Internet of Things (IoT) devices can be exploited by the attackers as entry points to break into the IoT networks without early detection. Little work has taken hybrid approaches that combine different defense mechanisms in an optimal way to increase the security of the IoT against sophisticated attacks. In this work, we propose a novel approach to generate the strategic deployment of adaptive deception technology and the patch management solution for the IoT under a budget constraint. We use a graphical security model along with three evaluation metrics to measure the effectiveness and efficiency of the proposed defense mechanisms. We apply the multi-objective genetic algorithm (GA) to compute the Pareto optimal deployments of defense mechanisms to maximize the security and minimize the deployment cost. We present a case study to show the feasibility of the proposed approach and to provide the defenders with various ways to choose optimal deployments of defense mechanisms for the IoT. We compare the GA with the exhaustive search algorithm (ESA) in terms of the runtime complexity and performance accuracy in optimality. Our results show that the GA is much more efficient in computing a good spread of the deployments than the ESA, in proportion to the increase of the IoT devices.
@cite_37: In many Internet of Thing (IoT) application domains security is a critical requirement, because malicious parties can undermine the effectiveness of IoT-based systems by compromising single components and or communication channels. Thus, a security infrastructure is needed to ensure the proper functioning of such systems even under attack. However, it is also critical that security be at a reasonable resource and energy cost. In this article, we focus on the problem of efficiently and effectively securing IoT networks by carefully allocating security resources in the network area. In particular, given a set of security resources R and a set of attacks to be faced A, our method chooses the subset of R that best addresses the attacks in A, and the set of locations where to place them, that ensure the security coverage of all IoT devices at minimum cost and energy consumption. We model our problem according to game theory and provide a Pareto-optimal solution in which the cost of the security infrastructure, its energy consumption, and the probability of a successful attack are minimized. Our experimental evaluation shows that our technique improves the system robustness in terms of packet delivery rate for different network topologies. Furthermore, we also provide a method for handling the computation of the resource allocation plan for large-scale networks scenarios, where the optimization problem may require an unreasonable amount of time to be solved. We show how our proposed method drastically reduces the computing time, while providing a reasonable approximation of the optimal solution.
@cite_29: 
@cite_33: We present a formal method for computing the bestsecurity provisioning for Internet of Things (IoT) scenarios characterizedby a high degree of mobility. The security infrastructureis intended as a security resource allocation plan, computedas the solution of an optimization problem that minimizes therisk of having IoT devices not monitored by any resource. Weemploy the shortfall as a risk measure, a concept mostly usedin the economics, and adapt it to our scenario. We show how tocompute and evaluate an allocation plan, and how such securitysolutions address the continuous topology changes that affect anIoT environment.
Little work has addressed a problem on how to optimally select defense mechanisms for the IoT. Rullo @cite_37 developed a resource allocation mechanism to ensure the security of the IoT based on an a Stackelberg game. Based on the decisions from the attack-defense game, this work derived the best security resource allocation plan to achieve multiple system goals in terms of minimizing maximal risk, maximal criticality, energy consumption, and allocation cost. Rullo @cite_33 also took another approach to develop an optimal security resource allocation for an IoT network with mobile nodes based on GAs. Both works @cite_37 @cite_29 assume that an attacker can proceed a next attack after it can compromise a security resource. However, it is not realistic as highly sophisticated, stealthy attackers can directly compromise other components of a system while not being detected. Further, these works focus on device-level security but do not concern system-level security.