Invisible and forgotten: Zero-day blooms in the IoT

Abstract

In the IoT, massive distribution and long physical lifetimes will disrupt the "penetrate and patch" security paradigm that helps mitigate the consequences of the vulnerabilities endemic in individual systems. In this paper, we examine what will happen in the IoT if we build its systems the same way. We collect data and model the vulnerability blooms and patching delays in historical systems. We present the models and discuss future IoT networks where similar blooms happen but patching does not. We discuss initial results, and our plans to extend the models to look more deeply at these questions in our future work.

Security challenges in internet of things: Distributed denial of service attack detection using support vector machine‐based expert systems

“…Recent events 8,9 shows that hijacked IoT devices used to attack the DNS infrastructure and Mirai malware did serious damage by compromising IoT devices worldwide. 10 SDN is used to refer to network architecture, where a separate controller controls the packet forwarding operations performed on network devices.…”

A blockchain-based smart home gateway architecture for preventing data forgery

“…ZeroDay Attack: Zero-day attack is a technique that attacks when a patch for a software vulnerability is not available [37]. Because of the lack of countermeasures possible against such vulnerabilities, such attacks cannot be prevented, and any device Blockchain 51% Attack: It is a hacking attack that attempts to profit by manipulating transaction information after securing more than 50% of the hash nodes of the entire blockchain nodes [38].…”

A Consensus Framework for Reliability and Mitigation of Zero-Day Attacks in IoT

“…In some cases, these attacks are launched covertly once a bug is identified, while, in other cases, hackers may lead to an overt operation by publicizing over different domains [70,71]. Thus, it is evident that not only do hackers lead to zero-day attacks, but also the delays in updating of security mechanisms also cause possibilities of zero-day attacks.…”

“…The life cycle of zero-day attacks is studied with "Window of Vulnerability" (WoV). It is evaluated as a software timeline considering the discovery phase, security patching, intermediate exploitation phase, and patch applicability phase, as shown in Figure 1 [52,70,72].…”