# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Security Threats for Smart Factories
#### 2.1.1 Cyberattacks  
When designing smart factory security, it is important to understand what the potential threats are and where they are likely to originate. This section introduces DoS, man-in-the-middle (MiTM), and malware attacks, which are major attacks that occur in smart factories, as well as general types of attacks that affect smart factories when they occur, among various other cyberattacks. Then, based on the IIoT architecture, various cyberattack types that can occur in smart factories are examined for each layer. The intention is to gain insight into the background of this study through the recent case of malware-based attacks targeting the manufacturing industry. Denial of Service Attacks. Denial of service (DoS) attacks are specifically aimed at denying access to all forms of computing resources. A DoS attack incapacitates a system by effectively stopping the processes it controls [23]. Table 3 shows the types of DoS attacks, which are mainly attack types such as high-capacity traffic causing bandwidth exhaustion, exceeding the allowed number of connections causing session exhaustion, system resource exhaustion, and buffer overflow on communication protocols. For example, in a smart factory industrial control process, it may interfere with the communication that carries out the transmission of control commands and sensor signal information, causing access denial, control performance degradation, and instability with lower-level control systems or terminal devices [31]. Figure 1: History and timeline of international industrial control system (ICS) cyberattacks. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Attack** & **Description** & **Attack by (Packets, etc.)** \\ \hline Flooding & An attack in which the server receives many connection requests but does not respond to complete the handshake. & TCP, UDP, ICMP \\ \hline Smurf & Network layer DoS attack due to misconfiguration of network equipment & IP, ICMP \\ \hline Ping of Death & Attacks that use ping to make large ICMP packets and create a load to process all the fragmented packets. & ICMP \\ \hline Teardrop & An attack in which numerous Internet protocol (IP) data fragments are transmitted over a network and cannot be reassembled into the original packet, resulting in an overflow. & Variants such as Bonk, Boink, etc. \\ \hline Jamming & Attacks that disrupt normal communication through illegal wireless communication disturbance [32]. & Mobile communication network, GPS, radio wave (RF) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Denial of service (DoS) attack types. Man-in-the-middle Attacks. Man-in-the-middle attacks are mainly performed based on vulnerabilities in network protocols. They steal control of communication in the middle between specific devices exchanging information over a network [33]. An attacker who has taken control of communication can eavesdrop on communication between devices and can also falsify information exchanged with malicious intent. For example, it is a powerful attack that allows an attacker to change the configuration value of an IIoT device in the automated manufacturing process of smart factories or modulate sensor information and control input signals to stop the failure or operation of the ICS. There are various types of man-in-the-middle attacks; the typical attack types are shown in Table 4.  
Malware Attacks. Cyber criminals often use malware to launch cyberattacks. Malware is any software that performs unwanted and suspicious activities on a victim's computer [36]. Table 5 shows the various types of malware created by attackers to damage industrial control devices, systems, and networks. These attacks may render industrial control systems or networks inoperable or cause catastrophic damage to the industrial control system of the production process, operating processes, and related data by allowing remote control of the system.