PaperlayerView exact revision on arXiv

Source-linked AI summary

Machine Learning Based Solutions for Security of Internet of Things (IoT): A Survey

Syeda Manjia Tahsien, Hadis Karimipour, Petros Spachos

arXiv:2004.05289v1cs.CRcs.LGstat.ML

TL;DR

IoT’s open connectivity, growth, and resource constraints create security challenges that traditional techniques do not fully address. This survey reviews ML-based security solutions across IoT layers and attack surfaces, reporting strong attack-detection results while identifying computational, data, and privacy challenges.

  • Problem

    IoT devices carry private information and face diverse attacks, while resource constraints and changing attack types limit the suitability of complex traditional security techniques.

  • Method

    The paper conducts a state-of-the-art literature review of ML algorithms and security solutions across IoT’s three architectural layers and analyzes published work through 2019.

  • Results

    The reviewed ML methods report attack-detection performance above 0.99 accuracy for five classifiers in one local-device DDoS study, 99.4% detection rate with SVM, and 64.3% lower authentication error with Q-learning.

  • Takeaways & Limitations

    ML-based methods are presented as potential IoT security solutions for detecting attacks and supporting more reliable and accessible devices.

  • Takeaways & Limitations

    ML-based IoT security remains constrained by training-data manipulation, attack identification difficulties, computational complexity, limited device resources, and privacy leakage.

Abstract

from arXiv · show

Over the last decade, IoT platforms have been developed into a global giant that grabs every aspect of our daily lives by advancing human life with its unaccountable smart services. Because of easy accessibility and fast-growing demand for smart devices and network, IoT is now facing more security challenges than ever before. There are existing security measures that can be applied to protect IoT. However, traditional techniques are not as efficient with the advancement booms as well as different attack types and their severeness. Thus, a strong-dynamically enhanced and up to date security system is required for next-generation IoT system. A huge technological advancement has been noticed in Machine Learning (ML) which has opened many possible research windows to address ongoing and future challenges in IoT. In order to detect attacks and identify abnormal behaviors of smart devices and networks, ML is being utilized as a powerful technology to fulfill this purpose. In this survey paper, the architecture of IoT is discussed, following a comprehensive literature review on ML approaches the importance of security of IoT in terms of different types of possible attacks. Moreover, ML-based potential solutions for IoT security has been presented and future challenges are discussed.

1. Introduction

The paper surveys machine-learning approaches for IoT security, motivated by resource-constrained devices, evolving attacks, and the need for an updated literature review. It organizes IoT architecture, attacks, ML solutions, challenges, and future directions.

  • Resource-constrained IoT devices carrying private information require security techniques suited to limited battery, bandwidth, memory, and computation.
  • Machine learning can identify attacks, detect abnormal behavior, support early detection, and respond to new attacks in dynamic IoT networks.
  • The survey addresses the need for an updated review because only four comprehensive reviews of ML-based IoT security had been published previously.
  • The review covers ML techniques and applications for IoT attacks, with a state-of-the-art assessment of algorithms across three IoT architectural layers through 2019.
  • It presents IoT architecture, layer-wise attack effects, ML-based security solutions, published-article analysis, challenges, limitations, and future research directions.

2. Security of Internet of Things

IoT connects devices and services across homes, transportation, health, energy, and other domains, but its openness and scale increase security and privacy concerns. The section describes IoT architecture, communication technologies, data processing, and exposed surfaces.

  • A standard IoT architecture contains perception/physical, network, and web/application layers.
  • IoT layers: The application layer delivers services through mobile and web software across domains including homes, transportation, health, education, agriculture, business, and energy.
  • IoT layers: The network layer transmits, redirects, stores, and processes information through protocols, local clouds, and servers, with ML and DL used to analyze stored data.
  • IoT layers: The perception layer contains sensors and devices using protocols such as RFID, Zigbee, and Bluetooth, while its MAC layer links devices to networks.
  • IoT improves remote access and smart services while exposing users and their private information to diverse attacks through open connectivity.

3. Attacks in IoT

The paper frames IoT attacks as a consequence of rapidly expanding smart-device use and presents a diagram organizing attacks by type, surface, and effect.

  • Rapid growth in smart technologies and demand for remotely accessed devices has increased manufacturers’ and users’ concern about IoT attacks.
  • Figure 4 organizes IoT security attacks according to different attack types, attack surfaces, and attack effects.

3.1. Types of Attack

IoT attacks are classified into cyber and physical attacks, with cyber attacks divided into active and passive categories. The section describes their mechanisms and effects on services, communications, devices, and privacy.

  • Cyber attacks manipulate, steal, delete, alter, or destroy information through network-based compromise, whereas physical attacks directly damage IoT devices without requiring network access.
  • Active attacks: Active attacks manipulate configurations or interrupt services and include DoS, man-in-the-middle, Sybil, spoofing, hole, jamming, selective-forwarding, malicious-input, and data-tampering attacks.
  • Active attacks: DoS attacks disrupt services with redundant requests, prevent device communication, and can reduce battery lifetime by keeping devices continuously active.
  • Active attacks: Spoofing and Sybil attacks target user identification to gain illegal access and can initiate DoS or man-in-the-middle attacks.
  • Active attacks: Jamming disrupts wireless communication with unwanted signals and degrades device performance by consuming energy, bandwidth, and memory.
  • Passive attacks: Passive attacks gather users’ information without consent through eavesdropping or traffic analysis, including confidential information and location data.

3.2. Effects of Attacks

IoT attacks threaten privacy, authentication, authorization, integrity, and accessibility. Effective security protocols must manage unauthorized access, service disruption, confidentiality, and data modification across diverse users and devices.

  • IoT attacks threaten user privacy, authentication, authorization, and data integrity.Table 1 presents attack types and their effects on IoT devices.
  • Identification: Identification requires registering clients before communication with the cloud server, but Sybil and spoofing attacks can bypass proper identification.Tradeoffs and system robustness make effective identification schemes challenging.
  • Authorization: Authorization must restrict IoT network information and commands to authorized users, including humans, sensors, machines, and services.Maintaining user logs and processing large client datasets complicate authorization.
  • Accessibility: DoS and jamming attacks reduce accessibility by generating unnecessary requests that keep the network busy.IoT security protocols must preserve uninterrupted service availability for authorized clients.
  • Privacy: Attackers can track IoT devices and decrypt information, making confidentiality difficult to maintain against unauthorized third parties.Sensitive personal, medical, and national-defense information may be stored and transferred through IoT devices.
  • Integrity: Integrity protection limits information modification to authorized users and helps defend against malicious inputs such as SQL injection attacks.Compromised inspection during storage can affect device functionality over time.

3.3. Surface Attacks

IoT attack surfaces span physical devices, networks, cloud services, applications, and newly emerging interconnected or social systems. Their connectivity and remote access broaden the range and propagation of possible attacks.

  • IoT attack surfaces include physical devices, network and transport services, cloud services, and web or application surfaces.The paper distinguishes these four surfaces from the architecture’s three principal layers.
  • Physical Device/Perception Surface: Physical devices such as RFID tags, sensors, actuators, microcontrollers, and readers are vulnerable to DoS, eavesdropping, jamming, and radio interference.These devices directly carry or handle confidential user information.
  • Network/Transport Surface: Large-scale sensor networks expose user information during transfer when strong security protocols are absent.Attackers may exploit open ports or weak routing protocols using IP, gateway, or MAC addresses.
  • Cloud Surface: Cloud computing provides remote storage, resource sharing, and real-time updates for IoT devices, making it a core platform for transporting and storing user information.The passage identifies the cloud as the basis for IoT data transport and storage.
  • Web/Application Surface: Web and mobile applications enable remote access and control of IoT devices connected through servers and clouds.These systems are exposed to attacks including DoS, data corruption, eavesdropping, bluejacking, and bluesnarfing.
  • Emerging Surfaces: Interdependent and interconnected IoT systems create broad attack surfaces because contamination can spread across connected devices.Smart-building sensors may depend on one another and on cloud updates for real-time operation.

4. Machine Learning (ML) in IoT Security

Machine learning is presented as a promising IoT security approach because it can operate in dynamic networks and learn to detect attacks without explicit programming. Its intended uses include early attack detection and defensive policy generation.

  • Machine learning trains devices from experience rather than explicit programming and can function in dynamic IoT networks.The paper presents ML as an artificial-intelligence technique for evolving IoT security needs.
  • ML methods can detect various IoT attacks at an early stage by analyzing device or network behavior.

4.1. ML Techniques

The survey reviews supervised, unsupervised, and reinforcement learning techniques for IoT security, including classifiers, dimensionality reduction, clustering, and ensemble methods. It also summarizes practical strengths and limitations of representative algorithms.

  • ML techniques for IoT security include supervised, unsupervised, and reinforcement learning, which can detect attacks and establish defensive policies.The paper’s classification overview is illustrated in Figure 7.
  • Supervised Learning: Supervised learning predicts fixed categories or continuous values from trained data, covering classification and regression tasks.Classification examples include True/False or Yes/No outputs, while regression produces real or continuous values.
  • Supervised Learning: SVM separates classes with a maximum-margin hyperplane and uses kernel functions when the separation is nonlinear.Choosing an optimal kernel can be difficult, although SVM provides high accuracy.
  • Supervised Learning: Naive Bayes uses prior information and Bayesian probability for classification, supporting intrusion and anomaly detection with relatively little data.Its accuracy may be affected by feature interactions and dependence on prior information.
  • Supervised Learning: KNN estimates an unknown node from the average value of its k nearest neighbors and is used for intrusion, malware, and anomaly detection.The method is simple and inexpensive but can be time-consuming and less accurate when identifying missing nodes.
  • Supervised Learning: Random Forest combines multiple randomly developed decision trees and averages their outputs to produce robust estimates with fewer inputs.It reportedly performs better than SVM, ANN, and KNN for DDoS detection but is unsuitable for real-time applications and needs substantial training data.
  • Supervised Learning: Association rules infer unknown variables from mutual relationships in data and have been used with fuzzy rules for intrusion detection.High time complexity and assumption-based results limit their use in IoT.
  • Regression Learning: Decision trees sort samples by feature values and offer simple construction, implementation, scalability to large samples, and transparency.Their large storage requirements can make models with several trees more complex; they are used for DDoS and intrusion detection.

4.2. ML based Solution for IoT Security

The survey organizes ML-based IoT security solutions across physical, network, and web/application layers, covering authentication, jamming, intrusion, device identification, DDoS, and malware detection.

  • ML security solutions are investigated across the physical/perception, network, and web/application layers of IoT architecture.
  • Physical /Perception Layer: 64.3% lower authentication error was reported for Q-learning with 12 transmitters than usual physical-layer authentication methods.
  • Physical /Perception Layer: Reinforcement learning and deep CNN methods were used to address jamming attacks, including centralized power-distribution strategies and cognitive-radio protection.
  • Network Layer: Supervised algorithms including SVM, neural networks, and K-NN were applied to intrusion detection, while SVM achieved a 99.4% attack detection rate.
  • Network Layer: Low-cost classifiers using flow-based, protocol-agnostic traffic data detected local IoT DDoS attacks, with five algorithms exceeding 0.99 test accuracy.
  • Web/Application Layer: K-NN, random forest, Q-learning, and Dyna-Q were used for web/application attacks, including malware detection and latency-focused learning.

5. Research Challenges

The survey identifies data, infrastructure, computational, privacy, updating, and attack-identification challenges that constrain ML-based IoT security. These challenges include obtaining reliable training data, securing evolving systems, and deploying adaptive methods under resource and privacy constraints.

  • Data Security: Reliable, authenticated, high-quality training data are difficult to obtain and are essential for accurate ML-based IoT security.Data augmentation can help generate samples, but their class distribution must remain appropriate for accuracy.
  • Data Security: Attack identification remains difficult because attackers may manipulate training data and alter attack types or effects.Identifying attack kinds and their occurrence probabilities is described as a critical future research field.
  • Infrastructure Problem: Unknown vulnerabilities in released software enable zero-day attacks that traditional security techniques find difficult to predict.The survey calls for security to be embedded throughout the IoT system, from hardware through software.
  • Computational Restriction and Exploitation of Algorithms: Advanced ML algorithms increase memory, energy, and computational demands when deployed on resource-limited IoT devices.The survey therefore identifies reducing computational complexity as necessary for ML-based IoT security.
  • Privacy Leakage: Privacy leakage is a major IoT issue because smart devices collect and share sensitive information, including users’ locations and health data.The survey emphasizes encryption and privacy protection in IoT device design.
  • Real-Time Update Issue: Rapidly changing IoT environments create new attacks and require intelligent, real-time-updated ML algorithms for detection.Keeping software and firmware updated across millions of devices is also difficult, especially when over-the-air updates are unsupported.

6. Analysis on Published Articles on ML-based IoT security

The survey analyzes publications on ML, IoT security, and ML-based IoT security through March 2019. It reports rapid growth in the field and identifies decision trees as the most frequently used algorithm in IoT security publications.

  • Publication Trends: Publication rates for ML, IoT security, and ML-based IoT security increased exponentially in the surveyed literature.The analysis searched multiple scholarly databases and cross-checked titles, abstracts, and keywords.
  • Algorithm Usage: 32% of IoT security publications used decision trees, making DT the most frequently used learning method in the analysis.The statistics cover different ML algorithms used in IoT security through March 2019.

7. Conclusion

The survey presents ML-based IoT security as a response to security concerns arising from IoT’s expanding connectivity and use of sensitive information. It reviews IoT architecture, attacks, ML algorithms, security solutions, research challenges, and publications through 2019.

  • Conclusion: IoT enables remote access, connection, and information storage, while its security remains a major concern as smart-device use expands.The paper links IoT devices with users’ private and valuable information.
  • Conclusion: The survey covers IoT architecture, security attacks and their effects, attack surfaces, ML algorithms, ML-based security solutions, and research challenges.It describes itself as a comprehensive literature review of ML-based IoT security.
  • Conclusion: The review includes papers on IoT and ML-based IoT security published through 2019 and reports a large acceleration in security research during 2018.The conclusion frames these publications as a basis for understanding ML-embedded IoT security algorithms.
Loading 2004.05289v1…