=Paper=
{{Paper
|id=Vol-3642/paper12
|storemode=property
|title=Misbehavior detection systems in IoT environment: A survey
|pdfUrl=https://ceur-ws.org/Vol-3642/paper12.pdf
|volume=Vol-3642
|authors=Rahma Trabelsi,Ghofrane Fersi,Mohamed Jmaiel
|dblpUrl=https://dblp.org/rec/conf/tacc/TrabelsiFJ23
}}
==Misbehavior detection systems in IoT environment: A survey ==
Misbehavior detection systems in IoT environment: A
survey
Rahma Trabelsi1,* , Ghofrane Fersi1 and Mohamed Jmaiel1
1
ReDCAD Laboratory, ENIS, University of Sfax, Tunisia
Abstract
The rapid expansion of IoT systems has a double-edged weapon. Indeed, they have significantly broadened
their range of applications. However, this led to new security issues. In fact, IoT systems are known for
their sensitivity to several attacks which may reduce its reliability and availability. So it is primordial to
protect IoT systems against these attacks. The first step to fight against these attacks is to detect any
misbehavior that may lead to an attack. Such a process should be automatized for further efficiency. In
this survey, we present some attacks in order to understand them and we introduce some misbehavior
detection systems mechanisms that ensure security in IoT systems. We classify misbehavior detection
systems depending on their main detection features. We also highlight the advantages and drawbacks of
each type.
Keywords
Misbehavior detection systems, IoT, Survey
1. Introduction
Internet of Things (IoT) [1] [2] is a large-scale environment that connects different devices
through the Internet. In other words, IoT networks consist of interconnected devices (sensors,
actuators, and smart objects) that collect and exchange data over the Internet. These devices
often have limited resources and may be vulnerable to various security threats. The evolution
of IoT engendered new security issues. So Securing IoT systems against malicious attacks has
become a fundamental requirement. In order to secure IoT systems, researchers have proposed
lightweight cryptographic solutions [3]. Cryptographic algorithms can encrypt data transmit-
ted between IoT devices and servers. Even if data are intercepted, they remain unreadable to
unauthorized access. So, implementing cryptographic solutions enhances the resilience of IoT
systems against various cyber-attacks, including man-in-the-middle attacks, replay attacks, and
data tampering. Also, different access control solutions [4] have been proposed in order to
prevent unauthorized access. Several technologies like fog computing [5] and blockchain are
used to implement access control solutions. Several researchers concentrated on evaluating
the behavior of different participants in IoT networks. They proposed a misbehavior detection
TACC 2023: Tunisian-Algerian Joint Conference on Applied Computing, November 06–08, 2023, Sousse, Tunisia
*
Corresponding author.
$ rahma.trabelsi@redcad.org (R. Trabelsi); ghofrane.fersi@redcad.org (G. Fersi); mohamed.jmaiel@redcad.org
(M. Jmaiel)
0000-0002-3931-9399 (R. Trabelsi); 0000-0003-0427-5127 (G. Fersi); 0000-0002-2664-0204 (M. Jmaiel)
© 2023 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).
CEUR
Workshop
Proceedings
http://ceur-ws.org
ISSN 1613-0073
CEUR Workshop Proceedings (CEUR-WS.org)
CEUR
ceur-ws.org
Workshop ISSN 1613-0073
Proceedings
systems which are security mechanisms designed to identify and respond to abnormal or suspi-
cious activities.
Misbehavior detection systems are essential for protecting computer networks and systems
from malicious activity. They help identify abnormal behavior, such as malware attacks, intru-
sion attempts and alert system administrators so they can take appropriate security measures.
The study of misbehavior detection systems is becoming increasingly important. These systems
play a key role in threat prevention, data protection, online security and efficient resource
management, making them a critical area of research and development for many industries and
sectors.
In this paper, we focus on presenting an overview of several misbehavior systems and their
evaluation.
The remainder of this paper is organized as follows: Section 2 presents the related work.
Section 3 gives a brief review of several attacks. Section 4 overviews different misbehavior
detection systems and classified them. Finally, the conclusion, current limitations and future
directions are discussed in Section 5.
2. Related Work
In this section, we present existing surveys that have studied misbehavior detection systems
and specify the difference and the novelty of our paper compared to them. Authors in [6]
focused specifically on misbehavior detection in VANET. They provided a resume on different
attacks like jamming attacks and sybil attacks. The authors in [7] presented several attacks
and focused on machine learning-based misbehavior detection systems for vehicular networks.
They categorized solutions into various domains based on architecture, approach, node-centric
and datacentric schemes.
The paper [8] provides an analysis of intrusion detection systems (IDS) based on deep learning
techniques proceeded by various systems for detecting intrusions. In anomaly detection systems,
they assumed that challenges can be summarized into factors such as normality, adaptability,
dynamic profile update, noisy data, false alarm rates and complexity. A survey of deep learning-
based Industrial Internet of Things (IIoT) misbehavior detection in smart cities was proposed
in [9]. In this work, the authors investigated how deep learning techniques can enhance the
efficiency of any application in the proposed domain. In [10], authors presented anomaly-based
detection systems and identified present-day issues and challenges like the fact of obtaining
specific data is time-consuming, expensive, and not always possible. The paper [11] presents an
overview of signature-based IDS systems developed using various machine learning approaches.
The novelty of our survey compared with existing ones is that our survey does not focus on a
specific domain. In fact, we present different misbehavior systems in various IoT domains. Also,
we present a new classification of misbehavior detection. In fact, we classified solutions into
three main types which are behavior-based, signature-based and reputation-based detection
systems.
Table 1
Comparison of the existing surveys
Paper Attacks Application domain Behavior based Signature based Reputation based
[6] Yes Vanet No No No
[7] Yes Vanet No No No
[8] No General No No No
[9] Yes IIoT No No No
[10] No General Yes No No
[11] No General No Yes No
Our survey Yes General Yes Yes Yes
3. Frequent attacks in IoT
This section provides an overview of attacks that affect IoT networks. We categorize these
attacks depending on their corresponding layer in the IoT three-layer architecture.
3.1. Physical attacks
Physical attacks are directed toward the hardware components within the system.
• Jamming: is a disruption in the channel of communication. For example, the adversary
continually launches a radio frequency to make noise in the network.
• Node tampering: is an attack in which the attacker alters physically the compromised
node in order to obtain sensitive information.
• Malicious node injection: is an attack where the attacker physically injects a malicious
node between two or more nodes.
• Malicious code injection: The attacker physically introduces a malicious code into a node
in an IoT system. Then it could get full control of IoT system.
• Sleep deprivation attack: The attacker sends repetitively numerous packets to the nodes
leading to their shutdown.
3.2. Network attacks
These attacks concerned the network layer of IoT systems.
• Man in the middle attack: is where an attacker is looking to interrupt the connection
between two parties. The attacker has the possibility not only to read the traffic data but
also to modify it.
• Deny of service (DoS): is an attack that makes the service unavailable or prevents the
user from services. The most of the DoS attacks target the TCP protocol.
• Distributed deny of services(DDoS): is similar to DoS but in DDoS, the incoming traffic to
the victim originates from many different sources. The DDoS attack is more difficult to
fix.
• Sinkhole attack: In this attack, attacker node advertises a beneficial path to attract many
nearby nodes to route traffic through it.
• Sybil attack: is an attack where a malicious node uses several identities on the same
physical node. Using this attack large parts of a network can be taken under the attacker’s
control without deploying physical nodes.
3.3. Application attacks
These attacks are mainly software attacks.
• SQL injection: is the act of passing SQL code into interactive web applications that are
employed in database services.
• Phishing attack: in this attack, an attacker could get access to passwords, credit cards and
other sensitive data via hacking an email, phone, or social media.
• Virus, Worms, Trojan horse and Spyware: A potential adversary has the capability to
harm the system through the utilization of malicious code. These code instances are
distributed via email attachments or by downloading files from the Internet. The worm
possesses the capacity to autonomously replicate itself without requiring any human
intervention.
4. Misbehaviour detection systems
Misbehavior detection systems in IoT refer to techniques and algorithms used to identify abnor-
mal or malicious behavior in IoT networks and devices. These systems can detect and prevent a
variety of malicious activities, such as DoS attacks, unauthorized access, data tampering, and
more. There are several methods used for misbehavior detection in IoT networks, including:
• Behavior-based detection: This involves monitoring the normal behavior of devices and
identifying any deviation from the expected behavior. Behavior detection can be achieved
through techniques such as statistical analysis, machine learning, and rule-based systems.
Anomaly detection is considered as a behavior-based sub-type. In this paragraph, we
will present behavior/anomaly based detection systems. The authors in [12] present a
method for using deep learning to detect anomalies in IoT systems. They propose using a
combination of autoencoders and recurrent neural networks to analyze sensor data and
identify patterns that deviate from normal behavior. They evaluate the performance of
their method on a dataset of real-world IoT sensor data and demonstrate that it is effective
at detecting anomalies.
A method for detecting anomalies in smart hospitals was proposed in [13]. The main con-
tribution of this article is that the proposed method can be used in real-time. The authors
propose to use a combination of statistical methods and machine learning techniques to
analyze data behavior. They also propose a new algorithm for anomaly detection that
is based on the k-nearest neighbors (k-NN) method and is specifically tailored to the
characteristics of IoT data and systems in smart hospitals.
A real-time anomaly detection system for industrial robots was proposed in [14]. This
work automatically learns normal patterns from time series data in training. This solution
is tested by injecting faults into the robot and observing how the robot resolves them.
The evaluation shows that the proposed model can detect anomalies spatially and tempo-
rally. The authors in [15] identified compromised devices using an anomaly detection
method that merges federated learning with linguistic analysis, adapted to specific device
categories. The evaluation showed that detection performance is around 94% for positive
and 99% for negative samples.
An anomaly-based intrusion detection system is proposed in [16]. This work is based
on a deep-learning model called Pearson-Correlation Coefficient - Convolutional Neural
Networks (PCC-CNN) to detect network anomalies. The evaluation shows that this model
is computationally efficient.
A proposed approach called BRIoT [17] utilizes behavior rule specification in order to
detect misbehavior in IoT devices within Cyber-Physical Systems (CPS). BRIoT allows
the specification of both normal and abnormal behavior for each IoT device and uses
this information to identify and prevent misbehavior. The known attacks that have been
investigated in that paper are spoofing attack, capture attack, DoS and energy exhaustion
attack. This approach is based on a device being monitored by a peer device (or more than
one peer IoT device to increase the detection strength). If a peer monitoring IoT device
is itself malicious and performs attacks, its misbehavior would be detected by another
peer IoT device. The authors claim that BRIoT is effective at detecting a wide range of
misbehaviors and is able to adapt to changing operating environments. They also present
the results of an experimental evaluation of BRIoT, which showed that it is able to detect
misbehavior with high accuracy and low false positive rates.
The authors in [18] presented a pattern recognition algorithm named as “Capturing-the-
Invisible (CTI)” to find the hidden process in industrial control device logs and detect
behavior-based attacks being performed in real-time. This solution is a new process
discovery algorithm that detects and monitors issues from device logs. The evaluation
shows that this approach discovers more anomalies than other solutions and consumes
less time. The main drawback of the behavior-based detection systems is its high false
positive rate. In fact, in this strategy, each behavior that differs from the "normal" pattern
is considered as abnormal which is not always true. Furthermore, there is a difficulty to
specify why is considered as "normal" behavior? In addition to that, the anomaly-based
detection systems are inefficient in the detection of the new attacks. To overcome this, it
is required that the system remains all the time in a continuous training which exhausts
its resources and degrades its performance.
• Signature-based detection: This method involves identifying known malicious patterns
or "signatures" in network traffic or device behavior. Signature-based detection can be
used to detect known attacks, such as known malware or known attack techniques. A
blockchain signature-based intrusion detection in IoT was proposed in [19]. In this work,
the key concept is to employ blockchain technology to gradually construct a dependable
signature database.
The authors in [20], proposed a lightweight misbehavior detection scheme that relies on
formal verification and automatic model checking in a medical cyber physical system.
The authors in [21] generate the rules for modern attacks based on signature attacks.
In their work, they used machine learning algorithms for generating effective rules to
support lightweight IDS systems.
In spite of the ability of the signature-based misbehavior detection system to detect most
of the known attacks, it faces difficulties to detect new attacks that it does not have
its corresponding signature. Also this system is unable to detect polymorphic attacks.
Contrarily to the anomaly-based misbehavior detection systems, the signature-based
system suffer from high False Negatives since it is unable to detect many real attacks.
Also, such systems are unable to detect attacks when the traffic is encrypted.
• Reputation-based detection: This method involves maintaining a reputation score for
each device or user based on their past behavior. Devices or users with a low reputation
score may be flagged as potential threats and further monitored or restricted.
The authors in [22] proposed a new model for grouping agents in IoT systems based on
their reputation. This approach is based on blockchain technology to create a decentralized
and tamper-proof system for storing and managing agent reputation information. They
proposed to use blockchain to create a distributed ledger that stores the reputation of each
agent, which can be used to group agents into different trust levels. This reputation-based
model is intended to improve the security and reliability of IoT systems by allowing
devices to communicate with only trusted peers. Additionally, the use of blockchain
technology would ensure the integrity and transparency of the reputation information. A
lightweight reputation-based RPL protocol is proposed in [23] in order to evaluate the
behavior of IoT nodes. The authors used weight factors as new parameters to calculate
reputation. In this approach, the network lifetime is divided into a series of evaluation
periods in order to compare normal packet loss with the actual packet loss and then they
can evaluate the behavior of all neighbors.
The authors in [24] introduced a novel trust evaluation framework that integrates multiple
sources, incorporating the contextual elements and the reputations of involved nodes
in the assessment of a user’s trustworthiness. They used context-aware feedback in the
evaluation of the behavior. They proposed the implementation of a monitor mode which
is designed to proactively detect malicious users even before they initiate communication
with the cloud. By putting malicious users in monitor mode, it assists fog nodes to prevent
any security issues. The evaluation shows that the proposed approach is effective and
reliable to evaluate the trustworthiness of a user.
The inaccurate reputation information in reputation-based system may lead to both false
positives and false negatives. Additionally, reaching the steady state in these systems
requires time and resources. Hence, many attacks may occur before reaching that state.
Also the reputation based systems rely only on reputations received from other nodes.
Hence, compromising a set of these node leads to reduce significantly the efficiency of
these solutions.
Table 2 displays a comparison between different misbehavior systems. It is possible to combine
two or more misbehavior detection systems. This can provide a more comprehensive approach
to detecting malicious activity, as each method has its own strengths and weaknesses. In the
next paragraph, we present some hybrid approaches.
• Hybrid systems: A DoS attack detection using hybrid IDS was proposed in [25]. This
model is based on a combination between signature-based IDS and anomaly-based IDS.
In this solution, if the malicious behavior reached the signature-based detector without
Table 2
A comparison of the methods for misbehavior detection in IoT networks
System Benefits Limits
Anomaly de- Can detect Can have a
tection unknown or high rate of
previously false posi-
unseen mali- tives.
cious activity.
Signature- Can detect May not be
based detec- known mali- able to detect
tion cious patterns unknown or
in network previously
traffic. unseen mali-
cious activity.
Reputation- Can detect May not be
based detec- malicious able to detect
tion devices or new mali-
users based cious devices
on their past or users that
behavior. have not yet
established a
reputation.
any detection, it will be traced and carefully monitored by the anomaly-based detector.
The authors in [26] proposed a new misbehavior detection approach that utilizes a
behavior detection system and a distributed signature scheme in order to detect and
prevent malicious activity in IoT devices within medical CPS. After the behavior rule set
is identified, they transform it to a state machine for lightweight misbehavior detection.
The behavior-rule-to-state-machine transformation process is automatic. The proposed
approach is lightweight and efficient, making it suitable for use in resource-constrained
IoT devices. The authors also present the results of an experimental evaluation of the
proposed approach, which showed that it effectively detects and prevents misbehavior in
medical CPS.
The authors in [27] proposed a hybrid anomaly detection method that combines signature
and behavior-based methods to improve detection performance. For the purpose of
signature-based detection, they employed the standard deviations calculated from the
normal data to serve as the classification criteria. This solution provides a real-time
control system. The evaluation shows that the proposed method improved the precision
and recall compared to other ones.
5. Conclusion and future directions
This survey has provided valuable insights into misbehavior detection systems. We overviewed
firstly different attacks. Through careful analysis of attacks, a better understanding of
several attacks is ensured. Secondly, we presented several misbehavior detection systems.
In this field, we provided a new classification which is based on the type of detection
system. This classification has led to a better understanding the advantages and limits
of each type. This survey has provided a wide scope of different detection approaches,
which provides a conclusive overview. The limitation of our work is that it was re-
stricted to a small number of existing "misbehavior detection systems". Hence, we plan
to continue our investigation by completing this survey with most proposed approaches
for detection of misbehaviors. We can extend this work in the future by covering other solutions.
Funding
Dr. Ghofrane Fersi: project 22PEJC-D3P1 "Système IoT basé sur blockchain pour la supervision
sanitaire sécurisée des patients lors des pandémies",Tunisian Ministry of Higher Education and
Scientific Research.
References
[1] A. Rejeb, K. Rejeb, H. Treiblmaier, A. Appolloni, S. Alghamdi, Y. Alhasawi, M. Iranmanesh,
The internet of things (iot) in healthcare: Taking stock and moving forward, Inter-
net of Things 22 (2023) 100721. URL: https://www.sciencedirect.com/science/article/pii/
S2542660523000446. doi:https://doi.org/10.1016/j.iot.2023.100721.
[2] A. Hemmati, A. M. Rahmani, The internet of autonomous things applications: A taxonomy,
technologies, and future directions, Internet of Things 20 (2022) 100635. URL: https:
//www.sciencedirect.com/science/article/pii/S2542660522001160. doi:https://doi.org/
10.1016/j.iot.2022.100635.
[3] M. N. Khan, A. Rao, S. Camtepe, Lightweight cryptographic protocols for iot-constrained
devices: A survey, IEEE Internet of Things Journal 8 (2021) 4132–4156. doi:10.1109/
JIOT.2020.3026493.
[4] A. Ouaddah, H. Mousannif, A. Abou Elkalam, A. A. Ouahman, Access control in the
internet of things: Big challenges and new opportunities, Computer Networks 112 (2017)
237–262.
[5] G. Fersi, Fog computing and internet of things in one building block: A survey and an
overview of interacting technologies, Cluster Computing 24 (2021) 2757–2787.
[6] R. W. van der Heijden, S. Dietzel, T. Leinmüller, F. Kargl, Survey on misbehavior detection in
cooperative intelligent transportation systems, IEEE Communications Surveys & Tutorials
21 (2019) 779–811. doi:10.1109/COMST.2018.2873088.
[7] A. Boualouache, T. Engel, A survey on machine learning-based misbehavior detection
systems for 5g and beyond vehicular networks, IEEE Communications Surveys & Tutorials
25 (2023) 1128–1172. doi:10.1109/COMST.2023.3236448.
[8] A. R. Khan, M. Kashif, R. H. Jhaveri, R. Raut, T. Saba, S. A. Bahaj, H. U. Khan, Deep
learning for intrusion detection and security of internet of things (iot): Current analysis,
challenges, and possible solutions, Sec. and Commun. Netw. 2022 (2022). URL: https:
//doi.org/10.1155/2022/4016073. doi:10.1155/2022/4016073.
[9] N. Magaia, R. Fonseca, K. Muhammad, A. H. F. N. Segundo, A. V. Lira Neto, V. H. C.
de Albuquerque, Industrial internet-of-things security enhanced with deep learning
approaches for smart cities, IEEE Internet of Things Journal 8 (2021) 6393–6405. doi:10.
1109/JIOT.2020.3042174.
[10] A. Chatterjee, B. S. Ahmed, Iot anomaly detection methods and applications: A survey,
Internet of Things 19 (2022) 100568. URL: https://www.sciencedirect.com/science/article/
pii/S2542660522000622. doi:https://doi.org/10.1016/j.iot.2022.100568.
[11] M. Masdari, H. Khezri, A survey and taxonomy of the fuzzy signature-based intrusion de-
tection systems, Applied Soft Computing 92 (2020) 106301. URL: https://www.sciencedirect.
com/science/article/pii/S1568494620302416. doi:https://doi.org/10.1016/j.asoc.
2020.106301.
[12] L. Aversano, M. Bernardi, M. Cimitile, R. Pecori, L. Veltri, Effective anomaly detection
using deep learning in iot systems, Wireless Communications and Mobile Computing
2021 (2021). doi:10.1155/2021/9054336.
[13] A. M. Said, A. Yahyaoui, T. Abdellatif, Efficient anomaly detection for smart hospital iot
systems, Sensors 21 (2021). URL: https://www.mdpi.com/1424-8220/21/4/1026. doi:10.
3390/s21041026.
[14] T. Chen, X. Liu, B. Xia, W. Wang, Y. Lai, Unsupervised anomaly detection of industrial
robots using sliding-window convolutional variational autoencoder, IEEE Access 8 (2020)
47072–47081. doi:10.1109/ACCESS.2020.2977892.
[15] T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, A.-R. Sadeghi, Dïot: A
federated self-learning anomaly detection system for iot, in: 2019 IEEE 39th International
conference on distributed computing systems (ICDCS), IEEE, 2019, pp. 756–767.
[16] M. Bhavsar, K. Roy, J. Kelly, O. Olusola, Anomaly-based intrusion detection system for iot
application, Discover Internet of Things 3 (2023) 5.
[17] V. Sharma, I. You, K. Yim, I.-R. Chen, J.-H. Cho, Briot: Behavior rule specification-based
misbehavior detection for iot-embedded cyber-physical systems, IEEE Access 7 (2019)
118556–118580. doi:10.1109/ACCESS.2019.2917135.
[18] A. Bhardwaj, F. Al-Turjman, M. Kumar, T. Stephan, L. Mostarda, Capturing-the-invisible
(cti): Behavior-based attacks recognition in iot-oriented industrial control systems, IEEE
Access 8 (2020) 104956–104966. doi:10.1109/ACCESS.2020.2998983.
[19] W. Li, S. Tug, W. Meng, Y. Wang, Designing collaborative blockchained signature-based
intrusion detection in iot environments, Future Generation Computer Systems 96 (2019)
481–489.
[20] I. You, K. Yim, V. Sharma, G. Choudhary, I.-R. Chen, J.-H. Cho, Misbehavior detection
of embedded iot devices in medical cyber physical systems, in: Proceedings of the 2018
IEEE/ACM International Conference on Connected Health: Applications, Systems and
Engineering Technologies, CHASE ’18, Association for Computing Machinery, New York,
NY, USA, 2020, p. 88–93. URL: https://doi.org/10.1145/3278576.3278601. doi:10.1145/
3278576.3278601.
[21] Y. N. Soe, Y. Feng, P. I. Santosa, R. Hartanto, K. Sakurai, Rule generation for signature
based detection systems of cyber attacks in iot environments, Bulletin of Networking,
Computing, Systems, and Software 8 (2019) 93–97.
[22] G. Fortino, F. Messina, D. Rosaci, G. M. L. Sarné, Using blockchain in a reputation-based
model for grouping agents in the internet of things, IEEE Transactions on Engineering
Management 67 (2020) 1231–1243. doi:10.1109/TEM.2019.2918162.
[23] A. Patel, D. Jinwala, A reputation-based rpl protocol to detect selective forwarding attack
in internet of things, International Journal of Communication Systems 35 (2022) e5007.
[24] Y. Hussain, H. Zhiqiu, M. A. Akbar, A. Alsanad, A. A.-A. Alsanad, A. Nawaz, I. A. Khan,
Z. U. Khan, Context-aware trust and reputation model for fog-based iot, IEEE Access 8
(2020) 31622–31632. doi:10.1109/ACCESS.2020.2972968.
[25] M. M. Shurman, R. M. Khrais, A. A. Yateem, Iot denial-of-service attack detection and
prevention using hybrid ids, in: 2019 International Arab Conference on Information
Technology (ACIT), 2019, pp. 252–254. doi:10.1109/ACIT47987.2019.8991097.
[26] G. Choudhary, P. V. Astillo, I. You, K. Yim, I.-R. Chen, J.-H. Cho, Lightweight misbehavior
detection management of embedded iot devices in medical cyber physical systems, IEEE
Transactions on Network and Service Management 17 (2020) 2496–2510. doi:10.1109/
TNSM.2020.3007535.
[27] H.-Y. Kwon, T. Kim, M.-K. Lee, Advanced intrusion detection combining signature-based
and behavior-based detection methods, Electronics 11 (2022). URL: https://www.mdpi.
com/2079-9292/11/6/867. doi:10.3390/electronics11060867.