# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 4 Attack Categorisation
### Use Case Specific
#### 4.8.3 Wireless Ad-Hoc Networks  
Contrary to the classical functionality of wireless communications, which transit through a central infrastructure, certain devices communicate directly between each other using direct ad-hoc communications. Furthermore, it is possible to use what is known as a multi-hop network structure, where multiple network devices serve as relays between a source and destination. Wireless Sensor Networks (WSN) use small sensor devices to retrieve information and then rely on the principals of wireless ad-hoc networks to relay their data back to a central point, through multi-hop routing [95].  
Due to their versatility and adaptability, they can be deployed in multiple areas from environmental applications, such as the aforementioned forest fire monitoring system, to health or home applications, such as ECG devices to monitor patients health [96]. In certain cases, these types of equipment can also possess motion, meaning their network topology is constantly fluctuating, causing the need for constant adaptation and exploration of their surroundings. These networks are called Mobile Ad-Hoc Networks, or MANETs, and are an area of research in constant exploration.  
With the possibilities of multiple routing paradigms, communications between devices can be more or less prominent, meaning any attack could have a greater or lesser impact on the network functionality. Attack examples include the classic DoS, MitM, as well as Replay and Jamming. However, due to the importance of communications in such a dynamic network, attacks that directly interact with routing have increased impact. These attacks are called Byzantine Attacks, where an attacker takes control of authenticated devices on the network and exploits them to arbitrarily disrupt routing [97]. Examples of such attacks include:  
* **Black-Hole Attack**, which influences routing decisions to force all messages to transit to the compromised node itself to then be dropped, resulting in a DoS of varying intensity [98].
* **Wormhole Attack**, which creates an unauthorised long distance link between two compromised nodes, forwarding data from one end of the network to the other, disrupting routing efficiency as nodes on one end believe they are closer to nodes on the other end than they are [99].
* **Gray-Hole Attack**, which functions in a similar fashion to black-hole, except, instead of dropping all passing messages, only a select few will be dropped, dependant on various metrics from random to specific message types [62].  
Due to the nature of WSNs, which can be left for long durations to monitor data in remote areas, such as the previous example of forest fire monitoring systems, they are susceptible to tampering and other network-based attacks. An example of such an attack is the Sybil Attack, where an attacker forges illicit identities to incorporate illegitimate nodes directly into the network. This allows the nodes to not only relay information between nodes but also emit false sensor data, which can trick the system into believing that an actual forest fire is not happening, allowing it to grow in intensity.  
A simple method of threat categorisation when multiple areas and domains are being evaluated is the separation based on the application used, in this case _Attacks on MANET_ and _Attacks on WSN_ as explained and presented in [20].