## 7 Discussion
### Major Security Threats and Attacks  
1. _DDoS attacks and defense mechanisms_: protocol-level flaws caused by a lack of sufficient security in the initial design are the main reason for flooding-based DDoS attacks. On the other hand, the main reason for zero-day flooding attacks is code-level vulnerabilities. Flooding-based attacks are easy to launch since the attacker only needs to create a large number of malicious packets, which can be provided through compromised distributed devices. However, zero-day attacks may not be very easy and common to launch since discovering zero-day vulnerabilities in a system demands highly sophisticated analysis. Nevertheless, launching a zero-day attack is still quite practical since it is difficult to avoid code-level vulnerabilities, especially in large systems with millions of lines of code. It is even harder to avoid such vulnerabilities in edge computing since edge devices are not usually built with strong security software to avoid high costs and have a better user experience. Countermeasures against DDoS attacks are still very limited. Per-packet-based detections (e.g., packet filters, firewalls, or some types of IDSs) against flooding-based attacks can be either bypassed using more advanced DDoS attacks that, for instance, exploit address spoofing or require maintaining a large list of authorized IP addresses that might need frequent changes. On the other hand, statistics-based detections (e.g., IDSs) can identify DDoS attacks only when groups of DDoS attacks have been sent to the target edge servers, which can cause irreparable damages. Zero-day DDoS attacks are even harder to detect and defend. Most of the offline detection countermeasures are not able to recognize the exact type or location of the vulnerabilities, and if the DDoS attack shellcodes are encrypted or intentionally modified, most of the real-time online defense mechanisms are barely able to discover the attacks. 2. _Side-channel attacks and defense mechanisms_: the main reason for side-channel attacks is hidden connections between publicly available side-channel data and sensitive data that should be protected [101]. Leaking of side-channel information is very common and unavoidable. With the advances in machine learning and deep learning, achieving a successful side-channel attack is becoming easier. Research shows that all kinds of side-channel attacks can be practically launched in edge computing [174]. Side-channel attacks are very difficult to defend since they can be launched silently and passively. Defense mechanisms such as data perturbation-based techniques (e.g., differential privacy) can be very effective and prevent attackers from deriving a user's sensitive data, but they may sacrifice the utility of the data [175], while there is still a tradeoff between privacy protection and data utility for some particular applications. In addition, defense mechanisms such as source code-level obfuscation and hardware protection directly manipulate or restrict access to side channels in order to provide protection; however, it is not possible to use these solutions for any piece of side-channel information, as most of this information is undetectable. Moreover, many of the existing countermeasures are still vulnerable to side-channel attacks [176; 177]. 3. _Malware injection attacks and defense mechanisms_: the main reason for server-side injections is protocol design flaws, while device-side injections mostly happen because of code-level design flaws, as well as the adoption of device-level coarse-grained access control [101]. Server-side injections are quite common and have been widely exploited in the industry. Even though device-side injections are not as common as those at the server-side, research shows that they can still be launched in practice. The defense mechanisms against server-side injections are mainly based on the detection filter philosophy, while code-level analysis for fine-grained access control and malicious behavior detection is mainly used to defend against device-side injections.