IoT Security & ML: Threats, Defenses, and Smart Analytics

TAKEAWAYS:

• IoT security threats span physical tampering (e.g., sensor spoofing), network attacks (e.g., DDoS via botnets), and data vulnerabilities (e.g., unencrypted telemetry), requiring layered defenses (authentication, encryption, firmware updates).
• Machine learning in IoT enables anomaly detection (e.g., detecting unusual sensor readings in industrial IoT) and predictive maintenance (e.g., Google’s ML-driven cooling optimization in data centers).
• Edge computing reduces latency for real-time analytics (e.g., Pathao’s traffic routing uses edge ML to reroute drivers dynamically) and minimizes cloud dependency.
• Blockchain secures IoT data integrity (e.g., NEPSE uses it to timestamp stock trades), while homomorphic encryption allows secure processing of sensitive data (e.g., patient vitals in hospitals).
• Regulatory compliance (e.g., GDPR, Nepal’s Electronic Transactions Act 2008) mandates data privacy and audit trails for IoT deployments.
• Worked example: A smart irrigation system (like those used in Nepal’s terai farms) uses ML to predict soil moisture from historical weather data, but must encrypt sensor data to prevent tampering by malicious actors.

1. IoT Security Challenges: A Layered Threat Model

IoT devices are soft targets due to their heterogeneous hardware, limited computational power, and always-on connectivity. Threats can be categorized by attack surface:

1.1 Physical Layer Threats

• Tampering: Malicious actors physically alter sensors (e.g., replacing a temperature sensor in a cold storage with one reporting false readings).
• Supply Chain Attacks: Compromised firmware during manufacturing (e.g., counterfeit Arduino clones with backdoors).
• Side-Channel Attacks: Extracting secrets via power analysis or electromagnetic leaks (e.g., hacking a smart lock by measuring its power consumption).

stateDiagram-v2
    [*] --> IoT_Device: Powered On
    IoT_Device --> Authenticated: Credentials Checked
    Authenticated --> Tampered: Firmware Tampering (Physical Attack)
    Authenticated --> Secure_Communication: TLS/SSL Handshake
    Secure_Communication --> MitM: Unencrypted Channel (Network Attack)
    Secure_Communication --> Data_Processing: Encrypted Payload
    Data_Processing --> Data_Leak: Unauthorized Access (Data Attack)
    Data_Processing --> [*]: Normal Operation
    Tampered --> [*]: False Data Injection
    MitM --> [*]: Data Interception
    Data_Leak --> [*]: Data Exfiltration

Labelled components: ATmega328P microcontroller, USB port, and power jack (vulnerable to supply-chain attacks). (Image: SparkFun Electronics from Boulder, USA, CC BY 2.0, via Wikimedia Commons)

1.2 Network Layer Threats

• DDoS Attacks: Botnets like Mirai (which infected 200K+ IoT devices in 2016) exploit weak default credentials to overwhelm targets.
• Man-in-the-Middle (MitM): Eavesdropping on unencrypted IoT traffic (e.g., intercepting a Khalti payment token sent via HTTP).
• IP Spoofing: Fake devices impersonate legitimate ones to disrupt services (e.g., a rogue NTC smart meter draining power from a grid).

1.3 Data Layer Threats

• Data Breaches: Unauthorized access to sensitive telemetry (e.g., a hacker selling patient ECG data from wearable devices).
• Insecure APIs: Poorly secured REST APIs exposing device configurations (e.g., Daraz’s warehouse IoT leaking inventory data).
• Lack of Audit Trails: No logs for forensic analysis after a breach (e.g., Nepal Rastra Bank fines banks for failing to log IoT transaction logs).

1.4 Worked Example: Smart Grid Attack

Scenario: A NTC smart grid uses IoT sensors to balance load. An attacker:

1. Spoofs a sensor to report a "power surge" (false data injection).
2. Triggers a cascading failure by causing the grid to shut down non-critical loads.
3. Demands a ransom to restore service.

Mitigation:

• Physical seals on sensors to detect tampering.
• Blockchain-based logging to verify sensor integrity.
• AI-driven anomaly detection to flag unusual load patterns.

2. Machine Learning in IoT: From Prediction to Automation

ML transforms IoT from reactive to proactive systems by analyzing time-series data, sensor patterns, and user behavior.

2.1 Key ML Applications in IoT

2.2 How ML Works in IoT: A Trace

Example: Wearable ECG monitor (e.g., Fitbit) detects arrhythmias using ML.

1. Data Collection: Heart rate sensor streams data to a Raspberry Pi edge device.
2. Feature Extraction: ML model extracts RR intervals (time between heartbeats).
3. Training: Model is trained on labeled data (normal vs. abnormal ECGs).
4. Inference: Edge device runs the model in real-time to classify heartbeats.
5. Alert: If abnormal, it triggers an SMS alert (via Ncell’s SMS gateway) to the user.

sequenceDiagram
    participant Sensor as ECG Sensor (e.g., AD8232)
    participant Edge as Raspberry Pi 4 (Edge ML)
    participant Cloud as AWS IoT Core
    participant User as Doctor's App (Telegram/WhatsApp)
    Sensor->>Edge: Raw ECG Signal (12-lead, 250Hz)
    Edge->>Edge: Bandpass Filter (0.5–40Hz)
    Edge->>Edge: Feature Extraction: RR Intervals (ms)
    Edge->>Edge: LSTM Model (Trained on MIT-BIH Dataset)
    Edge->>Cloud: Alert (If Arrhythmia > 200ms)
    Cloud->>User: Push Notification (Ncell SMS Gateway)
    User->>Edge: Feedback Loop (Correction Data)

2.3 Challenges of ML in IoT

• Edge vs. Cloud Tradeoff:
  • Edge ML (e.g., TensorFlow Lite) reduces latency but has limited model size.
  • Cloud ML (e.g., Google Vertex AI) supports complex models but introduces privacy risks.
• Data Quality: Noisy sensor data (e.g., vibration in a factory IoT) degrades model accuracy.
• Explainability: "Black-box" models (e.g., deep neural networks) make it hard to debug failures.

3. Security vs. ML: A Balancing Act

Worked Example: Secure Smart Home Scenario: A smart lock (e.g., Nepal’s "Smart Door") uses:

1. Biometric authentication (fingerprint + ML-based liveness detection).
2. Blockchain to log access attempts.
3. Edge ML to detect brute-force attacks.

Attack Path:

1. Attacker tries 1000 password combinations → ML detects unusual access pattern.
2. System locks the door and notifies the owner via WhatsApp.
3. Blockchain provides an immutable audit trail for police.

4. Edge Computing: The Security and Performance Booster

Edge computing moves processing closer to data sources, reducing:

• Latency (critical for real-time IoT, e.g., autonomous tractors in Nepal’s agriculture).
• Bandwidth usage (avoids sending raw data to the cloud).
• Single point of failure (data never leaves the local network).

4.1 Edge Analytics in Action

Example: Traffic Management in Kathmandu

1. IoT Sensors: Cameras and GPS track vehicle speeds on Ring Road.
2. Edge Device: A NVIDIA Jetson runs a YOLOv5 model to detect congestion.
3. Action: Dynamically adjusts traffic light timings via NTC’s SCADA system.
4. Feedback Loop: ML model improves over time using reinforcement learning.

4.2 Edge vs. Cloud: When to Use Which

5. Real-World Applications: IoT Security and ML in Nepal

5.1 eSewa and Khalti: Fraud Detection with ML

• Problem: Fake transactions via cloned SIMs or stolen credentials.
• Solution:
  • Behavioral Biometrics: ML models analyze typing speed, mouse movements.
  • Anomaly Detection: Flags unusual transaction patterns (e.g., sudden large transfer).
• Example: If a user in Pokhara suddenly transfers ₹500,000 to India, Khalti’s ML freezes the transaction and asks for OTP verification.

5.2 NTC Smart Grid: Predictive Maintenance

• Problem: Power outages due to transformer failures.
• Solution:
  • IoT Sensors: Monitor temperature, vibration, and oil levels.
  • ML Model: Predicts failures 3 days in advance using LSTM networks.
• Impact: Reduced downtime by 40% in Chitwan’s microgrids.

5.3 Pathao: Dynamic Routing with Edge ML

• Problem: Traffic jams in Kathmandu increase delivery times.
• Solution:
  • Edge Devices: Process GPS and traffic camera data locally.
  • Reinforcement Learning: Adjusts driver routes in real-time.
• Result: 20% faster deliveries during peak hours.

6. Regulatory and Ethical Considerations

6.1 Nepal’s IoT Security Landscape

• Electronic Transactions Act 2008: Mandates data encryption and audit logs for IoT systems.
• Nepal Rastra Bank (NRB) Guidelines: Banks using IoT (e.g., ATM sensors) must comply with PCI-DSS.
• Data Localization: Sensitive data (e.g., health records) must be stored in Nepal’s data centers.

6.2 Ethical Dilemmas

• Privacy vs. Convenience: Smart meters (like NTC’s) can profile energy usage to infer occupancy patterns.
• Bias in ML Models: A farm irrigation system trained on terai climate data may fail in mountain regions.
• Accountability: Who is responsible if a self-driving tractor (used in Nepal’s agriculture) causes an accident?

Exam Tip

How to Score Full Marks in TU/PU Exams for This Unit

1. For "Explain IoT Security Challenges" (5 marks):

   • Structure: Use the 3-layer model (Physical, Network, Data).
   • Examples: Always tie threats to Nepalese context (e.g., Ncell SIM cloning, Khalti payment fraud).
   • Mitigations: Pair each threat with a specific defense (e.g., DDoS → Rate limiting, Tampering → Tamper-evident seals).

2. For "Machine Learning Applications in IoT" (5 marks):

   • Formula: Use Case → ML Technique → Real-World Example.
   • Avoid: Generic answers like "ML is used everywhere." Instead, say:

     *"In NTC’s smart grids, Isolation Forest detects anomalies in voltage readings with 95% accuracy, reducing blackouts by 30%."*

3. For "Edge Computing vs. Cloud" (4 marks):

   • Comparison Table: Use the 4-criteria table (Latency, Bandwidth, Security, Cost).
   • Worked Example: Compare Pathao’s edge ML (fast rerouting) vs. cloud-based analytics (long-term trend analysis).

4. For "Domain-Specific Applications" (4 marks):

   • Pick 2 sectors: Healthcare (wearables), Agriculture (smart irrigation), Smart Cities (traffic).
   • Structure:
     • Problem (e.g., "Farmers in Dhankuta waste water due to poor irrigation").
     • IoT + ML Solution (e.g., "Soil moisture sensors + Random Forest predict water needs").
     • Nepalese Example (e.g., "Agritech Nepal" uses this in terai farms).

5. Diagrams = Extra Marks:

   • Always draw:
     • Threat model (state diagram for attack paths).
     • ML pipeline (sequence diagram for data flow).
     • Edge vs. Cloud (graph comparing metrics).

Final Pro Tip: Relate everything to Nepal. Examiners love answers that show local relevance. For example:

"Unlike Western IoT systems, Nepal’s limited bandwidth makes edge computing essential for applications like NTC’s smart meters."