# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Security Threats for Smart Factories
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Security Item** & **Manufacturing Systems** & **IT Systems** \\ \hline System & \(\blacktriangleright\) HMI, PLC, sensor, actuator, etc. & \(\blacktriangleright\) ERP: SCM, MES, WMS, etc. \\  & Mechanical control & \(\blacktriangleright\) Data or corporate resource management \\ \hline OS & \(\blacktriangleright\) Use of dedicated OS/real-time OS & \(\blacktriangleright\) Use of general-purpose OS (Windows, Linux) \\ \hline Components & \(\blacktriangleright\) Heterogeneous & \(\blacktriangleright\) Homogeneous \\ \hline Lifecycle & \(\blacktriangleright\) Long (5-20 years) & \(\blacktriangleright\) Short (3-5 years) \\ \hline Communication & \(\blacktriangleright\) Mixing industrial protocols and standard communication protocols & \(\blacktriangleright\) Standard communication protocols \\ \hline Network requirements & \(\blacktriangleright\) Emphasis on robustness and real-time requirements & \(\blacktriangleright\) Focus on non-real time and overall throughput \\  & \(\blacktriangleright\) Response time is important and communication delay is not allowed & \(\blacktriangleright\) Reliability of response is important, and some communication delay is allowed \\ \hline Availability & \(\blacktriangleright\) Critical, 24 \(\times\) 7, planned downtime & \(\blacktriangleright\) Not always available, outages, rebooting tolerable \\ \hline Time dependency & \(\blacktriangleright\) Delays accepted & \(\blacktriangleright\) Critical \\ \hline Resources & \(\blacktriangleright\) Limited & \(\blacktriangleright\) Enough resources for security \\ \hline Patch (including security patch) & \(\blacktriangleright\) Difficult maintenance such as patching & \(\blacktriangleright\) Easy maintenance such as patching \\ \hline Security priority & \(\blacktriangleright\) Availability \(>\) Integrity \(>\) Confidentiality & \(\blacktriangleright\) Confidentiality \(>\) Integrity \(>\) Availability \\ \hline Security awareness & \(\blacktriangleright\) Not familiar with security in general & \(\blacktriangleright\) Awareness of the importance of security \\ \hline Prevention & \(\blacktriangleright\) Physical protection for field devices & \(\blacktriangleright\) In-depth defense \\ \hline Forensics & \(\blacktriangleright\) Limited & \(\blacktriangleright\) Available \\ \hline Antivirus & \(\blacktriangleright\) Non-general with difficulty applying to general IT products & \(\blacktriangleright\) General for wide use \\ \hline Impact of accident & \(\blacktriangleright\) Fatal damage and large-scale physical and economic damage due to industrial site operation disruption & \(\blacktriangleright\) Relatively insignificant economic damage such as work inconvenience and delay \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Differences between manufacturing systems security and IT systems security. traditionally unconnected links in the supply chain [3]. Insecure networks in these supply chains can affect the entire supply chain by providing an entry point for malicious software. Cyberattacks on smart factories span a wide spectrum. Although some of these attacks are motivated by political reasons, most of the recent attacks, such as ransomware infections, are motivated by financial reasons. Cyberattacks typically pursue one of the following three goals [25]. 1. Stealing personal data of end customers: Criminals use integrated customer relationship management (CRM) systems, e.g., operating system access through heating and air conditioning vendors. 2. Entire system down: This can cause dramatic losses associated with hacker attacks. 3. Industrial espionage and sabotage: This involves extortion of duties by exploiting technical vulnerabilities to gain a competitive advantage over competitors by stealing intellectual property and trade secrets.