Cited by 48Network Security and Intrusion DetectionInternet of Things and AIIoT and Edge/Fog Computing

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

Open access
Bahaa, Ahmed, Abdelaziz, Ahmed, Sayed, Abdalla, Elfangary, Laila, Fahmy, Hanan·2021·Information

Abstract

In many enterprises and the private sector, the Internet of Things (IoT) has spread globally. The growing number of different devices connected to the IoT and their various protocols have contributed to the increasing number of attacks, such as denial-of-service (DoS) and remote-to-local (R2L) ones. There are several approaches and techniques that can be used to construct attack detection models, such as machine learning, data mining, and statistical analysis. Nowadays, this technique is commonly used because it can provide precise analysis and results. Therefore, we decided to study the previous literature on the detection of IoT attacks and machine learning in order to understand the process of creating detection models. We also evaluated various datasets used for the models, IoT attack types, independent variables used for the models, evaluation metrics for assessment of models, and monitoring infrastructure using DevSecOps pipelines. We found 49 primary studies, and the detection models were developed using seven different types of machine learning techniques. Most primary studies used IoT device testbed datasets, and others used public datasets such as NSL-KDD and UNSW-NB15. When it comes to measuring the efficiency of models, both numerical and graphical measures are commonly used. Most IoT attacks occur at the network layer according to the literature. If the detection models applied DevSecOps pipelines in development processes for IoT devices, they were more secure. From the results of this paper, we found that machine learning techniques can detect IoT attacks, but there are a few issues in the design of detection models. We also recommend the continued use of hybrid frameworks for the improved detection of IoT attacks, advanced monitoring infrastructure configurations using methods based on software pipelines, and the use of machine learning techniques for advanced supervision and monitoring.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/info12040154

Cites

81 of 81 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Embedding automated security testing and machine learning into CI/CD pipelines facilitates early attack detection and continuous vulnerability assessment across varied IoT landscapes.

    “finding that embedding automated security testing and machine learning into CI/CD pipelines facilitates early attack detection and continuous vulnerability assessment across varied IoT landscapes.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [34]

    Section 3.6 says IoT detection models using DevSecOps pipelines were more secure, and the Abstract says machine learning can detect IoT attacks. The Discussion recommends pipeline-based monitoring and machine learning, but the paper does not establish that embedding automated security testing and machine learning in CI/CD pipelines enables early attack detection or continuous vulnerability assessment across varied IoT settings. (LLM, conf=0.86)

    Experimental — accuracy not yet measured
  • The literature reveals ongoing challenges including a shortage of security experts, limited resources, scalability issues for heterogeneous device ecosystems, high false positive rates, and insufficient standardisation of evaluation metrics.

    “nonetheless, the literature reveals ongoing challenges including a shortage of security experts, limited resources, scalability issues for heterogeneous device ecosystems, high false positive rates, and insufficient standardisation of evaluation metrics.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [34]

    The Introduction (page unavailable) links the growing number of different IoT devices and protocols to security risks, and the Discussion (page unavailable) identifies challenges in attack-detection datasets and models. The review also catalogs varied evaluation metrics, but the passages do not establish a shortage of security experts, limited resources, scalability problems, high false-positive rates, or insufficient standardisation of metrics as ongoing challenges. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Bipraneel, R.; Cheung, H. A deep learning approach for intrusion detectionin internet of things using BI-directional long short- term memory recurrent neural network. In Proceedings of the 28th International Telecommunication Networks and Applications Conference (ITNAC), Sydney, NSW, Australia, 21-23 November 2018.

Cited by

Sorted by citations

Authors
Bahaa, A., Abdelaziz, A., Sayed, A., Elfangary, L., & Fahmy, H.
Affiliations
  • Beni-Suef University (EG)
  • Higher Technological Institute (EG)
  • Helwan University (EG)
Corresponding author
Abdelaziz, Ahmed
Venue
Information
Publisher
MDPI AG
Published
2021-04-07
Volume
12
Issue
4
Pages
154
ISSN
2078-2489 (ISSN-L)
OpenAlex
W3150051937
Cited by
48
References
81
Citations by year
2026: 6 · 2025: 16 · 2024: 8 · 2023: 8 · 2022: 6 · 2021: 4
FWCI
1.05
Type
journal article
Language
en
Open access
Locations
  • Information (publishedVersion, cc-by)
  • Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
Keywords
Internet of Things security, attack detection, DevSecOps, machine learning, denial-of-service attacks, remote-to-local attacks, network layer attacks, NSL-KDD dataset, UNSW-NB15, security monitoring, software pipeline, hybrid detection system

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review