# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Smart Factory Cyberattack Structure Diagram
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Attack** & **Description** & **Citation** \\ \hline Side-Channel & Using technology to collect and analyze various types of information leaking from the hardware and software of industrial equipment, such as analysis of power consumption, electromagnetic waves, optical signals, traffic flow (e.g., network), etc., secret information is decrypted to carry out an attack. & [39] \\ \hline Eavesdropping & By monitoring network traffic, attackers can obtain sensitive information, such as how a particular system or production process operates, which can be used for further attacks in the future. & [28] \\ \hline Data tampering & Data tampering attacks are those in which data (e.g., industrial control data) are stored or transmitted without permission for malicious purposes. & [40] \\ \hline False Data Injection & Industrial control systems without an authentication mechanism can use this attack to inject malicious code and malformed commands. & [23] \\ \hline Advanced Persistent Threats (APT) & APIs are highly intelligent attacks that set clear targets, collect information over the long term, and perform more sophisticated attacks by combining new technologies and various attack methods. & [38; 41; 42; 43] \\ \hline Zero-Day & These attacks exploit a security vulnerability that has not yet been disclosed, and it is difficult to defend and develop a patch as only a small number of people are aware of such a vulnerability until it is disclosed to the public. & [44] \\ \hline Attacks against AI (machine learning and data analytics) & These attacks change the input data supplied to the system causing the AI system to malfunction, damaging the learning process by tampering with the measurement values of IIoT sensors and manipulating training data, and stealing information about the training model by extracting the data used to train the AI model. & [45; 46; 47] \\ \hline Phishing & As the most common cyberthreat, phishing refers to the act of stealing useful information or attempting theft through a connected device (a link to a fake bank website, an email infected with malware, etc.) disguised as a legitimate message. & [48; 49] \\ \hline Physical & This refers to the illegal manipulation, changing, or causing of physical damage to accessible devices (e.g., sensors, industrial IoT terminals, production facilities) by an attacker with physical access. & [50] \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Common attacks in smart factories. message queuing protocol (AMQP), and HTTP--and is subject to malware, false data injection, APT, zero-day, and phishing attacks [51]. The Data and Cloud Services Layer provides an IoT framework based on major cloud services--such as AWS, Google, and Cisco--and is subject to APT and zero-day attacks. If AI is used in the cloud, attacks against AI (e.g., insertion of incorrect data in the data collection stage) may occur in AI-related processes (collection, transmission, and processing).