  In trigger-action IoT platforms, IoT devices report event conditions to IoT
hubs notifying their cyber states and let the hubs invoke actions in other IoT
devices based on functional dependencies defined as rules in a rule engine.
These functional dependencies create a chain of interactions that help automate
network tasks. Adversaries exploit this chain to report fake event conditions
to IoT hubs and perform remote injection attacks upon a smart environment to
indirectly control targeted IoT devices. Existing defense efforts usually
depend on static analysis over IoT apps to develop rule-based anomaly detection
mechanisms. We also see ML-based defense mechanisms in the literature that
harness physical event fingerprints to determine anomalies in an IoT network.
However, these methods often demonstrate long response time and lack of
adaptability when facing complicated attacks. In this paper, we propose to
build a deep reinforcement learning based real-time defense system for
injection attacks. We define the reward functions for defenders and implement a
deep Q-network based approach to identify the optimal defense policy. Our
experiments show that the proposed mechanism can effectively and accurately
identify and defend against injection attacks with reasonable computation
overhead.
