# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 3 Approach
### IoT Based Smart Irrigation System Testbed
In this layer, the _TriggerActuatorToActuate_ process initiates actuator activation, which is simulated in the testbed using a buzzer that represents the irrigation valve. Communication from the Cloud to the Edge Layer also uses TCP to ensure reliable data transmission, whereas communication from the Edge to the Physical Layer uses UDP, favoring low-latency, lightweight messaging suitable for real-time actuation. The Application Layer hosts the _ShowAnalysisResult&TriggerDecision_ process, which provides a user-friendly interface for visualizing analysis outcomes and system decisions. This interface also supports manual control, allowing users to override or trigger actuators as needed. Data exchange between Cloud and Application Layers is conducted over the Hypertext Transfer Protocol (HTTP), enabling seamless web-based interaction. The Network Layer forms the foundational infrastructure of the system, comprising routers, Wi-Fi access points, and a network server responsible for managing traffic flow and facilitating end-to-end communication across all layers. To strengthen the system's resilience against cyberattacks and security threats, it is crucial to secure the communication channels between different layers of the IoT architecture. However, the inherent heterogeneity of IoT ecosystems--characterized by diverse devices, communication protocols, and varying security configurations--introduces vulnerabilities that adversaries can exploit to disrupt system operations. Addressing these risks requires embedding _security awareness_ into the system, enabling it to detect anomalous changes and assess their potential impact in accordance with the unique characteristics and operational constraints of each architectural component. In our IoT-based smart irrigation system testbed, we focus on uncertain and potentially disruptive events such as Distributed Denial of Service (DDoS) attacks to prevent seamless communication among different layers in the IoT architecture. To mitigate these threats, the testbed integrates a DL model that predicts potential DDoS attacks by analyzing critical attributes of network traffic. The _CollectNetworkTraffic_ process is responsible for capturing traffic data, extracting relevant features, and generating monitoring instances for further analysis. The testbed leverages the publicly available Edge-IIoTset dataset [54], a comprehensive and heterogeneous collection of IoT cybersecurity traffic data that spans multiple layers of IoT applications. This dataset includes both benign and malicious traffic and features a wide range of DDoS attack scenarios targeting protocols such as TCP, UDP, and HTTP. Within the testbed, the _CollectNetworkTraffic_ process is responsible for loading and preparing instances from the dataset for further analysis by the DL-based detection model. The _SendNetworkTrafficDataToCloud_ process then transmits the preprocessed instances to a deep learning model hosted in the Cloud Layer, where the data is analyzed and classified as either benign or malicious. This workflow is supported by a dedicated prediction pipeline, which comprises several processes--ranging from _ReceivedNetworkTrafficData_ to _GetDLModelPrediction_--as illustrated in Figure 1. The pipeline in Figure 1 represents the operational phase of the system, during which the model is deployed and the testbed is actively running. To ensure the adaptability and accuracy of predictions over time, we maintain separate retraining pipelines for both the pre-trained ML model (used to predict soil moisture) and the DL model (used to detect DDoS attacks). These pipelines use the latest batches of data for retraining. While not depicted in the process flow diagram for the sake of simplicity, these retraining routines are executed at regular intervals. Once retrained, the updated model artifacts are deployed to the _ExecuteMLModel_ and _ExecuteDLModel_ processes, respectively.