Anatomy of Threats to the Internet of Things

TLDR

The Internet of Things is increasingly adopted across industrial control, e‑health, e‑commerce, smart cities, and other domains, generating vast data streams but also exposing devices to availability, privacy, integrity, malware, and physical compromise threats. This paper aims to delineate the principal threats at each layer of the IoT architecture, with particular emphasis on the anatomy of malware attacks. We detail the attack methodologies of prominent IoT malware—including those targeting industrial control and cyber‑physical systems—analyze a distributed denial‑of‑service strategy via IoT botnets, and propose a composite guideline for an industry‑aligned security framework.

Abstract

The world is resorting to the Internet of Things (IoT) for ease of control and monitoring of smart devices. The ubiquitous use of IoT ranges from industrial control systems (ICS) to e-Health, e-Commerce, smart cities, supply chain management, smart cars, cyber physical systems (CPS), and a lot more. Such reliance on IoT is resulting in a significant amount of data to be generated, collected, processed, and analyzed. The big data analytics is no doubt beneficial for business development. However, at the same time, numerous threats to the availability and privacy of the user data, message, and device integrity, the vulnerability of IoT devices to malware attacks and the risk of physical compromise of devices pose a significant danger to the sustenance of IoT. This paper thus endeavors to highlight most of the known threats at various layers of the IoT architecture with a focus on the anatomy of malware attacks. We present a detailed attack methodology adopted by some of the most successful malware attacks on IoT, including ICS and CPS. We also deduce an attack strategy of a distributed denial of service attack through IoT botnet followed by requisite security measures. In the end, we propose a composite guideline for the development of an IoT security framework based on industry best practices and also highlight lessons learned, pitfalls and some open research challenges.