Emerging Cybersecurity Threats in Embedded Systems: A Review of Attack Techniques, Anomaly Detection, and AI-Based Prediction Approaches
Abstract
Embedded systems have become fundamental to modern technological infrastructures, powering applications from smart vehicles and medical devices to critical industrial control. However, their rapid integration into the IoT (Internet of Things) ecosystem has significantly expanded the attack surface, exposing them to a wide range of cybersecurity threats. This paper provides a structured review of attack techniques targeting embedded systems, including fuzzing, reconnaissance, shellcode injection, denial-of-service, and backdoor exploitation. Furthermore, it discusses the role of AI (Artificial Intelligence) in early anomaly detection and predictive threat modeling. By comparing traditional and AI-enhanced security mechanisms, the paper highlights both the advantages and limitations of current defense strategies. The analysis emphasizes the growing importance of adaptive, data-driven models capable of operating under resource-constrained embedded environments, proposing a synthesis of theoretical and practical advances in securing embedded architectures.
Full Text:
PDFReferences
P. Koopman, “Embedded system security,” Computer (Long Beach Calif), vol. 37, no. 7, pp. 95–97, Jul. 2004, doi: 10.1109/MC.2004.52.
A. I. Molcut, S. Lica, and I. Lie, “Cybersecurity for Embedded Systems: A review,” 2022 15th International Symposium on Electronics and Telecommunications, ISETC 2022 - Conference Proceedings, 2022, doi: 10.1109/ISETC56213.2022.10009944.
“IoT devices installed base worldwide 2015-2025| Statista.” Accessed: Oct. 23, 2025. [Online]. Available: https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide/
S. A. Dragusin, N. Bizon, and R. N. Bostinaru, “Comprehensive Analysis of Cyber-Attack Techniques and Vulnerabilities in Communication Channels of Embedded Systems,” Proceedings of the 16th International Conference on Electronics, Computers and Artificial Intelligence, ECAI 2024, 2024, doi: 10.1109/ECAI61503.2024.10607432.
M. Alabadi and Y. Celik, “Anomaly Detection for Cyber-Security Based on Convolution Neural Network: A survey,” HORA 2020 - 2nd International Congress on Human-Computer Interaction, Optimization and Robotic Applications, Proceedings, Jun. 2020, doi: 10.1109/HORA49412.2020.9152899.
N. Elmrabit, F. Zhou, F. Li, and H. Zhou, “Evaluation of Machine Learning Algorithms for Anomaly Detection,” International Conference on Cyber Security and Protection of Digital Services, Cyber Security 2020, Jun. 2020, doi: 10.1109/CYBERSECURITY49315.2020.9138871.
G. D. Apostolidis, I. Kalouptsoglou, M. Siavvas, D. Kehagias, and D. Tzovaras, “AI-Enhanced Static Analysis: Reducing False Alarms Using Large Language Models,” Proceedings - 2025 IEEE International Conference on Smart Computing, SMARTCOMP 2025, pp. 288–293, 2025, doi: 10.1109/SMARTCOMP65954.2025.00088.
X. Zhou, P. Wang, L. Zhou, P. Xun, and K. Lu, “A Survey of the Security Analysis of Embedded Devices,” Sensors 2023, Vol. 23, Page 9221, vol. 23, no. 22, p. 9221, Nov. 2023, doi: 10.3390/S23229221.
D. Adhikari, W. Jiang, J. Zhan, D. B. Rawat, and A. Bhattarai, “Recent advances in anomaly detection in Internet of Things: Status, challenges, and perspectives,” Comput Sci Rev, vol. 54, p. 100665, Nov. 2024, doi: 10.1016/J.COSREV.2024.100665.
A. Aloseel, H. He, C. Shaw, and M. A. Khan, “Analytical Review of Cybersecurity for Embedded Systems,” IEEE Access, vol. 9, pp. 961–982, 2021, doi: 10.1109/ACCESS.2020.3045972.
S. Trilles, S. S. Hammad, and D. Iskandaryan, “Anomaly detection based on Artificial Intelligence of Things: A Systematic Literature Mapping,” Internet of Things, vol. 25, p. 101063, Apr. 2024, doi: 10.1016/J.IOT.2024.101063.
S. Rani, A. Kataria, S. Kumar, and V. Karar, “A new generation cyber-physical system: A comprehensive review from security perspective,” Comput Secur, vol. 148, p. 104095, Jan. 2025, doi: 10.1016/J.COSE.2024.104095.
M. Kohli and I. Chhabra, “A comprehensive survey on techniques, challenges, evaluation metrics and applications of deep learning models for anomaly detection,” Discover Applied Sciences, vol. 7, no. 7, pp. 1–29, Jul. 2025, doi: 10.1007/S42452-025-07312-7/TABLES/7.
H. Liang, X. Pei, X. Jia, W. Shen, and J. Zhang, “Fuzzing: State of the Art,” IEEE Trans Reliab, vol. 67, no. 3, pp. 1199–1218, Sep. 2018, doi: 10.1109/TR.2018.2834476.
H. Dai, C. Murphy, and G. Kaiser, “Configuration fuzzing for software vulnerability detection,” ARES 2010 - 5th International Conference on Availability, Reliability, and Security, pp. 525–530, 2010, doi: 10.1109/ARES.2010.22.
X. Deng, Y. Duan, and K. Deng, “A Fuzzing Method for Embedded Software,” IEEE Information Technology, Networking, Electronic and Automation Control Conference, ITNEC 2021, pp. 1735–1738, Oct. 2021, doi: 10.1109/ITNEC52019.2021.9587220.
S. K. Cha, M. Woo, and D. Brumley, “Program-adaptive mutational fuzzing,” Proc IEEE Symp Secur Priv, vol. 2015-July, pp. 725–741, Jul. 2015, doi: 10.1109/SP.2015.50.
P. Zhang, B. Ren, H. Dong, and Q. Dai, “CAGFuzz: Coverage-Guided Adversarial Generative Fuzzing Testing for Image-Based Deep Learning Systems,” IEEE Transactions on Software Engineering, vol. 48, no. 11, pp. 4630–4646, Nov. 2022, doi: 10.1109/TSE.2021.3124006.
Z. Hu and Z. Pan, “A Systematic Review of Network Protocol Fuzzing Techniques,” IMCEC 2021 - IEEE 4th Advanced Information Management, Communicates, Electronic and Automation Control Conference, pp. 1000–1005, Jun. 2021, doi: 10.1109/IMCEC51613.2021.9482063.
D. Kengo Oka, “ Automating File Fuzzing over USB for Automotive Systems ,” Building Secure Cars, pp. 211–239, May 2021, doi: 10.1002/9781119710783.CH10.
V. Herdt, D. Große, H. M. Le, and R. Drechsler, “Verifying Instruction Set Simulators using Coverage-guided Fuzzing,” Proceedings of the 2019 Design, Automation and Test in Europe Conference and Exhibition, DATE 2019, pp. 360–365, May 2019, doi: 10.23919/DATE.2019.8714912.
J. Wang, B. Chen, L. Wei, and Y. Liu, “Skyfire: Data-Driven Seed Generation for Fuzzing,” Proc IEEE Symp Secur Priv, pp. 579–594, Jun. 2017, doi: 10.1109/SP.2017.23.
H. ; Li et al., “A Novel Network Protocol Syntax Extracting Method for Grammar-Based Fuzzing,” Applied Sciences 2024, Vol. 14, Page 2409, vol. 14, no. 6, p. 2409, Mar. 2024, doi: 10.3390/APP14062409.
M. Safta, P. Svasta, M. Dima, A. Marghescu, and M. N. Costiuc, “Design and setup of Power Analysis attacks,” 2016 IEEE 22nd International Symposium for Design and Technology in Electronic Packaging, SIITME 2016, pp. 110–113, Dec. 2016, doi: 10.1109/SIITME.2016.7777256.
S. R. Kavya Rani, B. C. Soundarya, H. L. Gururaj, and V. Janhavi, “Comprehensive Analysis of Various Cyber Attacks,” 2021 IEEE Mysore Sub Section International Conference, MysuruCon 2021, pp. 255–262, 2021, doi: 10.1109/MYSURUCON52639.2021.9641089.
M. Nachtigall, L. Nguyen Quang Do, and E. Bodden, “Explaining static analysis-a perspective,” Proceedings - 2019 34th IEEE/ACM International Conference on Automated Software Engineering Workshops, ASEW 2019, pp. 29–32, Nov. 2019, doi: 10.1109/ASEW.2019.00023.
V. Anandhi et al., “Malware Detection using Dynamic Analysis,” 2023 International Conference on Advances in Intelligent Computing and Applications, AICAPS 2023, 2023, doi: 10.1109/AICAPS57044.2023.10074588.
M. A. Salitin and A. H. Zolait, “The role of user entity behavior analytics to detect network attacks in real time,” 2018 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2018, Nov. 2018, doi: 10.1109/3ICT.2018.8855782.
Q. R. McCluskey, M. M. Chowdhury, S. Latif, and K. Kambhampaty, “Computer Forensics: Complementing Cyber Security,” IEEE International Conference on Electro Information Technology, vol. 2022-May, pp. 507–512, 2022, doi: 10.1109/EIT53891.2022.9813886.
Y. Li, Y. Jiang, Z. Li, and S. T. Xia, “Backdoor Learning: A Survey,” IEEE Trans Neural Netw Learn Syst, vol. 35, no. 1, pp. 5–22, Jan. 2024, doi: 10.1109/TNNLS.2022.3182979.
T. Hemmert, A. May, J. Mittmann, and C. R. T. Schneider, “How to Backdoor (Classic) McEliece and How to Guard Against Backdoors,” Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13512 LNCS, pp. 24–44, 2022, doi: 10.1007/978-3-031-17234-2_2.
S. Suresh Kumar, A. Ponni Valavan, and V. Prathiksha, “Prevention of Kernel Rootkit in Cloud Computing,” Proceedings of the 7th International Conference on Intelligent Computing and Control Systems, ICICCS 2023, pp. 732–739, 2023, doi: 10.1109/ICICCS56967.2023.10142886.
A. Waksman and S. Sethumadhavan, “Silencing hardware backdoors,” Proc IEEE Symp Secur Priv, pp. 49–63, 2011, doi: 10.1109/SP.2011.27.
H. M. Albadi, M. A. Khder, S. W. Fujo, and T. M. Yousif, “A Literature Review of the Seriousness of Flooding-based DoS Attack,” 2022 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies, 3ICT 2022, pp. 463–469, 2022, doi: 10.1109/3ICT56508.2022.9990774.
Y. Feng, J. Li, and T. Nguyen, “Application-Layer DDoS Defense with Reinforcement Learning,” 2020 IEEE/ACM 28th International Symposium on Quality of Service, IWQoS 2020, Jun. 2020, doi: 10.1109/IWQOS49365.2020.9213026.
C. Douligeris and A. Mitrokotsa, “DDoS attacks and defense mechanisms: A classification,” Proceedings of the 3rd IEEE International Symposium on Signal Processing and Information Technology, ISSPIT 2003, pp. 190–193, 2003, doi: 10.1109/ISSPIT.2003.1341092.
P. Kijsanayothin and R. Hewett, “Exploit-based analysis of attack models,” Proceedings - IEEE 12th International Symposium on Network Computing and Applications, NCA 2013, pp. 183–186, 2013, doi: 10.1109/NCA.2013.18.
T. Bao, R. Wang, Y. Shoshitaishvili, and D. Brumley, “Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits,” Proc IEEE Symp Secur Priv, pp. 824–839, Jun. 2017, doi: 10.1109/SP.2017.67.
“What is an Exploit? Exploit Prevention - Bitdefender.” Accessed: Oct. 25, 2025. [Online]. Available: https://www.bitdefender.com/consumer/support/answer/10556/
S. Regi, G. Arora, R. Gangadharan, R. Bathla, and N. Pandey, “Case Study on Detection and Prevention Methods in Zero Day Attacks,” 2022 10th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions), ICRITO 2022, 2022, doi: 10.1109/ICRITO56286.2022.9964873.
C. Cowan, F. Wagle, Calton Pu, S. Beattie, and J. Walpole, “Buffer overflows: attacks and defenses for the vulnerability of the decade,” pp. 119–129, Nov. 2002, doi: 10.1109/DISCEX.2000.821514.
A. Rai, M. M. I. Miraz, D. Das, H. Kaur, and Swati, “SQL Injection: Classification and Prevention,” Proceedings of 2021 2nd International Conference on Intelligent Engineering and Management, ICIEM 2021, pp. 367–372, Apr. 2021, doi: 10.1109/ICIEM51511.2021.9445347.
H. C. Chen, A. Nshimiyimana, C. Damarjati, and P. H. Chang, “Detection and prevention of cross-site scripting attack with combined approaches,” 2021 International Conference on Electronics, Information, and Communication, ICEIC 2021, Jan. 2021, doi: 10.1109/ICEIC51217.2021.9369796.
S. Souissi and A. Serhrouchni, “AIDD: A novel generic attack modeling approach,” Proceedings of the 2014 International Conference on High Performance Computing and Simulation, HPCS 2014, pp. 580–583, Sep. 2014, doi: 10.1109/HPCSIM.2014.6903738.
L. Bosnjak, J. Sres, and B. Brumen, “Brute-force and dictionary attack on hashed real-world passwords,” 2018 41st International Convention on Information and Communication Technology, Electronics and Microelectronics, MIPRO 2018 - Proceedings, pp. 1161–1166, Jun. 2018, doi: 10.23919/MIPRO.2018.8400211.
K. D. Tandale and S. N. Pawar, “Different Types of Phishing Attacks and Detection Techniques: A Review,” Proceedings of the 2020 International Conference on Smart Innovations in Design, Environment, Management, Planning and Computing, ICSIDEMPC 2020, pp. 295–299, Oct. 2020, doi: 10.1109/ICSIDEMPC49020.2020.9299624.
A. Alshamrani, “Reconnaissance Attack in SDN based Environments,” pp. 1–5, Oct. 2020, doi: 10.1109/ICT49546.2020.9239510.
S. N. Hidayah Zulkiffli, M. N. Ahmad Zawawi, and F. A. Rahim, “Passive and Active Reconnaissance: A Social Engineering Case Study,” 2020 8th International Conference on Information Technology and Multimedia, ICIMU 2020, pp. 138–143, Aug. 2020, doi: 10.1109/ICIMU49871.2020.9243402.
K. Shye Lianq and V. Selvarajah, “Footprinting and Reconnaissance: Impact and Risks,” IEEE International Conference on Distributed Computing and Electrical Circuits and Electronics, ICDCECE 2022, 2022, doi: 10.1109/ICDCECE53908.2022.9793237.
D. Theodorus, M. S. Nabi, and Q. Al-Maatouk, “Web-based Reconnaissance and Vulnerability Scanner: A Review and Proposed Solution,” 2021 International Conference on Data Analytics for Business and Industry, ICDABI 2021, pp. 666–670, 2021, doi: 10.1109/ICDABI53623.2021.9655963.
M. M. ; Alani, E. Damiani, M. M. Alani, and E. Damiani, “XRecon: An Explainbale IoT Reconnaissance Attack Detection System Based on Ensemble Learning,” Sensors 2023, Vol. 23, Page 5298, vol. 23, no. 11, p. 5298, Jun. 2023, doi: 10.3390/S23115298.
G. Yang, X. Chen, Y. Zhou, and C. Yu, “DualSC: Automatic Generation and Summarization of Shellcode via Transformer and Dual Learning,” Proceedings - 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2022, pp. 361–372, 2022, doi: 10.1109/SANER53432.2022.00052.
“Types of Shellcode | eCPPTv2 Notes.” Accessed: Oct. 25, 2025. [Online]. Available: https://zer0verflow.gitbook.io/ecpptv2-notes/system-security/shellcoding/types-of-shellcode
J. Ganz and S. Peisert, “ASLR: How Robust Is the Randomness?,” Proceedings - 2017 IEEE Cybersecurity Development Conference, SecDev 2017, pp. 34–41, Oct. 2017, doi: 10.1109/SECDEV.2017.19.
Y. Lin, “Novel Techniques in Recovering, Embedding, and Enforcing Policies for Control-Flow Integrity,” 2021, doi: 10.1007/978-3-030-73141-0.
V. S. Koganti, L. K. Galla, and N. Nuthalapati, “Internet worms and its detection,” 2016 International Conference on Control Instrumentation Communication and Computational Technologies, ICCICCT 2016, pp. 64–73, Jul. 2017, doi: 10.1109/ICCICCT.2016.7987920.
C. C. Zou, D. Towsley, and W. Gong, “Email worm modeling and defense,” Proceedings - International Conference on Computer Communications and Networks, ICCCN, pp. 409–414, 2004, doi: 10.1109/ICCCN.2004.1401687.
M. E. Johnson, D. McGuire, and N. D. Willey, “The evolution of the peer-to-peer file sharing industry and the security risks for users,” Proceedings of the Annual Hawaii International Conference on System Sciences, 2008, doi: 10.1109/HICSS.2008.436.
N. Wattanapongsakorn, E. Wonghirunsombat, T. Assawaniwed, V. Hanchana, S. Srakaew, and C. Charnsripinyo, “A network-based internet worm intrusion detection and prevention system,” 2013 International Conference on IT Convergence and Security, ICITCS 2013, 2013, doi: 10.1109/ICITCS.2013.6717779.
M. Ravinder and V. Kulkarni, “A Review on Cyber Security and Anomaly Detection Perspectives of Smart Grid,” Proceedings - 5th International Conference on Smart Systems and Inventive Technology, ICSSIT 2023, pp. 692–697, 2023, doi: 10.1109/ICSSIT55814.2023.10060871.
M. Zhao and J. Chen, “A Review of Methods for Detecting Point Anomalies on Numerical Dataset,” Proceedings of 2020 IEEE 4th Information Technology, Networking, Electronic and Automation Control Conference, ITNEC 2020, pp. 559–565, Jun. 2020, doi: 10.1109/ITNEC48623.2020.9085206.
M. Farshchi et al., “Contextual Anomaly Detection for a Critical Industrial System Based on Logs and Metrics,” Proceedings - 2018 14th European Dependable Computing Conference, EDCC 2018, pp. 140–143, Nov. 2018, doi: 10.1109/EDCC.2018.00033.
J. Tao et al., “Visual Analysis of Collective Anomalies Through High-Order Correlation Graph,” IEEE Pacific Visualization Symposium, vol. 2018-April, pp. 150–159, May 2018, doi: 10.1109/PACIFICVIS.2018.00027.
G. Muruti, F. A. Rahim, and Z.-A. bin Ibrahim, “A Survey on Anomalies Detection Techniques and Measurement Methods,” pp. 81–86, Feb. 2019, doi: 10.1109/AINS.2018.8631436.
S. A. Dragusin, N. Bizon, R. N. Bostinaru, F. M. Enescu, R. M. Teodorescu, and C. Savulescu, “Analysis of Vulnerabilities in Communication Channels Using An Integrated Approach Based on Machine Learning and Statistical Methods,” Proceedings of the 16th International Conference on Electronics, Computers and Artificial Intelligence, ECAI 2024, 2024, doi: 10.1109/ECAI61503.2024.10607483.
A. B. Nassif, M. A. Talib, Q. Nasir, and F. M. Dakalbab, “Machine Learning for Anomaly Detection: A Systematic Review,” IEEE Access, vol. 9, pp. 78658–78700, 2021, doi: 10.1109/ACCESS.2021.3083060.
N. Duffield, P. Haffner, B. Krishnamurthy, and H. Ringberg, “Rule-based anomaly detection on IP flows,” Proceedings - IEEE INFOCOM, pp. 424–432, 2009, doi: 10.1109/INFCOM.2009.5061947.
M. A. Al Naeem, A. Abubakar, and M. M. H. Rahman, “Dealing with well-formed and malformed packets, associated with point of failure that cause network security breach,” IEEE Access, vol. 8, pp. 197554–197566, 2020, doi: 10.1109/ACCESS.2020.3034383.
R. Riley, X. Jiang, and D. Xu, “An architectural approach to preventing code injection attacks,” Proceedings of the International Conference on Dependable Systems and Networks, pp. 30–39, 2007, doi: 10.1109/DSN.2007.13.
“IEEE Standard Classification for Software Anomalies.,” Dec. 1993, doi: 10.1109/IEEESTD.1994.121429.
Refbacks
- There are currently no refbacks.
Copyright (c) 2025 Journal of Electrical Engineering, Electronics, Control and Computer Science
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.