Threat Intelligence for IoT Cybersecurity: Frameworks, Detection Methodologies, and Deployment Strategies

Author

Arunabh K S, Ms. Riya K Prakash, Dr. L C Manikandan

Abstract

 For much of the past two decades, organizations defended their digital assets using static, signature-driven tools anchored at a well-defined network boundary. That assumption is no longer tenable. The rapid, uncontrolled expansion of Internet of Things (IoT) devices spanning consumer gadgets, industrial sensors, and embedded medical equipment has created a sprawling, largely unmanaged attack surface that legacy boundary defenses were never designed to observe, let alone protect. Constrained processing budgets, fragmented protocol stacks (MQTT, CoAP, Zigbee, Modbus), infrequent firmware updates, and always-on connectivity combine to make IoT fleets an attractive staging ground for botnets, ransomware pivots, and covert reconnaissance. Threat Intelligence (TI), when purpose-built for these constraints, offers a way out of this impasse: it converts scattered, low-context telemetry into structured, actionable knowledge that machines and analysts alike can act upon before damage occurs.This paper examines how threat intelligence can be engineered specifically for IoT cybersecurity, tracing the full operational path from constrained-device data capture and on-device inference through standardized indicator exchange and cooperative, privacy-conscious intelligence sharing across organizational boundaries. Building on this foundation, the paper surveys five representative deployment contexts—industrial cyber-physical systems, consumer smart-home networks, malware-focused honeypot and sandbox pipelines, semantically aware automated response engines, and the emerging domains of smart agriculture and connected healthcare—to illustrate how the same underlying intelligence lifecycle adapts to very different risk profiles and latency requirements. A comparative assessment of the enabling techniques and a discussion of practical deployment frictions round out the analysis before the paper closes with open research directions and a synthesis of its findings.

Keywords

Threat Intelligence (TI), Internet of Things (IoT) Security, Edge Analytics, TinyML, Federated Learning, STIX/TAXII, Decentralized Intelligence Sharing, Industrial IoT (IIoT), Honeypots, Semantic Threat Detection.

Full Text:

Download Paper PDF

References

1] D. Mendez Mena and B. Yang, "Decentralized Actionable Cyber Threat Intelligence for Networks and the Internet of Things," IoT, vol. 2, no. 1, pp. 1-16, 2020.

[2] A. Dutta and S. Kant, "Implementation of a Cyber Threat Intelligence Platform on IoT Using a TinyML Approach for Deceiving Cyber Invasion," Proc. Int. Conf. on Artificial Intelligence and Smart Systems, 2021.

[3] S. Brown, et al., "Cyber Threat Intelligence for IoT Using Machine Learning," IEEE Trans. Network and Service Management, vol. 19, no. 3, pp. 2100-2114, 2022.

[4] A. Collen and N. A. Nijdam, "Can I Sleep Safely in My Smart Home? A Novel Framework on Automating Dynamic Risk Assessment in IoT Environments," Electronics, vol. 11, no. 7, p. 1123, 2022.

[5] R. Alvarez, et al., "ESSecA: An Automated Expert System for Threat Modelling and Penetration Testing for IoT Ecosystems," Computers & Security, vol. 118, p. 102730, 2022.

[6] P. Kumar, et al., "Tools and Techniques for Collection and Analysis of Internet-of-Things Malware: A Systematic State-of-the-Art Review," ACM Computing Surveys, vol. 55, no. 4, pp. 1-36, 2022.

[7] A. Sharma, et al., "An Intelligent Context-Aware Threat Detection and Response Model for Smart Cyber-Physical Systems," IEEE Internet of Things Journal, vol. 10, no. 12, pp. 10450-10462, 2023.

[8] P. T. Duy, et al., "FedChain-Hunter: A Reliable and Privacy-Preserving Aggregation for Federated Threat Hunting in SDN-Based IIoT," Internet of Things, vol. 24, p. 100966, 2023.

[9] M. Hassan, et al., "Collaborative Threat Intelligence: Enhancing IoT Security Through Blockchain and Machine Learning Integration," Journal of Network and Computer Applications, vol. 221, p. 103780, 2024.

[10] L. Zhao, et al., "FedCTI: Federated Learning and Cyber Threat Intelligence on the Edge for Secure IoT Networks," IEEE Trans. Information Forensics and Security, vol. 19, pp. 3200-3215, 2024.

[11] K. Patel, et al., "SmartSentry: Cyber Threat Intelligence in Industrial IoT," IEEE Micro, vol. 44, no. 2, pp. 45-54, 2024.

[12] V. Singh, et al., "Cyber Attack Detection in IoT-WSN Devices with Threat Intelligence Using Hidden and Connected Layer Based Architectures," Wireless Networks, vol. 30, no. 4, pp. 1820-1835, 2024.

[13] I. Ali, et al., "A Novel Cyber Threat Intelligence Platform for Evaluating the Risk Associated with Smart Agriculture," Computers and Electronics in Agriculture, vol. 228, p. 108500, 2025.

[14] F. Rahman, et al., "A Computational Framework for IoT Security Integrating Deep Learning-Based Semantic Algorithms for Real-Time Threat Response," Future Generation Computer Systems, vol. 162, p. 107400, 2025.

[15] A. Al-Sulaihi, et al., "Toward Using Cyber Threat Intelligence with Machine and Deep Learning for IoT Security: A Comprehensive Study," IEEE Access, vol. 13, pp. 15200-15225, 2025.

Share your valuable work from Social Media Buttons