An empirical analysis of evolutionary computing approaches for IoT security assessment

1Introduction

Millions of individuals now rely on the Internet for a variety of purposes. Because of the advantages associated with the Internet, a new industry called the IoT is emerging, which allows items and devices to communicate and interact with one another through the availability of the Internet. The idea behind such technological innovation is to automate work and interconnect the devices we being used in our daily lives via the Internet. The rate at which electronic objects around us are hooked up to The internet is rapidly increasing. As per the latest Gartner report approximately 8.4 billion smart devices or things on the planet by 2020 will be deployed. This figure is expected to increase to 20.4 billion by the end of 2022. Machine-to-machine (M2M) interactions are projected to increase from 5.6 billion in 2016 to 27 billion in 2024.

Furthermore, many of these digital solutions enable users to consciously disclose some personal data in exchange for more innovative and personalised services. It follows that privacy and security should be prioritised in the configuration of IoT services and technologies. Sadly, this isn’t the scenario for many industrial IoT products, which have insufficient, inadequate, or poorly designed security policy.

We identify a few of the most well-known and dangerous real-world IoT-related attacks, vulnerabilities, impacts, and exploitation practises carried out by various hackers in recent years. The depiction of evaluated real-world attacks is explained in section 3. Despite conducting such a thorough investigation, there are still numerous imprecise, uncertain, or partially missing pieces of information, making it difficult to determine which factor or attack is the most threatening.

In order to more effectively resolve the ambiguity that often arises in pertinent information and best reflect the inherent fuzziness of human judgment and recommendation, fuzzy set theory has been used in developing ill-defined MCDM concern. MCDM is a technique that enables you to choose the best option from a list of predestined alternatives by weighing various criteria against it. In order to deal with ambiguity in a decision-making procedures and obtain the much more consistent outcome, it is suggested to apply two different MCDM methods, namely Analytic Hierarchy Process (AHP) and Analytic Network Process (ANP), with fuzzy sets.

In both academic research and commercial practise, the AHP has now been extensively used to resolve multiple-criteria decision-making issues (such as concept assessment and equipment procurement). However, a precise pair-wise correlation with a traditional AHP might not be able to fully capture the decision-judgment maker’s due to ambiguity and uncertainty in their assessment. To make up for this shortcoming in the traditional AHP, fuzzy logic is added to the pair-wise correlation in the AHP. F-AHP is the name given to this [1]. In F-ANP, the language evaluation is transformed into TFNs (triangular fuzzy numbers). In order to construct a pairwise comparison for the ANP, the TFNs have been used, and by employing extent assessment (Chan et al. 2003 [2], Chan 1999 [3]), it is possible to determine the weights for every attribute at each level. Weights are simpler to calculate in F-ANP than in traditional ANP. To deem the best application to choose, such weights could be combined [4]. In this paper, we use the F-ANP method to derive priorities from various kinds of undefined ratio scale assessments, therefore expanding the ANP’s capability for making decisions in the face of ambiguity. The novelty of the work is that we deeply investigated the real world IoT attacks and the digged out the seven important affected information security factors. For more refinement we have done critical risk assessment of the seven affected security factors via two well refined MCMD techniques. Our work presents the quantitative risk assessment instead of qualitative that was not done by the researchers before in this field. This quantitative approach provides the better assessment of risk in terms of weightage of the security factors which gives the clear understanding of the severity. The result of our assessment gives the quantitative insight to the researchers for future research work in this area.

The following are the key contributions of this work:

Fig. 1

Information security parameters.

2Related works

Various IoT-empowered attacks discovered across all application domains since 2010 were surveyed by the author. The author focuses on the most recent, verifiable IoT-enabled assaults for each industry, based on reported proof-of-concept attacks and documented real-world instances [5]. The authors investigated nine real-world security events that attacked IoT devices deployed in the consumer, industrial, and commercial sectors. And presents a taxonomy that offers a systematic approach for classifying attacks based on the compromised layer and associated impact [6]. The “value-focused thinking” strategy is adopted by the researcher to systematically determine IoT security goals and values from 58 IT specialists. They provide four core goals and thirteen means goals [7]. The author provides an Organizational Information Security Framework Regarding Human Aspects contributing to the IoT, which contains remedies that can assist avoid or mitigate data breach occurrences caused by human factors [8].

The multitude of IoT devices is increasing rapidly. The legal regime for ensuring data controller as well as processor adherence must be enhanced in order to provide a safer environment for emerging creative IoT products and services without jeopardising data subjects’ freedoms and rights. It is also critical to raise homeowners’ awareness of potential security risks while using smart and IoT services and devices [9].

The researcher focused on a comprehensive investigation of the most common methods of attacking commercial applications, as well as the commensurate literature studies, with the goal of providing a more efficacious, cyber-security-oriented strategy that would ultimately lead to a more adaptable industrial environment. The author’s major contribution is to dealing with commercial IoT technologies in general, with a major analysis on issues concerning cyber-attacks on industrial equipment, as well as the most recent mitigation strategies for the safety of the infrastructure in question, via a crucial and benchmarking schema [10].

The author demonstrates a short illustration of possible attacks on Bluetooth Low Energy (BLE) devices using several current tools to conduct spoofing, firmware assaults, and man in the middle (MITM) attacks. They also emphasised the necessity of privacy and security in BLE devices [25]. Author discusses numerous IoT security challenges such as IoT security framework, attack types, encryption challenges, authentication, and IoT hardware-based support [26].

In the research during 2004 and 2018, researchers analysed the types of threats that impact the firmware update process in IoT devices and the current secure firmware update techniques for IoT devices. A number of well-known firmware evaluation and vulnerability assessment tools are also included. They are certain that their study will enable researchers to create new defences for embedded devices by enabling firmware inspection, attacks, and security [27].

The idea of malware and botnets operating behind “Distributed” DoS in IoT is discussed by the author. The diverse DDoS defence strategies are thoroughly discussed and contrasted in order to pinpoint any security flaws. Additionally, researchers identify the unresolved problems and difficulties that must be overcome to improve DDoS prevention [28]. Researchers are working to address this discrepancy by thoroughly examining the issues and challenges related to IoT security. An in-depth review of IoT attack surfaces, security concerns, threat models, forensics, needs, and obstacles is provided by the researcher [29].

The author mentions their efforts to comprehend file less exploits on Linux-based Iot systems in the wild. They deployed four hardware IoT honeypots and 108 specifically developed software IoT honeypots over the course of a year, effectively attracting a wide range of real-world IoT threats. They discuss their measuring analysis on these attacks, focusing on file less attacks, including the prevalence, environments, exploits, and impacts. The research also yields multiple insights into effective defensive techniques that IoT providers and end users can implement [30].

The author provides a high-level overview of the security threats in the IoT sector and discusses some potential countermeasures. Then, describes and analyses some of the attacks against real IoT devices documented in the literature, highlighting the present security flaws of commercial IoT solutions and emphasising the significance of addressing security as an important component of IoT system design [31]. The author discovers that the Analytic Hierarchy Process (AHP) and approach for Order of Preference by Similarity to Ideal Solution (TOPSIS) hesitant fuzzy-based symmetry approach is an efficient methodology for analysing the endurance of online applications. The authors analysed the outputs of six distinct University projects to determine the level of accuracy of the results and their sensitivity [32].

Researchers deductively and inductively identify attack traits and measurements based on the most recent research and a collection of roughly 50 attacks. The author uses a real-world situation involving a German steel factory to illustrate the utility and practical significance of their taxonomy. [33]. K. Sahu et al. proposed a unique technique for selecting the optimal model of dependability prediction. The methodology is an amalgam of the AHP, hesitant fuzzy sets (HF), and the the technique for order of reference by similarity to ideal solution (TOPSIS) [34].

Ling Z. et al. provides an overview of IoT privacy and security as well as a case analysis. Their contribution is dual in nature. First, they show their end-to-end perspective of an IoT system. Second, they give a vulnerability assessment of the Edimax IP camera system using an end-to-end view of IoT privacy and security. Their real-world trials confirm the efficacy of the revealed attacks and increase the stakes for IoT makers once more [35]. The researcher was trying to figure out and rank different ways of handling security problems. They wanted to do this by going through two known approaches that people use when trying to analyze big data security. The author is currently using the Fuzzy AHP approach to see how much levels of priority matter in the realm of data security [36].

As per the outcomes of this study, sit may be possible to use F-ANP to obtain a distinct set of attributes that are more pertinent for assessing the importance of security attributes with respect to test plan parameters. This article reviews the information that was gathered from a range of experts who work in academia as well as industry. To assess the significance of particular security qualities, the efforts of such experts are subjected to a weighing and ranking procedure using a risk assessment plan formulation. As a result, F-ANP uses the evaluative contributions from a group of decision-makers to develop a network of security parameters including test plan criteria based on their level of significance or priority. Additionally, F-ANP has established a more precise relationship that enables the decision-makers to finish the priority evaluation.

3Expounding real world IoT attacks

We have considered some famous and critical real world IoT attacks of last few years. The illustration of considered real world attacks are tabulated in Table 1. These are just a couple of drops in an ocean of unprotected devices and gizmos in which we are all drowning.

4Risk assessment of encountered security parameters using MCDM techniques

The cases that are uncovered in section 3 bring to the fore the inherent security issues with IoT systems and show how such interconnected ecosystems might be vulnerable to attack. We investigate IoT-enabled cyber assaults found across all application areas. We focus on the most recent, certified IoT-enabled assaults in each industry, based on documented real-world instances and written proof-of-concept assaults. After extensive investigation, we found that several information security factors were affected, which are as follows: Confidentiality, Integrity, Availability, Privacy, Access Control, Authorization and Non-Repudiation. We accord a complete attack assessment on IoT devices, as well as their extant threat scenario.

To enhance the accuracy and acceptability of the evaluation, the risk assessment of encountered security factors was performed using two distinct MCDM techniques, namely F-AHP and F-ANP. Now the MCDM methodologies are employed and all the encountered security factors are mapped to respective variables to make the calculation easier and effective. The mapping of the security factors is illustrated as follows: Availability as S1, Access control as S2, Confidentiality as S3, Integrity as S4, Privacy as S5, Authorization as S6 and Non-Repudiation as S7.

4.2Fuzzy Analytic Network Process (F-ANP)

The ANP provides the most exhaustive framework for analysing social, corporate and governmental decisions available to decision-makers today. It is an approach that enables one to consider all of the tangible and intangible variables and factors that have an impact on making the optimal option. The ANP permits feedback and interaction both within and across clusters of elements (both inner dependence and outer dependence). Such feedback best depicts the complex consequences of human society’s interplay, primarily when both risk and uncertainty are present [43].

The first component of an ANP model is a control sequence or network of key targets and criterion that control the communications in the system under investigation; the second component is a number of sub-networks of interactions among the problem’s elements and clusters, one for every control criterion. The Global priorities of affected security factors is given below in Table 9 and the data used in the matrix has been collected from the experts of industries as well as academicians.

Table 9

Global priorities of affected security factors

Security Factors	S1	S2	S3	S4	S5	S6	S7	Weightage
S1	1	1.529	0.598	2.311	2.414	2.093	0.639	0.183922
S2	0.654022	1	1.474	0.96	1.859	1.523	2.2	0.168352
S3	1.67224	0.678426	1	1.343	2.336	0.427	1.816	0.164648
S4	0.432713	1.04167	0.744602	1	1.928	1.081	1.639	0.134153
S5	0.41425	0.537924	0.428082	0.518672	1	1.535	1.489	0.100619
S6	0.477783	0.656599	2.34192	0.925069	0.651466	1	0.511	0.12351
S7	1.56495	0.454545	0.550661	0.610128	0.671592	1.95695	1	0.124795

Table 10

Supermatrix formed by local priorities vectors

Security Factors	S1	S2	S3	S4	S5	S6	S7
S1	1	0.2577	0.1257	0.1984	0.2256	0.2998	0.2099
S2	0.3020	1	0.2959	0.2451	0.2789	0.2449	0.2119
S3	0.2667	0.2005	1	0.2291	0.1661	0.2323	0.2323
S4	0.2499	0.2266	0.2229	1	0.1408	0.0701	0.1272
S5	0.1617	0.1580	0.0991	0.2056	1	0.0605	0.0555
S6	0.0877	0.0737	0.0322	0.0877	0.0674	1	0. 1913
S7	0	0	0.2304	0	0.1514	0.1117	1

Table 11

Weighted supermatrix

Security Factors	S1	S2	S3	S4	S5	S6	S7
S1	0.5000	0.1433	0.0560	0.1458	0.1192	0.1630	0.1214
S2	0.1471	0.5000	0.1641	0.1267	0.1414	0.1112	0.1122
S3	0.1548	0.1243	0.5000	0.1170	0.0759	0.2211	0.1100
S4	0.1142	0.1141	0.1210	0.5000	0.0647	0.0315	0.0557
S5	0.0587	0.0786	0.0454	0.0828	0.0493	0.0354	0.0547
S6	0.0339	0.0501	0.0115	0.0451	0.0369	0.5000	0.0912
S7	0	0	0.1212	0	0.0688	0.0549	0.5000

Table 12

Limit supermatrix

Security Factors	S1	S2	S3	S4	S5	S6	S7
S1	0.1759	0.1759	0.1759	0.1759	0.1759	0.1759	0.1759
S2	0.2272	0.2272	0.2271	0.2272	0.2271	0.2272	0.2272
S3	0.1799	0.1798	0.1799	0.1799	0.1799	0.1798	0.1799
S4	0.1726	0.1726	0.1726	0.1725	0.1726	0.1726	0.1726
S5	0.1006	0.1006	0.1006	0.1005	0.1006	0.1006	0.1006
S6	0.0786	0.0786	0.0785	0.0786	0.0786	0.0785	0.0786
S7	0.0652	0.0652	0.0652	0.0652	0.0652	0.0652	0.0652

4.2.1Supermatrix

The initial step in ANP is to evaluate the criteria throughout the entire system in order to construct the supermatrix. It is accomplished by pair - wise comparisons by asking, “How important is a criterion in contrast towards another criterion in terms of our preferences or desires?” The relative relevance value can be calculated using a level of 1–9, with 1 representing equal importance and 9 representing great importance. We envisage that network model is made up of Hierarchy P _h  (k = 1, 2, . . . . . i). For every hierarchy, P assumes that elements d _h1, d2, . . . . . . , d _hi exists, so the impact of P _h  = (k = 1, 2, . . . . . i) can be represented as follows:

                   P1    P2   …     PiM=P1P2⋮Pi[M11M12...M1iM21M22...M2i⋮⋮⋱⋮Mi1Mi2...Mii]

Table 13

Comparision of results

Security factors	Global priorities by F-AHP	Global priorities by F-ANP
Availability (S1)	18.88%	17.59%
Access control (S2)	21.66%	22.72%
Confidentiality (S3)	18.52%	17.99%
Integrity (S4)	16.19%	17.26%
Privacy (S5)	11.17%	10.06%
Authorization (S6)	7.18%	7.86%
Non-Repudiation (S7)	6.41%	6.52%

Which is the basic form of the supermatrix. represents the impact of every element of the m hierarchy on the n hierarchy, which is known as a block of a supermatrix, and has the following form: Mmn=[Mm1n1Mm1n2...Mm1njnMm2n1Mm2n2...Mm2njn⋮⋮⋱⋮Mmj1n1Mmj2n2...Mmjmnjn]

4.2.2Weighted supermatrix

A supermatrix can be used to express the priorities of components in one hierarchy based on a specific criterion, which means that each and every column of each hierarchy with in supermatrix is column stochastic. The effect of other hierarchies, however, is unaffected by this criterion. As a possible consequence, the supermatrix’s columns are not stochastic. It is crucial to take into account the influence of each hierarchy on the other. The process involves treating each hierarchy like an element, doing pairwise comparisons with respect to each hierarchy, and determining the relevant priorities. Assuming that b _mn represents the weighted influence of the m hierarchy over the n hierarchy, let M¯=bmnMmn......(8) M¯ is denoted as a weighted supermatrix. The sum of the elements within every column of a weighted supermatrix is 1. This characteristic of a matrix is known as column stochastic [49]. To make sure that the total probability of all states implies 1, this step is quite identical to the Markov’s chain idea.

4.2.3Limited supermatrix

We wish to get the priority along each potential path in a supermatrix, or the final impact an element has on the top aim. This type of result can be obtained by solving M¯∞ , M¯∞=limh→∞M¯h...(9)

The weighted supermatrix is created to limiting powers, as shown in (9) to provide the global priority vector, often known as weights.

Fig. 2

Comparison of global priorities of the affected security factors.

5Comparison of results obtained by MCDM techniques

MCDM techniques are used to evaluate and select alternatives based on multiple criteria. There are several MCDM techniques available, each with its strengths and weaknesses. Here are some general comparisons of the results obtained by some commonly used MCDM techniques. When it comes to global priorities, F-AHP and F-ANP are commonly used MCDM techniques to evaluate alternatives based on multiple criteria. Overall, the choice of MCDM technique depends on the problem, the available data, and the preferences of decision-makers. In Table 14, the results obtained by the F-ANP and F-AHP in terms of Global Priorities of security factors are compared. Further the comparison of proposed work is also done with the various existing approaches where the proposed work endorse the transcendent over the existing approaches in terms of number of targeted security factors for severity evaluation.

6Discussion and future research direction

The proliferation of smart, linked, and inherently insecure gadgets is altering the security landscape. Alternative strategies must be developed in addition to the clear legal structure that will be needed to accommodate the IoT technological shift.

The reason for the rising number of IoT gadgets appears to be that they offer convenience to humans and execute activities more efficiently than humans. Existing as well as forthcoming IoT solutions are highly promising in terms of increasing user comfort, efficiency, and automation. To be capable of implementing such a realm in an ever-increasing fashion, high security, privacy, authentication, and attack recovery are required. In this reference, it is critical to make the necessary modifications in the architectural style of IoT systems in order to achieve end-to-end impregnable IoT habitat.

Attacks against resource-constrained IoT systems have increased in recent years. Security breaches in IoT technologies employed in both industrial (e.g., actuators and sensors) and residential environments are constantly being revealed (e.g. implantable medical devices, home appliances, etc). Faults and malfunction in faulty hardware chips, software applications, and easily tampered devices are exacerbating the current situation.

Moreover, we have classified IoT-related security flaws, exploitation practices, attacks, and their implications via real-world cyber incidents that address IoT gadgets installed in the industrial, consumer, and commercial sectors. These (and several other) mishaps emphasize the underpinning security issues of IoT systems and illustrate the potential attack effects of such integrated ecosystems, whereas the calculated priorities of affected security factors obtained after the assessment procedure using two different MCDM methodologies, which delivers a more appropriate way to classify attacks based on the affected security factors and their corresponding impacts.

7Conclusion

In the era of intelligent devices, IoT has expanded rapidly. A wide range of industries, including hospitals, enterprises, and farming, are heavily utilising the rapidly evolving smart gadgets, such as grids and sensors. Consumers are exposed to a wide range of security vulnerabilities because there are so many Devices connected to the internet in use. It is critical to recognize the risks that endanger the distinctive infrastructures as well as endow confidentiality of the data due to the number of threats that are escalating in the constantly evolving IoT environment and the concurrent inability of conventional security systems to recognize serious threats of intensifying depth and duration. In this paper, we demonstrate attacks/vulnerabilities of real-world IoT attack and also tabulated the impacted information security factors associated with varied vulnerabilities to concerned event in Table 1. Furthermore, the risk assessment of encountered security factors was performed by using two distinct MCDM methodologies i.e. F-AHP and F-ANP, to make assessment more accurate and appropriate. After analyzing the Global Priorities, we identify that the information security factor positioned at S2 i.e. Access Control is the most affected factor having global priority of 21.66% and 22.72% by F-AHP and F-ANP respectively among the existing factors affected in the encountered attacks/vulnerabilities and the information security factor positioned at S7 i.e. Non-Repudiation is the least affected factor having global priority of 6.41% and 6.52% by F-AHP and F-ANP respectively.

Author contributions

All authors contributed equally.

Data availability

Authors confirm that the data supporting the findings of this study are available within the article.

Declarations