Attack Behavior Research Articles

Enhancing intrusion detection performance using explainable ensemble deep learning.

Given the exponential growth of available data in large networks, the need for an accurate and explainable intrusion detection system has become of high necessity to effectively discover attacks in such networks. To deal with this challenge, we propose a two-phase Explainable Ensemble deep learning-based method (EED) for intrusion detection. In the first phase, a new ensemble intrusion detection model using three one-dimensional long short-term memory networks (LSTM) is designed for an accurate attack identification. The outputs of three classifiers are aggregated using a meta-learner algorithm resulting in refined and improved results. In the second phase, interpretability and explainability of EED outputs are enhanced by leveraging the capabilities of SHape Additive exPplanations (SHAP). Factors contributing to the identification and classification of attacks are highlighted which allows security experts to understand and interpret the attack behavior and then implement effective response strategies to improve the network security. Experiments conducted on real datasets have shown the effectiveness of EED compared to conventional intrusion detection methods in terms of both accuracy and explainability. The EED method exhibits high accuracy in accurately identifying and classifying attacks while providing transparency and interpretability.

Cluster Detection Method of Endogenous Security Abnormal Attack Behavior in Air Traffic Control Network

Cluster Detection Method of Endogenous Security Abnormal Attack Behavior in Air Traffic Control Network

ConLBS: An Attack Investigation Approach Using Contrastive Learning with Behavior Sequence.

Attack investigation is an important research field in forensics analysis. Many existing supervised attack investigation methods rely on well-labeled data for effective training. While the unsupervised approach based on BERT can mitigate the issues, the high degree of similarity between certain real-world attacks and normal behaviors makes it challenging to accurately identify disguised attacks. This paper proposes ConLBS, an attack investigation approach that combines the contrastive learning framework and multi-layer transformer network to realize the classification of behavior sequences. Specifically, ConLBS constructs behavior sequences describing behavior patterns from audit logs, and a novel lemmatization strategy is proposed to map the semantics to the attack pattern layer. Four different augmentation strategies are explored to enhance the differentiation between attack and normal behavior sequences. Moreover, ConLBS can perform unsupervised representation learning on unlabeled sequences, and can be trained either supervised or unsupervised depending on the availability of labeled data. The performance of ConLBS is evaluated in two public datasets. The results show that ConLBS can effectively identify attack behavior sequences in the cases of unlabeled data or less labeled data to realize attack investigation, and can achieve superior effectiveness compared to existing methods and models.

A Combinatorial Optimization Analysis Method for Detecting Malicious Industrial Internet Attack Behaviors

Industrial Internet plays an important role in key critical infrastructure sectors and is the target of different security threats and risks. There are limitations in many existing attack detection approaches, such as function redundancy, overfitting and low efficiency. A combinatorial optimization method Lagrange multiplier is designed to optimize the underlying feature screening algorithm. The optimized feature combination is fused with random forest and XG-Boost selected features to improve the accuracy and efficiency of attack feature analysis. Using both the UNSW-NB15 and Natural gas pipeline datasets, we evaluate the performance of the proposed method. It is observed that the influence degrees of the different features associated with the attack behavior can result in the binary classification attack detection increases to 0.93, and the attack detection time reduces by 6.96 times. The overall accuracy of multi-classification attack detection is also observed to improve by 0.11. We also observe that nine key features of attack behavior analysis are essential to the analysis and detection of general attacks targeting the system, and by focusing on these features one could potentially improve the effectiveness and efficiency of real-time critical industrial system security. In this paper, CICDDoS2019 dataset and CICIDS2018 dataset are used to prove the generalization. The experimental results show that the proposed method has good generalization and can be extended to the same type of industrial anomaly data sets.

ResADM: A Transfer-Learning-Based Attack Detection Method for Cyber–Physical Systems

Deep learning has proven to be effective for enhancing the accuracy and efficiency of attack detection through training with large sample sizes. However, when applied to cyber–physical systems (CPSs), it still encounters challenges such as scarcity of attack samples, the difficulty of selecting features for high-dimensional data, and weak model-generalization ability. In response, this paper proposes ResADM, a transfer-learning-based attack detection method for CPSs. Firstly, an intentional sampling method was employed to construct different sets of samples for each class, effectively balancing the distribution of CPS-attack samples. Secondly, a feature-selection method based on importance was designed to extract the meaningful features from attack behaviors. Finally, a transfer-learning network structure based on ResNet was constructed, and the training parameters of the source model were optimized to form the network-attack detection method. The experimental results demonstrated that ResADM effectively balanced the data classes and extracted 32-dimensional attack-behavior features. After pre-training on the UNSW-NB15 dataset, ResADM achieved a detection accuracy of up to 99.95% for attack behavior on the CICIDS2017 dataset, showcasing its strong practicality and feasibility.

Does the provision of live black soldier fly and yellow mealworm larvae improve Muscovy duck welfare?

BackgroundThe provision of environmental enrichments to Muscovy ducks could reduce the expression of the aggressive behaviors. The aim of the present study was to evaluate the effects of black soldier fly (BSF) and yellow mealworm (YM) live larva provision on Muscovy duck performance, excreta corticosterone metabolites (ECM), behavior, and blood parameters.MethodsA total of 126 3-day-old female Muscovy ducklings were allotted to 18 pens (6 replicates/treatment, 7 birds/pen) and assigned to 3 experimental treatments: a control group fed commercial feed, and two experimental treatments fed commercial feed plus the 5% (based on the expected daily feed intake, as fed basis) of BSF and YM live larvae (BSF and YM groups, respectively). A two-phase feeding program was applied: starter (from 3 to 31 days of age) and grower-finisher (from 32 to 55 days of age). The live weight, average daily gain, average daily feed intake, and feed conversion ratio were calculated. Larva consumption times were collected, and video recordings were performed during 3 periods (P) each day: the hour before (P1), during (P2), and after (P3) the larva administration. ECM were evaluated at 3, 31, and 55-day-old. Finally, the total red and white blood cell counts, serum proteins, lipids, and liver and renal function serum enzymes were evaluated on 12 birds/treatment.ResultsThe experimental treatment did not affect the growth performance of the birds (P > 0.05). Larva consumption times were always similar between the two insect species, except at 14–18 days of age, were BSF larvae were consumed faster than YM larvae (P < 0.001). The birds showed less walking activity during P2, and preening behavior increased in YM birds during P3. The C birds increased the attack behavior over the weeks (P < 0.05). During weeks 1–3 the YM group reduced the attack frequency (P1 > P3; P < 0.05). Finally, the provision of live BSF and YM larvae significantly reduced the ECM at 55 days of age and the heterophil to lymphocyte ratio (P < 0.05).ConclusionsLive BSF and YM larva supplementation in Muscovy duck improves duck welfare, without impairing birds’ growth performance.

Application of machine learning algorithm and data evaluation in computer network security situation awareness technology

With the rapid development of information technology and the rapid popularization of the Internet, while people enjoy the convenience and efficiency brought about by new technologies, they are also suffering from the harm caused by cyber attacks. In addition to efficiently thwarting network assaults, a high volume of complicated security event data might unintentionally increase the strain of policy makers. At present, NS threats mainly include network viruses, trojans, DOS (Denial-Of-Service), etc. For the increasingly complex Network Security (NS) problems, the traditional rule-based network monitoring technology is difficult to predict the unknown attack behavior. Environment-based, dynamic and integrated data fusion can integrate data from a macro perspective. In recent years, Machine Learning (ML) technology has developed rapidly, which could easily train, test and predict existing third-party models. It uses ML algorithms to find out the association between data rather than manually sets rules. Support vector machine is a common ML method, which can predict the security of the network well after training and testing. In order to monitor the overall security status of the entire network, NS situation awareness refers to the real-time and accurate reproduction of network attacks using the reconstruction approach. Situation awareness technology is a powerful network monitoring and security technology, but there are many problems in the existing NS technology. For example, the state of the network cannot be accurately detected, and its change rule cannot be understood. In order to effectively predict network attacks, this paper adopted a technology based on ML and data analysis, and constructed a NS situational awareness model. The results showed that the detection efficiency of the model based on ML and data analysis was 7.18% higher than that of the traditional NS state awareness model.

APT Attack Detection Based on Graph Convolutional Neural Networks

Advanced persistent threat (APT) attacks are malicious and targeted forms of cyberattacks that pose significant challenges to the information security of governments and enterprises. Traditional detection methods struggle to extract long-term relationships within these attacks effectively. This paper proposes an APT attack detection model based on graph convolutional neural networks (GCNs) to address this issue. The aim is to detect known attacks based on vulnerabilities and attack contexts. We extract organization-vulnerability relationships from publicly available APT threat intelligence, along with the names and relationships of software security entities from CVE, CWE, and CAPEC, to generate triple data and construct a knowledge graph of APT attack behaviors. This knowledge graph is transformed into a homogeneous graph, and GCNs are employed to process graph features, enabling effective APT attack detection. We evaluate the proposed method on the dataset constructed in this paper. The results show that the detection accuracy of the GCN method reaches 95.9%, improving by approximately 2.1% compared to the GraphSage method. This approach proves to be effective in real-world APT attack detection scenarios.

Disruption of Cdk5-GluN2B complex by a small interfering peptide attenuates social isolation-induced escalated intermale attack behavior and hippocampal oxidative stress in mice

Social isolation has emerged as a significant issue during the COVID-19 pandemic that can adversely impact human mental health and potentially lead to pathological aggression. Given the lack of effective therapeutic interventions for aggressive behavior, alternative approaches are necessary. In this study, we utilized a genetic method combined with a pharmacological approach to identify and demonstrate the crucial role of Cdk5 in escalated intermale attack behavior induced by 2-week social isolation. Moreover, we developed a small peptide that effectively disrupts the interaction between Cdk5 and GluN2B, given the known involvement of this complex in various neuropsychiatric disorders. Administration of the peptide, either systemically or via intrahippocampal injection, significantly reduced oxidative stress in the hippocampus and attenuated intermale attack behavior induced by 2-week social isolation. These findings highlight the previously unknown role of the hippocampal Cdk5-GluN2B complex in social isolation-induced aggressive behavior in mice and propose the peptide as a promising therapeutic strategy for regulating attack behavior and oxidative stress.

Impact of anthropogenic infrastructure on aquatic and avian predator–prey interactions in a modified lowland river

Abstract The relationship between aquatic and avian predators and prey is a fundamental process that influences the ecological dynamics of freshwater communities; a landscape of fear underpins spatial and temporal habitat use of prey, i.e., non‐consumptive predation effects. For example, complex marginal vegetation and other natural in‐river refuges are known to be important for prey to manage predation risk and predators must alter their behaviour in response to habitat patches prey occupy. However, it is unclear how prey respond to predators, and vice versa, in heavily modified degraded lowland rivers with a high degree of river maintenance measures; a component critical for flood risk management globally. Such modifications could lead to prey seeking refuge at hazardous anthropogenic infrastructure, but a robust quantification of predator–prey interactions in this context is required to develop this understanding. Using multi‐beam sonar (Dual‐Frequency Identification Sonar), we non‐invasively and simultaneously quantified the temporal rate of predator–prey interactions, the attack behaviour of predators, and the refuge seeking behaviour of prey at a pumping station intake during winter in a heavily modified lowland river. Prey fish experienced temporally dynamic, density‐dependant, and species‐specific predation risks from two dissimilar predators (i.e., aquatic vs. avian); pike (Esox lucius) and cormorant (Phalacrocorax carbo). Generalised linear modelling revealed that prey refuge use was positively associated with predator attack rate. Non‐consumptive effects were evidenced by quantified changes to shoal structure (density, area), shoaling (group aggregation), and schooling (coordinated directional movement), including diurnal migrations to and from the pumping station intake for refuge. Our results show that in the absence of natural refuge habitats the natural landscape of fear shifted and speculate that prey fish were paradoxically dependant on hazardous anthropogenic infrastructure, i.e., a pumping station intake, for refuge from predators in a degraded lowland river. These findings strongly enhance our understanding of the impact of anthropogenic infrastructure on predator–prey interactions by demonstrating how flood risk management, including river maintenance measures, and associated anthropogenic infrastructure can impact the behavioural game played between aquatic and avian predators and their prey.

Application of Deep Neural Network with Frequency Domain Filtering in the Field of Intrusion Detection

In the field of intrusion detection, existing deep learning algorithms have limited capability to effectively represent network data features, making it challenging to model the complex mapping relationship between network data and attack behavior. This limitation, in turn, impacts the detection accuracy of intrusion detection systems. To address this issue and further enhance detection accuracy, this paper proposes an algorithm called the Fourier Neural Network (FNN). The core of FNN consists of a Deep Fourier Neural Network Block (DFNNB), which is composed of a Hadamard Neural Network (HNN) and a Fourier Neural Network Layer (FNNL). In a DFNNB, the HNN is responsible for sampling the network intrusion data samples in different time domain spaces. The FNNL, on the other hand, performs a Fourier transform on the samples outputted by the HNN and maps them to the frequency domain space, followed by a filtering process. Finally, the data processed by filtering are transformed back to the time domain space for subsequent feature extraction work by the DFNNB. Additionally, to enhance the algorithm’s detection accuracy and filter out noise signals, this paper also introduces a High-energy Filtering Process (HFP), which eliminates noise signals from the data signal and reduces interference on the final detection result. Due to the ability of FNN to process network data in both the time domain space and the frequency domain space, it possesses a stronger capability in expressing data features. Finally, this paper conducts performance evaluations on the KDD Cup99, NSL-KDD, UNSW-NB15, and CICIDS2017 datasets. The results demonstrate that the proposed FNN-based IDS model achieves higher detection rates, lower false alarm rates, and better detection performance than classical deep learning and machine learning methods.

Simulation Study of Pedestrians Evacuation Considering Aggressive Behavior

Conflict during an evacuation may turn into aggressive behavior and create problems for evacuation. To study the influence of attack behaviors such as pushing and shoving on evacuation and the evacuation law, an extended cellular automata model is developed in this paper. In the model, pedestrian movement is influenced by static, dynamic, and attack floor fields. In addition, pedestrian vision is influenced by the direction and location of movement of surrounding pedestrians, and pedestrians adopt different coping strategies for attacks: avoidance detour, or imitation. Attacker movement and aggressive behavior are also studied. Numerical simulations are conducted to discuss the pedestrian evacuation problem under attack behavior. The effects of the evacuation process, attack field sensitivity coefficient, location of fallen pedestrians, pedestrian density, number of initial attackers, initial attacker location, and pedestrian imitation ratio on evacuation time and number of fallen pedestrians are analyzed. The simulation results show that an appropriate increase in the impact of the attack field can slow down the congestion, that is, the evacuation time is the fastest at kA = 0.5. The evacuation time is faster when the room is full of normal pedestrians or full of attacking pedestrians. The number of casualty pairs is high when the initial position of the attacker is in the middle of the inner side of the room. The results of the study can provide recommendations and guidance for the formulation of evacuation strategies for pushing and shoving type attacks and reducing casualties.

LFighter: Defending against the label-flipping attack in federated learning

Federated learning (FL) provides autonomy and privacy by design to participating peers, who cooperatively build a machine learning (ML) model while keeping their private data in their devices. However, that same autonomy opens the door for malicious peers to poison the model by conducting either untargeted or targeted poisoning attacks. The label-flipping (LF) attack is a targeted poisoning attack where the attackers poison their training data by flipping the labels of some examples from one class (i.e., the source class) to another (i.e., the target class). Unfortunately, this attack is easy to perform and hard to detect, and it negatively impacts the performance of the global model. Existing defenses against LF are limited by assumptions on the distribution of the peers’ data and/or do not perform well with high-dimensional models. In this paper, we deeply investigate the LF attack behavior. We find that the contradicting objectives of attackers and honest peers on the source class examples are reflected on the parameter gradients corresponding to the neurons of the source and target classes in the output layer. This makes those gradients good discriminative features for the attack detection. Accordingly, we propose LFighter, a novel defense against the LF attack that first dynamically extracts those gradients from the peers’ local updates and then clusters the extracted gradients, analyzes the resulting clusters, and filters out potential bad updates before model aggregation. Extensive empirical analysis on three data sets shows the effectiveness of the proposed defense regardless of the data distribution or model dimensionality. Also, LFighter outperforms several state-of-the-art defenses by offering lower test error, higher overall accuracy, higher source class accuracy, lower attack success rate, and higher stability of the source class accuracy. Our code and data are available for reproducibility purposes at https://github.com/NajeebJebreel/LFighter.

Vulnerability analysis of an electric vehicle fleet for car-sharing service under cyber attacks

The booming development of the car-sharing industry and the continuous increase in the market share of electric vehicles demand effective dispatching strategies that consider collaborative optimization of route selection and charging management. Furthermore, in recent years, network attacks have posed significant threats to traffic management centers. Therefore, this paper presents a pioneering work aimed at investigating the vulnerability of electric vehicle sharing services in traffic management systems under network attacks. Firstly, we develop a bilevel optimization model to capture the game between network attackers and electric vehicle fleet operators. The upper-level problem represents the behavior of network attackers, who aim to maximize the total cost by manipulating traffic control signals and sensor data. The lower-level problem determines the system operator's decisions on optimizing route selection and charging scheduling to minimize costs. Secondly, a nested column generation algorithm is employed to solve the bilevel optimization model. Finally, several sensitivity studies are conducted using real-world traffic networks to examine the effectiveness of the proposed model and the influence of various parameters on system performance.

MTS-DVGAN: Anomaly detection in cyber-physical systems using a dual variational generative adversarial network

Deep generative models are promising in detecting novel cyber-physical attacks, mitigating the vulnerability of Cyber-physical systems (CPSs) without relying on labeled information. Nonetheless, these generative models face challenges in identifying attack behaviors that closely resemble normal data, or deviate from the normal data distribution but are in close proximity to the manifold of the normal cluster in latent space. To tackle this problem, this article proposes a novel unsupervised dual variational generative adversarial model named MST-DVGAN, to perform anomaly detection in multivariate time series data for CPS security. The central concept is to enhance the model's discriminative capability by widening the distinction between reconstructed abnormal samples and their normal counterparts. Specifically, we propose an augmented module by imposing contrastive constraints on the reconstruction process to obtain a more compact embedding. Then, by exploiting the distribution property and modeling the normal patterns of multivariate time series, a variational autoencoder is introduced to force the generative adversarial network (GAN) to generate diverse samples. Furthermore, two augmented loss functions are designed to extract essential characteristics in a self-supervised manner through mutual guidance between the augmented samples and original samples. Finally, a specific feature center loss is introduced for the generator network to enhance its stability. Empirical experiments are conducted on three public datasets, namely SWAT, WADI and NSL_KDD. Comparing with the state-of-the-art methods, the evaluation results show that the proposed MTS-DVGAN is more stable and can achieve consistent performance improvement.

Collaborative Federated Learning-Based Model for Alert Correlation and Attack Scenario Recognition

Planned and targeted attacks, such as the advanced persistent threat (APT), are highly sophisticated forms of attack. They involve numerous steps and are intended to remain within a system for an extended length of period before progressing to the next stage of action. Anticipating the next behaviors of attackers is a challenging and crucial task due to the stealthy nature of advanced attack scenarios, in addition to the possible high volumes of false positive alerts generated by different security tools such as intrusion detection systems (IDSs). Intelligent models that are capable of establishing a correlation individual between individual security alerts in order to reconstruct attack scenarios and to extract a holistic view of intrusion activities are required to exploit hidden links between different attack stages. Federated learning models performed in distributed settings have achieved successful and reliable implementations. Alerts from distributed security devices can be utilized in a collaborative manner based on several learning models to construct a federated model. Therefore, we propose an intelligent detection system that employs federated learning models to identify advanced attack scenarios such as APT. Features extracted from alerts are preprocessed and engineered to produce a model with high accuracy and fewer false positives. We conducted training on four machine learning models in a centralized learning; these models are XGBoost, Random Forest, CatBoost, and an ensemble learning model. To maintain privacy and ensure the integrity of the global model, the proposed model has been implemented using conventional neural network federated learning (CNN_FL) across several clients during the process of updating weights. The experimental findings indicate that ensemble learning achieved the highest accuracy of 88.15% in the context of centralized learning. CNN_FL has demonstrated an accuracy of 90.18% in detecting various attacks of APTs while maintaining a low false alarm rate.

A Labeled RFS-Based Framework for Multiple Integrity Attackers Detection and Identification in Cyber–Physical Systems

The problem of multiple integrity attacks (attackers) detection and identification (MIADI) in cyber-physical systems (CPSs) is still a challenging problem to date. The goal of this paper is to develop a knowledge-based method capable of simultaneously detecting and identifying multiple integrity attacks aiming at different sensors in a CPS. In this paper, with the help of labeled random finite set (RFS) theory, a new solution to solve the MIADI problem is proposed. The main contributions of this paper, lie in the the following two aspects, the first is the novel formulation of the MIADI problem, in which labeled RFSs are used to model the behaviors of multiple integrity attackers for the first time, and the second is the proposed labeled RFS-based solution, which provides an elegant framework to cope with the MIADI problem. Numerical experiments are conducted and experimental results demonstrate the effectiveness of the proposed solution. This proposed solution further extends the feasibility of the labeled RFS theory in the context of CPSs cybersecurity.

Magnets to Adversaries—An Analysis of the Attacks on Public Cloud Servers

Security adversaries are always constantly looking for targets to exploit. The mechanism of exploitation used by security adversaries varies significantly. Many focus on easy compromises as mere pivots to extend their attacks from these exploited systems to continue accomplishing their original goals. The cloud environment is a highly susceptible target for adversaries and provides a solid mechanism for observing adversary behavior. The sheer volume of attacks on the cloud provides insights into the attacker’s objectives and attack patterns, which can be leveraged for protecting infrastructure. This work deep dives into the practices used by adversaries on the commonly exposed protocols in the Amazon Web Services (AWS), Microsoft Azure (Azure), Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) platforms. A robust honeypot model is documented that compares attacker behavior across various ports and protocols running in multiple cloud environments. This work illustrates that adversary activity is highly versatile in the public cloud environment, with an average of 700 new and unique IP addresses found attacking honeypot infrastructure daily. Further, this article illustrates the security safeguards a typical organization can leverage to mitigate the threats from these adversaries constantly probing insecure targets on the cloud platform.

An Intelligent Digital Twin Method Based on Spatio-Temporal Feature Fusion for IoT Attack Behavior Identification

An Intelligent Digital Twin Method Based on Spatio-Temporal Feature Fusion for IoT Attack Behavior Identification

PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks

The increase in scale of cyber networks and the rise in sophistication of cyber-attacks have introduced several challenges in intrusion detection. The primary challenge is the requirement to detect complex multi-stage attacks in realtime by processing the immense amount of traffic produced by present-day networks. In this paper we present PRISM, a hierarchical intrusion detection architecture that uses a novel attacker behavior model-based sampling technique to minimize the realtime traffic processing overhead. PRISM has a unique multi-layered architecture that monitors network traffic distributedly to provide efficiency in processing and modularity in design. PRISM employs a Hidden Markov Model-based prediction mechanism to identify multi-stage attacks and ascertain the attack progression for a proactive response. Furthermore, PRISM introduces a stream management procedure that rectifies the issue of alert reordering when collected from distributed alert reporting systems. To evaluate the performance of PRISM, multiple metrics have been proposed, and various experiments have been conducted on a multi-stage attack dataset. The results exhibit up to 7.5x improvement in processing overhead as compared to a standard centralized IDS without the loss of prediction accuracy while demonstrating the ability to predict different attack stages promptly.