Multi-layered architecture for detecting false data injection in IoT sensors

Challenges and architectural principles for detecting false data injection in IoT sensors

False Data Injection Attacks (FDIA) on Internet of Things (IoT) sensors in critical infrastructure represent one of the most insidious cyber threats. Unlike natural drift or random noise, FDIA is a deliberate, malicious act aimed at altering original sensor measurements to mislead control and decision-making systems. Such attacks can lead to catastrophic consequences, including failures in power grids, Building Automation (BMS) systems, production lines, and transportation networks.

To counter these threats, implementing architectural solutions that ensure data integrity at all levels is critical. Security guidelines for Industrial Control Systems (ICS) and Operational Technology (OT) are outlined in standards such as NIST SP 800-82 “Guide to Operational Technology (OT) Security” and ISA/IEC 62443 “Security for industrial automation and control systems.” These standards emphasize the importance of comprehensive risk management, defense-in-depth strategies, and ensuring the integrity, availability, and confidentiality of critical systems. Additionally, ENISA provides recommendations for IoT security in critical information infrastructures, highlighting the need to protect devices, cloud backends, and services.

Architectural patterns for data integrity verification at the sensor level

Protecting data directly at the sensor level is the first and fundamental step in a multi-layered architecture for detecting false data injection. The limited computational resources of many IoT sensors necessitate the use of optimized, “lightweight” cryptographic methods.

• Secure Boot: This mechanism ensures that only cryptographically signed and authorized software (firmware, operating system) loads onto the device. It establishes a hardware root of trust, preventing malicious code execution during startup, even if an attacker gains physical access to the device.
• Remote Attestation: Allows remote verification of a device's security state, including hardware and software configurations, as well as runtime status. This enables the detection of unauthorized changes or sensor compromise.
• Cryptographic Data Binding: To ensure the integrity of data generated by the sensor, cryptographic hash functions (e.g., SHA) and keyed-hash message authentication codes (HMAC) are used. These methods allow verification that data has not been altered during storage or transmission. The use of Hardware Security Modules (HSM) can significantly enhance the security of cryptographic key management.

Anomaly detection architecture at the Edge gateway

Edge gateways play a crucial role in detecting false data injection, acting as an intermediate processing layer closer to the data sources. This enables real-time analysis, reducing latency and the load on centralized cloud platforms.

At Edge gateways, anomalies indicative of false data injection can be detected, such as sharp and uncharacteristic value changes, data exceeding established ranges, and discrepancies between current data and historical or behavioral patterns.

Architectural patterns for deploying machine learning (ML) at the Edge include using “lightweight” models (TinyML) and federated learning, which allows models to be trained on distributed data without transmitting it to a central repository. Algorithms suitable for anomaly detection at the Edge include Isolation Forest, One-Class SVM, and simplified neural networks such as Random Forest, Decision Tree, and shallow LSTM. Key requirements for Edge analysis are low detection latency and efficient use of the gateway's limited computational resources.

Centralized aggregation and analysis for detecting complex attacks

While Edge computing is effective for detecting local anomalies, complex and coordinated false data injection attacks often require centralized data analysis from multiple sensors and Edge gateways. At this level, architectural patterns for collecting and aggregating large volumes of data, such as Data Lake or Message Bus, are applied.

Centralized systems enable correlational analysis of data from various sources, revealing anomalies that might be imperceptible on individual devices or gateways. The use of advanced Artificial Intelligence and Machine Learning (AI/ML) methods for behavioral analysis allows the identification of complex attack patterns that go beyond simple thresholds or local deviations. Integration with Security Information and Event Management (SIEM) systems and Security Operations Centers (SOC) is critical for centralized monitoring, automated alerting, and rapid incident response.

Architectural matrix for selecting an approach to false data injection detection

The choice of the optimal architectural approach for detecting false data injection in critical infrastructure IoT sensors depends on several factors. The matrix below will help IIoT solution architects balance data reliability, implementation complexity, computational resources, and system performance impact.

AZIOT integrates various protocols, such as MQTT, Modbus, BACnet, KNX, Zigbee, Z-Wave, LoRaWAN, Matter, SCADA, BMS, and ERP, and utilizes Edge processing, Unity Base, rules/scenarios, dashboards, audit, and Access Control. These capabilities enable AZIOT to implement architectural patterns for false data injection detection, particularly through Edge telemetry processing for early anomaly detection, as well as data aggregation for comprehensive analysis and audit. Unity Base's audit and Access Control systems contribute to ensuring data integrity at all stages of the information lifecycle.

Effective protection of critical infrastructure IoT sensors from false data injection requires a deep understanding of architectural patterns and their integration. Implementing a multi-layered architecture encompassing sensor, Edge gateway, and centralized aggregation levels is key to ensuring data reliability and the uninterrupted operation of critical systems. Continuous monitoring, analysis, and adaptation of protective mechanisms to new threats are an integral part of cybersecurity strategy in IIoT.

For more information on Intecracy Group solutions, please visit Intecracy solutions and inbase.com.ua solutions.