# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Security Threats for Smart Factories
#### 2.1.2 Common Cyberattacks  
Smart factory architecture is vulnerable to various kinds of cyberattacks [37]. Table 6 shows the common types of attacks occurring in smart factories in addition to the main attacks mentioned above. Among them, advanced persistent threats (APT) attacks are characterized by being operated through secret multilateral cooperation over a long period. A representative example showing the danger of APT attacks is Stuxnet [38], which paralyzed an Iranian nuclear power plant in July 2010. If the main control system of the smart factory is destroyed or stopped owing to such an APT attack, the continuity of production and  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Attack** & **Description** & **Attack by (Packets, etc.)** \\ \hline Sniffing & Eavesdropping on network traffic (e.g., data packets of other people) between systems connected to the network. & Sniffer \\ \hline Spoofing & Attacks that trick hostnames, IPs, MACs, email addresses, etc. [34]. & IP/ARP/DNS/DHCP/Email Spoofing \\ \hline Session Hijacking & Attacks that control communication by intercepting a session in which the connection between two systems is active (e.g., logged in) [35]. & TCP, RDP \\ \hline Packet Injection & Attacks that inject malicious data along with normal data. & \\ \hline Replay & Attacks that copy and retransmit messages and packets that have the same effect even if reused. & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Types of man-in-the-middle attacks.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**Malware** & **Description** \\ \hline Worms & They are not parasitic on other programs. They exist and run independently and self-replicate. \\ Viruses & It is possible to self-replicate while infecting and parasitizing other programs, but they cannot spread independently. \\ Trojans & They hide their original purpose without self-replication and perform malicious actions by disguising as normal programs. \\ Spyware & They are installed secretly without the consent of users and operate in a manner to collect and steal information from users. \\ Ransomware & They encrypt sensitive data of users and operate in a manner requiring money in exchange for decryption. \\ Backdoor & They operate in a manner that allows bypass access through the communication connection path installed secretly without a normal authentication procedure. \\ \hline \hline \end{tabular}
\end{table}
Table 5: Malware classification.  
service of the factory is also interrupted, inevitably incurring huge financial losses. Eavesdropping on the process control network of smart factory production equipment steals important process information such as recipes and control device accounts and passwords. Attacks against AI enable attackers to take control of an AI-loaded robot through machine learning poisoning in the smart factory manufacturing process. Such machine learning poisoning attacks can result in performance degradation and even shutdown of the smart factory, causing problems directly related to safety.