Reactive security of IoT communications

Abstract: IoT networks’ intrinsic vulnerabilities can be protected through intru- sion detection and response systems (IDRS). Anomaly-based intrusion detection offers multiple advantages: it can detect unknown attacks and it can adapt to multiple types of protocols. However, intrusion response is harder to carry out in combination with an anomaly-based detection system in part due to the possibility of false positive alerts. Through two implementations of IDRS in two distinct IoT networks, this thesis will highlight ways to improve anomaly-based detection and allow for appropriate response when possible. The results show that anomaly-based detection can be used in the case of a ZigBee IoT network to detect different types of attacks without previous knowl- edge of these attacks. Moreover, soft response methods that improve the quality of detection with a low impact on the IoT network behavior are achievable.