A Review on Attack Graph Analysis for IoT Vulnerability Assessment: Challenges, Open Issues, and Future Directions

• Published in: IEEE access Vol. 11; p. 1
• Main Authors: Almazrouei, Omar Saif Musabbeh Bin Hamed, Magalingam, Pritheega, Hasan, Mohammad Kamrul, Shanmugam, Mohana
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01.01.2023; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Algorithms; Attack Graph; Cluster analysis; Clustering; Computer security; Cybersecurity; Genetic algorithms; Graphs; Internet of Things; Machine learning; Markov processes; Metadata; Modelling; Network Vulnerabilities; Networks; Regression models; Systematics; Terminology; the Internet of Things; Vector quantization; Vulnerability Assessment; Wireless sensor networks
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2023.3272053

Vulnerability assessment in industrial IoT networks is critical due to the evolving nature of the domain and the increasing complexity of security threats. This study aims to address the existing gaps in the literature by conducting a comprehensive survey on the use of attack graphs for vulnerability assessment in IoT networks. Attack graphs serve as a valuable cybersecurity tool for modeling and analyzing potential attack scenarios on systems, networks, or applications. The survey covers the research conducted between 2016 and 2021(34 peer-reviewed journal articles and 28 conference papers), identifying and categorizing the main methodologies and technologies employed in generating and analyzing attack graphs. In this review, core modeling techniques for IoT vulnerability assessment are highlighted, such as Markov Decision Processes (MDP), Feature Pyramid Networks (FPN), K-means clustering, and logistic regression models, along with other techniques involving genetic algorithms like fast-forward (FF), contingent fast-forwards (CFF), advanced reinforcement-learning algorithms, and HARMs models. The evaluation of the performance of these attack graph models using IoT networks or devices as case studies is also emphasized. This survey provides valuable insights into the state-of-the-art in attack graph techniques for IoT network vulnerability assessment, identifying various applications, performances, research opportunities, and challenges. As a reference source, it serves to inform academicians and practitioners interested in leveraging attack graphs for IoT network vulnerability assessment and guides future research directions in this area.