Internet of Things (IoT) is one of the rapidly developing technologies today that attract huge real-world applications. However, the reality is that IoT is easily vulnerable to numerous types of cyberattacks and anomalies. Detecting them is becoming increasingly challenging day by day due to limitations with IoT devices and threat intelligence. Particularly, one of the most challenging problems is to detect the existence of malicious adversaries that continuously adapt or conceal their behaviors in IoT to hide their actions and to make the IoT security protocol ineffective. In this article, we study this problem at the IoT device level that can be a great idea to avoid potential attacks. We presentAntiConcealer, an edge-aided IoT framework, and propose an edge artificial intelligence-enabled approach (EdgeAI) for detecting adversary concealed behaviors in the IoT. We first develop an adversary behavior model and use this to identify mid-attack temporal patterns by learning the multivariate Hawkes process (MHP), a kind of point process as a random and finite series of events (e.g., behaviors) controlled by a probabilistic model. Naturally, learning MHP processed on EdgeAI reveals the influence of the concealed behaviors of adversaries in the IoT. These concealed behaviors are then grouped using a nonnegative weighted influence matrix. To observe the performance of theAntiConcealerframework through evaluation, we employ honeypots integrated with edge servers and verify the usability and reliability of adversary behavioral identification.

There has recently been a significant growth in resource-constrained devices (RCDs) that exchange sensitive and private data. Lightweight ciphers are designed to implement confidentiality in RCDs. Hardware implementation of lightweight cipher should minimize resources, including area, power, and energy. Hardware Trojans (HTs) are malicious circuits that are inserted into designs, including lightweight ciphers, to modify cipher behavior and leak sensitive data. Although runtime monitoring is a very effective method to implement design-for-trust and detect hardware trojans, it requires significant resources and degrades performance. The main motivation of this research is to design RCD-friendly runtime monitoring and create a trusted design with minimal resource overhead. This article develops a low-power, low-energy and trusted design based on a smart runtime monitoring algorithm targeted for lightweight ciphers in RCDs, implemented in the FPGA platform. The algorithm is adaptive, minimizes resource, and maximizes confidence and HT detection. The novelties of the algorithm are its adaptive activation of checking and its validation. Checking is triggered when a predefined critical node is active, which limits power/energy overhead. Our proposed algorithm has adaptive positive aging because it forgoes validation when a critical node has been already proven safe. To optimize trust, the validation uses a reverse-function design. The implementation results show that proposed algorithm reduces area, power and energy, when compared with existing algorithms. The proposed algorithm achieves 37%–55% reduction in energy and power, and has an average of 53% improvement in LE×energy metric. Furthermore, our proposed algorithm reduces the area by 25% when both encryption and decryptions are implemented.

Internet of Things (IoT) devices and the edge jointly broaden the IoT's sensing capability and the monitoring scope for various applications. Though accessing sensing data and making decisions through IoT smart devices turns out to be commonplace, it is challenging to guarantee user privacy and preserve the accuracy (integrity) of the collected data. The IoT smart devices frequently lose either IoT user's privacy or data integrity. This also makes it crucial to put a threshold on the cost of computation and load of the IoT devices, as gradually more IoT services demand access to the resources that devices offer. In this article, we propose BalancePIC, a scheme that attempts to preserve a balance in the three aspects (user privacy, data integrity in edge-assisted IoT devices, and the computational cost). It achieves the balance through a balanced truth discovery approach and a proposed enhanced technique for data privacy, which are used in IoT devices and edge server interactions. It authenticates the IoT user participation with privacy in the truth discovery process through a biometric-ECC-based authentication algorithm. The nature of the BalancePIC scheme is to straightforwardly provide the likelihood for a simple amendment on the cryptography technique and weight assignment. This lessens the overall computational cost for the IoT user devices but also restricts the communications between the user devices and the edge server, which is important for data integrity. We present an enhanced technique to preserve privacy by guarding the user from potential threats and suspicious data collection parties. To achieve this, BalancePIC takes steps to blur the original sensory data of the device by processing results in groups called zones. Simulation result analysis provides evidence for the balance preservation in the three aspects.

Extracting knowledge from sensor data for various purposes has received a great deal of attention by the data mining community. For the purpose of event detection in cyber-physical systems (CPS), e.g., damage in building or aerospace vehicles from the continuous arriving data is challenging due to the detection quality. Traditional data mining schemes are used to reduce data that often use metrics, association rules, and binary values for frequent patterns as indicators for finding interesting knowledge about an event. However, these may not be directly applicable to the network due to certain constraints (communication, computation, bandwidth). We discover that, the indicators may not reveal meaningful information for event detection in practice. In this paper, we propose a comprehensive data mining framework for event detection in the CPS named DPminer, which functions in a distributed and parallel manner (data in a partitioned database processed by one or more sensor processors) and is able to extract a pattern of sensors that may have event information with a low communication cost. To achieve this, we introduce a new sensor behavioral pattern mining technique called differential sensor pattern (DSP) which considers different frequencies and values (non-binary) with a set of sensors, instead of traditional binary patterns. We present an algorithm for data preparation and then use a highly-compact data tree structure (called DP-Tree) for generating the DSP. An important tradeoff between the communication and computation costs for the event detection via data mining is made. Evaluation results show that DPminer can be very useful for networked sensing with a superior performance in terms of communication cost and event detection quality compared to existing data mining schemes.

In this article, an industrial cyber-physical system (ICPS) is utilized for monitoring critical events such as structural equipment conditions in industrial environments. Such a system can easily be a point of attraction for the cyberattackers, in addition to system faults, severe resource constraints (e.g., bandwidth and energy), and environmental problems. This makes data collection in the ICPS untrustworthy, even the data are altered after the data forwarding. Without validating this before data aggregation, detection of an event through the aggregation in the ICPS can be difficult. This article introduces TrustData, a scheme for high-quality data collection for event detection in the ICPS, referred to as “Trust worthy and secured Data collection” scheme. It alleviates authentic data for accumulation at groups of sensor devices in the ICPS. Based on the application requirements, a reduced quantity of data is delivered to an upstream node, say, a cluster head. We consider that these data might have sensitive information, which is vulnerable to being altered before/after transmission. The contribution of this article is threefold. First, we provide the concept of TrustData to verify whether or not the acquired data are trustworthy (unaltered) before transmission, and whether or not the transmitted data are secured (data privacy is preserved) before aggregation. Second, we utilize a general measurement model that helps to verify acquired signal untrustworthy before transmitting toward upstream nodes. Finally, we provide an extensive performance analysis through a real-world dataset, and our results prove the effectiveness of TrustData.

There are tremendous security concerns with patient health monitoring sensors in Internet of Things (IoT). The concerns are also realized by recent sophisticated security and privacy attacks, including data breaching, data integrity, and data collusion. Conventional solutions often offer security to patients' health monitoring data during the communication. However, they often fail to deal with complicated attacks at the time of data conversion into cipher and after the cipher transmission. In this paper, we first study privacy and security concerns with healthcare data acquisition and then transmission. Then, we propose a secure data collection scheme for IoT-based healthcare system named SecureData with the aim to tackle security concerns similar to the above. SecureData scheme is composed of four layers: 1) IoT network sensors/devices; 2) Fog layers; 3) cloud computing layer; and 4) healthcare provider layer. We mainly contribute to the first three layers. For the first two layers, SecureData includes two techniques: 1) light-weight field programmable gate array (FPGA) hardware-based cipher algorithm and 2) secret cipher share algorithm. We study KATAN algorithm and we implement and optimize it on the FPGA hardware platform, while we use the idea of secret cipher sharing technique to protect patients' data privacy. At the cloud computing layer, we apply a distributed database technique that includes a number of cloud data servers to guarantee patients' personal data privacy at the cloud computing layer. The performance of SecureData is validated through simulations with FPGA in terms of hardware frequency rate, energy cost, and computation time of all the algorithms and the results show that SecureData can be efficient when applying for protecting security risks in IoT-based healthcare.

Abstract The growth of low‐resource devices has increased rapidly in recent years. Communication in such devices presents two challenges: security and resource limitation. Lightweight ciphers, such as HIGHT cipher, are encryption algorithms targeted for low resource systems. Designing lightweight ciphers in reconfigurable platform (e.g., field‐programmable gate array) provides speedup as well as flexibility. The HIGHT cipher consists of simple operations and provides adequate security level. The objective of this research work is to design, optimize, and model FPGA implementation of the HIGHT cipher. Several optimized designs are presented to minimize the required hardware resources and energy including the scalar and pipeline ones. Our analysis shows that the scalar designs have smaller area and power dissipation, whereas the pipeline designs have higher throughput and lower energy. Because of the fact that obtaining the best performance out of any implemented design mainly requires balancing the design area and energy, our experimental results demonstrate that it is possible to obtain such optimal performance using the pipeline design with two and four rounds per stage as well as with the scalar design with one and eight rounds. Comparing the best implementations of pipeline and scalar designs, the scalar design requires 18% less resources and 10% less power, while the pipeline design has 18 times higher throughput and 60% less energy consumption. Copyright © 2016 John Wiley & Sons, Ltd.

Cooperative communication is a technique that helps to improve the communication performance in wireless networks. It allows the nodes to rely on their neighbors when transmitting packets providing some diversity gain. Wireless sensor networks (WSNs) can benefit from cooperative communication to, which was proven by other researcher in the field. In this paper we consider security issues in WSNs with cooperative communications. We study such issues at each of the main protocol layers: physical layer, data link layer, network layer, services (topology) layer, and application layer. For each layer, we clarify the main task, enumerate the main attacks and threats, specify the primary security approaches and techniques, if any, and discuss possible new attacks and problems that may arise with the use of cooperative communications. Further, we showed for some attacks (e.g. jamming, packet dropping, and wormhole) that using cooperative communication improves the network resiliency and reliability. This paper builds the foundations and clarifies the specifications for a needed security protocol in WSNs with cooperative communications that can enhance its performance and resiliency against cyber-attacks.

Distance health monitoring is becoming an attractive option for both the patients and the medical sector staff. However, these systems face many design challenges including the large amount of processed data, users' mobility, and network coverage area. Accordingly, integrating cloud computing with Wireless Body Area Networks (WBANs) is amongst the best solutions to promote health monitoring systems. In this paper, we propose a cloud-based real-time remote health monitoring system. Several novel techniques are developed to optimize the performance of the proposed system. First, we utilize the concept of data classification and aggregation to reduce the traffic flow in the cloud. Second, a dynamic channel assignment policy is developed to distribute the users' WBANs among the available frequency channels to manage interference. Third, to optimize the delay of the delivered data a delay-aware routing metric is proposed to be used in the multi-hop routing. In addition, this metric is further utilized by the association protocols used by the WBANs to connect with the cloud. The simulation results prove the efficiency of the proposed architecture in optimizing the end-to-end delay, managing interference, maximizing the network capacity, and tracking the mobility of the users.

ABSTRACT In wireless sensor networks (WSNs), sensor devices have limited supply of energy. The sensor death due to dissipating battery energy is one of the fundamental design issues in WSNs. Hence, energy efficiency is argued to be the most important requirement for any protocol designed for WSNs. With sensors acting as routers to transport the packets from a source to a destination sensor, multipath protocols are used to discover multiple paths with the objective to improve the reliability, efficiency, and security in WSNs. Selecting the path that minimizes the rate of sensors death and extends the lifetime of the network is the main challenge for multipath protocols. In this paper, we propose a new energy and security aware route selection (ESARS) protocol for WSNs. The first part of ESARS selects a route that maximizes the network lifetime based on a novel metric. The second part of ESARS finds the optimal security level for the selected path based on the estimated security risk of the path. Traditionally, these two parts are addressed separately in the literature, and this paper combines the two parts in one protocol. The proposed protocol is evaluated and compared with other protocols using both analytical analysis and extensive simulations. The results show that the proposed protocol not only achieves its main objective to extend the network lifetime by significantly reducing the sensors death rate but also uses the most optimal security level for the selected route. Moreover, in ESARS protocol, several threshold parameters were employed to provide flexibility per the needs of the application in which the sensors are used. Copyright © 2013 John Wiley & Sons, Ltd.

Abstract The identity and/or location of communicating entities in wireless ad hocnetworks is extremely important due to the potential of their being identified and subsequently subjected to cyber or physical attacks. In this paper, we show that a global attacker who can eavesdrop on the overall data transmissions and count them can simply visualize the transmissions and infer contextual information. Current approaches to obfuscate the locations of source and destinations do not provide protection against such attacks. We propose two novel techniques (1) SECLOUD: Source and Destination Seclusion using Clouds to obfuscate the true source/destination nodes and make them indistinguishable among a group of neighbor nodes, and (2) ANONYRING: Anonymous Ring which hides the source/destination nodes within a group of nodes that form a ring. Both proposed techniques work well even under network‐wide traffic visualization by a global attacker. Furthermore the proposed techniques are shown viasimulation to be superior to existing schemes in the literature. Copyright © 2010 John Wiley & Sons, Ltd.

The ability to correctly determine their neighborhood is a fundamental requirement for nodes in ad hoc and sensor networks. Many applications, protocols, and system functionality rely on neighborhood discovery. Malicious nodes that taint neighborhood information using wormholes can significantly dis

Detecting malicious packet dropping is important in ad hoc networks to combat a variety of security attacks such as blackhole, greyhole, and wormhole attacks. We consider the detection of malicious packet drops in the presence of collisions and channel errors and describe a method to distinguish between these types. We present a simple analytical model for packet loss that helps a monitoring node to detect malicious packet dropping attacks. The model is analyzed and evaluated using simulations. The results show that it is possible to detect malicious packet drops in the presence of collisions and channel errors.

The privacy of communicating entities in wireless ad hoc networks is extremely important due to the potential of their being identified and subsequently subjected to attacks (e.g., in military networks). Previously, random walk and fractal propagation schemes have been proposed to address privacy of source and destination nodes in ad hoc or sensor networks. Entropy of packet transmissions has been used as the metric for comparison. In this paper, we show that under a global attacker that can eavesdrop on the overall data transmissions and count them, neither of these approaches provide sufficient privacy when the attacker can visualize the transmissions and infer contextual information. Moreover, we show that the entropy is not a useful metric in such a case. We propose SECLOUD: Source and Destination Seclusion using Clouds to obfuscate the true source/destination nodes and make them indistinguishable among a group of neighbor nodes which works well even under network-wide traffic visualization by a global attacker.

Jamming attacks are considered one of the most devastating attacks as they are difficult to prevent and sometimes hard to detect. In this paper we consider the impact of the placement and range of limited-range jammers on ad hoc networks. Limited range jammers are more difficult to detect as they use transmission powers similar to that of regular nodes (or perhaps even smaller transmit powers). The attacker can locate his jammer(s) randomly in the network. Alternatively, jammers can be placed at strategic locations. For instance, intuitively, this can be nodes with the highest traffic inputs/outputs (discovered by sensing the traffic flow in the network). Using OPNET, we perform extensive simulations to show how significant such strategically placed attacks can be compared to random placement of limited-range jammers on both TCP and UDP traffic.

The wormhole attack is considered to be a serious security attack in multihop ad hoc and sensor networks. We propose "DeWorm", a simple protocol to effectively detect wormhole attacks without the need for special hardware and/or strict location or synchronization requirements. DeWorm makes use of discrepancies in routing information between neighbors to detect wormholes. A simulation based analysis of DeWorm for a variety of scenarios shows that the proposed protocol can detect wormhole attacks with a high detection rate, a low false positive rate and low overhead. Further, in comparison to other wormhole detection protocols, the proposed protocol is simple, localized, and capable of detecting a variety of types of wormhole attacks including physical layer wormholes.