Wireless Sensor Networks (WSN) are commonly adopted by the Industrial Internet of Things (IIoT) scenarios due to their easy and fast deployment. However, WSNs are especially vulnerable to security attacks as reflexive packet flooding Denial of Service (DoS) may occur. Admission control and reputation-based strategies are effective for attacks detection. However, mitigation strategies to deal with the effects of these attacks, such as congestion channel transmission is an open issue. Additionally, the resource-constrained nature of nodes, as low bandwidth, limited memory, and battery within WSNs, poses a challenge to develop efficient mechanisms in such scenario. To address this issue, we propose a Distributed Congestion Control by Duty-cycle Restriction (D-ConCReCT) to detect and mitigate DoS in IIoT. The main goal is to investigate its feasibility in large-scale networks, as well as its ability to reduce both the detection and mitigation times when compared to a previous centralized approach, so-called ConCReCT. Our results indicate that D-ConCReCT may be applied in the mitigation of DoS attacks in a sensor network scenario with 500 nodes.

Connected and digital electricity substations based on IEC–61850 standards enable novel applications. On the other hand, such connectivity also creates an extended attack surface. Therefore, Intrusion Detection Systems (IDSs) have become an essential component of safeguarding substations from malicious activities. However, in contrast to traditional information technology systems, there is a serious lack of realistic data for training, testing, and evaluating IDSs in smart grid scenarios. Many existing substation IDSs rely on datasets from other contexts or on proprietary datasets that do not allow reproducibility, validation, or performance comparison with competing algorithms. To address this issue, we propose the Efficacious Reproducer Engine for Network Operations (ERENO) synthetic traffic generation framework based on the IEC–61850 standard specifications. As an additional contribution, and as a proof-of-concept, we create and make available a suite of realistic IEC–61850 datasets that model 8 use cases, namely traffic for 7 common attacks and one for normal network traffic. Based on those datasets, we further evaluate how enriched features combining raw data from the substation can significantly improve intrusion detection performance. Our results suggest that it can improve F1-Score up to 47.22% for masquerade attacks.

Cyber-Physical Systems (CPS) are the basis for the world’s critical infrastructure and, thus, have the potential to significantly impact human lives in the near future. In recent years, there has been an increasing demand for connectivity in CPS, which has brought to attention the issue of cybersecurity. Aside from traditional information systems threats, CPS face new challenges due to the heterogeneity of devices and protocols, as well as its strong reliability requirements. In this work, we provide a brief overview of the CPS architecture and applications and describe the security challenges in the three CPS layers of perception, transmission, and application. Besides, we discuss how feature selection (FS) may improve intrusion detection performance. In particular, we evaluate how metaheuristic approaches can improve classification performance in CPS perception, transmission, and application layers. Our results reveal that (i) Greedy Randomized Adaptive Search Procedure (GRASP) outperforms traditional filter-based methods, and (ii) using the proposed enhanced approaches in GRASP construction and local search phases can enhance the average F1-Score of five classifier algorithms.