A Cost Based Dynamic Response Method for Internet of Things Cyberattacks

Internet of Things (IoT) applications have attracted growing attention due to the widespread availability of low-cost, high power computing devices supported by the latest mobile, wireless and edge technologies. Consequently, this has given rise to new opportunities for cyberattacks, both in sophistication and scale. Prior research has predominantly focused on detecting cyberattacks in real time, while attack mitigation is left to security experts, which is usually both time consuming and requires complex decision-making skills like prioritization and the trade-off of impacts and costs. Recently, research has been directed towards deploying automated responses, with these systems mostly employing static rule-based response selection methodologies. In this paper, we present a novel cost-based response selection method for detected attacks, which is both adaptive and dynamic, addressing the importance of attack and host characteristics within response selection. The methodology is tested and evaluated in a use case, in a real-world IoT scenario, demonstrating its effectiveness.