# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 5 Analysis of the Categorisation Methodologies
\begin{table}
\begin{tabular}{l c c} \hline
**Categorisation** & **Approach** & **References** \\ \hline Attack Severity & Six threat levels: Localised, Moderate, Substantial, Significant, Highly & [15] \\  & Significant and National Cyber Emergency & [16] \\ \hline Access Type & Physical, Cyber & [16] \\ \hline  & DoS, Probing, R2L, U2R & [19, 20, 21, 22, 23, 24, 25] \\ \hline  & DoS, MitM, Brute Force & [26, 30] \\ \cline{2-3} Attack Type & DoS, Replay, Deception & [35, 36] \\ \cline{2-3}  & Active Eavesdropping, Scanning, Probing & [44] \\ \cline{2-3}  & Physical, Network, Software, Encryption & [55] \\ \hline Attacker Position & Outside, Inside & [15, 56, 57, 58, 59] \\ \hline Attacker Implication & Active, Passive & [13, 20, 56, 60, 61, 62] \\ \hline  & Privacy & [16] \\ \cline{2-3}  & Reconnaissance, Access, Malicious, Non-Malicious, Cyber Crime, Cyber & [20] \\  & Espionage, Cyber Terrorism, Cyber War & [20] \\ \cline{2-3} Objective Oriented & Disconnection and Goodput Reduction, Side-Channel Exploitation, & [44] \\ \cline{2-3}  & Cover-Channel Exploitation & [57] \\ \cline{2-3}  & Hardware, Network, Human Factor & [57] \\ \cline{2-3}  & Interception, Interruption, Fabrication, Modification & [61] \\ \cline{2-3}  & Access Control, Authentication, Availability, Confidentiality, Integrity & [70] \\ \hline Network Layer Oriented & OSI model, Layers 1-4 and 7 & [56, 74] \\ \hline \end{tabular}
\end{table} 
Table 2: Overview of the categorisation methods. \begin{table}
\begin{tabular}{l l c c} \hline
**Categorisation** & & **Approach** & **References** \\ \hline  & CPS-NCS & Attacks on Physical Components, Attacks on Communication Network & [80] \\ \cline{2-4}  & CPS-Smart Grids & Power and Energy Layer, Computer/IT Layer, Communication Layer & [87] \\ \cline{2-4}  & Wireless Ad-Hoc Networks & Attacks on MANET, Attacks on WSN & [20] \\ \cline{2-4}  & IoT & Low-Level, Intermediate-Level, High-Level Security Issues & [100] \\ \cline{2-4}  & IoT Stack Layers-Perception, Network, Application & [13,108] \\ \hline SDN & SDN Architecture-Application Layer, Application-Control Interface, Control & [115] \\ \cline{2-4}  & Layer, Control-Data Interface, Data Layer & \\ \hline \end{tabular}
\end{table} 
Table 2: _Cont._In many cases, especially in IoT applications where devices are left alone or provided to individuals, such as our previous medical example, physical tampering is also a significant risk. Not only can the device itself be damaged or broken, but, with direct access, attackers can analyse the system in detail, providing them with a significant edge. Furthermore, certain software related threats, such as Viruses, Data-injection, and Ransomware, are all categorised upon the Application layer, without further detail as to their organisation. One of the most common used approaches, **Attacker Implication**, grants an important insight into the use of the attack, such as separating reconnaissance threats from malicious activities. However, alone it is insufficient to provide enough input to properly categorise and separate attacks. As stated previously, this approach is used alongside other approaches. As such, it is a good method for providing further insight to certain methods, such as the previously explored **Network Layer** approach, allowing for each network layer to be separated into passive and active attacks. Overall, each of these methods possess their own merits since they can be used at the authors discretion to represent attacks how they see fit. However, when coupled with the large number of categorisation approaches, this can lead to confusion in understanding the structure but also as to which is the best approach to employ. Thus, we hope to provide insight into some of the methods and approaches used in the literature to inform and help guide in the choice for a suitable solution.