# Review of Smart-Home Security Using the Internet of Things
## 4 Analysis and Discussions of the IoT Setting
### Threats Faced by a Smart Home and Related Countermeasures
#### 4.2.3 Network Layer Analysis  
The network layer is responsible for the correct pairing of devices with each other and subsequently for their correct communication. At this level, the required authentication of the devices involved in the network takes place, but this level is also vulnerable to attacks. One form of attack involves the sending of a large amount of data that the system is unable to process. This overflow of data causes congestion in the nodes, and as a result, they cannot respond to even the simplest functions. This attack is called a Denial of Service (DoS), and when it happens, it blocks even the legitimate and authorized user from accessing the network [124; 150]. Thus, the attacker finds an opportunity to enter the network and modify the pairing parameters of the devices, receiving all information. Another form of attack is the gateway attack, where the attacker modifies the routing process between smart devices, resulting in information being sent through another route that leads to the compromised devices. The gateway attack aims to collapse the connection between the sensors and the remote server of an Internet Service Provider (ISP) [145; 151; 152], an attack which often results in a DoS. An attack that leads to an unauthorized user accessing the network can cause major problems, as valuable information can be intercepted or even modified to serve the attackers' interests [19; 153; 154; 155]. Such an attack would be devastating in a smart-health environment, which manages sensitive patient information often with disastrous consequences for the patients themselves. Storing large amounts of personal data on local devices, or even worse on remote servers (cloud), provides poles of attraction for potential attackers, especially when many users have the right to access these data [156; 157; 158]. This is an entry point of the system, where the attacker can pretend to be another authorized user and gain access to the stored and completely private data. Another popular attack is when the attacker interferes between the communication of the devices by compromising a network device. Thus, without disrupting the operation of the system, it receives all information circulating in the system, an attack also known as a black-hole attack (e.g., in RPL) [32]. A similar attack is that of man-in-the-middle, where communication between nodes is disrupted through a malicious device, creating a large amount of irrelevant data on them and causing confusion in their operation, making the network particularly vulnerable to several security issues [159; 160]. Another routing attack is that of flooding with HELLO messages [38]. The attacker bombards a network node with a large number of HELLO messages, claiming to be a neighboring node. The node accepts it as its neighbor and starts communication with it. Due to the high frequency of HELLO messages, the attacking node is treated by the rest nodes as a parent node, and they start sending all the data to it, thus changing the network routing. The different technologies of sending data between the devices that can be found in a smart environment create many vulnerabilities in the system [161; 143; 160]. The wide variety of different technologies used in the connections between the devices and the end-node creates many weak points in terms of security [117]. DoS is generally a main concern for computer networks. In ordinary cases where a computer is being attacked by a network of compromised nodes (botnet) through the Internet, ISPs are applying solutions to detect DoS and block the traffic before reaching the target. The defending machine could also deploy anti-DoS mechanisms for networks or services, like backoff algorithms. [PERSON] et al. [162] propose WARDOG, an end-user awareness system designed to mitigate botnet infections on host devices. It operates by alerting and enabling infected machines to automatically block malicious activity once a botnet attack is detected, primarily focusing on DDoS attacks.