CoChat
Sign Up
Cited by 24Network Security and Intrusion DetectionSmart Grid Security and ResilienceInternet of Things and AI

Agentless Approach for Security Information and Event Management in Industrial IoT

Open access
Zahid, Huma, Hina, Sadaf, Hayat, Muhammad Faisal, Shah, Ghalib A.·2023·Electronics
DOI 10.3390/electronics12081831
Open this paper in CoChat — free accountOpen PDF

Abstract

The Internet of Things (IoT) provides ease of real-time communication in homes, industries, health care, and many other dependable and interconnected sectors. However, in recent years, smart infrastructure, including cyber-physical industries, has witnessed a severe disruption of operation due to privilege escalation, exploitation of misconfigurations, firmware hijacking, malicious node injection, botnets, and other malware infiltrations. The proposed agentless module for Wazuh security information and event management (SIEM) solution contributes to securing small- to large-scale IoT networks of industry 4.0. An agentless module is implemented by vigilantly examining the IoT device traffic without installing any agent or software on the endpoints. In the proposed research scheme, a module sniffs the network traffic of IoT devices captured from the gateway and passes it to a machine learning model for initial detection and prediction. The output of the ML model is embedded in the JSON log format and passed through the Wazuh agent to the Wazuh server where a decoder is added that decodes the network traffic logs. For event monitoring in Wazuh, industrial protocols are also thoroughly analyzed, and the feature set is determined. These features are used to write rules which are tested on the SWaT dataset, utilizing a common industrial protocol (CIP) for communication. Custom and dynamic rules are written at the Wazuh end to generate alerts to respond to any anomaly detected by the machine learning (ML) model or in the protocols used. Finally, in case of any event or an attack is detected, the alerts are fired on the Wazuh dashboard. This agentless SIEM solution has practical implications for the security of the industrial control systems of industry 4.0.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/electronics12081831

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns.

    “This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns [60-62,64].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [60]

    The Introduction (page unavailable) describes ML-based attack detection at an IIoT gateway and dynamic SIEM rules based on predictions. It does not describe SDN controllers enforcing policies or rules derived from learned device profiles; its rules are for alert generation and event monitoring. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

  • The surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer by coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering.

    “By coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering, the surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer [60-64].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [60]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Zahid et al. [60] proposed an agentless security framework that sniffs IoT/IIoT traffic at the gateway and links machine-learning-based anomaly detection results with Wazuh SIEM policies.

    “Using SWaT and CICDDoS2019 network traffic, Zahid et al. [60] proposed an agentless security framework that sniffs IoT/IIoT traffic at the gateway and links machine-learningbased anomaly detection results with Wazuh SIEM policies.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [60]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 22 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Zahid, H., Hina, S., Hayat, M. F., & Shah, G. A.
Affiliations
  • University of Engineering and Technology Lahore (PK)
  • University of Salford (GB)
Corresponding author
Hina, Sadaf
ORCID
Venue
Electronics
Publisher
MDPI AG
Published
2023-04-12
Volume
12
Issue
8
Pages
1831
ISSN
2079-9292 (ISSN-L)
DOI
10.3390/electronics12081831
OpenAlex
W4365453589
Cited by
24
References
22
Citations by year
2026: 4 · 2025: 7 · 2024: 10 · 2023: 3
FWCI
2.67
Type
journal article
Language
en
Open access
Licence
Locations
  • Electronics (publishedVersion, cc-by)
  • University of Salford Institutional Repository (University of Salford) (submittedVersion, cc-by)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
Keywords
security information and event management, Industrial Internet of Things, Wazuh, network traffic analysis, machine learning for intrusion detection, industrial cybersecurity, Industry 4.0, industrial communication protocols, SWaT dataset, anomaly detection, event monitoring, alerting

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review