Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

TL;DR

This paper reviews IoT security challenges, focusing on advanced persistent threats, and discusses machine learning approaches, detection methods, and open issues for future research in IoT network protection.

Contribution

It provides a comprehensive review of APT attacks in IoT, summarizes ML-based detection methods, and highlights open challenges and future directions.

Findings

ML methods show promise but struggle with small APT attack data

Signature, anomaly, and hybrid detection systems are summarized

Open issues include dataset scarcity and detection of long-term APT attacks

Abstract

Despite its technological benefits, Internet of Things (IoT) has cyber weaknesses due to the vulnerabilities in the wireless medium. Machine learning (ML)-based methods are widely used against cyber threats in IoT networks with promising performance. Advanced persistent threat (APT) is prominent for cybercriminals to compromise networks, and it is crucial to long-term and harmful characteristics. However, it is difficult to apply ML-based approaches to identify APT attacks to obtain a promising detection performance due to an extremely small percentage among normal traffic. There are limited surveys to fully investigate APT attacks in IoT networks due to the lack of public datasets with all types of APT attacks. It is worth to bridge the state-of-the-art in network attack detection with APT attack detection in a comprehensive review article. This survey article reviews the security challenges in IoT networks and presents the well-known attacks, APT attacks, and threat models in IoT systems. Meanwhile, signature-based, anomaly-based, and hybrid intrusion detection systems are summarized for IoT networks. The article highlights statistical insights regarding frequently applied ML-based methods against network intrusion alongside the number of attacks types detected. Finally, open issues and challenges for common network intrusion and APT attacks are presented for future research.