Analyzing Threats and Attacks in Edge Data Analytics within IoT Environments

By inergency On Mar 18, 2024

Various industries, including healthcare, transportation, and smart cities, leverage edge data analytics to derive real-time insights and enhance operational efficiency [86]. In healthcare, edge computing facilitates remote patient monitoring, medical imaging analysis, and wearable health devices, while facing security challenges related to patient data confidentiality, regulatory compliance, and medical device security [87]. In transportation, edge data analytics enables real-time traffic monitoring, predictive maintenance, and autonomous vehicle operations, posing security challenges such as protecting connected vehicles from cyberattacks and ensuring the integrity of navigation data [88]. In smart cities, edge computing supports smart energy management, public safety monitoring, and urban infrastructure optimization, with security challenges including safeguarding citizen data privacy and protecting critical infrastructure against cyber threats [89]. Addressing these unique security challenges requires industry-specific security measures, robust encryption, access controls, and ongoing security assessments to ensure the integrity and security of edge data analytics deployments across various industries.

The integration of edge computing for smart applications can improve the user experience by enhancing the computing efficiency. This has resulted in adopting edge computing for various use cases, including healthcare, traffic management, and smart city applications. In this section, the use cases are reviewed and tabulated in Table 3. The use cases are studied in the following section to understand the edge aspect of the applications, the working model, and how they contribute toward decision-making. Any attacks on these applications will adversely affect the decision-making process by falsifying information, hacking confidentiality, and privacy, and all these are studied further.

4.1. Healthcare Applications

The use of healthcare applications is rapidly increasing since they offer mobility, regular monitoring, periodic updates, and real-time interactions during an emergency. In many healthcare applications, typical end-users are elderly patients who require special attention and supervision. They use devices, such as smartwatches or smart glasses, with various sensors, accelerometers, gyroscopes, and GPS. These devices are interconnected and process patients’ information, which requires high levels of privacy and integrity.

In the present context, COVID-19 is a fast-spreading chronic illness that requires monitoring of infected patients to control the rapid spread. Artificial intelligence (AI)-integrated edge computing is proposed to provide real-time processing of a patient’s health data to predict whether the patient is infected or not [90]. The edge node contains AI units and a medical database capable of collecting, storing, processing, and generating alert messages. The AI unit uses ensemble-based techniques to perform clinical diagnoses and generate alert messages. The decision is based on the risk score estimated using an AI model. This triggers an alert message to the doctors and assists them in taking immediate action to quarantine the infected patients. Although AI supports the overwhelming decision-making process, it is proven that AI increases the computation load on the devices. In case of any attack on AI models, they become vulnerable to threats and lose their reliability [91]. This may result in delaying the alert message to the doctors and degrading the efficiency of the application. Similar applications were proposed for the Chikungunya virus diagnosis. This application uses Social Network Analysis (SNA) to predict the virus outbreak. SNA graphs generate relative scores for each region and identify the critical region. Based on this, appropriate alert messages are generated [92]. Cancer prediction and monitoring applications use data gathered in the healthcare system for decision-making based on neuromorphic multi-criteria [93]. These decisions help the specialist to determine the level of symptoms and provide quality services. There are several instances where cancer patients’ data were hacked through cyber-attacks [94].

There are few fall detection applications available for patients suffering from stroke [95,96]. In these applications, sensors, edge gateways, and access points are interconnected in the Low-Power Wide-Area Network (LPWAN). They monitor electroencephalography (EEG), electrocardiography (ECG), electromyography (EMG), blood pressure, and contextual data, such as temperature, humidity, and air quality. The combination of health data and contextual data assists in improving the accuracy of prediction. Low Bluetooth energy in LPWAN reduces latency during data transmission. When the fall is detected, a notification via smartphone is sent to the caregivers. However, if the body blocks the electromagnetic signal transmissions in some postures, it may either reduce the quality of the link or make communications within body devices impossible [97].

eWall is an advanced home sensing environment with e-health and e-solution for elderly patients to live independently. Elderly patients may suffer from declining memory functions, cardio-pulmonary conditions, neuro-muscular control movements, and so on. This application provides an effective solution to address all these societal challenges. It includes: (i) eWall devices, such as sensors and actuators, (ii) home sensing middleware to connect devices, collect, query, report, and store data, (iii) a local context manager to analyze human and non-audio/video perception processing, and (iv) a cloud to monitor complete infrastructure communication. The services provided by this application are daily activity monitoring (such as jogging, cycling, and gardening), daily functions’ monitoring (such as shopping, walking in the park, cooking, sleeping, eating/drinking, socializing, mood status, self-care, and chores), healthcare support through teleconference with a medical professional, and caregiver notifications. Ubiquitous devices, such as sensors, accelerometers, gyroscopes, GPS, utility sensors (such as gas, electricity, and bed), passive infrared (PIR), and audio/video sensors are interconnected with Bluetooth or Zigbee technology to provide these services. The data transmission rate in this technology is very low [98]. The health Fog framework is another application where hospitals, clinics, and smart homes are equipped with sensors, actuators, smartphones, and other smart devices. Medical professionals monitor patient’s sedentary lifestyle, which affects their health, and advise physical routines, diets, and other plans to pursue a healthy lifestyle. This is a patient-centric application to improve human health and well-being with suitably engaging technologies [99].

In the healthcare system, implementing security measures entails several ethical considerations. These include safeguarding patient data privacy and confidentiality, obtaining consent for data usage, ensuring patient data ownership and control, addressing biases in algorithms, promoting transparency and accountability, and prioritizing patient safety [100]. However, in healthcare applications, since devices are connected in WPAN (Wireless Personal Area Network) or BAN (Body Area Network), this makes the network vulnerable to potential attackers who can anonymously sneak into the devices, listen to all traffic, hack personal data, and exploit the system [101]. Common threats identified in healthcare applications include insider attacks, software attacks, and hardware attacks. Among these, insider attacks cause severe damage because the attacker pretends to be legitimate and can take control of the communication channel or devices [102].

Observation #1: The quality of medical services is improving tremendously due to the integration of AI and edge computing. The health applications are serving as a powerful tool for the medical field to monitor and control the spread of fatal diseases. Despite these advantages, as the data volume increases, AI computation tasks increase. This can drain the computation, network, and storage capacities of the edge infrastructure and affect its performance or reliability.

Observation #2: The sensors and the devices in the healthcare applications are connected in WPAN, Bluetooth, ZigBee, or WBAN. Even though these networks are energy efficient, they have a lower network range than Wi-Fi and cellular connections. This may decrease the necessary bitrate for biomedical signals, such as ECG or EEG. If the patient wears several body sensors, the transmission of electromagnetic signals may become blocked due to some body postures affecting data transmission.

4.2. Traffic Management Applications

VANET (Vehicular ad hoc Network) and VSDN (Vehicular Software-Defined Networking) are the standard networks used in most edge-based traffic management applications. The importance of these networks is to improve driving efficiency, navigation, and information exchange in a decentralized network structure. A Vehicular Fog Computing (VFC) network enables traffic schemes for traffic management and road safety in a decentralized network structure. Events such as traffic jams, car accidents, and road surfaces are uploaded to edge nodes, which are closer to the roadside units. Some data generated at this level can be used for vehicle-level decision-making, while other data are processed by the servers in the edge layer and pushed to the cloud. The traffic management server on the cloud is responsible for broadcasting feedback messages to vehicles through the edge nodes at roadside units [103]. When the data are transmitted to different nodes, a lack of authentication can lead to malicious activities, such as hacking users’ personal data or affecting the consistency of data [104].

A vehicular network collaboration using VSDN is used to assist various services, such as autonomous driving, collision avoidance, accident detection, fast rescue, emergency traffic prioritization, emergency message dissemination, remote video analysis, and so on. This technique enables handling most of the software attack efficiently, but tracking location and a few network attacks, such as sinkhole, sniffing, and spoofing, are challenging [105,106]. The vehicles behave as a content provider or consumer simultaneously, so tracking them for process discovery or process request is very easy. Once these vehicles are tracked, they can be easily made unreachable and isolated from the network [107]. The virtualization in VANET is still evolving and there are no standards to integrate wireless communication mechanisms, as in IPv6. Therefore, they are more prone to attacks such as DDoS and network pattern analysis [108].

The 5G-based intelligent transport system was developed to track traffic violation reports using vehicles’ speed sensors. It was based on security protocol to verify location-based information with a digital signature [109]. The edge nodes aggregate multiple speed violation reports, verify, and broadcast anonymous notifications to other entities in the vicinity. Considering these reports, the transportation authority generates the decisions on vehicles’ traffic violations. The digital signature mitigates the risk of jamming, privacy violation, and false injection threats. Hence, the privacy of information and location, mutual authentication, traceability, data confidentiality, and integrity are achieved. However, hardware attacks, such as physical damage to sensor nodes or blocking communication channels, are not considered. These attacks can cause the edge nodes to wait indefinitely for the data [110].

Observation #3: In VANET, data are traversed from different nodes and regions. There is high mobility and uneven distribution of vehicles in the network. This makes selecting appropriate relay nodes challenging and results in consistency liability of data. Therefore, there is a need for an efficient correlation mechanism to address data inconsistency.

Observation #4: The 5G, SDN, and virtualization technologies are broadly adopted in VANET applications. They support traffic programmability, agility of services, and create policy-driven network supervision. However, it will be challenging to achieve reliability, abstraction, performance, scalability, and security by virtualizing the network infrastructure for edge computing.

4.3. Smart City Applications

Smart city applications have enhanced the living standards of the users [111]. IoT devices play a vital role in these applications to collect and sense real-time data. They collect users’ data pertaining to city supervision and utilities (gas, lighting, etc.). In a video summarizing framework, the edge nodes collect the captured videos and create an embedded vision. Further, it is pushed to the centralized servers in the edge layer connected through internet gateways. The servers operate as master nodes, and these master nodes control the edge nodes. The servers offload the embedded vision to the cloud through the MQTT communication protocol. The embedded vision reduces bandwidth consumption to the cloud significantly [112]. The MQTT protocol is prone to many threats, such as DoS, flooding, spoofing, tampering, and denying access control [113]. These threats result in maliciously dropped or delayed information, capture of transmitted data, send infinite false details, contribute to degrading decision-making efficiency, and block the resource for processing nodes [113].

A smart meter application is used to collect data on energy consumption. The collected data are aggregated by the edge nodes and transferred to the cloud. The edge computing layer includes smart meters to sense data, distribution transformers in the respective geographic region, and a meter data management system at the substation level. The data management system performs distributed data aggregation to summarize data before sending it to the cloud. The routing protocols are used to transfer the data with multiple hops to the destination [114]. The routing protocols can be prone to attacks, such as eavesdropping, network pattern analysis, jamming, spoofing, data alteration, message replay, and DoS [115]. In a smart lighting application, the controller node monitors the streetlight switches when vehicles are approaching [116]. The smart lighting is further enhanced by interconnecting to a smart city system for public safety. It includes various sensors, such as a video camera or gun-shot detection sensor, and datasets such as weather or traffic data. This application helps users to navigate the safest route based on pedestrian count and road traffic. Google map API is used to assist navigation for the users. In case of an emergency, such as accidents or theft, the users can press the emergency call button and streetlights begin to pulse immediately. The responder can locate the emergency by identifying pulsing streetlights nearby. The brightness of the streetlights and pulse are between 10% to 100%, making it visible to pedestrians and emergency responders. This application also includes secure communication protocols to mitigate cybersecurity threats, such as DoS, eavesdropping, session hijacking, and MITM [117]. Similarly, in the smart pipeline application, the controller node detects a fire or gas leak and closes the gas pipeline. Fiber optic sensors and sequential learning algorithms on edge nodes are used to detect events threatening pipeline safety [118]. The common threats anticipated are equipment sabotage, jamming, eavesdropping, tampering, and sinkhole attacks. These attacks can alter decisions, block the edge nodes from processing, or even isolate the edge nodes.

Observation #5: There are many sensors, IoT devices, and edge nodes connected in the smart city applications. They collect and process data in the long term to obtain deep sequential resolution. This advancement greatly reduces the power consumption of the devices while maintaining the same performance. Therefore, there is a need to preserve the longevity of devices and edge nodes.

Observation #6: Smart city applications continuously collect users’ sensitive data for a long time and store them in the edge layer for processing before transferring them to the cloud. Any threats to the data stored can lead to catastrophic events, such as information theft or identity fraud. Lack of security measures can compromise the stored data and lead to a loss of public faith and affect the reputation of the applications.

Table 3.
Analysis of edge use case applications and effects of threats on the applications.

Use Case	Ref.	Working Model	Decision Making Node	Evaluation	Insider Attack	Software Attack	Hardware Attack	Network Attack	Effect of Threats on the Model
Health Care Applications	[90]	Emergency alert message for COVID-19 infection	Artificial intelligence-based fog node	Generate medical report and alert message to caregivers and doctors	Data breach	–	Equipment malfunction	–	Hack data or may degrade alert message efficiency
	[96]	FAST—Fall detection system for stroke patients	Back-end module server on the cloud	Detects if the stroke patient is about to fall and triggers message to the emergency phone number	Forgery, MITM	Tampering	–	–	Causes false predictions, degrades efficiency, and maliciously drops or delays information
	[95]	Fall detection or electrocardiography monitoring	Edge gateway—Fall detection system	Notification and alert message to caregivers	Forgery, MITM	Tampering	–	–	May degrade notification efficiency
	[98]	eWall—Home management for senior citizens	eCloud or ePSOS	Track daily activities of an elderly patient. Alert message from eWall cloud to relatives or hospital	MITM, malicious insider	–	Resource depletion	–	Affect confidentiality, breach privacy, tamper with hardware devices, and disturb normal data flow
	[99]	Activity monitoring	Cloud Access Security Broker	Activity detection and calories burnt are sent to hospitals and nutritionists	MITM, insider, hacking	Impersonation	–	–	Affect confidentiality, privacy, and reliability of the decision
	[119]	Healthcare and Assisted Living (AAL) in Smart ambient	Fog Accelerator Nodes	Aggregate data from IoT sensors and monitor patients’ fall or cardiovascular issues. In case of emergency, informs caretakers	–	SQL Injection	Equipment sabotage	–	Affect confidentiality, leak sensitive information, and destroy hardware devices
	[120]	Smart e-Healt hcare system	Gateway nodes	Gather medical information of patients from sensors, aggregate in edge layer, and generate EWS in case of emergency for doctors or caretakers	Malicious insider	Impersonation, jamming	–	–	Malicious insider can watch the activities, illegitimately communicate with other users, falsify data, or send a false alarm
	[92]	Chikungunya virus diagnosis solutions	Alert generation component in fog layer	Alert message is sent to government and healthcare to control outbreak of virus	–	–	Equipment sabotage	–	May not create an alert message or causes a delay in generating the alert message
	[93]	Detect cancer and monitor patients	Smart gateway nodes in fog layer	Send e-report to patients, send ambulance in case of emergency, and monitor patients until they recover	Data breach	–	–	Eavesdropping	Intruder may hack patients’ personal data or may be a silent spectator
Traffic Management Application	[103]	Traffic Management Scheme	Cloudlets	Minimize response delay for traffic management by load balancing	Data breach, malicious insider	–	–	–	Breach data privacy
	[105]	Vehicular Network collaboration	Fog Controller Node	Accident notification and avoid road congestion Traffic prioritization in case of emergency and directs fast rescue route	Location privacy	–	Fault tolerance	Sinkhole, sniffing, spoofing	Track users’ location or deprive them from the network
	[106]	Smart Traffic Control	Traffic Control Node	Identifies road congestion and avoids traffic jams	Location privacy	–	Fault tolerance	Sinkhole, sniffing, spoofing	Track users’ location or deprive them from the network
	[109]	5G-based Intelligent Transport System	Transportation authority at the edge layer	Sends traffic violation report (TVR) based on the vehicle’s speed sensors	–	–	Equipment sabotage, side channel attack		Physical damage to sensor nodes, blocks communication channels, and increases waiting time.
	[121]	Smart Car Parking system	Microcontroller device generates parking status	Identifies traffic jam and shows parking spots	Location privacy	–	Jamming		Track users and vehicle information, cause traffic congestion
Smart City Applications	[122]	Surveillance videos for smart cities	Fog Aggregate Nodes	Send compressed video data to the cloud	Side channel attack	Tampering	Equipment sabotage	Eavesdropping, Sybil, DDoS, pattern analysis	Maliciously drop or delay information, block the resource or request from the users, hack user privacy
	[123]	Smart things to machine interaction	Fog Controller Node	Intelligent lighting—sensor identifies when to turn the switch on/off	–	Tampering	–	–	Device tampering
	[118]	Smart pipeline monitoring system	Fog Controller Node	Closes gas pipeline in case of gas leakage or fire detection	–	Tampering	–	–	Device tampering
	[114]	Powerline communication for smart meters	Fog Computing Nodes	Summary of electric power consumption data is sent to the cloud	Data alteration	–	–	Eavesdropping, pattern analysis, jamming, DoS	Device tampering
	[124]	Forest Fire management systems	Prediction system	Identifies and generates an alert message to forest authorities	–	Tampering	–	–	Alters the decision with malicious intentions