# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 4 Attack Categorisation
### Use Case Specific
#### 4.8.4 IoT  
Since IoT networks are becoming increasingly common, their security concerns are also increasing. Following this upwards curve in the deployment and integration of IoT devices in multiple sectors, such as Critical Infrastructures, attacks against these systems are also increasing. As such, research into this area is in constant evolution, proposing new methodologies for attack detection as well as solutions to various issues, such as the integration of blockchain methodologies into communication paradigms [100]. Due to this interest in IoT as well as their security issues, multiple categorisation methods have been proposed to cover the various attacks against such architectures. In many IoT applications, the various devices communicate directly to each other, using Machine-to-Machine (M2M) communications to share or retrieve data, such as a display device soliciting a thermometer sensor node to provide and show the temperature. However, such networks are susceptible to multiple attacks since these communications are both self configured and maintained. Examples of these attacks [101] include DoS, MitM as well as Configuration Attacks, which use fake updates to trick users into downloading malware [102], which, in this case, employ software updates on a distant nodes, or even privacy-related attacks, such as types of eavesdropping or spoofing. In [100], the proposed categorisation for security issues was split into three level-related categories: _Low-Level_, _Intermediate-Level_, and _High-Level Security Issues_. _Low-Level Issues_ encompasses all threats against the lowest network layers, Physical and Data-Link, but also against the hardware itself. This includes such attacks as jamming, sleep deprivation, otherwise know as Denial-of-Sleep [103], which forces devices to stay awake and transmit data, causing their energy reserves to dwindle, resulting in a DoS attack [104], or a low level spoofing attack, like faking a MAC address to trick neighbours. Moving up a level to _Intermediate-Level Security Issues_, we find all attacks against network and transport-layer-related activities, such as routing or session management. Here, we can find such attacks as Replay attacks, Sinkhole, Communication Authentication, using cryptographic keys to secure and authenticate nodes, as well as RPL routing attacks, which impact the IPv6 Routing Protocol for low power and Lossy networks (RPL) by exploiting compromised nodes to gain access to data exchange and perform multiple malicious activities [105]. The final _High-Level Issues_ evolve around the applications themselves that are running on the various nodes. Such threats revolve around application vulnerabilities, such as insecure public interfaces, causing a breach to data privacy, or insecure software or firmware, allowing the attacker to take advantage of injection attacks, like SQL [68] or XML-Injection [106]. Another method for categorising IoT attacks was proposed by [13] and revolves around the three IoT stack layers _Perception_, _Network_, and _Application_. Similar to the previous approach, the layer separation allows identification of attacks depending on their impact on network operations. The _Perception_ layer, also called the _Sensors_ layer, concerns all operations on the sensor nodes themselves, from data collection to processing and transmission. Attacks, such as Replay or Timing Attacks, are a type of Side-Channel Attack to extract cryptographic keys by evaluating the algorithm execution time [107]. The second category, _Network_, deals with the data exchange between devices, from routing to data transmission itself. Here, attacks, such as DoS, MitM, eavesdropping, and traffic analysis, can take place. The final layer, _Application_, deals with the data itself, creating the \"smart\" environment itself, all the while protecting the data's authenticity, integrity as well as confidentiality.