# Intrusion Detection and Prevention in CoAP Wireless Sensor Networks Using Anomaly Detection
## 2 Security and Intrusion Detection in the IoT
### Intrusion Detection on the IoT  
As previously discussed, we consider that attacks against the security and stability of Internet-integrated constrained sensing and actuating devices may take place at the various layers of the communications stack, thus from the IEEE 802.15.4 [7] link layer up to the application layer using CoAP [4]. For example, we may find jamming and collisions attacks at the link layer, while at the application layer flooding and overwhelming of CoAP communications are two examples of attacks against this communications protocol [10]. On [16], jamming, cloning of things and eavesdropping are identified as possible DoS attacks against IoT communication environments, either at the routing or application layers. In [17] a solution is described to prevent DoS attacks against sensing devices originated at the Internet, by employing more capable devices and edge routers in the support of security-related operations. In this proposal, the routers also authorize the forwarding of communications between the WSN and the Internet domains, for the devices that pass a set of predefined conditions. In [16], a system is proposed to secure IoT devices via encryption and policy enforcement mechanisms employing Suricata [18] as an SD IDS. Authors in [19] propose SVELTE, an hybrid IDS for the detection of attacks against routing using RPL, which merges the characteristics of SD and AD intrusion detection. This proposal is evaluated through simulation with good results in dealing with sinkhole attacks.  
In [20] the authors propose REATO, a rule-based solution for actively and dynamically detecting and dealing with DoS attacks in the context of a cross-domain IoT middleware. This system is designed to react to various situations in order to block undesired communications, and the proposal is implemented and evaluated experimentally, and found to be viable in defending from DoS attacks in an IoT scenario. In [21] a hybrid IDS (RIDES) is proposed with the goal of dealing with Ping of Death (PoD) attacks. RIDES is based on two main components, the signature code generator, which uses bloom filters for storing signature codes for Snort [22], and the network anomaly detector, which employs cumulative sum control charts for detecting abnormal network activity. The authors argue that RIDES can reduce energy consumption by 8 uJ using signature codes, and it is shown that the true positive ratio increases with the time interval.  
We also find [23; 24] as proposals of anomaly-based detection systems. The two proposals focus on preventing botnet attacks and on the usage of TCP communications, thus not being compliant with the usage of 6 LoWPAN and CoAP, which currently run over UDP. We may find also other proposals in the literature with different methodologies, such as [25] for wormhole detection, Reference [26] based on Deep Packet Inspection (DPI) and [27]. In conclusion, and regarding the previously discussed proposals, we note that most of the implemented pure AD solutions are not extensively described in the literature. We also note that none of the existing proposals target the detection and handling of attacks at the CoAP application-layer, as per our motivation in this work.