# Defense and Security Mechanisms in the Internet of Things: A Review
## 3 Materials and Methods
### Cyber-Attacks on IoT Environments
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Attack** & **Description and Solution** & **References** \\ \hline Temporary Parameter Leakage attack & • Sensitive temporary information, such as session keys, is exposed due to improper management. & [82] \\ • & • Solution: Use secure storage methods and regularly refresh session parameters to minimise exposure. & \\ \hline Physical and Modelling attacks & • Attempts to physically compromise devices and mathematically model them to compromise security. & [83] \\ • & • Solution: Employ tamper-proof hardware and secure boot mechanisms to protect physical devices. & \\ \hline Guessing attacks & • An attacker tries guessing information like passwords or identities. & [19,84] \\ • & • Solution: Enforce strong password policies, use complex keys, and implement rate-limiting on login attempts. & [14] \\ \hline Insider attack & • Attack carried out by people who have authorised access to a system but are using it maliciously. & [14] \\ • & • Solution: Implement role-based access control, continuous monitoring, and regular audits of user activities. & \\ \hline Sensor Node Capture attacks & • An attacker takes physical control of a sensor node and uses it to manipulate data or gain access to the network. & [14, 15, 16] \\ • & • Solution: Employ data encryption and key obfuscation and ensure that captured devices cannot compromise the entire network. & [85] \\ \hline Session Key Temporary Information attack & • An attacker gains access to temporary session key data, allowing the session to be compromised later. & [28] \\ • & • Solution: Use secure session key negotiation protocols and ephemeral key generation. & \\ \hline Denial of Service (DoS) attack & • An attacker overflows the network or device with traffic, causing it to become inaccessible. & [85,86] \\ • & • Solution: Implement rate-limiting, intrusion prevention systems (IPSs), and a redundant network architecture. & [87] \\ \hline Stolen (smart card, verifier) attack & • An attacker gains physical possession of a smart card or verifier and uses it maliciously. & [87] \\ • & • Solution: Use biometric authentication, encrypt sensitive data on the card, and enable immediate deactivation of stolen cards. & [88] \\ \hline Side-channel attack & • An attacker uses side-channel data (for example, power consumption analysis) to guess the device’s operation or cryptographic keys. & [88] \\ • & • Solution: Add random delays to operations and design attack-resistant hardware. & \\ \hline Device hijacking & • An attacker gains unauthorised access to a device, such as cameras or locks, to gain control or steal data. & [89] \\ • & • Solution: Using strong passwords, turning off unused services, and implementing access control lists. & \\ \hline Zero-day exploits & • An attacker exploits previously unknown vulnerabilities in IoT devices or their software before the manufacturer has time to develop and deploy appropriate patches. This attack can lead to device takeover, data theft, or disruption. & [90] \\ • & Solution: Regularly monitor threats and security updates, use anomaly detection systems (IDSs), segment the network, restrict device access, and implement zero-trust. & [91] \\ \hline IoT botnets & • An attacker takes control of weakly secured IoT devices, creating a botnet to launch DDoS attacks. & [91] \\ • & Solution: Update device firmware, use strong passwords, restrict port access, and monitor network traffic. & [92] \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._