# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 3 State-of-the-Art Review
### Attacks and Defense Strategies
#### 3.4.6. Denial of Service Attack  
DoS is a popular cyber-attack in computer networks [86]. It consists on the deliberate interruption of network connectivity, making services inaccessible to applications and users. DoS attacks consist in flooding the specific target--a server or other computational entity--with superfluous requests, that prevent IoT devices from obtaining access to specific services [67], which are typically delivered by Software-oriented Architectures (SoA) or microservices architectures. When the attack is accomplished, the system's processing power gets compromised and is loaded with numerous spam requests that result in a system overload with a high likelihood of crashing. This attack can be achieved through distinct methods, being the most commonly known as botnets and buffer overflow attacks [87]. Although not so common, Distributed-Denial-of-Service (DDoS), cf. Figure 11, is considered as one of the most dangerous DoS attacks. In this type of attack, the malicious entities use thousands of Internet Protocol (IP) addresses to request IoT services, making it difficult for the server to distinguish legitimate DoS devices from attacks [88]. The most common victims of this type of attack are, typically, high-profile organizations such as banking and government, that rely on highly confidential information. DoS attacks can take a lot of time to resolve, result in high monetary losses, and, in the worst case, cause data loss for the organization [87].  
**Defense Strategies**: This type of attack can be recognized with the use of signature-based detection (known as rule-based or misuse-based Intrusion Detection System (IDS)). This technique consists of comparing known attack signatures--that is, patterns, malicious instruction sequences used by malware (such as specific byte sequences--with the monitored network traffic, where a match generates an alarm that signalizes a potential attack. The response is characterized by a fast detection time and high detection rate, and gener  
Figure 11: Distributed Denial of Service Attack.  
ally, has a low false-positive rate. Signature detection is based on well-known DoS attack patterns, which are frequently detected as protocol attacks and malformed packets.  
Another technique is to use anomaly-based IDS (known as behavior-based detection). Operates by comparing the network traffic behavior against previous normal traffic. Any deviation in the comparison is an indication of an attack. The system acquires a normal traffic profile through training and monitoring the traffic against any differences with the normal profile. However, it generally produces higher false-positive rates than signature-based systems [89].  
In [90] the proposed DDoS attack prevention mechanism uses a cloud-based Software-defined Networking (SDN) framework, and machine learning for attack detection. A semi-supervised machine learning algorithm is used for blacklisting malicious devices and filters the traffic using OpenFlow switches and an SDN controller.  
Another solution is to use SDN-based honeypots. Honeypot is a computer security mechanism that is used to detect, deflect, or counteract attacks. It has positive effects in defending against DDoS attacks on the Internet [91]. The SDN controller is used to mimic IoT nodes in the network to attract the attackers. The SDN controller changes the address of the devices while mapping it to their original addresses, making it difficult for the attackers to find the active devices to attack [42].