IEEE - 56998

Securing the Future of IoT: A Comprehensive

2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT) | 979-8-3503-3509-5/23/$31.00 ©2023 IEEE | DOI: 10.1109/ICCCNT56998.2023.10307306

Framework for Real-Time Attack Detection and

Mitigation in IoT Networks
Aviral Srivastava Usha Jain*
Amity School of engineering and technology Department of Computer Science and Engineering,
Amity University Rajasthan Manipal University Jaipur, Jaipur,
Jaipur, India India
[email protected] [email protected]
ORCID:- 0000-0002-6724-4662 ORCID:- 0000-0002-6333-8426

Abstract—Increased security complexity and variety come 1.2 Secure IoT networks
with IoT devices. Existing security solutions generally fail to
handle multiple difficulties, particularly in real-time attack The relentless growth of IoT necessitates network security.
detection and response. This research introduces a novel, IoT networks are vulnerable to several cyberattacks due to the
comprehensive architecture that synergistically incorporates complex network of interconnected devices. Unaddressed risks
various cutting-edge security measures to protect IoT networks may lead to data breaches, privacy violations, and vital
from all cyber threats. The proposed framework incorporates infrastructure disruptions. These security incidents can result in
NodeMCU ESP8266-based real-time response, safe boot, brand damage and regulatory penalties, thus underlining the
hardware-based security modules, and zero trust architecture. It necessity for robust IoT network security.[11]
recommends incorporating blockchain for security, real-time
logging and monitoring, machine learning-assisted intrusion
detection, and indicators of compromise (IOCs) for incident 1.3 Real-time attack detection and mitigation
response. For improved malware analysis and threat mitigation,
integration of APIs for smooth communication with third-party Advanced security solutions are needed for real-time attack
services such as VirusTotal and Hybrid Analyzer is suggested. detection and mitigation due to the rapidly changing threat
This paper also discusses data encryption, updates and patching, landscape and the complexity of IoT systems. Traditional
identity and access management, risk assessment and threat security procedures generally fall short in solving many IoT
modelling, incident response and recovery, and privacy. This network difficulties, thereby highlighting the need for
holistic approach to IoT security provides a robust, flexible, and innovative approaches that can swiftly identify and neutralise
scalable framework to address the changing threat landscape and threats. Real-time solutions can help mitigate threats and speed
growing complexity of IoT ecosystems. The proposed methodology up cleanup, improving IoT network resilience. The study
defends IoT networks against sophisticated cyberattacks through presented here provides a comprehensive framework that
careful analysis and empirical validation. In an increasingly combines advanced technologies and approaches for real-time
interconnected world, this research could be useful for
attack detection and mitigation in IoT networks, contributing to
practitioners, academics, and stakeholders aiming to strengthen
IoT infrastructure resilience.
the knowledge base in this critical field.

Keywords—Internet of Things (IoT), Network Security, Machine

Learning, Blockchain, Intrusion Detection, Secure Boot II. LITERATURE REVIEW

I. INTRODUCTION
Researchers have been exploring a variety of different ways for
attack detection and mitigation as a result of the ever-increasing
1.1 IoT adoption background complexity of IoT security. Gelenbe et al. (2020) [1] proposed
The Internet of Things (IoT) has experienced rapid growth a system for the detection and mitigation of Internet of Things
in industry, healthcare, transportation, and smart homes. The (IoT) network attacks. They emphasized the significance of
efficiency, automation, and data-driven decision-making constant monitoring and learning for the protection of
capabilities of IoT devices drive their adoption. Billions of IoT networks. The results of their work provide a basis for
devices are expected to be connected by the end of the decade, comprehending the fundamental aspects that make up an
creating a deeply networked environment.[10] efficient Internet of Things security framework.

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India
 IEEE - 56998

Detecting and protecting against distributed denial-of-service III. CORE COMPONENTS OF THE PROPOSED FRAMEWORK
(DDoS) assaults in IoT networks has been accomplished with
the application of adaptive machine learning. Aslam et al. 3.1 NodeMCU-ESP8266 real-time reaction
(2022) [2] presented a system for SDN-enabled IoT that relies
on adaptive machine learning approaches to recognize and Benefits and implementation:
address DDoS threats. This system was developed for the Enabled by the NodeMCU ESP8266, a low-cost microcontroller
Internet of Things. Their work sheds light on the potential of with Wi-Fi, real-time reaction involves constant monitoring of
machine learning to enhance the security solutions for the network traffic for anomalies potentially indicating attacks.
internet of things. Upon detecting suspicious behaviour, the NodeMCU ESP8266
sends deauthentication messages to disconnect the potentially
Computing at the edge of the network has also been compromised IoT device from the network. This action isolates
investigated for use in the detection and mitigation of DDoS the device, preventing contagion and limiting network
attacks. An Internet of Things (IoT)-based DDoS attack propagation by the attacker. A real-time reaction based on the
detection and mitigation system employing the edge of NodeMCU ESP8266 offers several advantages. Rapid response
software-defined networking (SDN) was proposed by Yang et to new threats minimizes security incidents and expedites
al. (2019) [3]. The authors emphasized the importance that edge remediation. Additionally, the NodeMCU ESP8266 negates the
computing plays in alleviating the burden of network security need for expensive hardware or network infrastructure
and boosting the overall system performance. modifications, rendering the solution cost-effective and simple
to deploy. Restrictions and Improvements: Despite its
advantages, a real-time response based on NodeMCU ESP8266
Mihoub et al. (2022) [4] conducted research on the application
has certain limitations. Advanced attackers can evade detection,
of looking-back-enabled machine learning algorithms in
rendering real-time reaction ineffective. Deauthentication
Internet of Things environments with the goal of detecting and packets may also fail to address IoT device software or firmware
mitigating denial of service (DoS) attacks. Their technique vulnerabilities. Enhancements to the NodeMCU ESP8266 could
highlights the value of adding machine learning into Internet of involve integrating machine learning techniques to detect even
Things security frameworks in order to improve attack the most elusive threats. Incorporation of real-time response,
detection and mitigation. secure boot, and hardware-based security could reinforce the
overall foundation.
For dynamically detecting and mitigating DoS attacks in the
IoT, prototypes based on SDN have been created. An SDN- 3.2 Secure boot
based system was shown by Binu et al. (2021), [5] and it Validating firmware and software:
demonstrated the promise of software-defined networking to
improve the security of the internet of things by providing The proposed framework emphasizes the importance of
secure boot for verification of firmware and software in IoT
attack mitigation measures that are both more effective and
devices during the boot process. Secure boot authenticates
more flexible. firmware and software using cryptographic signatures. If an
anomaly is identified, the device may be prevented from booting
Using an SDN-cloud architecture, Ravi and Shalinie (2020) [6] or restored to a known-good state, thereby protecting the IoT
suggested a learning-driven detection and mitigation solution network from compromised devices.
for Distributed Denial of Service attacks in the Internet of
Things (IoT). Their research highlighted the advantages of Preventing Unauthorized Changes:
combining SDN with cloud computing for the development of Secure boot employs cryptographic keys, digital signatures, and
IoT security solutions that are both more robust and scalable. certificate authority to inhibit firmware and software changes. It
establishes a chain of trust to authenticate and verify each stage
Patel (2023) [7] created an attack detection and mitigation of the boot process, culminating in application software
technique utilising a novel authentication model made possible validation. This rigorous approach safeguards IoT devices
by an optimised neural network. This scheme was applied to the against firmware or software threats.
context of smart healthcare. Their research emphasises the 3.3 Hardware-based security
importance of domain-specific security considerations as well
as the application of advanced security solutions in specialised Hardware security modules:
Internet of Things contexts. Hardware-based security techniques, integral to the
framework, are employed to defend IoT devices from attacks.
These studies collectively highlight how important it is to Hardware Security Modules (HSMs) provide secure, tamper-
improve the security of the internet of things by utilising more resistant storage for sensitive data including encryption keys and
complex methods, cutting-edge technologies, and solutions that digital certificates. By segregating crucial cryptographic
are relevant to particular domains. In order to deliver an all- activities in the HSM, the system mitigates the risk of IoT device
encompassing, rock-solid, and upgradable security solution for data theft.
Internet of Things networks, the framework that we have
Tamper-resistant storage and secure cryptographic
presented builds on these findings.
operations:
Identify applicable funding agency here. If none, delete this text box.

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India
 IEEE - 56998

HSMs provide cryptographic and secure storage benefits. IV. INTEGRATION OF CUTTING-EDGE TECHNOLOGIES
Firstly, tamper-resistant features detect and respond to physical
or environmental tampering attempts, protecting crucial data
4.1 Blockchain for enhanced security
even against determined adversaries. Secondly, HSMs offer a
variety of cryptographic techniques for secure encryption, Blockchain technology is integrated into the framework to
decryption, signing, and verification. Inclusion of HSMs in the bolster IoT network security. The architecture secures IoT data
IoT security architecture guards’ crucial data and cryptographic exchanges through a decentralized, immutable ledger.
operations, making success of insecure implementations or Consensus methods and cryptography inherent in blockchain
storage vulnerabilities less likely. technology prevent data tampering and falsification, thereby
fostering trust and transparency among network nodes.[9]
3.4 Zero trust architecture
4.2 Real-time logging and monitoring
Benefits and principles:
Real-time logging and monitoring become crucial for detecting
Zero Trust Architecture (ZTA) operates under the
and analysing emerging risks. By carefully monitoring network
assumption that no entity, whether internal or external, should
traffic, system events, and user activity, the framework can
be trusted. Accordingly, every access attempt requires
identify potentially harmful patterns. This exhaustive approach
validation, authorization, and monitoring. This comprehensive
facilitates swift response and clean-up, mitigating security
security paradigm replaces the perimeter-centric model, where
incident damage and providing valuable insights for enhancing
internal resources are trusted, with a more detailed, context-
security measures.[13]
aware model accounting for the increasing porousness of
modern networks. Implementation of a zero-trust design 4.3 Machine-learning-assisted intrusion detection
enhances IoT networks in several ways. Firstly, rigorous access
controls and segmentation of network resources minimize the Intrusion detection capabilities of the framework are augmented
risk of unauthorized access and lateral movement. Secondly, it by machine learning algorithms. Capable of processing vast
enables real-time security adjustments to evolving threats. amounts of data, these sophisticated algorithms can identify
Lastly, a zero trust architecture promotes continuous evaluation subtle correlations and anomalies that could be overlooked by
and improvement of security by organizations. rule-based detection methods. Machine learning-assisted
intrusion detection systems continuously refine their models,
Implementation issues: thereby enabling adaptive responses to evolving threats.[12]
Despite its benefits, implementation of a zero-trust architecture 4.4 Indicators of compromise (IOCs) for swift incident response
may present challenges. Firstly, deployment of a zero-trust
architecture can be complex and expensive, especially for large Indicators of compromise (IOCs) serve to expedite incident
IoT networks. Secondly, integrating zero trust-incompatible response within the proposed framework. Unusual network
legacy systems and devices can prove challenging. A phased traffic, unauthorized access attempts, and suspicious file
approach to zero trust adoption, starting with prioritizing key alterations serve as IOCs, signifying potential security
assets and gradually expanding the infrastructure, can address vulnerabilities. By establishing a comprehensive repository of
these concerns. Software-defined networking (SDN) and IOCs and integrating them into the framework's detection
network function virtualization (NFV) can simplify the algorithms, the incident response team can rapidly identify and
implementation and management of a zero-trust architecture. neutralise threats, thereby reducing security incidents and
Until compatibility with zero trust is achieved, legacy systems accelerating recovery.
may necessitate compensatory controls such as network Collaboration APIs
segmentation or intrusion detection systems.
1. VirusTotal
The proposed framework leverages APIs to facilitate
collaboration with third-party services, thus enhancing security.
VirusTotal, a malware analysis platform, amalgamates the
scanning capabilities of multiple antivirus engines. Suspicious
files can be swiftly verified for potential threats by submitting
them to VirusTotal through APIs, thereby leveraging the
collective strength of multiple antivirus engines for improved
malware detection within the framework.
2.Hybrid Analyzer
Hybrid Analyzer, a sophisticated malware analysis tool, is also
compatible with the framework. Suspected malware samples
can be transmitted to Hybrid Analyzer via APIs, enabling the
Fig 1. core componentS listed along with its subpoints framework to gain insights into malware activities,
communication patterns, and persistence mechanisms. These
insights can be utilized by the security operations center (SOC)
staff to devise effective containment and remediation

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India
 IEEE - 56998

procedures, thereby strengthening the cyber resilience of the alterations should obstruct booting or initiate reset to a
framework. known-good state.
3. Hardware-Based Security: Deploy hardware security
modules (HSMs) for storing encryption keys in IoT
devices. HSMs should secure cryptographic operations
to safeguard sensitive data.
4. Zero Trust Architecture: Implement least privilege
access and micro-segmentation to establish a zero trust
IoT network. This necessitates the authentication and
authorization of every access request, irrespective of its
origin, and granting network access solely based on the
least privilege principle. For maintaining security, real-
time risk assessments and continuous scrutiny of
access requests are essential.

5.2 Integrating Cutting-Edge Technologies

1. Deploy blockchain technology to devise a
decentralized, tamper-resistant ledger for IoT data
transfers. Cryptographic hashing and consensus
algorithms ensure data integrity and immutability.
2. Real-Time Logging and Monitoring: Use centralized
systems for tracking and analyzing IoT network
activity. Ensure secure log storage and real-time
monitoring to timely detect and respond to threats.
3. Machine Learning-Assisted Intrusion Detection:
Deploy machine learning techniques for identifying
complex IoT network attack patterns and anomalies.
Fig 2. High-level architecture overview Train these algorithms on past network data to
recognize threats and adapt to evolving risks.

V. IMPLEMENTATION OF THE COMPREHENSIVE IOT SECURITY 4. Indicators of Compromise (IOCs) for Rapid Incident
Response: Devise a comprehensive incident response
FRAMEWORK
plan incorporating IOCs for swift detection and
response to security breaches. Automate network
This section delineates the integration of fundamental segment isolation using the NodeMCU ESP8266
components and state-of-the-art technology into the proposed module and alert the Security Operations Center (SOC)
IoT security architecture. Following these procedures, and forensics teams.
organizations can construct a robust and secure IoT architecture 5. APIs for Third-Party Services: Incorporate VirusTotal
that mitigates cyber threats and ensures integrity and availability and Hybrid Analyzer into the IoT security framework
of IoT devices and data.[14] via APIs. These services scan suspicious files and
provide malware analysis reports, aiding SOC teams.
The amalgamation of these core components and
5.1 Implementing Core Components advanced technology culminates in a comprehensive
and secure IoT architecture capable of resisting a
1. NodeMCU ESP8266-based Real-Time Response:
multitude of cyber threats. This architecture fortifies
Instruct the module to scrutinize network traffic and
IoT networks and preserves device and data integrity,
identify suspicious activity. Upon detection, the
confidentiality, and availability at all times.
module should initiate deauthentication packets to
disconnect affected devices from the network. For These fundamental components and cutting-edge
identifying advanced attacks and bypass methods, technology can create a complete and secure IoT architecture
deploy machine learning algorithms. that can withstand a variety of cyber threats. This architecture
secures IoT networks and maintains device and data integrity,
2. Secure Boot: During secure boot, ensure integrity
confidentiality, and availability always.
check of firmware and software on all networked IoT
devices. Implement a method for cryptographic
signature verification that compares existing firmware
and software to a trusted reference. Any unauthorized

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India
 IEEE - 56998

2. Machine Learning-Assisted Intrusion Detection and

Indicators of Compromise (IOCs): Machine learning
methodologies bolster intrusion detection systems in
identifying complex attack patterns and anomalies.
When these sophisticated detection capabilities are
combined with IOCs, they trigger the NodeMCU
ESP8266 module to segregate network segments and
relay incident information to the security operations
center (SOC) and forensics teams.
3. APIs and Integration of Third-Party Services: APIs
facilitate the integration of third-party services like
VirusTotal and Hybrid Analyzer into the IoT security
architecture, adding layers of protection. These
services have the capability to scan suspicious files,
Fig 3. NodeMCU ESP8266-based real-time response provide malware analysis reports, and assist SOC
teams, thereby enhancing incident response.[8]
VI. METHODOLOGY: SYNERGY OF COMPONENTS FOR A SECURE
IOT ARCHITECTURE 6.3 Unified Operation of Comprehensive IoT Security
Framework
This section elucidates how the components of the framework
collaboratively construct a secure and resilient IoT architecture. The harmonious operation of the proposed IoT security
By comprehending these dynamics, organizations can bolster framework provides holistic protection against cyber threats.
their security strategy and safeguard their IoT networks against IoT security is primarily governed by the NodeMCU ESP8266
escalating cyber threats. module, secure boot, hardware-based security, and zero trust
architecture. These elements are fortified by blockchain
6.1 Collaborative Functioning of Core Components technology, real-time logging and monitoring, machine
learning-assisted intrusion detection, IOCs, and the integration
1. NodeMCU ESP8266-based Real-Time Response and of third-party services. This collaborative approach constructs
Secure Boot: These two elements constitute a a resilient and secure IoT infrastructure that shields devices and
comprehensive defense mechanism. The NodeMCU data from cyberattacks. This synergistic approach safeguards
ESP8266 module constantly scrutinizes network the IoT ecosystem and aids organizations in navigating the
traffic for suspicious activities and isolates ever-evolving cybersecurity landscape.
compromised devices in real time, thereby mitigating
potential threats. The Secure Boot process ensures that
IoT devices operate solely with validated firmware
and applications.
2. Hardware-Based Security and Zero Trust
Architecture: Hardware Security Modules (HSMs)
protect cryptographic operations and sensitive data
storage. The security of cryptographic keys and
authentication credentials provided by HSMs
enhances the security of the IoT network. Meanwhile,
the zero trust architecture demands stringent
authentication and authorization for all access
requests.

6.2 Integration and Synergy of Cutting-Edge Technologies

1. Blockchain and Real-Time Logging and Monitoring:

The amalgamation of blockchain technology with
real-time logging and monitoring solutions ensure data
integrity and transparency within the network. The
decentralized, tamper-proof nature of blockchain
guarantees the validity and immutability of IoT data
exchanges, while real-time logging and monitoring
solutions facilitate visibility into network activities
and enable threat detection. Fig 4. Zero trust architecture implementation

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India
 IEEE - 56998

VII. CONSLUSION [2] M. Aslam et al., "Adaptive machine learning based distributed denial-of-
services attacks detection and mitigation system for SDN-enabled iot," Sensors,
vol. 22, no. 7, p. 2697, 2022.
The rapid proliferation of IoT devices and their increasing [3] Y. Yang et al., "IoT-based DDoS attack detection and mitigation using the
adoption across various sectors have underscored the critical edge of SDN," Cyberspace Safety and Security: 11th International Symposium,
need for robust and comprehensive security frameworks. This CSS 2019, Guangzhou, China, December 1–3, 2019, Proceedings, Part II,
Springer International Publishing, 2019.
research paper presented a multifaceted IoT security
[4] A. Mihoub et al., "Denial of service attack detection and mitigation for
architecture, incorporating core components such as NodeMCU internet of things using looking-back-enabled machine learning techniques,"
ESP8266-based real-time response, secure boot, hardware- Computers & Electrical Engineering, vol. 98, p. 107716, 2022.
based security, and zero trust principles, as well as cutting-edge [5] P. K. Binu, D. Mohan, and E. M. S. Haridas, "An sdn-based prototype for
technologies such as blockchain, real-time logging and dynamic detection and mitigation of dos attacks in iot," 2021 Third
monitoring, machine learning-assisted intrusion detection, International Conference on Inventive Research in Computing Applications
indicators of compromise, and API integration with third-party (ICIRCA), IEEE, 2021.
services. [6] N. Ravi and S. M. Shalinie, "Learning-driven detection and mitigation of
DDoS attack in IoT via SDN-cloud architecture," IEEE Internet of Things
The proposed framework's effectiveness lies in the Journal, vol. 7, no. 4, pp. 3559-3570, 2020.
synergistic operation of its constituent elements, providing a [7] S. K. Patel, "Attack detection and mitigation scheme through novel
holistic and resilient defense mechanism against a diverse array authentication model enabled optimized neural network in smart healthcare,"
Computer Methods in Biomechanics and Biomedical Engineering, vol. 26, no.
of cyber threats. By implementing and maintaining this 1, pp. 38-64, 2023.
comprehensive IoT security architecture, organizations can
[8] Z. Shelby, K. Hartke and C. Bormann, "The Constrained Application
safeguard their IoT ecosystems and ensure the integrity, Protocol (CoAP)," IETF RFC 7252, June 2014.
confidentiality, and availability of devices and data within their [9] D. Thakore, A. Joshi, T. Finin and A. Joshi, "A policy-based permission
networks. blockchain for the internet of things," 2019 IEEE 39th International Conference
on Distributed Computing Systems (ICDCS), pp. 1260-1270, 2019, doi:
As the IoT landscape continues to evolve and the complexity 10.1109/ICDCS.2019.00109.
of cyber threats increases, it is imperative for organizations to [10] B. Schneier, "Public-interest internet infrastructure," in IEEE Security &
remain vigilant and adaptive. Future research endeavors may Privacy, vol. 13, no. 6, pp. 84-87, Nov.-Dec. 2015, doi:
explore the integration of emerging technologies, such as 10.1109/MSP.2015.132.
quantum computing and artificial intelligence, to further [11] B. Liu, B. Yu, S. Chen, X. Xu and L. Zhu, "Trusted Data in the Cloud with
enhance the robustness and adaptability of IoT security Secure Coprocessor-Based Big Data Provenance," in IEEE Transactions on Big
frameworks. The pursuit of innovative and proactive security Data, vol. 4, no. 3, pp. 370-383, Sept. 2018, doi:
10.1109/TBDATA.2018.2833312.
solutions will remain a paramount concern for organizations as
[12] P. Baracaldo, N. Baracaldo, H. Ludwig, J. Safavi and Y. Zhou, "Mitigating
they navigate the dynamic and interconnected world of the poisoning attacks on machine learning models: A data provenance-based
Internet of Things. approach," 2017 16th IEEE International Conference on Machine Learning and
Applications (ICMLA), pp. 301-306, 2017, doi: 10.1109/ICMLA.2017.0-134.
REFERENCES [13] F. Dehghantanha and A. Dehghantanha, "Cyber threat intelligence:
Challenges and opportunities," 2016 11th International Conference on
Availability, Reliability and Security (ARES), pp. 50-58, 2016, doi:
[1] E. Gelenbe, P. Fröhlich, M. Nowak, S. Papadopoulos, A. Protogerou, A. 10.1109/ARES.2016.87.
Drosou, and D. Tzovaras, "IoT network attack detection and mitigation," 2020
9th Mediterranean Conference on Embedded Computing (MECO), 2020, pp. [14] A. Farris, R. TaheriMonfared, Y. Gligoric, O. Tommila, S. Plosila,
1-6. "Internet of Things: A survey on the security of IoT frameworks," in Journal of
Information Security and Applications, vol. 38, pp. 8-27, Feb. 2018, doi:
10.1016/j.jisa.2017.11.002.

14th ICCCNT IEEE Conference

Authorized licensed use limited to: VNR Vignana Jyothi Inst of Eng & Tech. Downloaded on February 20,2025 at 17:38:13 UTC from IEEE Xplore. Restrictions apply.
July 6-8, 2023
IIT - Delhi, Delhi, India