Attack Defense Research Articles

A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO

The development of 5G brings convenience to people, but it also brings threats. It is particularly important to analyze attack–defense confrontation from a macro perspective. Network security of graph is an important research problem in current network environment. A Stackelberg game model based on 5G network graph is established to analyze the attack–defense confrontation in this paper. In order to solve the Nash equilibrium, a compact particle swarm optimization based on t-Location-Scale distribution (tCPSO) is proposed. The tCPSO uses less memory space and has better optimization performance. The experiments prove that tCPSO has better optimization performance than other heuristic algorithms on CEC2013. The clustering experiments further show that tCPSO has better optimization ability than other heuristic algorithms. The optimal defense strategies under different attack–defense resources are analyzed in this paper. It is concluded that increasing the successful defense rate is more effective for the defender to obtain greater profit than reducing the successful attack rate. Using intelligent computing to solve Nash equilibrium is a new idea for researchers to analyze attack–defense confrontation.

The Concepts and Contextualization of Incantations in Nigerian Popular Music: Juju Music as Paradigm

The Yoruba people like any other African tribe are enriched with magical and other traditional spiritual powers that are capable of invoking spirits and deities. These powers actualized with incantation as one of the Yoruba oral literature, to achieve a particular spiritual purpose. This paper discusses the concepts and contextualization of incantations by some Nigerian Juju musicians as part of their music in order to highlight various types and their socio-religious roles. Data is collected through primary and secondary sources, and this paper relies on culture change and role theories in musicology as a fulcrum for discourse. The findings revealed that the incantation used in Juju music contains texts requesting spiritual protection, a defensive attack against the enemy, as well as for fame and financial success. Discovered that the incantation performed in spoken verse or song form as prescribed by the spiritualists consulted. This paper concludes that, apart from musicians’ creativity, the culture change witnessed in terms of the use of incantation in juju music in the 1970s, was because of the borrowed creativity influenced by different Yoruba traditional spiritual poetry. This paper, therefore, highlights and documents the phenomenon of incantation as a Yoruba linguistic verbal art in popular music in Nigeria.

Combat Response Training Tester Based on Intelligent Force-Measuring Sensor and Digital Circuit

In combat sports, the team members take attack and defense as the core of sports, and the technical movements are not periodic and the application process is irregular. During the competition, observe the opponent’s neutral position, judge timely, and react quickly. At the same time, athletes are required not only to master skilled technical movements but also to have rapid and accurate adaptability. In order to improve athletes’ rapid response ability, according to the rapid response training scheme, a combat response training tester based on a force-measuring intelligent sensor and digital circuit is designed to improve the athletes’ response ability. Firstly, a comprehensive test system of combat trainer is designed based on the intelligent force-measuring sensor and MSP430, which can measure the response time, speed, and strength of boxing. Secondly, a wavelet filtering algorithm is used to filter the sensor measurement data. Finally, the striking force and striking time of each action are recorded by sensors and data acquisition devices to reflect the striking effect and reflect the “accurate” objectives of the project characteristics. Based on the noninterference and anti-interference of e-touch piezoelectric film, it can be made into universal force-measuring sensors of different specifications for fight competitions according to needs. After being connected into a module network in parallel, it can be connected with the microcontroller to determine the hit area. In addition, the team reaction training test device has laid a foundation for the scientific evaluation of improving the team members’ reaction ability and attack defense conversion ability. The launch of the comprehensive ability tester for combat athletes introduces the previous fuzzy evaluation of athletes’ comprehensive ability into a new way of scientific quantitative measurement and evaluation, which will provide a scientific basis for the selection of combat vibration items, the regulation of training process, the inspection of training effect, and the formulation of enrollment and examination standards for sports colleges and universities. The results show that the instrument can obtain the parameters of hitting strength, strength endurance, hitting speed, speed endurance, hitting impulse, and hitting power of sports biomechanics on the group of fighting events, which provides a reliable basis for coaches to implement teaching and training for athletes.

An anti-collusion attack defense method for physical layer key generation scheme based on transmission delay.

Physical layer security (PLS) is considered one of the most promising solutions to solve the security problems of massive Internet of Things (IoTs) devices because of its lightweight and high efficiency. Significantly, the recent physical layer key generation (PLKG) scheme based on transmission delay proposed by Huang et al. (2021) does not have any restrictions on communication methods and can extend the traditional physical layer security based on wireless channels to the whole Internet scene. However, the secret-sharing strategy adopted in this scheme has hidden dangers of collusion attack, which may lead to security problems such as information tampering and privacy disclosure. By establishing a probability model, this article quantitatively analyzes the relationship between the number of malicious collusion nodes and the probability of key exposure, which proves the existence of this security problem. In order to solve the problem of collusion attack in Huang et al.'s scheme, this article proposes an anti-collusion attack defense method, which minimizes the influence of collusion attack on key security by optimizing parameters including the number of the middle forwarding nodes, the random forwarding times, the time delay measurement times and the out-of-control rate of forwarding nodes. Finally, based on the game model, we prove that the defense method proposed in this article can reduce the risk of key leakage to zero under the scenario of the "Careless Defender" and "Cautious Defender" respectively.

An SDN perspective IoT-Fog security: A survey

The utilization of the Internet of Things (IoT) has burst in recent years. Fog computing is a notion that solves cloud computing’s limitations by offering low latency to IoT network user applications. However, the significant number of networked IoT devices, the large scale of the IoT, security concerns, users’ critical data, and heterogeneity in this extensive network significantly complicate the implementation. The IoT-Fog architecture consists of fog devices (servers) at the fog layer, which decreases network utilization and response time due to their closeness to IoT devices. However, as the number of IoT and fog devices under the IoT-Fog architecture grows, new security concerns and requirements emerge. Because incorporating fog computing into IoT networks introduces some vulnerabilities to IoT-Fog networks, the nodes in the fog layer are the target of security threats. Software-Defined Networking (SDN) is a novel paradigm that decouples the data plane from control plane, resulting in better programmability and manageability. Attack defense mechanisms can be implemented in the IoT-Fog network without SDN. But SDN paradigm provides the IoT-Fog with some characteristics that facilitate counterattacks. This survey briefly explains some works that utilized the SDN features in the IoT-Fog network for security threats in the IoT-Oriented fog layer. To this end, we examine IoT-Fog, SDN, and SDN-based IoT-Fog networks. We describe security threats in IoT-Fog networks and briefly explain the vulnerabilities and attacks in the fog layer. Then, we describe the fog layer’s most common IoT-Fog security defense mechanisms. Following that, we present the SDN features, explore how SDN can help defensive mechanisms in IoT-Fog networks, and categorize the works based on the SDN features they use. We explain their features and present a comparison between them. Finally, we discuss the disadvantages of SDN in IoT-Fog networks.

An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments

As an essential piece of infrastructure supporting cyberspace security technology verification, network weapons and equipment testing, attack defense confrontation drills, and network risk assessment, Cyber Range is exceptionally vulnerable to distributed denial of service (DDoS) attacks from three malicious parties. Moreover, some attackers try to fool the classification/prediction mechanism by crafting the input data to create adversarial attacks, which is hard to defend for ML-based Network Intrusion Detection Systems (NIDSs). This paper proposes an adversarial DBN-LSTM method for detecting and defending against DDoS attacks in SDN environments, which applies generative adversarial networks (GAN) as well as deep belief networks and long short-term memory (DBN-LSTM) to make the system less sensitive to adversarial attacks and faster feature extraction. We conducted the experiments using the public dataset CICDDoS 2019. The experimental results demonstrated that our method efficiently detected up-to-date common types of DDoS attacks compared to other approaches.

Enriched Model of Case Based Reasoning and Neutrosophic Intelligent System for DDoS Attack Defence in Software Defined Network based Cloud

Software Defined Networking in Cloud paradigm is most suitable for dynamic functionality and reduces the computation complexity. The routers and switches located at the network's boundaries are managed by software-defined netwrking (SDN) using open protocols and specialised open programmable interfaces. But the security threats often degrade the performance of SDN due to its constraints of resource usage. The most sensitive components which are vulnerable to DDoS attacks are controller and control plane bandwidth. The existing conventional classification algorithms lacks in detection of new or unknown traffic packets which are malicious and results in degradation of SDN performance in cloud resources. Hence, in this paper double filtering methodology is devised to detect both known and unknown pattern of malicious packets which affects the bandwidth of the control panel and the controller. The case-based reasoning is adapted for determining the known incoming traffic patterns before entering the SDN system. It classifies the packets are normal or abnormal based on the previous information gathered. The traffic patterns which is not matched from the previous patterns is treated as indeterministic packet and it is defined more precisely using the triplet representation of Neutrosophic intelligent system. The grade of belongingness, non-belongingness and indeterminacyis used as the main factors to detect the new pattern of attacking packets more effectively. From the experimental outcomes it is proved that DDoS attack detection in SDN based cloud environment is improved by adopting CBR-NIS compared to the existing classification model.

Resilient Defense of False Data Injection Attacks in Smart Grids via Virtual Hidden Networks

The resilient defence strategy for the False Data Injection Attacks (FDIAs) from the perspective of structural vulnerability of smart grids, by using graph and cybernetic approaches, is investigated in this paper. FDIA is a kind of well-designed cyber attack that can bypass traditional bad data detection methods and thus cause serious damage to smart grids. To defend against FDIAs, a resilient defence control strategy based on virtual hidden networks is proposed to improve the structural vulnerability of smart grids in this study. Firstly, a reduced-dimensional local consensus dynamic model is derived by Kron reduction method. Secondly, a virtual hidden network interconnected with the grid is constructed and designed by using graph theory to indirectly improve the structural vulnerability of the smart grid. In addition, a competitive interconnection approach based on the network zero-sum game is used to further improve the structural vulnerability of the smart grid. The resilience of the smart grid can be effectively improved by changing the topology of the virtual hidden network and the interconnection bipartite graph. Thirdly, the stability of the virtual hidden network-based defence controller is demonstrated separately under either cases without or with FDIAs. The results show that the addition of the virtual hidden network does not change the steady-state operating point of the original grid, but can effectively mitigate the impact of FDIAs on the smart grid. Finally, the effectiveness of the proposed approach is demonstrated on the IEEE 14-bus grid and on the New England 39-bus grid, respectively.

Transformer-Based Device-Type Identification in Heterogeneous IoT Traffic

Due to the heterogeneity of Internet of Things (IoT) devices and the diversity of IoT communication protocols, it is challenging to model the communication behaviors of IoT devices to facilitate attack defense. Considering the complex correlation between the IoT device types and the patterns of their communication behaviors, one possible solution is to cluster IoT devices into different types based on the characteristics of their communication behaviors and deal with each type, respectively. However, IoT traffic includes a significant proportion of abnormal traffic, such as attack traffic sourcing from compromised devices, which cannot reflect the behavioral characteristics of the source device. In this article, we propose a Transformer-based IoT device-type identification method to address the above challenges. Specifically, our approach consists of three main components. First, we classify the traffic data from IoT devices into normal and abnormal types by a Transformer-based traffic diagnosis model. Next, another Transformer-based model is adopted on the normal traffic to identify the IoT device type. Finally, considering the immutability of IoT device types, a results-ensemble algorithm is designed to improve the accuracy of IoT device-type identification. Experimental results verify the effectiveness of our method, which brings a noticeable improvement in terms of both accuracy and macro <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$F1$ </tex-math></inline-formula> -score compared to other methods. Moreover, by applying the results-ensemble algorithm in the test phase, we can achieve 100% accuracy under certain conditions.

Security Quantification of Container-Technology-Driven E-Government Systems

With the rapidly increasing demands of e-government systems in smart cities, a myriad of challenges and issues are required to be addressed. Among them, security is one of the prime concerns. To this end, we analyze different e-government systems and find that an e-government system built with container-based technology is endowed with many features. In addition, overhauling the architecture of container-technology-driven e-government systems, we observe that securing an e-government system demands quantifying security issues (vulnerabilities, threats, attacks, and risks) and the related countermeasures. Notably, we find that the Attack Tree and Attack–Defense Tree methods are state-of-the-art approaches in these aspects. Consequently, in this paper, we work on quantifying the security attributes, measures, and metrics of an e-government system using Attack Trees and Attack–Defense Trees—in this context, we build a working prototype of an e-government system aligned with the United Kingdom (UK) government portal, which is in line with our research scope. In particular, we propose a novel measure to quantify the probability of attack success using a risk matrix and normal distribution. The probabilistic analysis distinguishes the attack and defense levels more intuitively in e-government systems. Moreover, it infers the importance of enhancing security in e-government systems. In particular, the analysis shows that an e-government system is fairly unsafe with a 99% probability of being subject to attacks, and even with a defense mechanism, the probability of attack lies around 97%, which directs us to pay close attention to e-government security. In sum, our implications can serve as a benchmark for evaluation for governments to determine the next steps in consolidating e-government system security.

SAFE: EFFICIENT DDOS ATTACK DEFENSE WITH ELASTIC TRAFFIC FLOW INSPECTION IN SDN-BASED DATA CENTERS

In this paper, we propose an efficient distributed denial-of-Service (DDoS) Attack deFEnse solution, namely SAFE, which utilizes an elastic traffic flow inspection mechanism, for Software-Defined Networking (SDN) based data centers. In particular, we first examine a leaf-spine SDN-based data center network, which is highly vulnerable to volumetric DDoS attacks. Next, we develop a rank-based anomaly detection algorithm to recognize anomalies in the amount of incoming traffic. Then, for the traffic flow inspection, we introduce a component called DFI (Deep Flow Inspection) running an Open vSwitch (OvS) that can be dynamically initiated (as a virtual machine) on-demand to collect traffic flow statistics. By utilizing deep reinforcement learning-based traffic monitoring from our previous study, the DFIs can be protected from the flow-table overflow problem while providing more detailed traffic flow information. Afterward, a machine learning-based attack detector analyzes the gathered flow rule statistics to identify the attack, and appropriate policies are implemented if an attack is recognized. The experiment results show that the SAFE can effectively defend against volumetric DDoS attacks while assuring a reliable Quality-of-Service level for benign traffic flows in SDN-based data center networks. Specifically, for TCP SYN and UDP floods, the SAFE attack detection performance is improved by approximately 40% and 30%, respectively, compared to the existing SATA solution. Furthermore, the attack mitigation performance, the ratio of dropped malicious packets obtained by the SAFE is superior by approximately 48% (for TCP SYN flood) and 52% (for UDP flood) to the SATA.

Genome-Wide Identification and Expression Analysis of ESPs and NSPs Involved in Glucosinolate Hydrolysis and Insect Attack Defense in Chinese Cabbage (Brassica rapa subsp. pekinensis)

Glucosinolates are secondary plant metabolites that are part of the plant's defense system against pathogens and pests and are activated via enzymatic degradation by thioglucoside glucohydrolases (myrosinases). Epithiospecifier proteins (ESPs) and nitrile-specifier proteins (NSPs) divert the myrosinase-catalyzed hydrolysis of a given glucosinolate to form epithionitrile and nitrile rather than isothiocyanate. However, the associated gene families have not been explored in Chinese cabbage. We identified three ESP and fifteen NSP genes randomly distributed on six chromosomes in Chinese cabbage. Based on a phylogenetic tree, the ESP and NSP gene family members were divided into four clades and had similar gene structure and motif composition of Brassica rapa epithiospecifier proteins (BrESPs) and B. rapa nitrile-specifier proteins (BrNSPs) in the same clade. We identified seven tandem duplicated events and eight pairs of segmentally duplicated genes. Synteny analysis showed that Chinese cabbage and Arabidopsis thaliana are closely related. We detected the proportion of various glucosinolate hydrolysates in Chinese cabbage and verified the function of BrESPs and BrNSPs in glucosinolate hydrolysis. Furthermore, we used quantitative RT-PCR to analyze the expression of BrESPs and BrNSPs and demonstrated that these genes responded to insect attack. Our findings provide novel insights into BrESPs and BrNSPs that can help further promote the regulation of glucosinolate hydrolysates by ESP and NSP to resist insect attack in Chinese cabbage.

A differential game approach for real-time security defense decision in scale-free networks

The current network security defense decision method is based on the principle of attack–defense confrontation and generally uses a random network model to project the real network. Most of the existing complex network defense decision methods consider a single defender while ignoring the confrontation and dependence between network attack and defense behaviors. In addition, the pertinence and dynamics of the defense effect are also insufficient. This article comprehensively considers the structure of a scale-free network and characteristics of network attack and defense behavior and combines a complex network with differential game theory to study the real-time defense decision problem. First, a propagation model based on a scale-free network is designed to realize the real-time fluctuation analysis of a network security state. Then, the attack and defense strategy are described, and the calculation method of revenue based on the confrontation analysis of the attack and defense behavior and a change in the security state of the network nodes based on the saddle point equilibrium strategy are introduced. Finally, based on the average connection degree of the real word Internet, a simulated network is constructed to conduct experiments. By comparison with random defense strategies and several typical complex network defense decision methods, the effectiveness and advancement of the proposed method are verified.

High-dynamic intelligent maneuvering guidance strategy via deep reinforcement learning

Aiming at the coordination between maneuvering penetration and high-precision guidance under complex flight missions of high-velocity vehicle, the manuscript studies a three-dimensional high-dynamic intelligent maneuvering guidance strategy based on optimal control and deep reinforcement learning (DRL). A three-dimensional attack–defense model is established, and maneuver guidance mission is decomposed into longitudinal and lateral directions. In the longitudinal direction, maneuvering model with the instantaneous miss distance as the control variable is constructed, and the maximum value principle is employed to obtain the optimal maneuver duration and start timing. In the lateral direction, Markov decision process model of maneuver guidance is proposed by synthesizing the guidance error and miss distance of encounter point, and the reward function is designed by considering maneuver and guidance performance. The DRL method is used to learn and train the maneuver strategy, and the training process is improved as well. The simulation results show that the intelligent maneuvering guidance strategy can improve the penetration performance, reduce influence of maneuver flight on the guidance accuracy, and ensure the adaptability under changeable flight missions.

A quantum-based approach for offensive security against cyber attacks in electrical infrastructure

Deciding the correct offensive security strategy for safeguarding the electrical physical infrastructures of smart grids is a challenging task. The offensive security training against various cyber-attacks focuses on a multitude of electrical subsystems and measurement systems like the Load Frequency Control(LFC) system. Primarily, the principal challenge is to categorize and parameterize the various possible cyber-attacks on electrical infrastructures. This is done by specifying and selecting cyber-attacks considering various main and subsystem blocks of the power structural system within each area of major installations. In this research investigation, formal modeling of security strategy is proposed using Lambda calculus with both classical and quantum perspectives. Furthermore, using a Quantum Machine Learning (QML) technique, the procedure for correct vulnerability prediction, exploitation, and execution strategy is presented with an approximated likelihood of attack and its mode. The local and non-local interactions are introduced as quantum threats and entanglement threats similar to False Data Injection (FDI) methods to induce the attack and counter-attack events through quantum causality connections. Finally, the Quirk simulator is used to validate the proposed quantum design of offensive and defensive attack models considering scenarios of exogenous and scaling attacks on the LFC systems that support the feasibility of the present research work to address the issue of cyber-attacks on the power system networks.

Monocular Facial Presentation–Attack–Detection: Classifying Near-Infrared Reflectance Patterns

This paper presents a novel material spectroscopy approach to facial presentation–attack–defense (PAD). Best-in-class PAD methods typically detect artifacts in the 3D space. This paper proposes similar features can be achieved in a monocular, single-frame approach by using controlled light. A mathematical model is produced to show how live faces and their spoof counterparts have unique reflectance patterns due to geometry and albedo. A rigorous dataset is collected to evaluate this proposal: 30 diverse adults and their spoofs (paper-mask, display-replay, spandex-mask and COVID mask) under varied pose, position, and lighting for 80,000 unique frames. A panel of 13 texture classifiers are then benchmarked to verify the hypothesis. The experimental results are excellent. The material spectroscopy process enables a conventional MobileNetV3 network to achieve 0.8% average-classification-error rate, outperforming the selected state-of-the-art algorithms. This demonstrates the proposed imaging methodology generates extremely robust features.

Distributed denial of service attack defense system-based auto machine learning algorithm

The use of network-connected gadgets is rising quickly in the internet age, which is escalating the number of cyberattacks. The detection of distributed denial of service (DDoS) attacks is a tedious task that has necessitated the development of a number of models for its identification recently. Nonetheless, because of major fluctuations in subscriptions and traffic rates, it continues to be a difficult challenge. A novel automatic detection technique was created to address this issue in this work, which reduces the feature space and consequently minimizes the computational time and model overfitting. Data preprocessing is done first to increase the model's generalizability; then, a feature selection method is used to choose the most pertinent features to increase the accuracy of the classification process. Additionally, hyperparameter tuning-choosing the proper parameters for the learning approach-improved model performance. Finally, the support vector machine (SVM) is compatible with the optimization and the hyperparameters offered by supervised learning methods. The CICDDoS2019 dataset was used to evaluate each of these assays, and the experimental findings demonstrated that, with an accuracy of 99.95%, the suggested model performs well when compared to more modern techniques.

Literature Review of Distributed: Denial of Service Attack Protection

Abstract: In the current environment, cloud computing has developed into a commercial technology that enables users to quickly access resources via the internet on a pay-per-use basis. The customer receives these resources in the form of services. The three service models offered by the cloud services are infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS). As a result of the enormous improvement in cloud computing technology, it is now widely employed by a variety of business applications, industry apps, Enterprise organizations that have committed to multi-cloud designs, and most IT expenditures are based on the cloud. However, security is the main issue that requires more attention. Recent research indicate that resource availability is the main security issue that cloud users must deal with. The distributed denial of service attack is the main cause of this availability problem. A more advanced form of denial of service is the Distributed DoS assault. It is used by everyone to share knowledge, not just researchers. Therefore, the internet is used to transmit all information to any location in the world. As a result, the internet needs to be more dependable, secure, and safe. The number of attacks has increased exponentially with the growth of the internet. Among all attacks, DDOS is the most upsetting and intensive attack for reducing the network's resource or bandwidth. In this study, we will look at various DDoS attack types, their tactics, and associated defences. The treatment of several DDoS attack defence tactics, such as detection, defence, and mitigation, is explored in this study as well.

Identifying Industrial Control Equipment Based on Rule Matching and Machine Learning

To identify industrial control equipment is often a key step in network mapping, categorizing network resources, and attack defense. For example, if vulnerable equipment or devices can be discovered in advance and the attack path can be cut off, security threats can be effectively avoided and the stable operation of the Internet can be ensured. The existing rule-matching method for equipment identification has limitations such as relying on experience and low scalability. This paper proposes an industrial control device identification method based on PCA-Adaboost, which integrates rule matching and machine learning. We first build a rule base from network data collection and then use single and multi-protocol rule-matching methods to identify the type of industrial control devices. Finally, we utilize PCA-Adaboost to identify unlabeled data. The experimental results show that the recognition rate of this method is better than that of the traditional Nmap device recognition method and the device recognition accuracy rate reaches 99%. The evaluation effect of the test data set is significantly enhanced.

WAMS-Based HVDC Damping Control for Cyber Attack Defense

Owing to the fast and large power regulating the capacity of the HVDC system, the wide-area measurement system (WAMS) based high voltage direct current (HVDC) system has been regarded as a prospective solution to deal with the low-frequency oscillation issue. However, due to the vulnerability of the WAMS communication, WAMS based HVDC system control can be a prime target of malicious penetrations that could lead to disastrous events. To remediate this adverse effect, an improved WAMS based HVDC damping control framework is proposed. First, a lightweight network named Attack Shuffle convolutional neural Networks (ASNet) is proposed to learn the characteristics of cyber attacks. Then, a model-free-based cyber attack defense framework is introduced to quickly identify the attack types based on the continuous wavelet transform and ASNet. Additionally, an improved control framework of the WAMS and HVDC-based wide-area power oscillation damping control (WH-PODC) is developed to provide different response control for mitigation of the impact of cyber attacks. Finally, the performance of the proposed WH-PODC control framework is evaluated with real PMU data in multiple scenarios in RTDS, where the results indicate that the response intensity can be kept under multiple types of cyber attacks while providing similar effectiveness in oscillation suppression to conventional controls.