{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,4,26]],"date-time":"2025-04-26T17:06:38Z","timestamp":1745687198775,"version":"3.37.3"},"reference-count":46,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2021,4,26]],"date-time":"2021-04-26T00:00:00Z","timestamp":1619395200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"The Internet of things (IoT) has emerged as a topic of intense interest among the research and industrial community as it has had a revolutionary impact on human life. The rapid growth of IoT technology has revolutionized human life by inaugurating the concept of smart devices, smart healthcare, smart industry, smart city, smart grid, among others. IoT devices\u2019 security has become a serious concern nowadays, especially for the healthcare domain, where recent attacks exposed damaging IoT security vulnerabilities. Traditional network security solutions are well established. However, due to the resource constraint property of IoT devices and the distinct behavior of IoT protocols, the existing security mechanisms cannot be deployed directly for securing the IoT devices and network from the cyber-attacks. To enhance the level of security for IoT, researchers need IoT-specific tools, methods, and datasets. To address the mentioned problem, we provide a framework for developing IoT context-aware security solutions to detect malicious traffic in IoT use cases. The proposed framework consists of a newly created, open-source IoT data generator tool named IoT-Flock. The IoT-Flock tool allows researchers to develop an IoT use-case comprised of both normal and malicious IoT devices and generate traffic. Additionally, the proposed framework provides an open-source utility for converting the captured traffic generated by IoT-Flock into an IoT dataset. Using the proposed framework in this research, we first generated an IoT healthcare dataset which comprises both normal and IoT attack traffic. Afterwards, we applied different machine learning techniques to the generated dataset to detect the cyber-attacks and protect the healthcare system from cyber-attacks. The proposed framework will help in developing the context-aware IoT security solutions, especially for a sensitive use case like IoT healthcare environment.<\/jats:p>","DOI":"10.3390\/s21093025","type":"journal-article","created":{"date-parts":[[2021,4,27]],"date-time":"2021-04-27T10:19:11Z","timestamp":1619518751000},"page":"3025","source":"Crossref","is-referenced-by-count":145,"title":["A Framework for Malicious Traffic Detection in IoT Healthcare Environment"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9812-7488","authenticated-orcid":false,"given":"Faisal","family":"Hussain","sequence":"first","affiliation":[{"name":"Al-Khwarizmi Institute of Computer Science (KICS), University of Engineering & Technology (UET), Lahore 54890, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1835-5531","authenticated-orcid":false,"given":"Syed Ghazanfar","family":"Abbas","sequence":"additional","affiliation":[{"name":"Al-Khwarizmi Institute of Computer Science (KICS), University of Engineering & Technology (UET), Lahore 54890, Pakistan"}]},{"given":"Ghalib A.","family":"Shah","sequence":"additional","affiliation":[{"name":"Al-Khwarizmi Institute of Computer Science (KICS), University of Engineering & Technology (UET), Lahore 54890, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3394-6762","authenticated-orcid":false,"given":"Ivan Miguel","family":"Pires","sequence":"additional","affiliation":[{"name":"Instituto de Telecomunica\u00e7\u00f5es, Universidade da Beira Interior, 6200-001 Covilh\u00e3, Portugal"},{"name":"Computer Science Department, Polytechnic Institute of Viseu, 3504-510 Viseu, Portugal"},{"name":"UICISA: E Research Centre, School of Health, Polytechnic Institute of Viseu, 3504-510 Viseu, Portugal"}]},{"given":"Ubaid U.","family":"Fayyaz","sequence":"additional","affiliation":[{"name":"Al-Khwarizmi Institute of Computer Science (KICS), University of Engineering & Technology (UET), Lahore 54890, Pakistan"}]},{"given":"Farrukh","family":"Shahzad","sequence":"additional","affiliation":[{"name":"Al-Khwarizmi Institute of Computer Science (KICS), University of Engineering & Technology (UET), Lahore 54890, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3195-3168","authenticated-orcid":false,"given":"Nuno M.","family":"Garcia","sequence":"additional","affiliation":[{"name":"Instituto de Telecomunica\u00e7\u00f5es, Universidade da Beira Interior, 6200-001 Covilh\u00e3, Portugal"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7664-0168","authenticated-orcid":false,"given":"Eftim","family":"Zdravevski","sequence":"additional","affiliation":[{"name":"Faculty of Computer Science and Engineering, University Ss Cyril and Methodius, 1000 Skopje, North Macedonia"}]}],"member":"1968","published-online":{"date-parts":[[2021,4,26]]},"reference":[{"key":"ref_1","unstructured":"(2021, February 06). Internet of Things (IoT) Connected Devices Installed Base Worldwide from 2015 to 2025. Available online: https:\/\/www.statista.com\/statistics\/471264\/iot-number-of-connected-devices-worldwide\/."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Patel, C., and Doshi, N. (2019). Security Challenges in IoT Cyber World. Security in Smart Cities: Models, Applications, and Challenges, Springer.","DOI":"10.1007\/978-3-030-01560-2_8"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Hussain, F., Abbas, S.G., Fayyaz, U.U., Shah, G.A., Toqeer, A., and Ali, A. (2020, January 5\u20137). Towards a Universal Features Set for IoT Botnet Attacks Detection. Proceedings of the 2020 IEEE 23rd International Multitopic Conference (INMIC), Bahawalpur, Pakistan.","DOI":"10.1109\/INMIC50486.2020.9318106"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"3343","DOI":"10.1109\/ACCESS.2019.2962829","article-title":"Intrusion detection protocols in wireless sensor networks integrated to internet of things deployment: Survey and future challenges","volume":"8","author":"Pundir","year":"2019","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"101660","DOI":"10.1016\/j.scs.2019.101660","article-title":"A survey on cybersecurity, data privacy, and policy issues in cyber-physical system deployments in smart cities","volume":"50","author":"Habibzadeh","year":"2019","journal-title":"Sustain. Cities Soc."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Pires, I.M., Hussain, F., Garcia, N.M., and Zdravevski, E. (2020). Improving Human Activity Monitoring by Imputation of Missing Sensory Data: Experimental Study. Future Internet, 12.","DOI":"10.3390\/fi12090155"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Pires, I.M., Hussain, F., Garcia, N.M., Lameski, P., and Zdravevski, E. (2020). Homogeneous Data Normalization and Deep Learning: A Case Study in Human Activity Classification. Future Internet, 12.","DOI":"10.3390\/fi12110194"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Hussain, F., Ehatisham-ul Haq, M., Azam, M.A., and Khalid, A. (2018, January 8\u201312). Elderly assistance using wearable sensors by detecting fall and recognizing fall patterns. Proceedings of the 2018 ACM International Joint Conference and 2018 International Symposium on Pervasive and Ubiquitous Computing and Wearable Computers, Singapore.","DOI":"10.1145\/3267305.3274129"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Hussain, F., Umair, M.B., Ehatisham-ul Haq, M., Pires, I.M., Valente, T., Garcia, N.M., and Pombo, N. (2019). An Efficient Machine Learning-based Elderly Fall Detection Algorithm. arXiv.","DOI":"10.21203\/rs.3.rs-39065\/v1"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Dimitrievski, A., Zdravevski, E., Lameski, P., and Trajkovik, V. (2019, January 25\u201327). Addressing Privacy and Security in Connected Health with Fog Computing. Proceedings of the 5th EAI International Conference on Smart Objects and Technologies for Social Good (GoodTechs \u201919), Valencia, Spain.","DOI":"10.1145\/3342428.3342654"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Seh, A.H., Zarour, M., Alenezi, M., Sarkar, A.K., Agrawal, A., Kumar, R., and Khan, R.A. (2020). Healthcare data breaches: Insights and implications. Healthcare, 8.","DOI":"10.3390\/healthcare8020133"},{"key":"ref_12","unstructured":"(2021, February 15). Worldwide Threat Assessment\u2014The Director National Intelligence\u2019s View, Available online: https:\/\/www.intelligence.senate.gov\/sites\/default\/files\/documents\/os-coats-051117.pdf."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"102248","DOI":"10.1016\/j.cose.2021.102248","article-title":"Cyber security in the age of covid-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic","volume":"105","author":"Lallie","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_14","unstructured":"(2021, January 18). Hackers are Targeting Hospitals Crippled by Coronavirus. Available online: https:\/\/www.wired.co.uk\/article\/coronavirus-hackers-cybercrime-phishing."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Rughoobur, P., and Nagowah, L. (2017, January 18\u201320). A lightweight replay attack detection framework for battery depended IoT devices designed for healthcare. Proceedings of the 2017 International Conference on Infocom Technologies and Unmanned Systems (Trends and Future Directions) (ICTUS), Dubai, United Arab Emirates.","DOI":"10.1109\/ICTUS.2017.8286118"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Ghazanfar, S., Hussain, F., Rehman, A.U., Fayyaz, U.U., Shahzad, F., and Shah, G.A. (2020, January 26\u201327). Iot-flock: An open-source framework for iot traffic generation. Proceedings of the 2020 International Conference on Emerging Trends in Smart Technologies (ICETST), Karachi, Pakistan.","DOI":"10.1109\/ICETST49965.2020.9080732"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1016\/j.asoc.2018.05.049","article-title":"Semi-supervised learning based distributed attack detection framework for IoT","volume":"72","author":"Rathore","year":"2018","journal-title":"Appl. Soft Comput."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Hussain, F., Abbas, S.G., Husnain, M., Fayyaz, U.U., Shahzad, F., and Shah, G.A. (2020, January 5\u20137). IoT DoS and DDoS Attack Detection using ResNet. Proceedings of the 2020 IEEE 23rd International Multitopic Conference (INMIC), Bahawalpur, Pakistan.","DOI":"10.1109\/INMIC50486.2020.9318216"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Kumar, A., and Lim, T.J. (2019). Early Detection Of Mirai-Like IoT Bots In Large-Scale Networks Through Sub-Sampled Packet Traffic Analysis. arXiv.","DOI":"10.1007\/978-3-030-12385-7_58"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Carta, S., Podda, A.S., Reforgiato Recupero, D.R., and Saia, R. (2020). A Local Feature Engineering Strategy to Improve Network Anomaly Detection. Future Internet, 12.","DOI":"10.3390\/fi12100177"},{"key":"ref_21","first-page":"140","article-title":"Feature extraction based on word embedding models for intrusion detection in network traffic","volume":"1","author":"Corizzo","year":"2020","journal-title":"J. Surveill. Secur. Saf."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Santos, L., Rabadao, C., and Gon\u00e7alves, R. (2018, January 13\u201316). Intrusion detection systems in Internet of Things: A literature review. Proceedings of the 2018 13th Iberian Conference on Information Systems and Technologies (CISTI), Caceres, Spain.","DOI":"10.23919\/CISTI.2018.8399291"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1016\/j.jnca.2017.02.009","article-title":"A survey of intrusion detection in Internet of Things","volume":"84","author":"Zarpelao","year":"2017","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_24","unstructured":"(2021, February 20). IoT-Flock: An Open-source Tool for IoT Traffic Generation. Available online: https:\/\/github.com\/ThingzDefense\/IoT-Flock."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Alrashdi, I., Alqazzaz, A., Alharthi, R., Aloufi, E., Zohdy, M.A., and Ming, H. (2019, January 10\u201312). FBAD: Fog-based attack detection for IoT healthcare in smart cities. Proceedings of the 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), New York, NY, USA.","DOI":"10.1109\/UEMCON47517.2019.8992963"},{"key":"ref_26","unstructured":"(2021, February 04). 1998 DARPA Intrusion Detection Evaluation Dataset. Available online: https:\/\/www.ll.mit.edu\/r-d\/datasets\/1998-darpa-intrusion-detection-evaluation-dataset."},{"key":"ref_27","unstructured":"(2021, February 04). KDD Cup 1999 Data. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_28","unstructured":"(2021, February 06). NSL-KDD Dataset. Available online: https:\/\/www.unb.ca\/cic\/datasets\/nsl.html."},{"key":"ref_29","unstructured":"(2021, February 06). DEFCON. Available online: https:\/\/www.defcon.org\/html\/links\/dc-ctf.html."},{"key":"ref_30","unstructured":"(2021, February 06). LBNL\/ICSI Enterprise Tracing Project. Available online: http:\/\/www.icir.org\/enterprise-tracing\/."},{"key":"ref_31","unstructured":"(2021, February 06). Center for Applied Internet Data Analysis (CAIDA). Available online: https:\/\/www.caida.org\/data\/."},{"key":"ref_32","unstructured":"(2021, February 06). UNIBS: Data Sharing. Available online: http:\/\/netweb.ing.unibs.it\/~ntw\/tools\/traces\/index.php."},{"key":"ref_33","unstructured":"(2021, February 06). ISCX. Available online: http:\/\/www.iscx.ca\/datasets\/."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the ICISSP, Funchal, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Koroniotis, N., Moustafa, N., Sitnikova, E., and Turnbull, B. (2018). Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset. arXiv.","DOI":"10.1016\/j.future.2019.05.041"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Vaccari, I., Chiola, G., Aiello, M., Mongelli, M., and Cambiaso, E. (2020). MQTTset, a New Dataset for Machine Learning Techniques on MQTT. Sensors, 20.","DOI":"10.3390\/s20226578"},{"key":"ref_38","unstructured":"(2021, February 20). Global DDoS Threat Landscape Q1 2017. Available online: https:\/\/www.incapsula.com\/ddos-report\/ddos-report-q1-2017.html."},{"key":"ref_39","unstructured":"(2021, February 19). CVE-2018-1684 Detail, Available online: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-1684."},{"key":"ref_40","unstructured":"(2021, February 17). CVE-2016-9877 Detail, Available online: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-9877."},{"key":"ref_41","unstructured":"(2021, February 18). CVE-2016-10523 Detail, Available online: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-10523."},{"key":"ref_42","unstructured":"(2021, February 15). WireShark. Available online: https:\/\/www.wireshark.org\/."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"475","DOI":"10.1007\/s10207-016-0344-y","article-title":"Detecting zero-day attacks using context-aware anomaly detection at the application-layer","volume":"16","author":"Duessel","year":"2017","journal-title":"Int. J. Inf. Secur."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1109\/COMST.2018.2870658","article-title":"DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications","volume":"21","author":"Praseed","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_45","unstructured":"(2021, February 21). Kaspersky DDoS Intelligence Report for Q1 2016. Available online: https:\/\/securelist.com\/kaspersky-ddos-intelligence-report-for-q1-2016\/74550\/."},{"key":"ref_46","unstructured":"(2021, April 16). A-Framework-for-Malicious-Traffic-Detection-in-IoT-Healthcare-Environment. Available online: https:\/\/github.com\/ThingzDefense\/A-Framework-for-Malicious-Traffic-Detection-in-IoT-Healthcare-Environment."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/9\/3025\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,11]],"date-time":"2024-07-11T21:18:50Z","timestamp":1720732730000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/9\/3025"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,4,26]]},"references-count":46,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2021,5]]}},"alternative-id":["s21093025"],"URL":"https:\/\/doi.org\/10.3390\/s21093025","relation":{},"ISSN":["1424-8220"],"issn-type":[{"type":"electronic","value":"1424-8220"}],"subject":[],"published":{"date-parts":[[2021,4,26]]}}}