# An Efficient Framework for Securing the Smart City Communication Networks
## 3 Description of Our Proposed Cyber Security Framework for Smart Cities
### Cyber Attack Evaluation  
In this subsection, the analysis and evaluation of our proposed framework requires first to know the nature of the cyber attack. Because of this nature, malicious malware incorporates increasingly complex strategies. As a result, we undertook a more in-depth study of the harmful activities while computing the cyber attack score. The 12 phases of the MITRE ATT&CK were subjected to an analysis, and the findings are displayed.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Task Name** & **Phase Name** & **Start After** & **Source** & **Destination** \\ \hline \multirow{2}{*}{Authentication task} & Smart Meter to Control Center & Application Starts & Smart Meter & Control Center \\ \cline{2-5}  & Verify Control Centre & Previous Phase Ends & Smart Meter & Not Applicable \\ \hline \multirow{2}{*}{Encryption task} & Smart Meter to Control Center & Application Starts & Smart Meter & Control Center \\ \cline{2-5}  & Control Center to Smart Meter & Application Starts & Control Center & Smart Meter \\ \hline \hline \end{tabular}
\end{table}
Table 1: The phases’ configuration.  
Each layer, in Figure 4, depicts the steps of a cyber attack in MITRE ATT&CK. The flow of an attack is determined by the layer order. The red line demonstrates a link between a malicious code technique and the previous approaches used. The color of the blue plane indicates the cyber attack strategies at each level. Furthermore, the circle's hue shows the number of cyber attacks that have used it. For example, if there are five or more cyber attack kinds, the circle is dark brown; if there are three or four, it is orange; and if there are two or fewer, it is apricot [8; 22; 23].  
Due to these potential cyber attacks that may occur in smart city communication networks, we implemented and applied a man-in-the-middle (MITM) attack and network intrusion detection system (NIDS) in our proposed technique to validate and measure the security requirements maintaining the constrained resources.  
Signature-based systems (SBS) and anomaly-based systems (ABS) are examples of NIDS systems that can dynamically monitor and analyze system events to identify whether they are assaults or authorized accesses [24]. The goal of NIDS is to detect malicious behavior related to messages sent across the smart city communication network between a smart meter and the control center. Different sorts of assaults, such as replay and man-in-the-middle attacks, can be detected using the simultaneous network intrusion detection monitoring method. The given topology network is used to investigate the performance of the smart city wireless communication network by implementing authentication and session key exchange schemes, and also by preventing the man-in-the-middle attacks in order to measure our proposed security concerns over the smart city system.  
As seen in Figure 5, an MITM attack is characterized as follows: suppose entity \"A\" wants to monitor the messages sent by entity \"B\" as a smart meter to entity \"C\" as the control center server. A man-in-the-middle attack using keys can be conducted in this case to intercept messages between entities \"B\" and \"C\". Thereafter, the interceptor can replace the message and deceive entity \"A\". Entity \"A\" can be a mobile node observing data between a smart meter and a capturing device in the context of grid computing. Eavesdropping, replay attacks, and physical jamming attacks can all be treated in the same way as man-in-the-middle attacks. Consequently, Figure 6 shows how a man-in-the-middle attack can be detected and messages intercepted across the smart city communication network.  
Figure 4: Attack techniques of a fileless cyber attack [8].