Attack Detection Approach Research Articles

Design of Distributed Approach for Wormhole Attack Detection in Wireless Sensor Networks

Design of Distributed Approach for Wormhole Attack Detection in Wireless Sensor Networks

A stochastic approach for packet dropping attacks detection in mobile Ad hoc networks

A Mobile Ad hoc Network (MANET) is a dynamic network composed of mobile nodes that can communicate without relying on an existing infrastructure. In such decentralized environment, packet forwarding and other routing services are provided by network nodes cooperatively without any central administration. Most of existing Ad hoc routing protocols are based on the assumption that all network nodes are trustworthy. However, this assumption may be inconsistent when a malicious node decides to drop packets that are supposed to be forwarded in the aim of disrupting the routing services. Furthermore, the malicious node can change its behavior over time in order to appear as a legitimate node and still disrupting the network without being detected. To address this problem, we propose in this paper a fully decentralized mechanism that allows a node to monitor and detect neighbors that are malicious even if they have a changing behavior. Our mechanism is based on a Bernoulli Bayesian model for nodes’ behavior classification and a Markov chain model for behavior evolution tracking. Performance analysis of numerical results obtained using NS2 simulations show an accurate detection of malicious nodes, which can be used to guarantee a reliable and secure packet forwarding among network nodes.

A study on vulnerability and presentation attack detection in palmprint verification system

As biometric systems become ubiquitous in the domain of personal authentication, it is of utmost importance that these systems are secured against attacks. Among various types of attacks on biometric systems, the presentation attack, which involves presenting a fake copy (artefact) of the real biometric to the biometric sensor to gain illegitimate access, is the most common one. Despite the serious threat posed by these attacks, not much work has been done to address this vulnerability in palmprint-based biometric systems. This paper demonstrates the vulnerability of a palmprint verification system to presentation attacks and proposes a novel presentation attack detection (PAD) approach to discriminating between real biometric samples and artefacts. The proposed PAD approach is inspired by a work that established relationship between the surface reflectance and a set of statistical features extracted from the image. Specifically, statistical features computed from the distributions of pixel intensities, sub-band wavelet coefficients and the grey-level co-occurrence matrix form the original feature set, and CFS-based feature selection approach selects the most discriminating feature subset. A trained binary classifier utilizes the selected feature subset to determine whether the acquired image is of real hand or an artefact. For performance evaluation, an antispoofing database—PALMspoof has been developed. This database comprises left- and right-hand images of 104 subjects, and three kinds of artefacts generated from these images. In addition to PALMspoof database, the biometric system’s vulnerability has been assessed on display and print artefacts generated from two publicly available palmprint datasets. Our experimental results show that 1) the palmprint verification system is highly vulnerable with spoof acceptance of 84.56%; 2) the proposed PAD approach is effective against both print and display attacks, in both same-device and cross-device scenarios; and 3) the proposed approach for PAD provides an average improvement of 12.73 percentage points in classification error rate over local binary pattern (LBP)-based PAD approach.

A meta-heuristic learning approach for the non-intrusive detection of impersonation attacks in social networks

Cyber attacks have recently gained momentum in the research community as a sharply concerning phenomenon further ignited by the proliferation of social networks, which unfold a variety of ways for cybercriminals to access compromised information of their users. This paper gravitates on impersonation attacks, whose motivation may go beyond economic interests of the attacker towards getting unauthorised access to information and contacts, as often occurs between teenagers and early users of social platforms. This manuscript proposes a meta-heuristically optimised learning model as the algorithmic core of a non-intrusive detection system that relies exclusively on connection time features to detect evidences of an impersonation attack. The proposed scheme hinges on the K-Means clustering approach applied to a set of time features specially tailored to characterise the usage of users, which are weighted prior to the clustering under detection performance maximisation criteria. The obtained results shed light on the potentiality of the proposed methodology for its practical application to real social networks.

A Meta-heuristic Learning Approach for the Non-Intrusive Detection of Impersonation Attacks in Social Networks

Cyber attacks have recently gained momentum in the research community as a sharply concerning phenomenon further ignited by the proliferation of social networks, which unfold a variety of ways for cybercriminals to access compromised information of their users. This paper gravitates on impersonation attacks, whose motivation may go beyond economic interests of the attacker towards getting unauthorised access to information and contacts, as often occurs between teenagers and early users of social platforms. This manuscript proposes a meta-heuristically optimised learning model as the algorithmic core of a non-intrusive detection system that relies exclusively on connection time features to detect evidences of an impersonation attack. The proposed scheme hinges on the K-Means clustering approach applied to a set of time features specially tailored to characterise the usage of users, which are weighted prior to the clustering under detection performance maximisation criteria. The obtained results shed light on the potentiality of the proposed methodology for its practical application to real social networks.

P2P routing table poisoning: A quorum-based sanitizing approach

Peer-to-Peer (P2P) protocols underlie multiple networked applications given that the P2P decentralized design inherently fosters scalability and robustness. While distributiveness and scalability are attractive features, these facets also increase exposure to malicious peers which can propagate malicious routing information. Accordingly, a diverse set of continuously evolving attacks can be mounted that can cause severe service impairments over the entire overlay network. Most proposed countermeasures focus on providing diversity or redundancy to overcome malicious routing information with their emphasis on periodic detection/removal mechanisms done locally within a peer as continuous monitoring or global sharing of peer status entails high costs. However, a local approach naturally also limits the global effectiveness prompting the need for distributed solutions.In this work, we build upon contemporary distributed solutions (that developed specific attack detection and mitigation techniques for specific overlay types and specific attacks), to propose a generalized attack detection and mitigation approach applicable to varied overlay and attack models.Consequently, we propose a novel and efficient routing table sanitizing approach that (a) is independent of a specific attack variant, lookup approach or a specific victim set, (b) continuously detects and subsequently removes malicious routing information based on distributed quorum decisions, and (c) efficiently forwards malicious information findings to other peers which allows for progressive global sanitizing. The generalized mechanism shows a high sanitizing accuracy of up to 90% when evaluated against a generalized attack scenario with various adversarial behaviors.

A Khattak Approach for Detection and Removal of Black and Gray Hole Attacks in Manet

Mobility of nodes and dynamic changing topology creates security issues in MANETs making it vulnerable to some prominent attacks. Black and gray hole attacks drop the data packets in AODV. In this paper we propose a technique to detect and isolate malicious nodes. A cost effective Hash function to compute Message Digest (MD) is used for secure data transmission and data integrity in AODV. Malicious node is detected with the identification number or hop count. The security analysis of the existing ADOV and modified AODV is discussed. On the basis of analysis, we conclude that the proposed AODV is more secure as it provides cost effective secure mechanism for data transmission.

A Review on Various Approaches for Attack Detection in MANET

A Review on Various Approaches for Attack Detection in MANET

A Novel Approach for Detection of Single and Collaborative Black Hole Attacks in MANET

Ad hoc On Demand Distance Vector Routing is an extensively accepted routing protocol for Mobile Ad hoc Network. The inadequacy of security considerations in the design of AODV makes it vulnerable to black hole attack in which, malicious nodes attract data packets and drop them instead of forwarding. Among the existing black hole detection schemes, just a few strategies detect both single and collaborative attacks and that too with much routing, storage and computational overhead. In this paper, we propose a novel strategy to detect single and collaborative black hole attacks, with reduced routing and computational overhead. The proposed D-MBH algorithm detects single and multiple black hole nodes using an additional route request with nonexistent target address, computes a threshold ADSN, creates a black hole list and invokes the proposed D-CBH algorithm. Using ADSN, black hole list and next hop information extracted from RREP, the D-CBH algorithm creates a list of collaborative black hole nodes.

Detection of False Data Injection Attacks in Smart Grid Communication Systems

The transformation of traditional energy networks to smart grids can assist in revolutionizing the energy industry in terms of reliability, performance and manageability. However, increased connectivity of power grid assets for bidirectional communications presents severe security vulnerabilities. In this letter, we investigate Chi-square detector and cosine similarity matching approaches for attack detection in smart grids where Kalman filter estimation is used to measure any deviation from actual measurements. The cosine similarity matching approach is found to be robust for detecting false data injection attacks as well as other attacks in the smart grids. Once the attack is detected, system can take preventive action and alarm the manager to take preventative action to limit the risk. Numerical results obtained from simulations corroborate our theoretical analysis.

LAWRA: a layered wrapper feature selection approach for network attack detection

AbstractThe feature selection phase in network attack detection is mostly classifier based, while clustering techniques are used for labeling and creating compact training datasets. Because clustering finds natural groupings in the data, in this paper, a clustering‐based layered wrapper feature selection approach, LAWRA, has been proposed for selecting appropriate features for attack detection. The existing layered feature selection approaches in attack detection are unable to give results with high precision and recall because of the dependence on classifier accuracy, fitness value, and so on. Hence, in this paper, LAWRA uses external cluster validity indices, F‐measure, and Fowlkes–Mallows index, for feature selection. The two indices are the harmonic and geometric mean of precision and recall, respectively. Each index identifies features that give high precision and high recall of the attack detection algorithm. The first layer of LAWRA identifies the feature subset that best distinguishes between normal and attack instances and the second layer identifies the best cooperating features using cooperative game theory. Experiments have been conducted on NSL‐KDD dataset, and LAWRA has been compared with the existing approaches using different classifiers. The results show that LAWRA gives better overall accuracy and F‐measure value than the other approaches. Copyright © 2015 John Wiley & Sons, Ltd.

A cluster based approach for wormhole attack detection in wireless sensor networks

Due to the need of cooperation among nodes to relay packets, wireless sensor networks are very vulnerable to attacks in all layers of the network. One of these severe attacks is the wormhole attack. Detection of wormhole attack is hard, because it can be easily implemented by attacker without having knowledge of nodes in the network or it can be compromised by any legal node in the network. To date, the most of proposed protocols to defend against wormhole attacks are made by adopting synchronized clocks, directional antennas or strong assumptions in order to detect wormhole attacks. A method based on clustering is presented in this paper to detect this type of attacks. This method is implemented in static and mobile networks. The superiority of our protocol is that during the attack prevention or attack detection, the malicious nodes are detected and requires no additional hardware or complex calculations. Simulation results are perused with the NS-2 simulator and the protocol has been evaluated in terms of packet drop ratio, throughput, delay and energy consumption compared to a network without or under attack. Simulation results show that our protocol is practical and effective in improving resilience against wormhole attacks.

Online Monitoring of a Cyber Physical System Against Control Aware Cyber Attacks

Abstract In various industrial plants like power and chemical plants, the system operation is controlled by embedded controller(s). Any intentional malfunction of a critical controller can lead to shut down or failure of vital parts. It further leads the control plant into unsafe mode. Malware attacks can result in tremendous cost to the organization in terms of cleanup activity. Process related threats occur when the attacker gains control of the system and performs unintended actions. Industrial plants being a complex system need a wholesome approach for attack detection and prevention. In this paper we propose to use a geometric method to detect anomaly in a control system behavior which can possibly indicate a malware attack. The paper focuses on analysis of the large data sets for anomaly detection by using computational geometric methods to observe and analyze trends in the controller's output.

An effective attack detection approach in wireless mesh networks

Wireless mesh network (WMN) is a recent technology that is gaining significant importance among traditional wireless networks. It is considered a suitable solution for providing internet access in an inexpensive, convenient, and rapid manner. Nonetheless, WMNs are exposed to various types of security threats due to their intrinsic characteristics such as open broadcast medium and decentralised architecture. For instance, a compromised node can generate malicious traffic in order to disrupt the network routing service, putting the entire mesh network at risk. In this paper, we provide an efficient method for detecting active attacks against the routing functionality of a mesh network. The approach relies on the analysis of the protocol routing behaviour by processing the traces produced by each node using the Montimage Monitoring Tool (MMT), which outputs routing events that are correlated between nodes to detect potential intrusions. We demonstrate the approach feasibility by using a virtualised mesh netw...

Detecting Multi-ChannelWireless Microphone User Emulation Attacks in White Space with Noise

Cognitive radio networks (CRNs) are susceptible to primary user emulation (PUE) attacks. Conventional PUE attack detection approaches consider television broadcasting as the primary user. In this work, however, we study a special kind of PUE attack named wireless microphone user emulation (WMUE) att

Information Theoretic XSS Attack Detection in Web Applications

Cross-Site Scripting (XSS) has been ranked among the top three vulnerabilities over the last few years. XSS vulnerability allows an attacker to inject arbitrary JavaScript code that can be executed in the victim's browser to cause unwanted behaviors and security breaches. Despite the presence of many mitigation approaches, the discovery of XSS is still widespread among today's web applications. As a result, there is a need to improve existing solutions and to develop novel attack detection techniques. This paper proposes a proxy-level XSS attack detection approach based on a popular information-theoretic measure known as Kullback-Leibler Divergence (KLD). Legitimate JavaScript code present in an application should remain similar or very close to the JavaScript code present in a rendered web page. A deviation between the two can be an indication of an XSS attack. This paper applies a back-off smoothing technique to effectively detect the presence of malicious JavaScript code in response pages. The proposed approach has been applied for a number of open-source PHP web applications containing XSS vulnerabilities. The initial results show that the approach can effectively detect XSS attacks and suffer from low false positive rate through proper choice of threshold values of KLD. Further, the performance overhead has been found to be negligible.

Node Capture Attack Detection in Dynamic WSNs Based on New Node Tracking

Since the nodes of WSNs are always deployed on the outside, nodes are easy to be captured. The traditional detection approaches of capture attack can be categorized as approaches based on time of absence and approaches based on target tracking. The former only suitable in static WSNs and the latter usually requires a large communication cost. In this paper, a novel node capture attack detection approach is proposed in dynamic WSNs. Through this approach, every node record its neighbors and detect new nodes in real-time, if new nodes join in the network, a new node tracking algorithm is performed in WSNs and find out which of them are captured by adversaries. Simulation results show that, this method can greatly improve the detection accuracy in dynamic WSNs, and the communication cost is low.

Reputation‐based cross‐layer intrusion detection system for wormhole attacks in wireless mesh networks

ABSTRACTWireless mesh networks provide long‐distance wireless network connectivity over heterogeneous devices for greater scalability and availability. However, protecting legitimate long‐distance wireless links from wormhole attacks is an important yet challenging security issue in wireless mesh networks. In this paper, we propose a reputation‐based cross‐layer intrusion detection system to effectively detect various wormhole attacks. The proposed system analyses the behaviours of the routing paths in wireless mesh networks to correctly isolate the malicious wormhole paths from legitimate long‐distance wireless links. It uses reputation and cross‐layer parameters for comprehensive ability to isolate the wormhole attacks in routing paths. This isolation ensures full utilisation of legitimate long‐distance wireless links in wireless mesh networks, which is not possible with the existing wormhole attack detection approaches. Experimental results show that the proposed system increases the detection rate, decreases the false alarm rate, and secures legitimate long‐distance wireless links in wireless mesh networks. Copyright © 2014 John Wiley & Sons, Ltd.

Swarm intelligence based approach for sinkhole attack detection in wireless sensor networks

Swarm intelligence, a nature inspired computing applies an algorithm situated within the context of agent based models that mimics the behavior of ants to detect sinkhole attacks in wireless sensor networks. An Ant Colony Optimization Attack Detection (ACO-AD) algorithm is proposed to identify the sinkhole attacks based on the nodeids defined in the ruleset. The nodes generating an alert on identifying a sinkhole attack are grouped together. A voting method is proposed to identify the intruder. An Ant Colony Optimization Boolean Expression Evolver Sign Generation (ABXES) algorithm is proposed to distribute the keys to the alerted nodes in the group for signing the suspect list to agree on the intruder. It is shown that the proposed method identifies the anomalous connections without generating false positives and minimizes the storage in the sensor nodes in comparison to LIDeA architecture for sinkhole attack detection. Experimental results demonstrating the Ant Colony Optimization approach of detecting a sinkhole attack are presented.

Self-healing AIS with Entropy Based SVM and Bayesian Aggregate Model for the Prediction and Isolation of Malicious Nodes Triggering DoS Attacks in VANET

Vehicle ad hoc networks, or VANETs, are highly mobile wireless networks created to help with traffic monitoring and vehicular safety. Security risks are the main problems in VANET. To handle the security threats and to increase the performance of VANETs, this paper proposes an enhanced trust based aggregate model. In the proposed system, a novel adaptive nodal attack detection approach - entropy-based SVM with linear regression addresses the trust factor with kernel density estimation generating the trustiness value thereby classifying the malicious nodes against the trusted nodes in VANETs. Defending the VANETs is through a novel reliance node estimation approach - Bayesian self-healing AIS with Pearson correlation coefficient aggregate model isolating the malicious node thereby the RSU cluster communication getting secure. Furthermore, even a reliable node may be exploited to deliver harmful messages and requires the authority of both the data and the source node to be carried out by the onboard units of the vehicles getting the reports of incident. DoS attacks (Denial of Service) disrupting the usual functioning of the network leads to inaccessible network to its intended users thereby endangering human lives. The proposed system is explicitly defending the VANET against DoS attacks as it predicts the attack without compromising the performance of the VANET handling nodes with various features and functions based on evaluating the maliciousness of attacking nodes accurately and isolating the intrusion. Furthermore, the performance evaluations prove the effectiveness of the proposed work with increased detection rate by 97%, reduced energy consumption by 39% and reduced latency by 25% compared to the existing studies.