Security: Threats & Defense · Study deck

Intrusion Detection for IoT

A water pump that usually reports once a minute suddenly scans nearby addresses and sends traffic at midnight.

Shield Shelly is your guide for this deck.

intrusion-detectioniot-securitymonitoring
Shield Shelly, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: The return step is important: a confirmed benign maintenance burst can refine the rule, while a confirmed attack should lead to both containment and a search for similar evidence.
  • Explain: At 02:00, a gateway sees one sensor send more DNS requests than usual and then contact an address it has never used.
  • Explain: A device agent can see local process or authentication events but consumes device resources and may be unavailable on constrained hardware.
  • Explain: If the test set contains 20 attack events and the intrusion detector alerts on 18, recall is (18/20=90\%\).
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert

Each step can lose context.

  • Preserve device identity, observation time, rule or model version, and the packets or counters that support the intrusion-detection alert.
  • A gateway sensor can see traffic crossing zones but may miss peer-to-peer radio activity.
  • Cloud logs see service behavior after traffic leaves the site.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert (continued)

A device agent can see local process or authentication events but consumes device resources and may be unavailable on constrained hardware.

  • The return step is important: a confirmed benign maintenance burst can refine the rule, while a confirmed attack should lead to both containment and a search for similar evidence.
  • A naive “more than one destination” rule could create 200 false alerts.
  • Retest the intrusion-detection alert after any rule change.
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert (continued)

If the test set contains 20 attack events and the intrusion detector alerts on 18, recall is (18/20=90\%\).

  • If it raises 30 alerts total and 18 are true, precision is (18/30=60\%\).
  • Both numbers matter: missed attacks and excessive reviewer load are different risks.
  • A fast intrusion-detection alert that waits unseen for hours does not meet a rapid detection claim.
iotclass.org

Major section

Start With the Story: A Strange Signal Needs a Reviewer

The signal matters only if a reviewer can see its context, limits, and next action.

  • A gateway means the boundary system that joins local devices to another network or service.
  • At 02:00, a gateway sees one sensor send more DNS requests than usual and then contact an address it has never used.
  • Nothing has failed yet, and the firewall may still allow the flow.

Why it matters

This chapter starts there because intrusion detection is not magic protection.

iotclass.org

Major section

Overview: Detection Adds Visibility, Not Security

The camera gives a reviewable record so you can see what happened and respond.

  • An IDS is the camera.
  • A system that also blocks the door inline is closer to an intrusion prevention system (IPS).
  • Human or automated review then decides what the alert means and records the response.

Why it matters

The lock prevents entry; the camera does not.

The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
iotclass.org

Major section

Practitioner: Signals, Methods, Placement, and Alert Review

The three detection methods are useful only where their required evidence is visible.

  • A management-path sensor sees administrative access, while a SIEM can correlate identities, alerts, and operational records from several sources.
  • Recording those limits keeps the chosen detection method tied to evidence it can actually observe.
Placement determines evidence: each sensor sees only the traffic that reaches it, so the review should state the blind spots.
Placement determines evidence: each sensor sees only the traffic that reaches it, so the review should state the blind spots.
iotclass.org

Major section

Summary

Intrusion detection turns observable signals into reviewable alerts; it adds visibility but does not replace preventive controls.

  • Signature, anomaly, and policy detection each provide different evidence and have different blind spots; most IoT reviews need all three.
  • Sensor placement determines what can become evidence, and network and host detection see different things.
  • IPS adds inline blocking, which needs rollback and exception procedures, especially where device traffic affects physical processes.
iotclass.org

Deck summary

Key takeaways

Each step can lose context.

  • A device agent can see local process or authentication events but consumes device resources and may be unavailable on constrained hardware.
  • If the test set contains 20 attack events and the intrusion detector alerts on 18, recall is (18/20=90\%\).
  • The signal matters only if a reviewer can see its context, limits, and next action.
  • The camera gives a reviewable record so you can see what happened and respond.
iotclass.org

Retrieval practice

Recall check 1 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q1Which statement best describes the role of intrusion detection in an IoT system?

AIt creates reviewable alerts from signals; it is not standalone security
BIt secures the network on its own, so other controls become unnecessary
CIt is most effective when it produces the largest possible number of alerts
DIt only matters after an incident has already been confirmed
Show answer

Answer: A Detection is a visibility control.

iotclass.org

Retrieval practice

Recall check 2 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q2A gateway alert fires because the device contacted a new external address after several failed administrator logins. What is the strongest first review response?

ACheck device identity, expected destinations, authentication logs.
BIgnore the alert until a malware signature also fires
CBlock every gateway immediately without checking context
DRaise the threshold so the alert does not repeat
Show answer

Answer: A The alert must be reviewed against identity, path, timing, and operational context before deciding to quarantine, suppress, escalate, or retest.

iotclass.org

Retrieval practice

Recall check 3 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q3An operator complains about too many IoT alerts and raises every anomaly threshold significantly. What is the most accurate description of the consequence?

AIt removes both false positives and false negatives at the same time
BNoise drops, but the change also raises false negatives.
CIt has no effect because thresholds do not influence detection
DSecurity improves because operators have more time to investigate the remaining alerts
Show answer

Answer: B Raising thresholds trades false positives for false negatives.

iotclass.org

Print reference

Answers

Answer key.

  1. A · Detection is a visibility control.
  2. A · The alert must be reviewed against identity, path, timing, and operational context before deciding to quarantine, suppress, escalate, or retest.
  3. B · Raising thresholds trades false positives for false negatives.
iotclass.org