The Internet of Things (IoT) is omnipresent, exposing a large number of devices that often lack security controls to the public Internet. In the modern world, many everyday processes depend on these devices, and their service outage could lead to catastrophic consequences. There are many Deep Packet Inspection (DPI) based intrusion detection systems (IDS). However, their linear computational complexity induced by the event-driven nature poses a power-demanding obstacle in resource-constrained IoT environments. In this paper, we shift away from the traditional IDS as we introduce a novel and lightweight framework, relying on a time-driven algorithm to detect Distributed Denial of Service (DDoS) attacks by employing Machine Learning (ML) algorithms leveraging the newly engineered features containing system and network utilization information. These features are periodically generated, and there are only ten of them, resulting in a low and constant algorithmic complexity. Moreover, we leverage IoT-specific patterns to detect malicious traffic as we argue that each Denial of Service (DoS) attack leaves a unique fingerprint in the proposed set of features. We construct a dataset by launching some of the most prevalent DoS attacks against an IoT device, and we demonstrate the effectiveness of our approach with high accuracy. The results show that standalone IoT devices can detect and classify DoS and, therefore, arguably, DDoS attacks against them at a low computational cost with a deterministic delay.

The proliferation of Internet of Things (IoT) devices and big data has catalyzed the emergence of data markets. Regulatory and technological frameworks such as International Data Spaces (IDS) have been developed to facilitate secure data exchange while integrating security and data sovereignty aspects required by laws and regulations, such as the GDPR and NIS2. Recently, novel attack vectors have taken a toll on many enterprises, causing significant damage despite the deployed security mechanisms. Hence, it is reasonable to assume that the IDS may be just as susceptible. In this paper, we conduct a STRIDE threat analysis on IDS to assess its susceptibility to traditional and emerging cybersecurity threats. Specifically, we evaluate novel threats such as Man-in-the-Middle (MitM) attacks, compromised end-user devices, SIM swapping, and potential backdoors in commonly used open-source software. Our analysis identifies multiple vulnerabilities, particularly at the trust boundary (TB) between users and the IDS system. These include the traditionally troublesome Denial of Service (DoS) attacks, key management weaknesses, and the mentioned novel threats. We discuss the hacking techniques, tools, and associated risks to the IDS framework, followed by targeted mitigation strategies and recommendations. This paper provides a framework for performing a STRIDE-based threat analysis of the IDS. Using the proposed methodology, we identified the most potent threats and suggested solutions, thus contributing to the development of a safer and more resilient data space architecture.

Slowloris is a well-known application-layer Denial of Service (DoS) attack that is challenging to detect due to its low-rate nature, allowing it to blend with legitimate traffic and remain unnoticed. Our hypothesis is that deliberate prolongation of the pre-authentication stage in stateful protocols induces unnecessary CPU utilization. In this study, we repurpose Slowloris as an energy-oriented (E-DoS) attack that exploits pre-authentication statefulness of the most prevalent remote access protocols, the Secure Shell Protocol (SSH) and File Transfer Protocol (FTP). We employ a Raspberry Pi-based experimental setup with different software implementations of the mentioned protocols to validate our hypothesis. Our experiments confirm the susceptibility of SSH and FTP to Slowloris E-DoS attacks, and we quantify the consequential impact on power consumption. We find that the Slowloris E-DoS attack exhibits an asymmetrical nature, causing a disproportionate computational demand on victim systems compared to the resources invested by the attacker. The results of this study indicate that battery-powered single-board computers (SBCs) are critically affected by these attacks due to their limited power availability. This research demonstrates the importance of understanding and mitigating Slowloris E-DoS vulnerabilities in the SSH and FTP protocols, offering valuable insights for enhancing security measures. Our findings show that millions of SBCs worldwide may be at risk and highlight a deeper structural weakness: the stateful design of widely deployed protocols can turn service availability into an energy liability. This systemic risk extends beyond SSH and FTP, with implications for IoT devices and backends that depend on stateful communication protocols.

The proliferation of IoT devices and big data has catalyzed the emergence of data markets. Regulatory and technological frameworks such as the International Data Spaces (IDS) have been developed to facilitate secure data exchange while integrating security and data sovereignty aspects required by laws and regulations, such as the GDPR and NIS2. Recently, novel attack vectors have taken a toll on many enterprises, causing significant damage despite the deployed security mechanisms. Hence, it is reasonable to assume that the IDS may be just as susceptible. In this paper, we conduct a STRIDE threat analysis on IDS to assess its susceptibility to traditional and emerging cybersecurity threats. Specifically, we evaluate novel risks in widely used software, including Man-in-the-Middle (MitM) attacks, compromised end-user devices, SIM swapping, and potential backdoors. Our analysis identifies multiple vulnerabilities, particularly at the trust boundary (TB) between users and the IDS system. These include Denial of Service (DoS) risks, key management weaknesses, and the mentioned novel threats. We discuss the hacking techniques, tools, and associated risks to the IDS framework, followed by targeted mitigation strategies and recommendations. This work provides foundational insights to support the development of a safer and more resilient data space architecture.