# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 4 Attack Categorisation
### Use Case Specific
#### 4.8.2 Smart Grids  
These systems, classed as Critical Infrastructures, use various smart devices to measure the energy expenditure and adapt the grid distribution as needed. Many different threats exist towards Smart Grids, such as DoS, Replay and Jamming [82; 83] as well as Network Topology Attacks, which manipulate the communications between control centres and grids to create blackouts, leading to power system disruptions.  
Furthermore, many network-based attacks, such as Sniffing, War Dialling, the process of dialling random numbers until until a connection is found [84], MitM, and FDI, can also take place on these communication links, impacting the integrity of the communications [85]. As demonstrated during the 2015 Ukraine Blackout, where multiple coordinated attacks brought down three power suppliers plunging people into darkness for several hours, attacks targetting data control links can result in severe consequences [86].  
As a result, FDI attacks are considered the most dangerous in this context, with the attackers knowledge of the target environment and their level of access to said environment both influence the outcome. A method of categorisation for attacks against Smart Grids is proposed in [87], separating attacks into three distinct categories: the _Power and Energy Layer_, _Computer/IT Layer_, and _Communication Layer_. The first category, the _Power and Energy Layer_, concerns attacks against both control stations and equipment. In the case of control stations, only FDI attacks against AC and DC State Estimation, a significant central part in Energy Management Systems are considered, impacting the generation and upkeep of energy supplies.  
These attacks, considered stealthy and difficult to detect can bypass standard State Estimation techniques, making them difficult to counter [88]. On the other hand, attacks against equipment aim to cause physical damage to different devices by altering operational factors, such as Inertial Attacks, by increasing the speed of heavy equipment, or even Wear Attacks, which exploit malicious commands to cause wear-and-tear on equipment, reducing their life expectancy.  
The second category concerns attacks against the _Computer/IT Layer_, this time targeting the IT devices themselves running command software. The attacks here are split into two distinct sections, the first of which concerns software attacks, which take advantage of programming weaknesses. Examples of such attacks include Buffer Overflows, which consists of going beyond the memory buffers capacity to inject malicious code in active memory [89] and Dangling Pointers, which point to an invalid memory location where a data object has been deallocated but not yet deleted [90].  
The other part of the _Computer/IT Layer_ concerns malware attacks, such as Trojans, an inconspicuous program hiding malicious functionalities to evade security restrictions when executed [91] or Malicious Bots, a seemingly harmless intermediary program that receives commands from a third party to undertake malicious activities on the infected device or towards remote targets [92]. The third and final category evolves around the _Communication Layer_, once more targetting two aspects, the first of which is directed towards the Communication Protocols themselves. Dependant on the hardware and systems involved, various different protocols exist, such as Modbus [93] or DNP3 [94]. The second aspect concerns network related attacks, containing some familiar faces, such as DoS, MitM, and Replay Attacks.