Source-linked AI summary
Security of the Internet of Things: Vulnerabilities, Attacks and Countermeasures
Ismail Butun, Patrik Österberg, Houbing Song
TL;DR
Security is a major concern for WSNs and IoT, particularly in mission-critical applications, while heterogeneous devices and limited security precautions expose these systems to attacks. The paper surveys WSN and IoT attacks, classifies them by passive or active activity and OSI layer, and reviews prevention, detection, and mitigation techniques; it concludes that IDS techniques are increasingly important because some can address zero-day attacks.
Problem
Security gaps in WSNs and IoT can threaten mission-critical operations and expose confidential health data, while IoT devices may lack basic security elements.
Method
The paper provides a comprehensive survey of WSN and IoT attacks, classifying them by passive or active activity and OSI layer, and evaluating defensive strategies.
Results
The paper concludes that intrusion detection system techniques are increasingly important for IoT systems because some are efficient against zero-day attacks.
Takeaways & Limitations
Future WSN and IoT designs should address security across routing, key distribution, trust management, and data aggregation over multiple protocol layers.
Takeaways & Limitations
Enabling MQTT security with certificates and session-key management is burdensome because heterogeneous IoT devices complicate certificate storage and per-session key exchanges.
Abstract
from arXiv · showhide
Wireless Sensor Networks (WSNs) constitute one of the most promising third-millennium technologies and have a wide range of applications in our surrounding environment. The reason behind the vast adoption of WSNs in various applications is that they have tremendously appealing features, e.g., low production cost, low installation cost, unattended network operation, autonomous and longtime operation. WSNs have started to merge with the Internet of Things (IoT) through the introduction of Internet access capability in sensor nodes and sensing ability in Internet-connected devices. Thereby, the IoT is providing access to huge amount of data, collected by the WSNs, over the Internet. However, owing to the absence of a physical line-of-defense, i.e. there is no dedicated infrastructure such as gateways to watch and observe the flowing information in the network, security of WSNs along with IoT is of a big concern to the scientific community. Besides, recent integration and collaboration of WSNs with IoT will open new challenges and problems in terms of security. Hence, this would be a nightmare for the individuals using these systems as well as the security administrators who are managing those networks. Therefore, a detailed review of security attacks towards WSNs and IoT, along with the techniques for prevention, detection, and mitigation of those attacks are provided in this paper. In this text, attacks are categorized and treated into mainly two parts, most or all types of attacks towards WSNs and IoT are investigated under that umbrella: "Passive Attacks" and "Active Attacks". Understanding these attacks and their associated defense mechanisms will help to pave a secure path towards the proliferation and public acceptance of IoT technology.
1 INTRODUCTION
The introduction frames WSNs and IoT as widely applicable but security-critical technologies, especially as sensor networks become Internet-connected. It presents the paper as a comprehensive survey of attacks and integrated prevention, detection, and mitigation strategies.
- Motivation: WSNs support environmental monitoring, human activity observation, mission-critical services, and industrial applications because they are inexpensive and easy to deploy.Their applications include wildfire, healthcare, military operations, traffic, industrial automation, and machinery monitoring.
- Motivation: IoT connects smart objects and increasingly integrates WSNs, expanding access to sensor data and the range of connected applications.The paper describes IoT as an evolving ecosystem whose applications include homes, offices, and other aspects of daily life.
- Security significance: Security is especially consequential in mission-critical WSN and IoT deployments, where failures can cause battlefield casualties or expose confidential patient data.The introduction also notes that many healthcare systems lack strong security services for preserving patient privacy.
- Survey scope: The paper organizes security defenses into prevention, detection, and mitigation, which together form a complete structure rather than independent components.Prevention addresses attacks before occurrence, detection identifies compromised nodes during attacks, and mitigation reduces their effects afterward.
- Contribution: The survey claims comprehensive coverage of WSN attacks and related detection, prevention, and mitigation techniques, while applying lessons from WSN security to IoT.It positions this coverage against earlier surveys with narrower topics or classifications.
- Scope boundary: The manuscript omits security analysis of IoT subdomains such as LPWAN and excludes privacy and trust issues to focus on attacks and mitigation.The authors direct readers to other works for those topics.
2 ATTACKS TOWARDS THE WSNS AND IOT
The paper classifies WSN and IoT attacks first by attacker activity and then by the targeted OSI protocol layer. This framework structures the subsequent descriptions of attack categories.
- Attack taxonomy: Attacks are categorized as passive or active according to the activity of the attacker, with OSI-layer targeting used as a secondary classification.The classification follows existing attack taxonomies and organizes the paper’s attack descriptions.
2.1 Passive Attacks
Passive attacks are typically hidden and target confidentiality by tapping communications or exploiting compromised, malfunctioning, destroyed, or unavailable nodes. Traffic analysis can additionally reveal valuable network-topology information even without exposing packet contents.
- Passive attack characteristics: Passive attacks are generally undetectable because adversaries avoid radio emissions, making wireless eavesdropping relatively easy.They primarily threaten data confidentiality.
- Attack categories: The paper groups passive attacks into eavesdropping, node malfunctioning, node tampering or destruction, node outage, and traffic analysis.The paper notes that some studies classify malfunctioning, outage, and tampering as active attacks instead.
- Eavesdropping: Eavesdropping requires proximity in WSNs but can expose node locations, message metadata, and any unencrypted information.Short-range communication offers somewhat greater protection against tapping than long-range wireless technologies.
- Node disruption: Node destruction, malfunction, or outage can disrupt regular functionality, requiring alternate routes or new cluster-head election to reduce network effects.These failures may result from physical attacks, faulty sensors, energy depletion, or other DoS attacks.
- Traffic analysis: Traffic analysis can expose topology by identifying the base station, nearby nodes, or cluster heads from their heavier transmission patterns.Nodes near the sink relay more packets, while cluster heads are busier than other nodes.
2.2 Active Attacks
Active attacks affect network operations or seek unauthorized resource access, while threatening confidentiality and integrity. The paper organizes them across WSN layers, including physical, data-link, network, and IoT application protocols such as MQTT.
- Physical-layer attacks: DoS attacks consume resources or block packets, preventing legitimate users from accessing network services.They primarily target service availability and can isolate nodes from the network.
- Active attack characteristics: Active attacks generate detectable actions that can degrade or terminate services, while some attackers seek unauthorized access or threaten confidentiality and integrity.Unlike passive attacks, the adversary directly affects network operations.
- Physical-layer attacks: Jamming reduces the signal-to-noise ratio below the level required for correct reception by transmitting interference on the same frequency.Continuous jamming can prevent communication across an affected region.
- Physical-layer attacks: Node capture lets an attacker read or alter stored data and transmissions, while the captured node can issue arbitrary queries or provide false data.These effects threaten availability and integrity.
- Data-link attacks: Data-link DoS attacks include collision, denial of sleep, de-synchronization, exhaustion, flooding, link-layer jamming, spoofing, and unfairness.Their effects include packet loss, battery depletion, bandwidth exhaustion, identity abuse, and intermittent service degradation.
- Network-layer attacks: Network-layer attacks inject packets or manipulate routing through HELLO flooding, hole attacks, node replication, selective forwarding, routing attacks, and Sybil attacks.They can cause congestion, consume power, divert network behavior, or mislead neighboring nodes.
- Application and transport attacks: MQTT supports lightweight publish-subscribe communication but provides no security layer by default, leaving certificate and key management to users.The paper calls for scalable, lightweight, and robust protection because heterogeneous-device management is burdensome.
3 DEFENDING AGAINST VARIOUS ATTACKS TOWARDS THE WSNS AND IOT
Defense against WSN and IoT attacks combines prevention, detection, and mitigation across protocol layers. Preventive methods are efficient but threat-specific, whereas detection and resilient routing can cost more.
- Prevention: Prevention mechanisms address known threats efficiently but may not resist internal attackers or newly emerging threats.The paper characterizes prevention as the most cost-effective and widely used defense category.
- Detection: Detection mechanisms identify compromised or misbehaving nodes after prevention fails, especially through Intrusion Detection Systems.Detection can be designed more generically but is more costly than prevention.
- Mitigation: Mitigation limits damage after an attack by actions such as dismissing affected nodes or disabling exploited computer ports.Resilient routing can continue delivering packets during attacks but is also costly.
- Layered defense: The survey presents defense strategies for attacks across all layers of the WSN and IoT protocol stack.Its organization follows the OSI layers used for WSNs and IoT.
3.1 Defense against Passive Attacks
Passive-attack defenses focus on encryption and key management, but wireless eavesdropping is difficult to detect because packets travel through the air. Link-layer protections can prevent many outsider attacks, while key distribution supports protection of data in transit.
- Eavesdropping defense: Eavesdropping is almost impossible to detect because WSN packets are transmitted over the air without assured delivery only to intended recipients.The limitation arises from the broadcast nature of wireless communications.
- Eavesdropping defense: Link-layer encryption and authentication using globally shared keys can prevent eavesdropping and much of the external attack surface.TinySec and SNEP are cited as representative WSN encryption protocols.
- Key management: SensorWare provides three link-layer encryption levels derived from an active master key shared across sensors.The RC6 round-selection parameter directly affects the algorithm’s security level.
- Key management: Random key pre-distribution schemes supply encryption keys that help protect information in transit and prevent eavesdropping and spoofing.They support link-layer encryption schemes by distributing the keys required by encryption algorithms.
3.2 Defense against Active Attacks
The survey presents prevention, detection, and mitigation strategies for active attacks against WSNs and IoT, including DoS, routing, tampering, and MQTT threats. The approaches range from traffic controls and anomaly detection to topology choices, node removal, and protocol-layer security.
- DoS attacks: DoS defenses include jamming detection with Swarm Intelligence and JAM, plus rerouting around jammed regions and wormhole-based mitigation.JAM maps jammed areas and avoids them by rerouting packets; wormhole techniques are also proposed against jamming DoS.
- Node tampering: Tamper-resistant hardware can erase stored secrets after tampering, but its additional cost undermines WSNs’ low-cost advantage.Routine physical inspection is another detection approach, though deployed nodes may be difficult or dangerous to reach.
- MAC-layer attacks: Rate limiting and time-division multiplexing defend against collusion and exhaustion by restricting requests or assigning dedicated transmission slots.Both approaches reduce the ability of one node to monopolize network access.
- MAC-layer attacks: Anomaly-detection IDSs analyze MAC-layer traffic cooperatively, while 6TiSCH uses TSCH and IPv6 to support low-power, reliable, deterministic networking against de-synchronization.The IDS creates feature vectors at nodes and performs cross-feature analysis; 6TiSCH addresses applications with low delay tolerance.
- Network-layer attacks: Network-layer defenses include IDSs, REWARD routing, mesh topology, honeypots, watchdogs, neighbor evaluation, multi-detection routes, and coordinator-based removal.These methods target blackhole, grayhole, selective-forwarding, and related routing attacks through detection, avoidance, authentication, or exclusion.
- Network and transport-layer attacks: N2NB reportedly achieves a 100% detection rate when authenticated broadcast messages reach every node, while MQTT policy enforcement adds 10 ms delay.The MQTT delay may exceed the 1 ms tolerance cited for some mission-critical traffic-control and IIoT applications.
3.3 Summary of the Security Solutions
The survey consolidates attacks and corresponding defense mechanisms while emphasizing that routing security must account for attacks during protocol design. It also identifies concentration around fixed base stations as a major node-compromise risk.
- Security-solution summary: Table 2 summarizes WSN and IoT attacks alongside corresponding detection, prevention, and mitigation solutions.The survey presents the table as a consolidated reference for matching attack types with defense mechanisms.
- Routing security: Sinkhole and wormhole attacks are difficult to counter after routing protocols are completed, motivating designs that make them ineffective from the outset.Geographic routing is identified as one promising protocol class for this purpose.
- Routing security: Nodes within one or two hops of fixed base stations are especially attractive compromise targets, and compromising enough of them can lose the entire network.The survey notes that clustering protocols such as LEACH and PCAC may offer more secure solutions against node compromise.
4 CHALLENGES, OPEN ISSUES AND SOLUTIONS ON CYBER-SECURITY OF THE IOT
The survey reviews IoT’s technological and security challenges, including heterogeneity, scale, constrained devices, privacy exposure, and weak deployment practices. It summarizes proposed defenses while noting that resource limits and emerging protocols complicate broad adoption.
- Technological challenges: IoT security must address heterogeneous devices, protocols, processing methods, and standardized data exchange across gateways, sensors, actuators, and appliances.The survey identifies heterogeneity and interoperability as distinct challenges for communication, collaboration, and data sharing.
- Technological challenges: Scalability, diverse wired and wireless communications, energy consumption, location privacy, and autonomous self-organization further constrain IoT security design.Algorithms must support lightweight processing while devices manage millions-scale addressing and services.
- Open security issues: IoT security is often disregarded amid demand for connected sensing and processing devices, while smart-home traffic can reveal residents’ private activities.The survey connects device deployment with privacy concerns involving sniffers and inferred household behavior.
- Open security issues: Weak security precautions and default credentials allow IoT devices to become botnet resources; QBot variants exceeded 100,000 infected devices and preceded Mirai.Mirai captures Linux-based IoT devices for DDoS attacks, while Torii is described as more sophisticated than Mirai and QBot variants.
- Open security issues: Commercial IoT products averaged 25 vulnerabilities per device; 60% had vulnerable interfaces or firmware, 70% lacked encrypted communications, and 80% lacked secure password-length requirements.These findings are presented as evidence that many IoT ecosystems lack basic security elements.
- Security proposals: Proposed IoT defenses include encrypted VPN overlays, hardware PUFs, remote attestation, blockchain, SDN-based monitoring, and layered threat models.Remote attestation schemes may require high power and extra cost, while SoftThings is aimed at higher-capability gateways and switches.
5 DISCUSSIONS AND FINAL REMARKS
The paper reviews candidate security mechanisms for WSNs and IoT across prevention, detection, mitigation, trust, aggregation, traffic privacy, patching, and device authentication. It emphasizes that defenses must address resource constraints, attack diversity, and IoT heterogeneity while recognizing practical overheads and deployment limits.
- Defense strategies: Security defenses are organized around prevention, detection, and mitigation, including intrusion resistance, compromised-node identification, and post-attack node or port disabling.Detection mechanisms, especially IDSs, are described as particularly relevant to ongoing and internal attacks.
- Key distribution: Key distribution must support effective and flexible secret-key assignment while handling node revocation and the addition of new nodes.These requirements complicate key management in encrypted WSNs.
- Trust management: Trust management can isolate misbehaving nodes, but reviewed protocols introduce communication or computation overheads and show limited endurance against Sybil, DoS, and collusion attacks.Some trust evaluations rely on historical behavior or neighbor referrals without predicting future trust.
- Data aggregation: Secure data aggregation combines aggregation with data-trustworthiness assessment to address node-compromise vulnerabilities in resource-constrained and unattended deployments.Iterative Filtering is presented as one technique addressing both aggregation and trust assessment.
- Hierarchical security: Hierarchical security distributes simple attack detection to sensor nodes and complex detection to sinks or base stations, with mitigation supported by SDN and NFV.Hierarchical IDSs may use watchdog and majority-voting paths, thresholds, and node revocation.
- Traffic shaping: Independent Link Padding protects smart-home privacy by adding redundant traffic, but wastes bandwidth through extra load and unnecessary communication.The method maintains predetermined traffic rates and schedules while making useful information harder to infer from traffic patterns.
- Patch management: IoT patching is important for critical industrial devices, yet many low-cost embedded devices lack upgradeable firmware, making timely vulnerability patching impossible.The limitation is especially relevant to SCADA networks and other critical infrastructures.
- Device authentication: Automated device fingerprinting can flag behavior outside legitimate message patterns as suspicious, supporting detection of node-replication attacks and variants.Examples include status, firmware-update, patch-update, and initiation messages.
6 CONCLUSION
The conclusion argues that IoT security must account for heterogeneous, scalable architectures and resource-constrained devices. The paper compiles WSN and IoT attack types with corresponding defenses, while noting that timely patching is often unavailable and IDSs may require gateway support.
- 6 CONCLUSION: IoT security must address heterogeneity, scalability, transparency, and reliability through lightweight protocols and cryptography tailored to resource-constrained devices.The paper presents these architectural and device-level concerns as prominent security issues.
- 6 CONCLUSION: Heterogeneity and scalability can delay security-patch installation, increasing the importance of IDS techniques, including approaches described as efficient against zero-day attacks.Gateway devices may be employed when IDS processing requirements are high.
- 6 CONCLUSION: Security should be a key component of WSN and IoT protocol design, including routing, key distribution, trust management, and data aggregation across network layers.The conclusion links threat assessment and preventive measures with reducing network vulnerability to attacks.
- 6 CONCLUSION: The paper compiles known WSN security attacks in an IoT context and describes and evaluates defensive strategies for each attack type.The stated aim is to inform development of more robust and secure WSN and IoT solutions.
APPENDIX A ABBREVIATIONS AND ACRONYMS
The appendix points readers to Table 4 for the paper’s list of abbreviations and acronyms.
- APPENDIX A ABBREVIATIONS AND ACRONYMS: Table 4 contains the list of abbreviations used in the paper.The appendix identifies the table as the location of the abbreviation list.