Attack Algorithm Research Articles

Detection of False Data Injection Attack in AGC System Based on Random Forest

False data injection attacks change the control effect of automatic generation control systems, which may cause a destructive impact on power systems. In this paper, the data from the regular operation of a system and the data from false data injection attacks in the historical data are studied and classified. The normal operating parameters and abnormal operation parameters under various attack scenarios are collected as samples for training the detection model based on time series. The random forest algorithm model is selected for detection through the comparison of detection effects, and various data training models are accumulated during the operation process to improve the model’s accuracy. Finally, Simulink simulation experiments verify the consistency of the detection results of the simulated attack algorithm. This detection method can realize real-time attack detection and synchronize the detection results to the database with high timeliness. It can be used in systems with rich data samples and has broad applicability.

Designing a Location Trace Anonymization Contest

For a better understanding of anonymization methods for location traces, we have designed and held a location trace anonymization contest that deals with a long trace (400 events per user) and fine-grained locations (1024 regions). In our contest, each team anonymizes her original traces, and then the other teams perform privacy attacks against the anonymized traces. In other words, both defense and attack compete together, which is close to what happens in real life. Prior to our contest, we show that re-identification alone is insufficient as a privacy risk and that trace inference should be added as an additional risk. Specifically, we show an example of anonymization that is perfectly secure against re-identification and is not secure against trace inference. Based on this, our contest evaluates both the re-identification risk and trace inference risk and analyzes their relationship. Through our contest, we show several findings in a situation where both defense and attack compete together. In particular, we show that an anonymization method secure against trace inference is also secure against re-identification under the presence of appropriate pseudonymization. We also report defense and attack algorithms that won first place, and analyze the utility of anonymized traces submitted by teams in various applications such as POI recommendation and geo-data analysis.

Computer attack technology for gaining access based on remote implementation of a document template

The article examines the technology of a new type of attack using viruses that are remotely introduced into Microsoft Word document templates. Microsoft Word has a feature that allows the user to create a document with a template. Whenever a Word document with a template is written/read, those templates are downloaded/used from the local or remote machine. In this way, attackers can place a Word document template (.dotm) file with malicious macros on their servers. Every time a victim opens a Word document, the document receives a malicious template from the attacker's server and executes it. The attack algorithm and methods of countering such attacks have been studied.

МЕТОДИКА ПОСТРОЕНИЯ УСТОЙЧИВОЙ СИСТЕМЫ ЗАЩИТЫ НА ОСНОВЕ СОСТЯЗАТЕЛЬНОГО МАШИННОГО ОБУЧЕНИЯ В БЕСПРОВОДНЫХ СЕТЯХ 6G

Abstract The purpose of research is to develop the technique of analytical processing of big data of services and applications in the new generation communication networks to detect cybersecurity incidents and build sustainable protection systems based on adversarial machine learning. The methods of research: Analysis of modern methods of machine learning and neural network technologies, synthesis and formalization of algorithms for adversarial attacks on machine learning models. Scientific novelty: a technique for analytical processing of emulated data of services and applications for detecting cybersecurity incidents is presented, which provides a groundwork in the field of research into the security issues of complex intelligent services and applications in the infrastructure of wireless networks of the next generation. The result of research: The article proposes a technique of building a sustainable protection system against adversarial attacks in wireless ad hoc networks of the next generation. The main types of adversarial attacks, including poisoning attacks and evasion attacks, are formalized, and methods for generating adversarial examples on tabular, textual, and visual data are described. Several scenarios were generated and exploratory analysis of datasets was carried out using the DeepMIMO emulator. Potential application problems of binary classification and prediction of signal attenuation between a user and a base station for adversarial attacks are presented. The algorithmization of the processes of building and training a sustainable protection system against adversarial attacks in wireless networks of the next generation is presented on the example of emulated data

An Integrated Approach of Threat Analysis for Autonomous Vehicles Perception System

Automated vehicles are a revolutionary step in mobility, providing a safe and convenient riding experience while keeping the human-driving task minimal to none. Therefore, these intelligent vehicles are equipped with sophisticated perception sensors (e.g., cameras and radars), high-performance computers, artificial intelligence (AI)-driven algorithms, and connectivity with other internet-of-things (IoT) devices. This makes autonomous vehicles (AVs) a special kind of cyber-physical system (CPS) that is moving at speed in highly interactive and dynamic environments (e.g., public roads). Thus, AV is a potential target for cyber attackers to weaponize, compromising safety and mobility on the road. The first step in addressing this problem is to have a robust threat modeling framework that can address the evolving cyber-physical threats, especially to AV applications. In this regard, two areas are studied in this paper: the common practice of threat modeling in automotive and the ISO/SAE 21434 standard, and sensors and machine learning (ML) algorithms for AV perception systems and potential cyber-physical attacks. A comparative threat analysis for an AV perception system with the ISO/SAE 21434 standard and a system-theoretic process analysis for security (STPA-Sec) approach is also demonstrated in this paper. Based on the analysis, this paper proposes a robust threat analysis and risk assessment framework with mathematical modeling to identify cyber-physical threats to AV perception systems that are critical for the driving behaviors and complex interactions of AVs in their operational design domain.

Attributed Scattering Center Guided Adversarial Attack for DCNN SAR Target Recognition

Recently, deep learning has made significant progress in synthetic aperture radar automatic target recognition (SAR ATR). However, deep convolutional neural networks (DCNNs) are discovered to be susceptible to carefully crafted adversarial perturbations. Regarding the unique scattering mechanism in SAR imaging, the scattering feature such as attributed scattering centers (ASCs) should be deeply considered in the adversarial attack (AA) algorithms for DCNNs in SAR ATR. In this letter, an AA algorithm named ASC-STA is proposed to take advantage of the powerful SAR imaging property characterization capability of ASC model. Considering the imaging characteristic which is presented in the ASC model, the spatial transformation module is specially designed to be performed on the strong back-scattering structures guided by the reconstruction image of ASC model. Spatial transformation shifts the robust scattering point features via altering the locally gray-scale relationships of the target microstructures in SAR images. Besides, a modified shape context evaluated metric is established to assess the validity of the feature alternation process. Experimental results on the MSTAR database demonstrate that the proposed method achieves a high success rate without complex parameter settings and generates the perturbed image in high image quality. Compared with the norm-based AA algorithms, which are not involved with ASCs, the point feature of the original image is efficiently altered. At the same time, the perturbations are focused on the target regions accurately.

Online data poisoning attack against edge AI paradigm for IoT-enabled smart city.

The deep integration of edge computing and Artificial Intelligence (AI) in IoT (Internet of Things)-enabled smart cities has given rise to new edge AI paradigms that are more vulnerable to attacks such as data and model poisoning and evasion of attacks. This work proposes an online poisoning attack framework based on the edge AI environment of IoT-enabled smart cities, which takes into account the limited storage space and proposes a rehearsal-based buffer mechanism to manipulate the model by incrementally polluting the sample data stream that arrives at the appropriately sized cache. A maximum-gradient-based sample selection strategy is presented, which converts the operation of traversing historical sample gradients into an online iterative computation method to overcome the problem of periodic overwriting of the sample data cache after training. Additionally, a maximum-loss-based sample pollution strategy is proposed to solve the problem of each poisoning sample being updated only once in basic online attacks, transforming the bi-level optimization problem from offline mode to online mode. Finally, the proposed online gray-box poisoning attack algorithms are implemented and evaluated on edge devices of IoT-enabled smart cities using an online data stream simulated with offline open-grid datasets. The results show that the proposed method outperforms the existing baseline methods in both attack effectiveness and overhead.

Comprehensive Study in Open-Set Iris Presentation Attack Detection

Research in presentation attack detection (PAD) for iris recognition has largely moved beyond evaluation in “closed-set” scenarios, to emphasize ability to generalize to presentation attack types not present in the training data. This paper offers multiple contributions to understand and extend the state-of-the-art in open-set iris PAD. First, it describes the most authoritative evaluation to date of iris PAD. We have curated the largest publicly-available image dataset for this problem, drawing from 26 benchmarks previously released by various groups, and adding 150,000 images being released with this paper, to create a set of 450,000 images representing authentic iris and seven types of presentation attack instrument (PAI). We formulate a leave-one-PAI-out evaluation protocol, and show that even the best algorithms in the closed-set evaluations exhibit catastrophic failures on multiple attack types in the open-set scenario. This includes algorithms performing well in the most recent LivDet-Iris 2020 competition, which may come from the fact that the LivDet-Iris protocol emphasizes sequestered images rather than unseen attack types. Second, we evaluate the accuracy of five open-source iris presentation attack algorithms available today, one of which is newly-proposed in this paper, and build an ensemble method that beats the winner of the LivDet-Iris 2020 by a substantial margin. This paper demonstrates that closed-set iris PAD, when all PAIs are known during training, is a solved problem, with multiple algorithms showing very high accuracy, while open-set iris PAD, when evaluated correctly, is far from being solved. The newly-created dataset, new open-source algorithms, and evaluation protocol, all made publicly available with this paper, provide experimental artifacts that researchers can use to measure progress on this important problem.

Gradient-free adversarial attack algorithm based on differential evolution

Gradient-free adversarial attack algorithm based on differential evolution

Research on a Method of Defense Adversarial Samples for Target Detection Model of Driverless Cars

The adversarial examples make the object detection model make a wrong judgment, which threatens the security of driverless cars. In this paper, by improving the Momentum Iterative Fast Gradient Sign Method (MI-FGSM), based on ensemble learning, combined with L∞ perturbation and spatial transformation, a strong transferable black-box adversarial attack algorithm for object detection model of driverless cars is proposed. Through a large number of experiments on the nuScenes driverless dataset, it is proved that the adversarial attack algorithm proposed in this paper have strong transferability, and successfully make the mainstream object detection models such as FasterRcnn, SSD, YOLOv3 make wrong judgments. Based on the adversarial attack algorithm proposed in this paper, the parametric noise injection with adversarial training is performed to generate a defense model with strong robustness. The defense model proposed in this paper significantly improves the robustness of the object detection model. It can effectively alleviate various adversarial attacks against the object detection model of driverless cars, and does not affect the accuracy of clean samples. This is of great significance for studying the application of object detection model of driverless cars in the real physical world.

Gradient-free adversarial attack algorithm based on differential evolution

Gradient-free adversarial attack algorithm based on differential evolution

SCMA: A Scattering Center Model Attack on CNN-SAR Target Recognition

Convolutional neural networks (CNNs) have been widely used in SAR (Synthetic Aperture Radar) target recognition, which can extract feature automatically. However, due to its own structural flaws, CNNs are easy to be fooled by adversarial examples, even if they have excellent performance. In this letter, a novel attack named scattering center model attack (SCMA) is designed, and its generation process does not rely on the prior knowledge of any neural network. Therefore, we can get a stable way which can be applied to any neural network. In addition, an improved scattering center model extraction method, which is the pre-part of SCMA, can filter out the useless noise to optimize the stability of attack. In the experiment, SCMA is compared with advanced attack algorithms. From the experimental results, it is clear to find that SCMA has excellent performance in terms of transfer attack success rate. Furthermore, visualization and interpretability analysis underpin the theoretical feasibility of SCMA.

Noncoherent Massive MIMO With Embedded One-Way Function Physical Layer Security

We propose a novel physical layer security scheme that exploits an optimization method as a one-way function. The proposed scheme builds on nonsquare differential multiple-input multiple-output (MIMO), which is capable of noncoherent detection even in massive MIMO scenarios and thus resilient against risky pilot insertion and pilot contamination attacks. In contrast to conventional nonsquare differential MIMO schemes, which require space-time projection matrices designed via highly complex, discrete, and combinatorial optimization, the proposed scheme utilizes projection matrices constructed via low-complexity continuous optimization designed to maximize the coding gain of the system. Furthermore, using a secret key generated from the true randomness nature of the wireless channel as an initial value, the proposed continuous optimization-based projection matrix construction method becomes a one-way function, making the proposed scheme a physical layer secure differential MIMO system. An attack algorithm to challenge the proposed scheme is also devised, which demonstrates that the security level achieved improves as the number of transmit antennas increases, even in an environment where the eavesdropper can perfectly estimate channel coefficients and experience asymptotically large signal-to-noise ratios.

Plant Disease Classification and Adversarial Attack based CL-CondenseNetV2 and WT-MI-FGSM

In recent years, deep learning has been increasingly used to the detection of pests and diseases. Unfortunately, deep neural networks are particularly vulnerable when attacked by adversarial examples. Hence it is vital to explore the creation of intensely aggressive adversarial examples to increase neural network robustness. This paper proposes a wavelet transform and histogram equalization-based adversarial attack algorithm: WT-MI-FGSM. In order to verify the performance of the WT-MI-FGSM, we propose a plant pests and diseases identification method based on the coordinate attention mechanism and CondenseNetV2: CL-CondenseNetV2. The accuracy of CL- CondenseNetV2 on the PlantVillage dataset is 99.45%, which indicates that the improved CondenseNetV2 model has a more significant classification performance. In adversarial sample experiments using WT-MI-FGSM and CL-CondenseNetV2, experimental results show that when CL-CondenseNetV2 is attacked by the adversarial algorithm WT-MI-FGSM, the error rate reaches 89.8%, with a higher attack success rate than existing adversarial attack algorithms. In addition, the accuracy of CL-CondenseNetV2 is improved to 99.71% by adding the adversarial samples generated by WT-MI-FGSM to the training set and performing adversarial training. The experiments demonstrate that the adversarial examples caused by WT-MI-FGSM can improve the model's performance.

Use of implementations of arbitrary bitness permutations for cryptographic transformations

Background. Cryptographic transformations have always aroused the interest of the educated part of humanity and are an integral part of modern communications. A lot of different cryptographic algorithms exist for different tasks and requirements. Permutation functions are useful for cases where transformation speed is more critical than theoretical secrecy. Hardware implementation of such substitutions is quite simple.
 Objective. Investigate the model and combinational circuits for hardware implementation. Investigate algorithms for permutation functions software implementation. Investigate attack algorithms and cracking of permutation functions for cryptanalysis.
 Methods. The paper reviews algorithms of cryptographic transformations and their cryptanalysis for bijective permutations implemented by means of regular combinational structures of linear complexity. The proposed algorithms provide the rate of processing up to gigabits per second. The paper clarifies the algorithm of formation of elements of regular structures of permutations, specifies volumes of public and private data, reviews data formats, methods of their transfer and hardware implementation of one of the methods. The paper reviews attack types and permutation regular structure schemes cracking algorithms with experimental calculation of necessary operations quantity. The software implementation of the proposed algorithms for results calculation was developed.
 Results. Numerical results of the number of keys, the amount of memory required for hardware implementation and the number of required operations for cryptanalysis were obtained.
 Conclusions. The results show that the proposed algorithms for cryptographic transformations have a sufficient level of protection with a high-speed encryption and decryption.

On Attacking Future 5G Networks with Adversarial Examples: Survey

The introduction of 5G technology along with the exponential growth in connected devices is expected to cause a challenge for the efficient and reliable network resource allocation. Network providers are now required to dynamically create and deploy multiple services which function under various requirements in different vertical sectors while operating on top of the same physical infrastructure. The recent progress in artificial intelligence and machine learning is theorized to be a potential answer to the arising resource allocation challenges. It is therefore expected that future generation mobile networks will heavily depend on its artificial intelligence components which may result in those components becoming a high-value attack target. In particular, a smart adversary may exploit vulnerabilities of the state-of-the-art machine learning models deployed in a 5G system to initiate an attack. This study focuses on the analysis of adversarial example generation attacks against machine learning based frameworks that may be present in the next generation networks. First, various AI/ML algorithms and the data used for their training and evaluation in mobile networks is discussed. Next, multiple AI/ML applications found in recent scientific papers devoted to 5G are overviewed. After that, existing adversarial example generation based attack algorithms are reviewed and frameworks which employ these algorithms for fuzzing stat-of-art AI/ML models are summarised. Finally, adversarial example generation attacks against several of the AI/ML frameworks described are presented.

DTFA: Adversarial attack with discrete cosine transform noise and target features on deep neural networks

AbstractImage recognition on deep neural network is vulnerable to adversarial sample attacks. The adversarial attack accuracy is low when only limited queries on the target are allowed with the current black box environment. This paper proposes a target adversarial attack algorithm discrete cosine transform‐mean target feature attack (DTFA) based on the target features and a limited‐area sampling method. The algorithm first examines the original image and a target image to generate an initial adversarial example. Then the disturbance is sampled from the low‐frequency region intercepted by Gaussian noise after discrete cosine transform. The authors determine the size of the disturbance according to the difference between the adversarial example and the original image with consideration of the number of iterations and the position of the target feature region. The disturbance is applied on the initial adversarial example to generate the new adversarial example with the difference from the original image reduced. To evaluate the proposed algorithm, based on the common image classification model InceptionV3, and with identical queries accessing the same target model, the authors conduct experiments to compare the attack effectiveness of DTFA and the benchmark algorithms on the same image and target datasets. Experimental results show that the generated adversarial examples by the proposed algorithm are superior to 94% of those by the similar attack algorithms with less than 10,000 access queries on the target model.

Adversarial attacks on spiking convolutional neural networks for event-based vision.

Event-based dynamic vision sensors provide very sparse output in the form of spikes, which makes them suitable for low-power applications. Convolutional spiking neural networks model such event-based data and develop their full energy-saving potential when deployed on asynchronous neuromorphic hardware. Event-based vision being a nascent field, the sensitivity of spiking neural networks to potentially malicious adversarial attacks has received little attention so far. We show how white-box adversarial attack algorithms can be adapted to the discrete and sparse nature of event-based visual data, and demonstrate smaller perturbation magnitudes at higher success rates than the current state-of-the-art algorithms. For the first time, we also verify the effectiveness of these perturbations directly on neuromorphic hardware. Finally, we discuss the properties of the resulting perturbations, the effect of adversarial training as a defense strategy, and future directions.

Defense against membership inference attack in graph neural networks through graph perturbation.

Graph neural networks have demonstrated remarkable performance in learning node or graph representations for various graph-related tasks. However, learning with graph data or its embedded representations may induce privacy issues when the node representations contain sensitive or private user information. Although many machine learning models or techniques have been proposed for privacy preservation of traditional non-graph structured data, there is limited work to address graph privacy concerns. In this paper, we investigate the privacy problem of embedding representations of nodes, in which an adversary can infer the user's privacy by designing an inference attack algorithm. To address this problem, we develop a defense algorithm against white-box membership inference attacks, based on perturbation injection on the graph. In particular, we employ a graph reconstruction model and inject a certain size of noise into the intermediate output of the model, i.e., the latent representations of the nodes. The experimental results obtained on real-world datasets, along with reasonable usability and privacy metrics, demonstrate that our proposed approach can effectively resist membership inference attacks. Meanwhile, based on our method, the trade-off between usability and privacy brought by defense measures can be observed intuitively, which provides a reference for subsequent research in the field of graph privacy protection.

Multiuser Adversarial Attack on Deep Learning for OFDM Detection

Adversarial attack has been widely used to degrade the performance of deep learning (DL), especially in the field of communications. In this letter, we evaluate different white-box and black-box adversarial attack algorithms for a DL-based multiuser orthogonal frequency division multiplexing (OFDM) detector subject to multiuser adversarial attack. The bit error rates under different adversarial attacks are compared. The results show that, the perturbation efficiency of adversarial attack is higher than conventional multiuser interference. Virtual adversarial methods (VAM) and zeroth-order-optimization (ZOO) attacks perform the best among white-box and black-box methods, respectively. They are also effective when the attack changes the starting time. Additionally, adding the number of attackers is found useful to improve the VAM attack but not for ZOO. This letter shows that adversarial attack is powerful to generate adversarial against multiuser OFDM communications.