CNN (convolutional neural network), RNN (recurrent neural network), DBN (deep belief network), TDNN (time delay neural network), DSN (deep stacking network) and so forth.

10.2.3.1 Overview

The main ingredient in an ML system is data. With the spread of IoT, there is a massive amount of data that gets generated on a daily basis, and this is a goldmine for machine learning. The adoption of supervised and unsupervised machine‐learning techniques in IoT smart data analysis is broad. All of the smart things discussed in Section 10.1.1 – smart homes where appliances, lights, and thermostat connect to the Internet [1], smart medical appliances that not only monitor remotely but also administer medicines [2], smart bridges that have sensors to monitor load [3], smart power grids to detect disruptions and manage distribution of power [4] and smart machinery in industries that have embedded sensors in machinery to increase worker [5] – would be using or have the potential to use machine learning in some form or the other.

10.2.3.2 Examples

There are many concrete examples where machine learning saved millions of dollars for corporations:

• Google Deepmind AI. Google applied machine learning to 120+ variables from sensor in its data center to optimize cooling, and that cut its overall energy consumption by 15% [37].
• Roomba 980. This Roomba is connected to the Internet and comes with a camera that captures the images of a room and software that compares these images to gradually build up a map of the robot's surroundings to determine its location [38]. It is able to “remember” a home layout, adapt to different surfaces or new items, clean a room with the most efficient movement pattern, and dock itself to recharge its batteries.
• NEST Thermostat. NEST “learns” the regular temperature preferences of its users, and also adapts to the work schedule of its users by turning down energy use [39]. The input is the temperature preference of the user, time and day, presence of the user at home, etc. and the output is a discrete set of temperatures making this a classification problem.
• Tesla cars. Tesla enabled auto pilot service in its cars that helps in hands‐free driving, including complex tasks like lane changes. Tesla cars built since 2014 have 12 sensors on the bottom of the vehicle, a front‐facing camera next to the rear‐view mirror, and a radar system under the nose [40]. These sensing systems are not only constantly collecting data to help the autopilot work on the road, but also to amass data that can make Teslas operate better in the future. Because all Tesla cars have an always‐on wireless connection, data from driving and using autopilot is collected, sent to the cloud, and analyzed with software.

10.2.4.1 Healthcare

10.2.4.2 Utilities – Energy/Water/Gas

10.2.4.3 Manufacturing

10.2.4.4 Insurance

10.2.4.5 Traffic

10.2.4.6 Smart City – Citizens and Public Places

10.2.4.7 Smart Homes

10.2.4.8 Agriculture

10.3.2.1 Malware Detection Using SVM

In their paper for Android Malware detection using Linear SVM, Ham et al. [46] review various approaches for detecting malware, such as signature based, behavior based, and taint analysis based detection, and show that Linear SVM showed high performance among ML algorithms used to effectively detect malware. In a behavior‐based detection system, in order to detect abnormal patterns, event information on the device like memory usage, data content, and energy consumption are monitored. ML techniques are used to analyze the data, and hence, the choice of features is very important.

10.3.2.2 Malware Detection Using a Random Forest

In their paper for Android malware detection using a random forest, Alam et al. [47] apply ML ensemble learning algorithm random forest on an Android feature dataset of 48919 points of 42 features each. Their goal was to measure the accuracy of random forests in classifying Android application behavior to classify applications as malicious or benign. They also analyzed the detection accuracy as the parameters of RF algorithm, such as the number of trees, depth of each tree, and number of random features were changed. The results based on fivefold cross validation showed that RF performed very well with an accuracy of over 99% in general, an optimal out‐of‐bag (OOB) error rate of 0.0002 for forests with 40 trees or more, and a root mean squared error of 0.0171 for 160 trees.

10.3.2.3 Intrusion Detection Using PCA, Naïve Bayes, and KNN

In their paper for anomaly‐based intrusion detection, Pajouh et al. [48] present a novel model for intrusion detection based on two‐layer dimension reduction and two‐tier classification module, designed to detect malicious activities such as user to root (U2R) and remote to local (R2L) attacks. Their proposed model used PCA and linear discriminate analysis (LDA) to reduce the high dimensional dataset to a lower one with lesser features. They then applied a two‐tier classification module utilizing Naïve Bayes and certainty factor version of K‐nearest neighbor to identify suspicious behaviors.

10.3.2.4 Anomaly Detection Using Classification

In their paper for designing an IoT device for the safety of women, Jatti et al. [49] describe the design of a device that determines whether the wearer is in danger. The device transmits data related to physiology and body position of the person. The physiological signals that are transmitted are galvanic skin response (GSR) and body temperature. Body position is determined by acquiring raw accelerometer data from a triple axis accelerometer. The premise is that when a person is faced with a dangerous situation, secretion of adrenalin affects different systems in the body, resulting in increased blood pressure and heart rate and also sweating. This increases skin conductance, measured by GSR. The data are analyzed by an ML classifier that determines if the individual is in a dangerous situation, such as threat of rape.

10.3.4.1 Mirai

This DDoS attack is covered in Section 12.3.4. It took down half the Internet in the United States and Europe for hours. Mirai scans the Internet for hosts with an open telnet port and gains access if the password is weak. After it gets inside, it installs the malware and monitors the CNC (command and control) center. During the attack, the CNC instructs all the bots to create a flood of traffic and overwhelm the target. Perry [53] suggests that to protect the devices, one should take the following measures:

• Always change default password.
• Remove devices with telnet backdoors.
• Limit exposing a device directly to the Internet.
• Run port scans of all the devices.

10.3.4.2 Brickerbot

This bot makes the device under attack unusable, i.e. turns it into a brick. Once the malware obtains access to the device, it runs a series of commands to wipe data from the device's storage. This renders the device useless.

10.3.4.3 FLocker

FLocker (short for Frantic Locker) is a bot that locks the target device and prevents valid users from accessing it. Users could be asked to pay ransom or might lose access to the device and may have to hard‐delete all data. Norton Security [54] has noted its use for targeting Android Smart TVs.

10.3.4.4 Summary

In summary, IoT attacks are increasing, and new variants of the attacks are created often. A report from F5 labs [55] shows that IoT attacks exploded by 280% in the first half of 2017 with a large chunk of this growth stemming from Mirai. Moreover, the report claims that 83% of attacks came from a single hosting provider in Spain called SoloGigabit that had a “bulletproof” reputation.

10.3.5.1 Insights from the Research

Based on the research done on ML techniques used for IoT security, it is evident that different techniques need to be used for different scenarios. There is no one‐size‐fits‐all solution because of the complexity of the problem statement. Also, anomalies in data can occur at different layers in the IoT ecosystem. Multiple devices could be hacked, resulting in wrong access patterns or data dispatch, or a gateway could be hacked, resulting in data routing. This would mean that the training system could get incomplete data or different types of data. In these cases, classic ML algorithms might fail to operate – SVM needs standardized numerical data, as the input to a decision tree cannot traverse through a branch in the tree when values are missing. In these cases, the best option is ensemble machine learning.

The other insight that came out of the research is that there are increasing use cases where IoT data must be analyzed as data are streamed, and decisions must be taken quickly. This means that the data cannot wait to be sent to the cloud and processed. Hence, new paradigms like fog computing and edge computing are more relevant for IoT security than others. Table 10.4 shows characteristic of data in smart city use case mentioned in Mahdavinejad et.al. [41] and it is clear that there are many use cases that need data to be processed near the device for quicker turnaround.

To summarize the insights:

1. IoT devices and data are diverse and need different machine‐learning algorithms to analyze different aspects of the system.
2. IoT data need to be analyzed closer to the device than in the cloud.

10.3.5.2 Proposals

Proposal #1.

Use ensemble machine learning method for IoT data analysis in the cloud. Ensemble machine learning method uses multiple machine‐learning algorithms to obtain better predictive performance than what could be obtained from a single algorithm alone. It would also perform much better for different types of data and missing data. Figure 10.5 depicts the general idea behind ensemble machine learning.

10.4.3.1 ML in Fog Computing in Industry

Traditional cloud‐based or noncloud centralized analytics infrastructures rely on training a machine learning algorithm by using data from past failures. The algorithm would create a model that could be used to predict failure. But in many instances, failure prediction is too late to prevent the breakdown and is used to minimize the effect of damage. In comparison, if near‐instant analytics is done locally using fog computing, the system would be able to take steps to prevent the occurrence of the issue. That is because the analytics system is nearer to the edge and has more context.

10.4.3.2 ML in Fog Computing in Retail

Retail stores, in general, do product placement based on analytics derived from customer purchases and also seasonal preferences. So, we see product placements change during Halloween, Thanksgiving, Christmas, and so forth. If fog computing is used with analytics being done for a store or a group of stores in an area, the system would be able to analyze buying patterns of the users in the locality and help the store to target merchandise better and improve customer experience.

10.4.3.3 Fog Computing for Self‐Driving Cars

With Google, Tesla, Uber, GM, and other mainstream companies testing self‐driving cars, the reality of having these vehicles for mainstream use cases is very near. Self‐driving automobiles are excellent examples of fog computing, since a lot of computing and decision‐making happens on the edge. Nevertheless, each car transmits a lot of data for processing in the cloud. An N‐tier model would make the system considerably more efficient. Machine‐learning algorithms used are ANN for image processing, Naïve Bayes or similar algorithms for anomaly detection, reinforced learning, and so forth.