# IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories
## 2 Literature Review
### Security Threats for Smart Factories
Table 2 shows the security threat data provided by \"Good Practices for Security of Internet of Things in the context of Smart Manufacturing\" of the European Union Agency for Cybersecurity (ENISA) [26; 27] and the \"Security Model for Smart Factory\" of the Korea Internet and Security Agency (KISA) [28], supplemented by using threat/vulnerability information that occurs in the manufacturing (OT) environment and IT environment of smart manufacturing companies. It should be noted that the threat data and scenarios provided are helpful for forecasting but may still be inconsistent with the various threat vectors in the field. In particular, most threats classified in the high-risk category can lead to service disruption or damage. Owing to limited computational, communication, and processing resources, it is difficult to apply security technologies such as data encryption and secure communication protocol applications to most smart factory CPS devices. Consequently, many CPS devices do not use encryption in their machine-to-machine (M2M) [29] or server communications. It is important to note that if a hacker identifies and exploits this vulnerability, it can lead to a high-risk threat. Figure 1 shows cases in the last 10 years when hackers exploited these vulnerabilities to cause accidents such as power outages and failures. To mitigate these risks, it is important to thoroughly understand and implement cybersecurity standards [30]. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Threat Vector** & **Threat Classification** & **Risk Impact** \\ \hline \multirow{3}{*}{Work area} & \(\blacktriangleright\) Malicious activities (stealing, misuse, alteration, theft, destruction of information about \\  & business ICT systems, networks, and infrastructure) & Medium to High \\  & \(\blacktriangleright\) Business network failure through malware infection & \\ \hline \multirow{3}{*}{Process control network} & \(\blacktriangleright\) Malfunctions and interruptions due to denial of service (DoS) attacks & \\  & \(\blacktriangleright\) PLC malfunction and interruption through control command modulation & \\  & \(\blacktriangleright\) Obtaining and leaking recipes and control device account/password through eavesdropping & \\  & \(\blacktriangleright\) Intrusion of a Wi-Fi wireless network via public SSID & \\ \hline \multirow{3}{*}{Supply chain} & \(\blacktriangleright\) Modulation of normal operating setpoints through maintenance channels & \\  & \(\blacktriangleright\) Ransomware infection through external public services and ports & High \\  & \(\blacktriangleright\) DoS attack using remote access vulnerability & \\ \hline \multirow{3}{*}{External Internet} & \(\blacktriangleright\) Dos attack using server OS and software vulnerabilities & \\  & \(\blacktriangleright\) Infection with malware, such as phishing, spyware, and Trojans, via email & High \\ \hline \multirow{3}{*}{Physical attacks} & \(\blacktriangleright\) Damage to devices and supporting facilities & \\  & \(\blacktriangleright\) Normal operation setpoint and firmware modification & \\  & \(\blacktriangleright\) Ransomware infection via USB port & \\  & \(\blacktriangleright\) Malfunctions and interruptions through arbitrary process manipulation & \\ \hline \multirow{3}{*}{Others} & \(\blacktriangleright\) Disasters (accidents, force majeure, etc.) & \\  & \(\blacktriangleright\) Unintentional/accidental failure (malfunction and downtime due to user error) & \\ \cline{1-1}  & \(\blacktriangleright\) Laws (laws relating to third-party subcontractors, GDPR issues, etc.) & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classification of security threats in the smart factory environment.