# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 4 Attack Categorisation
### Attack Type  
Moving forwards, the following form of categorisation evolves around the distinction based upon attack type. Their are many different attack methodologies that exist; however, multiple belong to the same type of attack. An example is the _Denial-of-Service (DoS)_ attack shown in Figure 3 where the objective is to deny legitimate user access to a shared resource, such as a web server or wireless access point [18]. This can be achieved using various different methods, such as introducing large quantities of data to sensor networks causing data overload, or submerging hardware constrained IoT devices, impacting resources resulting in device shutdown. Furthermore, as presented previously, these devices use wireless communications to exchange with their neighbours. Since the wireless medium is both a shared and rare commodity, monopolising the frequencies can cause long communications blackouts, severely impacting both the operation of the network and the device's resources. A commonly used approach is the differentiation of attacks as being either _DoS_, _Probing_, _Remote-to-Local (R2L)_, or _User-to-Root (U2R)_. As defined in [19], _Probing_ attacks are reconnaissance methods to obtain information from a target system, which can then be used for more direct assaults. _R2L_ attacks, also known as _Remote-to-User (R2U)_, aim to gain unauthorised access to an \(\Pi\) system from a remote location using obtained user credentials. Following on, a _U2R_ attack aims to illegally access an administrative account on the system, from which devastating attacks can be performed. This approach is used in the presentation of different cyber attack detection strategies in [20], where they present the four different types of cyber attacks that they consider. In [21; 22], these four categories are used to define attacks and traffic anomalies for use in attack and anomaly detection systems. This approach can be adapted to various types of networks with their specific limitations and characteristics. For example, in [23], the authors applied this categorisation to deep-learning-based attack detection on IoT-based Fog computing, whereas, in [24], it is used to explain how Brute Force Attacks occur. Furthermore, it is also used in [25] during the analysis of Machine-Learning-based network intrusion detection classifiers. Following on, another approach is the separation of attacks into three distinct categories: _DoS_, _Man in the Middle (MitM)_, and _Brute Force_. _MitM_ is one of the most known attacks in the cyber-space and is illustrated in Figure 4. Studied in [26], this attack places the attacker between two victim devices, forcing traffic to pass through them by tricking each victim to  
Figure 3: Illustration of a Denial-of-Service attack. believe they are communicating with the other. In doing so, the attacker is rewarded access to all exchanges, encrypted or not, meaning it easy to extract information or even modify them to their advantage. Similar to _DoS_ attacks, multiple methodologies exist to perform such an attack, each taking a advantage of a different protocol in the network structure, such as low level ARP-spoofing [27] or high level DNS-poisoning [28]. On the other hand, _Brute Force_ attacks, presented in [24], iterate over every possible keystroke in an attempt to find a match and break or decrypt login credentials [29]. Once again, different methods exist for a Brute Force approach, such as a statistical analysis of the most common and recurring characters dependant on the password difficulty. This categorisation is presented in [30] to classify the most common recurring cyber attacks. The use of _DoS_ to categorise attacks is quite common. Indeed, it is used in yet another method, separating attacks into three distinct categories: _DoS_, _Replay_, and _Deception_. As explained in [31], _Replay_ attacks use legitimate captured data, which is then resent to the original destination.