## 2 Theoretical Background
### IoT Architecture in Wireless Sensor Network
Intermediate-level IoT security concerns the communication, routing, and session management occurring at the network and transport layers in the TCP/IP model. Both layers are vulnerable to a variety of attacks. This type of attack involves re-routing all  
Figure 2: Architecture layer of IoT scheme. traffic to a compromised node that appears to be a real node. The consequence is that an adversary can disrupt the flow of traffic by modifying routing information [15]. * Sinkhole Attack: This is considered a common type of active network layer attack in which an adversary node modifies routing packets and informs neighbor nodes of a false shortest path to a cluster or base node, making other nodes route their traffic through it. The consequence of this type of attack over the network is increased latency. A sinkhole attack is a severe threat to WSN, and most WSN routing protocols are incapable of detecting it [16; 17];
* Wormhole Attack: This is a form of layer three attack that employs more than one malicious node. The nodes utilized in this assault are more powerful than average ones, making it possible for them to set up more reliable long-distance communication channels. The goal of this assault is to forward the data from a hacked node through a tunnel to a second malicious node farther down the network. This type of attack causes issues with the WSN's routing algorithm since it tricks other nodes into thinking they're closer to other nodes than they actually are. Data packets could also be tampered with by infected nodes. This form of assault is similar to the sinkhole attack in that one of the conniving nodes could falsely be represented as the sink node, attracting more traffic than usual. Wormhole attacks can be used with sinkhole assaults to increase their effectiveness [18];
* Clone ID and Sybil Attacks: Attackers use clone IDs to compromise another node by transferring the identities of legitimate nodes. This can be used for a variety of purposes, including bypassing voting restrictions, and gaining access to otherwise inaccessible areas of the network. Sybil attacks, which are similar to clone ID attacks, involve the deployment of many logical entities on a single physical node. Sybil attacks allow for the takeover of huge portions of a network without the need to physically deploy any nodes [19]. * High-level security issues such as overwhelm, repudiation, data corruption, and malicious code injection are all examples of attacks that can be carried out at the application layer. The assault causes excessive energy consumption across nodes and uses up all available network bandwidth [16]. * CoAP security: In order to enable effective application-level communication for Internet of Things devices, the Constrained Application Protocol (CoAP) has been created as a protocol that operates over UDP. CoAP messages typically contain instructions for the nodes to carry out a particular activity. Replaying these messages has the potential to alter the behavior of the nodes in the 6 LoWPAN. In the absence of filtering, the replayed packet has the potential to have a significant impact on the performance of the network, with effects comparable to those that result from flooding attacks [20];
* Middleware security: The IoT middleware developed to enable communication across heterogeneous IoT entities must be safe enough to provide services. To keep communications private and secure, there must be a number of different interfaces and environments that use middleware [3].