# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 4 Attack Categorisation
### Attack Type
This allows the attacker to gain the trust of the victim, thus, allowing further messages to be sent and accepted by the target. This threat is even more significant in sensitive areas, such as battery-operated IoT medical devices in healthcare [31] where unauthorised access and control of such devices could have significant consequences on the patient's well-being. _Deception_ attacks on the other hand, sometimes called _Integrity attacks_[32] or _False Data-Injection attacks_ FDI [33], introduce false data in an attempt to deceive the victim's machine, in turn, forcing it to run invalid operations. Examples of such attacks are against smart grid functionalities, where the introduction of erroneous data into the network seemingly from a legitimate source can alter grid operations, such as altering energy routing [34]. These three categories are used in [35; 36] to categorise cyber-threats towards industrial Cyber-Physical Systems (CPSs). Another classification based on attack type concerns the separation of attacks based upon _Active Eavesdropping_; _Scanning and Probing_; and _Code Injection_. The first category, _Active Eavesdropping_, allows the attacker to increase their spying efficiency by actively interacting with the network, forcing traffic to pass through them [37]. This can be done in many ways, such as _DoS_ or _MitM_; for example, it is possible to introduce erroneous data into WSN routing tables, forcing the data to transit via a corrupted node or the attacker themselves [38]. This grants the ability to access and analyse the data, whilst not impacting network operations. Figure 4: Illustration of a Man-in-the-Middle attack. Scanning and Probing_, on the other hand, although inherently reconnaissance attacks, have as the objective to recover information from a target device. Similar to _Probing_ presented above, _Scanning_ can recover various types of system or network related information by simply \"looking\" at what is happening. By looking and evaluating the target environment, it is possible to extract information regarding the devices on the network [39] and even the different vulnerabilities that might exist on these devices [40]. An example of such an attack is the Port Scanning attack, where the goal is to identify and analyse any open and vulnerable ports on a networked device [41]. The final category concerns _Code Injection_, which defines any threat that seeks to introduce malicious code onto a device through unsecured inputs [42]. Such attacks are quite common and generally target applications where inputs are fundamental to their function. For example, many web based application possessing input forms that have not been properly sanitised are rich environments for such injections, as the code is not examined but instead executed by the server [43]. This three-way categorisation is used in [44] to organise multiple stealth attacks against Critical Information Infrastructures. The final method for categorising attacks based on their type is the use of the following four categories: _Physical_, _Network_, _Software_, and _Encryption_. As defined in the previous section, Physical attacks represent any attack resulting from direct physical access to the device in question. _Network_ attacks on the other hand, regroup any attack that is achieved through a network connection, or from a remote source on passing communications. This includes, for example DoS, MitM, the Sybil Attack, and the Sinkhole Attack. The Sybil Attack [45] is defined as the forging of multiple network identities in an attempt to compromise network integrity. When targeting Wireless Sensor Networks, this attack can cause disruption due to the lack of identity verification between nodes, meaning an unauthorised note with forged identity papers can insert itself into the network. In cases where such networks are in place for monitoring reasons, such as forest wildfire monitoring applications [46], these illicit nodes can counteract legitimate messages and potentially delay a fire response.