Modern societies are hyperconnected, relying on IoT devices in critical areas like healthcare, transport, industry, and homes. This connectivity brings convenience but also expands the “attack surface” for cyber threats. In recent years, significant incidents have shown how attackers can exploit insecure IoT devices; for example, the Mirai botnet hijacked thousands of smart cameras and routers by using their default passwords, turning them into a network of attack. Such events underscore the risk: a successful attack on IoT systems can disrupt services affecting even citizens’ safety. The challenge is that many IoT devices are resource-constrained (with limited computing power and memory) and often deployed in large numbers, making traditional security measures difficult to apply. INCENTIVE was conceived to address some of these challenges by developing new methods that help secure IoT devices in line with these evolving needs.
The project’s overarching objective is to proactively detect cyberattacks on IoT devices by continuously learning their “normal” behavior patterns. Instead of reacting after a breach, INCENTIVE’s approach is preventive, so it constantly monitors and learns from device activity to quickly flag abnormal behaviors. This is especially important for IoT, where attacks might not be immediately obvious.
To achieve its aim, INCENTIVE has four key objectives:
• O1. To understand IoT device behavior (with human factors) by developing enriched profiles of how IoT devices behave under normal conditions over time. This includes the influence of human interaction (e.g. how people manage settings, usage patterns, maintenance habits). These behavior profiles form a baseline to compare against and spot irregularities that could indicate a security threat.
• O2. Continuous decentralized learning through the design of a secure learning process that updates these behavior profiles using Federated Learning (FL). This allows the detection model to improve over time as devices generate new data, without relying on centralized data collection.
• O3. Trust and integrity in the learning process by ensuring that collaborative learning is trustworthy and tamper-resistant, to prevent attackers from poisoning the system with false data. INCENTIVE integrates robust aggregation approaches to guarantee that only legitimate devices participate and that the model updates they contribute cannot be maliciously modified.
• O4. Validation in different scenarios through the verification of the developed framework in various deployment settings. The goal is to demonstrate that the approach works in practice by measuring how well it detects intrusions, how it impacts device performance, and identifying any trade-offs. These evaluations ensure that the solution can be adapted to different IoT environments and inform further refinements needed for real-world adoption.
Through such objectives, INCENTIVE provides a practical approach to improving the security of IoT systems. Its methods are designed to work within the real-world limitations of connected devices, while also considering how people interact with them. Therefore, the project contributes to building more resilient and user-aware IoT environments, helping to reduce risks and support safer everyday use of connected technologies.
