Sensor and intelligence embedded technologies including RFID readers, sensors or GPS are under threat because of various security flaws. Main threats are discussed below:

Spoofing: It is initiated with a fake broadcast message sent to sensor network by the attackers. It makes it to assume its originality falsely which makes it appearing from the original source [29] . It is quite often that this scenario is results in the attacker obtaining full access to the system making it vulnerable.

Signal/Radio Jamming: It is a type of DoS attack that it occupies the communication channel between the nodes and hinders them from communicating with each other [30] .

Device-tampering/Node-capturing: The attacker captures the sensor node physically replaces the node with their malicious node. This type of attack usually results in the attacker gaining total control over the captured node and harms the network [31] .

Path-based DoS Attack (PDoS): In this type of DoS attack, the attacker overpowers sensor nodes a long distance away by flooding a multihop end-to-end communication path with either replayed packets or injected spurious packets [32] . Diminished system availability and exhaustion in batteries of nodes are impacts of this physical attack.

Node Outage: The attack is applied logically or physically to the network and it stops the functionality of network components. Node services such as reading, collecting and initiating operations are stopped because of this attack [31] .

Eavesdropping: Wireless characteristics of RFID system make it possible that attacker sniffs out the confidential information such as password or any other data flowing from tag-to-reader or reader-to-tag making the system vulnerable [21] [33] .

Various kinds of perception layer attacks are listed below with related risks on security mechanisms of IoT in Table 3.

Network layer which is known as the next-generation network are exposed to many kinds of threats. Related threats that come from this layer are listed below:

Selective Forwarding: In such attacks, malicious nodes do not forward some messages and selectively drop them, ensuring that they cannot propagate later

on. The attacker who is responsible for suppression or modification of packets originating from a select few nodes can sometimes forward the remaining traffic not to reveal her wrongdoing. There are different types of selective forwarding attacks. In one type, the malicious node can selectively drop the packets coming from a particular node or a group of nodes. This situation poses a risk of DoS attack for that node or a group of nodes. Another type of selective forwarding attack is called Neglect and Greed. In this type of attack, the subverted node arbitrarily skips routing some messages [34] .

Sybil Attack: It is clarified as a malicious device illegitimately taking on multiple identities [35] . Sybil attack [36] , an attacker can “be in more than one place at once” as a single malicious node. It presents multiple identities to other nodes in the network reducing the effectiveness of fault tolerant schemes.

Sinkhole Attack (Blackhole): The sink hole is defined in [37] by intense resource contention among neighboring nodes of the malicious node for the limited bandwidth and channel access. It results in congestion and can accelerate the energy consumption of the nodes involved. With sink holes forming in a sensor network, it is vulnerable to several other types of denial of service attacks [38] [37] [39] .

Wormhole: This form of DoS attack induces relocation of bits of data from its original position in the network. This relocation of data packet is carried out through tunneling of bits of data over a link of low latency [39] .

Man-in-the-Middle Attack: This attack is described as a form of eavesdropping in which the unauthorized party can monitor or control all the private communications between the two parties hideously. The unauthorized party can even fake the identity of the victim and communicate normally to gain more information [21] .

Hello-flood Attack: High traffic in channels is the main disrupting effect of this attack which congests the channel with an unusually high number of useless messages. Basically, a single malicious node sends a useless message which is then replied by the attacker to create a high traffic [30] .

Acknowledgement Flooding: Routing algorithms in sensor-based systems need acknowledgements from time to time. In this type of DoS attack, a malicious node sends false information to destined neighboring nodes by the help of these acknowledgements [30] .

Target of threats in support layer are mainly data storage technologies. These threats are discussed below:

Tampering with Data: The attack appears when a person from the inside tampers the data for personal benefits or commercial benefits of any 3rd party companies. The data can be extracted and modified easily on purpose from the inside [17] .

DoS Attack: Similar effects of DoS attacks that are discussed in previous layers are seen in this layer, too; e.g. it shuts down the system which results in unavailability of the services.

Unauthorized Access: The attacker can easily infiltrate into the system and damage the system by preventing the access to the related services of IoT or deleting sensitive data. Hence, an unauthorized access can be fatal for the system [21] .

The personalized services based on the needs of the users are included in the application layer; e.g. the interface that user can control devices in IoT [4] . Threats in this layer mainly target these services as mentioned below:

Sniffer/Loggers: Attackers can introduce sniffer/logger programs into the system that take important information from the network traffic. The main goal of the sniffer is to steal passwords, files (FTP files, E-mail files), and E-mail text. Many protocols are prone to sniffing [40] .

Injection: Attackers may enter code directly into the application that is executed on the server. This is a very common attack, easy to exploit, and can cause some bad results such as data loss, data corruption and lack of accountability [41] .

Session Hijacking: This attack reveals personal identities by exploiting security flaws in authentication and session management. This type of attack is very common and effects of attack are really important. With the identity of someone else, attacker can do anything the real user can do [41] .

DDoS (Distributed Denial of Service): Its working principle is the same as the traditional Denial of Service attack. However, it is executed by multiple attackers at the same time [21] [30] [41] .

Social Engineering: A serious threat for application layer where attackers can obtain information from users via chats, knowing each other etc. [4] .

Taking security measures for the perception layer dates back times before IoT.

Equipments such as RFID readers, sensors, gateways, GPS and other devices require to be secured efficiently. OWASP has identified poor physical security in the top 10 IoT vulnerabilities [42] . The first step is to ensure that only authorized people can have access to sensitive data produced by physical objects, that’s why a physical identity and access management policy need to be defined [43] . Authentication and authorization requirements from IoT are satisfied in this similar fashion.

Data collection is an important issue for this layer. In [44] , this issue is examined in two separate headings. In one heading which is presented as multimedia data collection, there are some recommended security techniques such as multimedia compression, stenography, water marking, encryption, time session and intellectual property. The second heading is image data collection, to use security in images as image compression, and CRC.

Cryptographic processing is one of the main tasks in security mechanisms for sensor data on IoT. These operations that are often used in order to guarantee privacy of data include encryption and decryption, key and hash generation, and sign and verify hashes. Table 4 gives some frequently used cryptographic algorithms and their use purposes in Internet security protocols based on studies [18] and [45] .

Wander et al. [46] compare two asymmetric algorithms in Table 4, RSA and Elliptic Curve Cryptography (ECC) [47] , on sensor nodes and prove that ECC is more efficient than RSA, and asymmetric cryptography is applicable for resource-constrained hardware. Hence, researchers focus on reducing complexity of asymmetric cryptographic algorithms and key distribution protocols. Wood et al. [48] and Hu et al. [49] present hardware cryptographic solutions for smart objects in their study. Key distribution mechanism of Liu et al. [50] and Chung et al. [51] are demonstrated in order to use in lightweight communication channels in resource-constrained networks. These improvements make cryptographic mechanisms in the context of WSNs more applicable. However, unique customized solutions are created and still there has been no standardized way of implementing services [52] .

Risk Assessment is a fundamental of IoT security which determines the extent of the potential threat and the risk associated with an IoT system. The output of this process helps to identify appropriate controls for reducing or eliminating risk during the risk mitigation process. A number of organizations have developed guidelines for conducting risk assessment such as the U.S. National Institute of Standards and Technology (NIST) [53] [54] ; the International Standards Organization (ISO) and the International Electrotechnical Commission (IEC) [55] .

The security of network layer can be examined in two main sub-layers; wireless and wired. One of the initial actions in wireless security sub-layer is the development of protocols for authentication and key management [56] . For example; SSL/TLS is developed to encrypt the link in the transport layer, and IP security protocol (IPSec) is developed to keep the network layer secure. They can provide authenticity, confidentiality and integrity in the each layer [18] . Also, using PPSK (Private Pre-Shared Key) for each sensor or device connected to the network provides another security measure for IoT system. By providing different unique keys, the access domain for each type of device can be defined easily. Moreover, disabling guest and default passwords in network devices such as routers and gateways should be done immediately upon installing a new network device. This includes strong password policies, password management and periodic change of passwords [43] .

The wired security sub-layer is concerned with devices, which communicate with other devices on the IoT system using wired channels. Common security techniques are applied in wired type networks are firewalls and Intrusion Prevention System (IPS). If the network has firewall or IPS, it can inspect network packets deeply that are destined towards the destination. However, existing IoT has no ability in terms of packet inspection and packet filtering. There is an ongoing research on this issue where security researchers try to design a low resource-hungry firewall for IoT to provide the ability of packet inspection [4] .

All information about the security of network layer that is discussed above is summarized in Table 5.

Devipriya et al. [44] claims that this topic contains two sub-layers. In one sub- layer, there are local applications and related middleware functions which should be secured with various techniques. For example, intelligent transportation systems can use encryption techniques, while smart home/smart metering

systems uses steganography techniques. The second sublayer corresponds to national applications and their security systems, ensuring that sent and received data are secure. Therefore, various security techniques are applied in these systems based on the scope of each system such as authentication, authorization, access control list, selective disclosure, intrusion detection, firewall, and antivirus.

According to Farooq et al. [21] , authentication mechanism preventing the access of intruders is applied in support and application layer by integrated identity identifications. This identity security mechanism is exactly similar to that in the network layer. The difference is that these layers focus on authentications by some certain cooperating services which means users can even choose the associated information to be shared with the services.

Data security is another issue on these layers [57] . There are various precautions taken by security system on IoT such as:

・ Safe programming and anti-virus software testing against malicious code injections and service loopholes,

・ Verification of data and developing temporary cache against malicious operations,

・ Session inspection mechanism to stop attacks of hijacking and redo sessions,

・ Boundary inspection, data encryption mechanism and resource access control to avoid leakage of privacy.

The IoT is vulnerable to a number of attacks that are mentioned in previous sections to disrupt the whole system, thus intrusion detection is a crucial concept for IoT deployments in real world such as industrial automation, building automation, smart metering and smart grids [58] . Attacks against a system are detected during analysis of actions in the system by a security mechanism broadly termed as Intrusion Detection System (IDS). When an attack is detected, IDS may log information about it and/or report an alarm. There are different existing intrusion detection techniques such as anomaly detection [59] , data mining techniques [60] [61] , statistical analysis [62] etc.