Security: Threats & Defense · Study deck

Intrusion Detection for IoT

A water pump that usually reports once a minute suddenly scans nearby addresses and sends traffic at midnight.

Shield Shelly is your guide for this deck.

intrusion-detectioniot-securitymonitoring
Shield Shelly, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: The return step is important: a confirmed benign maintenance burst can refine the rule, while a confirmed attack should lead to both containment and a search for similar evidence.
  • Explain: At 02:00, a gateway sees one sensor send more DNS requests than usual and then contact an address it has never used.
  • Explain: A signature matches known bad form, an anomaly compares current behavior with a sound baseline, and a policy check tests an allowed boundary.
  • Explain: A fast intrusion-detection alert that waits unseen for hours does not meet a rapid detection claim.
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert

Each step can lose context.

  • Preserve device identity, observation time, rule or model version, and the packets or counters that support the intrusion-detection alert.
  • A gateway sensor can see traffic crossing zones but may miss peer-to-peer radio activity.
  • Cloud logs see service behavior after traffic leaves the site.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert (continued)

A device agent can see local process or authentication events but consumes device resources and may be unavailable on constrained hardware.

  • The return step is important: a confirmed benign maintenance burst can refine the rule, while a confirmed attack should lead to both containment and a search for similar evidence.
  • A naive “more than one destination” rule could create 200 false alerts.
  • Retest the intrusion-detection alert after any rule change.
Worked gateway alert review starts with an unfamiliar outbound destination after failed administrator logins. It checks destination, authentication and maintenance context, then quarantines the gateway, preserves logs, resets credentials and retests deny and alert rules before closure.
An alert review record links the signal to context, an evidence-based decision, a response action, and a retest trigger.
iotclass.org

Major section

Follow an Odd Packet Into an Investigated Intrusion-detection alert (continued)

If the test set contains 20 attack events and the intrusion detector alerts on 18, recall is (18/20=90\%\).

  • If it raises 30 alerts total and 18 are true, precision is (18/30=60\%\).
  • Both numbers matter: missed attacks and excessive reviewer load are different risks.
  • A fast intrusion-detection alert that waits unseen for hours does not meet a rapid detection claim.
iotclass.org

Major section

Start With the Story: A Strange Signal Needs a Reviewer

The signal matters only if a reviewer can see its context, limits, and next action.

  • A gateway means the boundary system that joins local devices to another network or service.
  • At 02:00, a gateway sees one sensor send more DNS requests than usual and then contact an address it has never used.
  • Nothing has failed yet, and the firewall may still allow the flow.

Why it matters

This chapter starts there because intrusion detection is not magic protection.

iotclass.org

Major section

Overview: Detection Adds Visibility, Not Security

The camera gives a reviewable record so you can see what happened and respond.

  • An IDS is the camera.
  • A system that also blocks the door inline is closer to an intrusion prevention system (IPS).
  • Human or automated review then decides what the alert means and records the response.

Why it matters

The lock prevents entry; the camera does not.

The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
The detection pipeline: signals gain context, detection logic evaluates them, selected events become alerts, and alerts lead to recorded responses.
iotclass.org

Major section

Practitioner: Signals, Methods, Placement, and Alert Review

A sensor there may see peer traffic that never leaves the site.

  • A sensor on the staff path sees admin access.
  • The SIEM can join names, alerts, and work logs from several sources.
  • No point sees all events.
Placement determines evidence: each sensor sees only the traffic that reaches it, so the review should state the blind spots.
Placement determines evidence: each sensor sees only the traffic that reaches it, so the review should state the blind spots.
iotclass.org

Major section

Summary

Intrusion detection turns a visible signal into a claim that a person or rule can review.

  • A signature matches known bad form, an anomaly compares current behavior with a sound baseline, and a policy check tests an allowed boundary.
  • Blocking raises the risk further and needs a safe rollback.
  • Tuning must keep both missed attacks and noisy alerts visible.
iotclass.org

Major section

Summary (continued)

Every alert should retain the source facts, confidence, likely impact, reviewer, chosen response, and the new evidence that would reopen the decision.

  • Intrusion detection turns observable signals into reviewable alerts; it adds visibility but does not replace preventive controls.
  • Signature, anomaly, and policy detection each provide different evidence and have different blind spots; most IoT reviews need all three.
  • Sensor placement determines what can become evidence, and network and host detection see different things.
iotclass.org

Deck summary

Key takeaways

Each step can lose context.

  • A device agent can see local process or authentication events but consumes device resources and may be unavailable on constrained hardware.
  • If the test set contains 20 attack events and the intrusion detector alerts on 18, recall is (18/20=90\%\).
  • The signal matters only if a reviewer can see its context, limits, and next action.
  • The camera gives a reviewable record so you can see what happened and respond.
iotclass.org

Retrieval practice

Recall check 1 of 4

Shield Shelly says: answer from memory, then check your reasoning.

Q1Which statement best describes the role of intrusion detection in an IoT system?

AIt creates reviewable alerts from signals; it is not standalone security
BIt secures the network on its own, so other controls become unnecessary
CIt is most effective when it produces the largest possible number of alerts
DIt only matters after an incident has already been confirmed
Show answer

Answer: A Detection is a visibility control.

iotclass.org

Retrieval practice

Recall check 2 of 4

Shield Shelly says: answer from memory, then check your reasoning.

Q2A gateway IDS never sees traffic between two devices in the same local zone. What should the reviewer change?

ADelete alert identity as if that revealed unseen local-zone device traffic.
BRaise alert thresholds because the observed traffic is ordinary site activity rather than a security signal.
CCall unseen traffic safe because no gateway IDS alert was raised.
DPlace a collector where the local device-to-device traffic is observable.
Show answer

Answer: D A detection claim depends on the signal being visible to the chosen collector.

iotclass.org

Retrieval practice

Recall check 3 of 4

Shield Shelly says: answer from memory, then check your reasoning.

Q3A gateway alert fires because the device contacted a new external address after several failed administrator logins. What is the strongest first review response?

ACheck device identity, expected destinations, authentication logs.
BIgnore the alert until a malware signature also fires
CBlock each gateway immediately because a uniform shutdown contains the reported compromise.
DRaise the threshold so the alert does not repeat
Show answer

Answer: A The alert must be reviewed against identity, path, timing, and operational context before deciding to quarantine, suppress, escalate, or retest.

iotclass.org

Retrieval practice

Recall check 4 of 4

Shield Shelly says: answer from memory, then check your reasoning.

Q4An operator complains about too many IoT alerts and raises every anomaly threshold significantly. What is the most accurate description of the consequence?

AHigher thresholds remove both false alarms and missed attacks.
BThreshold changes cannot affect anomaly detection outcomes.
CFewer alerts prove the remaining investigations are more accurate.
DAlert noise falls, but more real anomalies may go undetected.
Show answer

Answer: D Raising thresholds trades false positives for false negatives.

iotclass.org

Print reference

Answers

Answer key.

  1. A · Detection is a visibility control.
  2. D · A detection claim depends on the signal being visible to the chosen collector.
  3. A · The alert must be reviewed against identity, path, timing, and operational context before deciding to quarantine, suppress, escalate, or retest.
  4. D · Raising thresholds trades false positives for false negatives.
iotclass.org