# Intrusion Detection and Prevention in CoAP Wireless Sensor Networks Using Anomaly Detection
## 2 Security and Intrusion Detection in the IoT
### Security in the Context of Internet-Integrated Sensor Networks  
A standardized communications stack is currently being formed with the purpose of enabling IP communications with constrained sensing and actuating devices [1]. In this context, protocols such as 6 LoWPAN [2], RPL [3] and CoAP [4] have been designed to run over IEEE.802.15.4 [7] physical (PHY) and MAC layer communications, and other technologies are also being adopted by the 6 LoWPAN adaptation layer, as is the case of Bluetooth Low Energy (BLE) [8]. IEEE 802.15.4 is inherently a link-layer communications technology, and as such only offers security to hop-by-hop communications. As this stack enables end-to-end communications (at the network and higher layers) between Internet-integrated constrained wireless sensing devices and other Internet entities, attacks against such devices may be diverse and take place at all layers of the stack. For example, in IEEE 802.15.4, confirmation (ACK) packets are not encrypted, and the knowledge of the numbering of the packet to be confirmed may be sufficient to perform a replay attack. As for the 6 LoWPAN [2] adaptation layer, it was designed without security mechanisms, although proposals exist in the literature in this context [9]. Regarding routing operations performed over 6 LoWPAN, Routing Protocol Layer (RPL) [3] defines a framework capable of transporting secure versions of the routing messages, as well as a set of mandatory cryptographic algorithms to be supported by sensing devices. Despite such functionalities, we find that RPL is vulnerable to attacks such as rank attacks, local repair attacks and resource depleting attacks [10].  
In our work we consider that a particular focus on the Constrained Application Protocol (CoAP) [11] is of importance, given that it promises to play a major rule in enabling the IoT. CoAP was designed with the purpose of extending the REpresentational State Transfer (REST) architecture of the web to encompass sensors and actuators. The CoAP protocol inherits the same Create, Read, Update, Delete (CRUD) operations as ReST, the same applying to the error codes, and also shares some URL similarities. Regarding security, other than introducing security at the application-layer itself, CoAP delegates its support to the Datagram Transport Layer Security (DTLS) protocol at the transport-layer, with the goal of transparently securing communications between devices. Devices may authenticate using DTLS with pre-shared keys, public-keys or X.509 digital certificates. It is important to note that, despite the fact that DTLS offers transparent security for end-to-end communications between devices, it does not protect such devices against a number of external and internal attacks.  
Among such attacks we may find cache manipulations, which make the devices susceptible to man in the middle attacks, Distributed Denial of Service (DDoS) amplified attacks, spoofing attacks and cross-layer attacks, which may allow to bypass firewalls. On the other hand, internal attackers may try to subvert the normal operations of the CoAP protocol, as well as its semantic rules. Therefore, end-to-end security mechanisms may be complemented by appropriate detection and prevention approaches deployed in the context of the Internet-integrated WSN, as is our motivation in this work.