## 3 Critical Analysis of Selected Literature
### Cyber Kill Chain Exploitation Technique  
According to [PERSON]. [50], a kill chain is a military concept that describes an attack's key phases, which include Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control (C2) and Actions on objectives. [PERSON], [PERSON] and [PERSON] [51] modified the existing Cyber Kill Chain (CKC) model, and included IoT-specific attacks and steps taken by attackers in the exploitation of IoT devices. This model is called IoT Kill Chain (IoTKC); it includes nine phases compared to the seven phases in the CKC model: Discovering the IoT device, Entering the IoT device, Getting device information, Preparing the device, Downloading the package, Preparing the package, Installing the package, Removing traces, and Performing actions. However, this model has not been widely adopted by the research community.  
In this type of exploitation technique, an attacker hacks a system connected to a network, which indirectly connects to the air-gapped network, as shown in Figure 8. This is a sophisticated type of attack that includes several underlaying attacks, including social engineering and injecting the malware; therefore, the **use case steps** could be the following:1. An employee with a **vulnerable** workstation connected to the isolated network opens an email attachment containing malware;
2. The malware contains dual zero-days that exploit the nearby Cisco firewalls, open up certain ports in the firewall, and add rules to allow transparent connectivity between the infected workstation and the air-gapped VSS network;
3. It then uses the infected firewall as a bot to infiltrate the VSS network and exploits a particular vulnerability in the camera. It then uploads malware that transmits video feeds every few minutes to a remote IP that the attacker controls.  
**Impact:** Same as Section 3.3.  
**Security measures:** [PERSON] and [PERSON] [52] agreed with [50] on the Mirai use case that to kill the kill chain, it needs to be split into seven phases, namely: **reconnaissance**, **weaponize**, **delivery**, **exploit**, **install**, **command and control and actions on objectives**. Each step is addressed separately with the relevant, appropriate defense measures. Figure 9 illustrates an example of controls applied to the industrial company with complex network infrastructure that includes servers, client's PCs, network devices and IoT components such as card readers, selling touch screens, HVAC and connected sensors, using the ontology-driven framework proposed in [52]. The framework identified the vulnerable assets and controls, and prioritized them according to the efficacy to cost (EtoC) ratio. The kill chain in the figure is divided into four phases: delivery, exploitation, installation, and action. Each phase features specific security measures aimed at mitigating potential attacks. The different colors represent various Advanced Persistent Threat (APT) attacks used for testing. Notably, many APT attacks employ social engineering tactics, using email or infected USB sticks for delivery. Consequently, we observe that filtering emails and blocking USB ports are two of the most prioritized security measures during the delivery phase.  
To detect intruder actions, unauthorised access, unusual patterns in video camera feeds such as frozen images or camera shutdowns, DoS attacks and many others attacks from the  
Figure 8: Exploitation diagram for Cyber Kill Chain exploitation technique in a logically air-gapped network.  
Figure 9: Framework for identifying the security measures in Cyber Kill Chain attacks.  
cyber kill chain, machine learning (ML) techniques can be used, which are considered the most advanced and promising methods in detection. The research studies on using ML for detecting attacks in IoT in general are summarized in [53].