Ghalib A. Shah

The Internet of Things (IoT) provides ease of real-time communication in homes, industries, health care, and many other dependable and interconnected sectors. However, in recent years, smart infrastructure, including cyber-physical industries, has witnessed a severe disruption of operation due to privilege escalation, exploitation of misconfigurations, firmware hijacking, malicious node injection, botnets, and other malware infiltrations. The proposed agentless module for Wazuh security information and event management (SIEM) solution contributes to securing small- to large-scale IoT networks of industry 4.0. An agentless module is implemented by vigilantly examining the IoT device traffic without installing any agent or software on the endpoints. In the proposed research scheme, a module sniffs the network traffic of IoT devices captured from the gateway and passes it to a machine learning model for initial detection and prediction. The output of the ML model is embedded in the JSON log format and passed through the Wazuh agent to the Wazuh server where a decoder is added that decodes the network traffic logs. For event monitoring in Wazuh, industrial protocols are also thoroughly analyzed, and the feature set is determined. These features are used to write rules which are tested on the SWaT dataset, utilizing a common industrial protocol (CIP) for communication. Custom and dynamic rules are written at the Wazuh end to generate alerts to respond to any anomaly detected by the machine learning (ML) model or in the protocols used. Finally, in case of any event or an attack is detected, the alerts are fired on the Wazuh dashboard. This agentless SIEM solution has practical implications for the security of the industrial control systems of industry 4.0.

The advancement in the domain of IoT accelerated the development of new communication technologies such as the Message Queuing Telemetry Transport (MQTT) protocol. Although MQTT servers/brokers are considered the main component of all MQTT-based IoT applications, their openness makes them vulnerable to potential cyber-attacks such as DoS, DDoS, or buffer overflow. As a result of this, an efficient intrusion detection system for MQTT-based applications is still a missing piece of the IoT security context. Unfortunately, existing IDSs do not provide IoT communication protocol support such as MQTT or CoAP to validate crafted or malformed packets for protecting the protocol implementation vulnerabilities of IoT devices. In this paper, we have designed and developed an MQTT parsing engine that can be integrated with network-based IDS as an initial layer for extensive checking against IoT protocol vulnerabilities and improper usage through a rigorous validation of packet fields during the packet-parsing stage. In addition, we evaluate the performance of the proposed solution across different reported vulnerabilities. The experimental results demonstrate the effectiveness of the proposed solution for detecting and preventing the exploitation of vulnerabilities on IoT protocols.

Internet of things (IoT) is a technology that enables our daily life objects to connect on the Internet and to send and receive data for a meaningful purpose. In recent years, IoT has led to many revolutions in almost every sector of our society. Nevertheless, security threats to IoT devices and networks are relentlessly disruptive, because of the proliferation of Internet technologies. Phishing is one of the most prevalent threats to all Internet users, in which attackers aim to fraudulently extract sensitive information of a user or system, using fictitious emails, websites, etc. With the rapid increase in IoT devices, attackers are targeting IoT devices such as security cameras, smart cars, etc., and perpetrating phishing attacks to gain control over such vulnerable devices for malicious purposes. In recent decades, such scams have been spreading, and they have become increasingly advanced over time. By following this trend, in this paper, we propose a threat modelling approach to identify and mitigate the cyber-threats that can cause phishing attacks. We considered two significant IoT use cases, i.e., smart autonomous vehicular system and smart home. The proposed work is carried out by applying the STRIDE threat modelling approach to both use cases, to disclose all the potential threats that may cause a phishing attack. The proposed threat modelling approach can support the IoT researchers, engineers, and IoT cyber-security policymakers in securing and protecting the potential threats in IoT devices and systems in the early design stages, to ensure the secure deployment of IoT devices in critical infrastructures.

The Internet of things (IoT) has emerged as a topic of intense interest among the research and industrial community as it has had a revolutionary impact on human life. The rapid growth of IoT technology has revolutionized human life by inaugurating the concept of smart devices, smart healthcare, smart industry, smart city, smart grid, among others. IoT devices’ security has become a serious concern nowadays, especially for the healthcare domain, where recent attacks exposed damaging IoT security vulnerabilities. Traditional network security solutions are well established. However, due to the resource constraint property of IoT devices and the distinct behavior of IoT protocols, the existing security mechanisms cannot be deployed directly for securing the IoT devices and network from the cyber-attacks. To enhance the level of security for IoT, researchers need IoT-specific tools, methods, and datasets. To address the mentioned problem, we provide a framework for developing IoT context-aware security solutions to detect malicious traffic in IoT use cases. The proposed framework consists of a newly created, open-source IoT data generator tool named IoT-Flock. The IoT-Flock tool allows researchers to develop an IoT use-case comprised of both normal and malicious IoT devices and generate traffic. Additionally, the proposed framework provides an open-source utility for converting the captured traffic generated by IoT-Flock into an IoT dataset. Using the proposed framework in this research, we first generated an IoT healthcare dataset which comprises both normal and IoT attack traffic. Afterwards, we applied different machine learning techniques to the generated dataset to detect the cyber-attacks and protect the healthcare system from cyber-attacks. The proposed framework will help in developing the context-aware IoT security solutions, especially for a sensitive use case like IoT healthcare environment.

Network traffic generation is one of the primary techniques that is used to design and analyze the performance of network security systems. However, due to the diversity of IoT networks in terms of devices, applications and protocols, the traditional network traffic generator tools are unable to generate the IoT specific protocols traffic. Hence, the traditional traffic generator tools cannot be used for designing and testing the performance of IoT-specific security solutions. In order to design an IoT-based traffic generation framework, two main challenges include IoT device modelling and generating the IoT normal and attack traffic simultaneously. Therefore, in this work, we propose an open-source framework for IoT traffic generation which supports the two widely used IoT application layer protocols, i.e., MQTT and CoAP. The proposed framework allows a user to create an IoT use case, add customized IoT devices into it and generate normal and malicious IoT traffic over a real-time network. Furthermore, we set up a real-time IoT smart home use case to manifest the applicability of the proposed framework for developing the security solutions for IoT smart home by emulating the real world IoT devices. The experimental results demonstrate that the proposed framework can be effectively used to develop better security solutions for IoT networks without physically deploying the real-time use case.

Resource allocation for machine-type communication (MTC) devices is one of the keys challenges in the 5G network as it affects the lifetime of battery powered devices and also the quality of service of the applications. MTC devices are battery restrained and cannot afford a lot of power consumption due to spectrum usage. In this paper, we propose a novel resource allocation algorithm termed threshold controlled access (TCA) protocol. We propose a novel technique of uplink resource allocation in which the devices make a decision of resource allocation blocks based on their battery status and related application’s power profile that eventually leads to required quality of service (QoS) metric. The first phase of the TCA algorithm selects the number of carriers to be allocated to a certain device for the better lifetime of low power MTC devices. In the second phase, the efficient solution is implemented through inducing a threshold value. A certain value of the threshold is selected through a mapping based on a QoS metric. The threshold enhances the selection of subcarriers for less powered devices, such as small e-health sensors. The algorithm is simulated for the physical layer of the 5G network. Simulation results show that the proposed algorithm is less complex and achieves better performance when compared to existing solutions in the literature.

In light of recent natural catastrophes and terrorist activities, it has become evident that new architectural approaches are needed for next generation public protection and disaster relief networks. These architectures should be adaptable to the conditions at the event site and resilient enough to operate under adverse conditions in an emergency. Furthermore, they should enable rapid gathering of crucial event data and its delivery to the responder units at the site as well as the command and control center that is off-site. In this article, we first examine the state of the art in areas related to communication in PPDR systems, and discuss the open research issues for each topic. Then we propose a novel architecture that meets the aforementioned requirements and relies on a novel device called an ICG. An ICG enables flexible use of the spectrum and facilitates data gathering from all lower-tier devices and relays this data to relevant units through the higher-tier public or commercial backhaul networks. Finally, we provide some results that justify the need for these devices in emergency scenarios.

Spectrum sensing is an integral part of medium access control (MAC) in cognitive radio (CR) networks as its reliability determines the success of transmission. However, it is an energy-consuming operation that needs to be minimized for CR sensor networks (CRSNs) due to resource scarcity. In this paper, a cognitive adaptive MAC (CAMAC) protocol, which supports opportunistic transmission while addressing the issue of power limitation in CRSNs, is proposed. Energy conservation in CAMAC is achieved in three fronts: on-demand spectrum sensing, limiting the number of spectrum sensing nodes, and applying a duty cycle. Spectrum sensing is initiated on-demand when the nodes have data to transmit, and it also exploits a subset of spectrum sensing nodes to gather spectrum availability information for all the nodes. Furthermore, it defines an adaptive duty cycle for the CRSN nodes to periodically sleep and remains awake when data are available for transmission. Hence, CAMAC stands as an adaptive solution that employs the small number of spectrum sensing nodes with an adaptive sensing period yielding minimum energy consumption. Simulation results reveal the efficiency of CAMAC in terms of high throughput and less energy consumption, which is adaptive to primary users' traffic and duty cycle.