Failure Modes and Effects Analysis (FMEA) is the process of identifying potential failure modes, their causes and effects associated with a product, process or system. In this paper, we discuss the application of FMEA in the design of cybersecurity experiments using a medium interaction server honeypot in an Internet of Things (IoT) environment. Through FMEA analysis, we identify the factors affecting the outcome or contributing to the potential failures of the cybersecurity experiment. We discuss the causes of failures, their effects and how to minimise or mitigate them.

The exponential growth in the Internet of Things (IoT) market has led to the proliferation of cyber threats as millions of vulnerable IoT devices are connected to the Internet each year. Security practitioners and researchers capture attacks on IoT devices using honeypots to explore the attack process, identify the types of attacks and analyse the interaction of the attackers with IoT devices. Several studies have focused on the classification of attacks on IoT devices, however, they are limited to performing manual analysis on command data by assigning skill levels to the attackers and looking at the purpose of executing specific commands. In this paper, we report our analysis of the captured attacks on IoT devices for four months using a medium-interaction server honeypot. We extract a new feature set by analysing the attacks according to the depth of interaction by the attackers, their behaviour in the attack process and the resources they utilised to perform these attacks. We apply unsupervised learning (i.e. clustering) to automatically group captured attacks and build a model to highlight the important features that contribute to understanding the relationship between various attacks grouped in the same cluster.

Manufacturing limitations, configuration and maintenance flaws associated with the Internet of Things (IoT) devices have resulted in an ever-expanding attack surface. Attackers exploit IoT devices to steal private information, take part in botnets, perform Denial of Service (DoS) attacks and use their resources for the mining of cryptocurrency. In this paper, we experimentally evaluate a hypothesis that attacks on IoT devices follow the generalised Cyber Kill Chain (CKC) model. We used a medium-interaction honeypot to capture and analyse more than 30,000 attacks targeting IoT devices. We classified the steps taken by the attackers using the CKC model and extended CKC to an IoT Kill Chain (IoTKC) model. The IoTKC provides details about IoT-specific attack characteristics and attackers' activities in the exploitation of IoT devices.