IIoT Cyberattacks & Cybersecurity Testbeds: Literature Review

Exploring IIoT Cyberattacks<br/>and Cybersecurity Testbeds

A Systematic Literature Review

University of Cincinnati, USA

Academic Conference Presentation | April 2026

ACM — 159 Primary Studies Reviewed

IEEE Xplore

ACM Digital Library

Scopus

Presentation Outline

Introduction & Motivation

Related Work

Methodology — SLR Protocol

Results: Cyberattacks (RQ1)

Results: Testbed Tools (RQ2)

Discussion & Conclusion

Introduction & Motivation

The IIoT Revolution

Interconnected industrial devices boosting efficiency and automating processes

Integrates legacy OT with modern IT/IoT technologies

Spans energy, water, manufacturing, healthcare, and agriculture sectors

The Cybersecurity Threat

Increased interconnectivity expands the attack surface dramatically

A single compromised node can cascade across entire industrial ecosystems

Economic impact: billions lost annually in downtime, fines, and recovery

<strong style="color:#00d2ff;">RQ1:</strong> What cyberattacks against IIoT systems are simulated using cybersecurity testbeds?

<strong style="color:#00d2ff;">RQ2:</strong> What tools and frameworks are used for designing a cybersecurity testbed for IIoT?

Related Work & Research Gap

Prior Attack Taxonomies

Berger et al. (2020)

<strong style="color: #ffffff; font-weight: 600;">Multi-layer taxonomy</strong><br/><br/><span style="color: #00d2ff;">↳ Abstract, not linked to testbeds</span>

Panchal et al. (2018)

<strong style="color: #ffffff; font-weight: 600;">Architectural attack categories</strong><br/><br/><span style="color: #00d2ff;">↳ Ignores IT/OT convergence</span>

Krishna et al. (2021)

<strong style="color: #ffffff; font-weight: 600;">IoT/IIoT threats</strong><br/><br/><span style="color: #00d2ff;">↳ Lacks industrial context</span>

Prior Testbed Studies

Alves et al. (2018)

<strong style="color: #ffffff; font-weight: 600;">Modular virtual SCADA testbed</strong><br/><br/><span style="color: #00d2ff;">↳ No link to threat taxonomy</span>

Al-Hawawreh & Sitnikova (2020)

<strong style="color: #ffffff; font-weight: 600;">Brownfield IIoT testbed</strong><br/><br/><span style="color: #00d2ff;">↳ Not generalizable</span>

THE RESEARCH GAP

Attack taxonomies and testbed implementations have evolved in isolation.<br/><strong style="font-weight: 700; color: #ffffff;">This SLR bridges the gap by directly linking attack categories to testbed capabilities and experimental reproducibility.</strong>

Methodology — SLR Protocol

Systematic Literature Review based on Kitchenham Guidelines

SLR Methodology

1,398

463

247

159

RQ1: Cyberattacks Simulated in IIoT Testbeds

Attack Classification Deep Dive

Software & Data Integrity Attacks

<b style="color: #ffffff;">False Data Injection (FDI)</b> — most simulated (energy/power grids)

<b style="color: #ffffff;">Memory manipulation</b> (PLC control logic)

<b style="color: #ffffff;">Firmware rewriting attacks</b> (persistent unauthorized behavior)

<b style="color: #ffffff;">Unauthorized command injection</b> (breaks SCADA processes)

<b style="color: #ffffff;">Service disruption:</b> ramp attacks, load tripping, electricity bidding

Well-covered in energy sector; underrepresented in healthcare & agriculture

Advanced Persistent Threats (APTs)

Multi-stage, long-duration, targeted campaigns

Spear-phishing → lateral movement → false command injection

MITRE ATT&CK framework for ICS applied (PS81)

Zero-day exploits, time synchronization attacks, insider threats

Severely underrepresented in testbeds due to complexity

Network Attacks

<b style="color: #ffffff;">DoS variants:</b> TCP SYN Flood, Slowloris, ping-of-death, ICMP flood

MitM using Ettercap & Wireshark on Modbus, DNP3, IEC 61850

Replay & delay attacks (lack of message authentication in ICS protocols)

<b style="color: #ffffff;">Protocol-based:</b> Modbus, DNP3, IEC 61850 GOOSE exploits

Most prevalent — enabled by network virtualization platforms

Malware & Phishing

WannaCrypt ransomware on brownfield IIoT testbed

Backdoor malware, Stuxnet-inspired firmware attacks

Phishing & social engineering: require human-in-the-loop

Lowest testbed representation due to safe deployment complexity

RQ2: Tools & Technologies for IIoT Testbeds

Key Finding

The Alignment Gap

Feasibility Bias

Technical feasibility, not threat realism, drives which attacks are studied.

Strategic Threat Gap

APTs, insider attacks, cross-layer campaigns remain largely unsimulated.

ML Integration Gap

Anomaly detection evaluated in isolation, not in full attack lifecycles.

Discussion: Implications & Future Directions

Testbeds Shape Research Priorities

Experimental affordances determine which threats are empirically explored, creating feedback loops between feasibility and perceived risk

Underestimated Systemic Vulnerabilities

Current testbeds likely underestimate threats requiring longitudinal and cross-layer experimentation

Need for Integrated Framework

Threat taxonomy and testbed architecture should be interdependent layers in a unified research model

Underrepresented Sectors

Healthcare, agriculture, and water sectors critically underserved by current testbed research

Next-Gen Testbed Architectures

Hybrid physical + virtual, hardware-in-the-loop for timing-sensitive processes

Human-in-the-Loop Modeling

Enable insider threat and social engineering simulation

AI-Driven Threat Detection

Embed ML/anomaly detection in full attack lifecycle simulations

Sector-Specific Testbeds

Water, healthcare, agriculture IIoT scenarios

Conclusion

<strong style="color: #00d2ff;">This SLR synthesized 159 primary studies</strong> to classify IIoT cyberattacks and identify testbed tools. The core finding: a structural misalignment exists between theoretical attack taxonomies and what is experimentally reproduced in cybersecurity testbeds.

<strong style="color: #ffffff;">159 primary studies reviewed</strong> across IEEE Xplore, ACM, and Scopus (2010–2025)

<strong style="color: #ffffff;">4 attack categories classified:</strong> Integrity Attacks, APTs, Network Attacks, Malware

<strong style="color: #ffffff;">5 tool categories identified:</strong> Simulation, Virtualization, Development, Security, ML/Analytics

<strong style="color: #ffffff;">Critical gap:</strong> Network attacks dominate testbeds; APTs, insider threats, cross-layer attacks remain underrepresented

Findings limited to published peer-reviewed literature; proprietary testbed implementations not captured. Only reported capabilities analyzed, not direct experimental validation.

Questions?

contact@uc.edu