# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Smart Factory Cyberattack Cases  
Recent TSMC ransomware cyberattacks, SolarWinds network attacks, Colonial Pipeline, etc., show how vulnerable companies are to hacking attacks using malware on industrial control systems and manufacturing industrial facilities.  
_TSMC WannaCry ransomware attack in Taiwan (2018)_: In 2018, TSMC, the world's largest semiconductor assignment manufacturer in Taiwan, suffered a production plant shutdown due to a WannaCry ransomware attack. In this attack, malware was introduced into the production facility via a universal serial bus (USB) infected with the WannaCry variant malware while the employee was upgrading the production facility software on a closed production computer that was blocked from outside access. As a result, more than 10,000 PCs and devices in the production process were infected, data were encrypted, and factory operations were suspended for two days. This resulted in an economic loss of approximately $250 million, equivalent to 3% of annual sales [52].  
_Hacking of SolarWinds Supply Chain (2020)_: The SolarWinds supply chain hacking incident was a case in which malware was inadvertently distributed in a legitimate manner using the automatic update function trusted and used by customers [53]. SolarWinds is an American company that supplies network systems and IT infrastructure software used by many manufacturing companies and public institutions worldwide. Figure 3 shows the operation process of the SolarWinds software supply chain attack. This attack h  
Figure 2: Smart factory cyberattack structure diagram.  
the Trojan horse malware called SUNBURST in the update file of \"Orion\", a monitoring solution from SolarWinds. More than 18,000 customers (3% of all customers) had their systems infected with malware when they updated the solution. As such, attackers are targeting the damage and severity of cyberattacks on supply chains as they are directly linked to the availability of smart factories.  
_Colonial Pipeline DarkSide ransomware attack in the US (2021):_ In May 2021, Colonial Pipeline, the largest oil pipeline company in the US, was attacked by the DarkSide ransomware, which led to supply constraints. This resulted in a six-day shutdown of fuel and other refined products that were transported through this pipeline (more than approximately 100 million gallons per day) over 5500-plus miles from Houston in Texas to New York in the southeast United States [54]. Gasoline futures prices reached their highest level in three years as the incident heightened concerns about fuel shortages in the US. Attackers infiltrated the computer systems of Colonial Pipeline by abusing legacy virtual private network (VPN) profile accounts that employees used to provide remote access to the company's computer networks. The DarkSide ransomware was used to encrypt all files, and Colonial ended up paying $4.4 million for the decryption [55].  
Based on these cases, the paths of cyberattacks that occur frequently in the smart factory industrial control network were found to include social engineering methods to use a USB infected with malware (physical) and the distribution of malware using legitimate service supply chain channels such as update and patch systems. Because of the ransomware malware attack, various control systems and management PCs in the smart factory could not perform their functions, failing to ensure availability. As cyberattacks targeting the smart factory industrial control system (ICS) may directly lead to physical damage, it is very important to implement security functions [56; 57].  
Figure 3: Conceptual diagram of the SolarWinds software supply chain attack.