Attack Detection Method Research Articles

Detecting and Analyzing Network Attacks: A Time-Series Analysis Using the Kitsune Dataset

Network security is a critical concern in today’s digital world, requiring efficient methods for the automatic detection and analysis of cyber attacks. This study uses the Kitsune Network Attack Dataset to explore network traffic behavior for IoT devices under various attack scenarios, including ARP MitM, SYN DoS, and Mirai Botnet. Utilizing Python-based data analysis tools, we preprocess and analyze millions of network packets to uncover patterns indicative of malicious activities. The study employs packet-level time-series analysis to visualize traffic patterns and detect anomalies specific to each attack type. Key findings include high packet volumes in attacks such as SSDP Flood and Mirai Botnet, with the Mirai Botnet attack involving multiple IP addresses and lasting over 2 hours. Notable attack-specific behaviors include high traffic on port -1 and targeted traffic on specific ports like 53195. The SYN DoS and Mirai Botnet attacks are characterized by their prolonged durations, suggesting significant disruption. Overall, the study highlights distinctive attack patterns and underscores the importance of understanding these characteristics to enhance detection and response mechanisms.

Modeling and detection of false data injection attacks in cyber-physical distribution system with load aggregator interaction

With the increasing number of users and multi-type loads accessing the cyber–physical distribution system (CPDS), the bidirectional interaction between the system becomes more and more frequent. The Load aggregator (LA) also plays an increasingly important role in the interaction process. However, the LA’s high dependence on information and lack of security measures make it vulnerable to attacks, so this paper analyzes the interactive security of the LAs from two points. Considering the game process between the LAs and users from the attacker’s point of view, this paper puts forward an attack strategy aiming cost function of the LAs, establishes a bi-level multi-objective programming attack model of false data injection attacks(FDIAs), and proposes an attack detection method based on the multi-state matching method and improved similar daily data preprocessing generative adversarial network (P-GAN) from the defender’s point of view to defend against the above attack strategy. Furthermore, a hybrid detection mechanism combining event triggering and periodic detection is proposed to ensure response speed and adaptability of detection. The effectiveness of the proposed attack model and the detection method is verified by simulation analysis.

A Survey of AI Methods for Detection of DDoS Attacks on Networks

This survey explores various artificial intelligence (AI) methods for detecting Distributed Denial of Service (DDoS) attacks on networks. It classifies these approaches into machine learning, deep learning, and other AI-based techniques, providing a comprehensive overview of current advancements in the field. Numerous research studies in the field of machine learning have evaluated DDoS attack detection performance using various datasets and techniques. Some noteworthy results are the supremacy of the J48 algorithm in SDN networks and the efficacy of the AdaBoost and Gradient Boost classifiers. In other investigations, Random Forest, Support Vector Machine, and Naive Bayes also showed excellent accuracy rates, up to 99.7%. To improve DDoS detection, deep learning techniques introduced autoencoders, hybrid models, and recurrent neural networks. These models achieved accuracy rates as high as 99.99%, frequently outperforming more conventional machine learning techniques. Enhanced detection rates were achieved by the utilization of a varied dataset in conjunction with deep-stacked autoencoders. Artificial intelligence methods such as Fuzzy Logic, Artificial Bee Colony, Ant Colony Optimization, and Whale Optimization Algorithm were used to identify DDoS assaults. These methods demonstrated high accuracy rates, efficient detection of various attack types, and improvements in reducing false positives; the integration of these techniques into intrusion detection systems offers a strong defense against dynamic DDoS threats. The overall survey highlights the effectiveness of AI techniques in DDoS attack detection across various methodologies.

Gradient correlation based detection of adversarial attacks on vehicular networks

The controller area network (CAN) bus, which controls real-time communication and data transmission among vehicle electronic control units, lacks security mechanisms and is highly vulnerable to attacks. Existing in-vehicle network intrusion detection systems (IDSs) typically rely on deep learning models for detection, which are susceptible to interference from adversarial attacks owing to the vulnerability of the models themselves, thereby compromising the detection performance. In this study, we propose an adversarial attack detection method based on gradient correlation that achieves a high accuracy rate using a linear approach to detect adversarial samples. The experimental results show that the proposed model does not require retraining of the original detection model and demonstrates better detection performance for multiple adversarial attacks.

A combination learning framework to uncover cyber attacks in IoT networks

The Internet of Things (IoT) is rapidly expanding, connecting an increasing number of devices daily. Having diverse and extensive networking and resource-constrained devices creates vulnerabilities to various cyber-attacks. The IoT with the supervision of Software Defined Network (SDN) enhances the network performance through its flexibility and adaptability. Different methods have been employed for detecting security attacks; however, they are often computationally efficient and unsuitable for such resource-constraint environments. Consequently, there is a significant requirement to develop efficient security measures against a range of attacks. Recent advancements in deep learning (DL) models have paved the way for designing effective attack detection methods. In this study, we leverage Genetic Algorithm (GA) with a correlation coefficient as a fitness function for feature selection. Additionally, mutual information (MI) is applied for feature ranking to measure their dependency on the target variable. The selected optimal features were used to train a hybrid DNN model to uncover attacks in IoT networks. The hybrid DNN integrates Convolutional Neural Network, Bi-Gated Recurrent Units (Bi-GRU), and Bidirectional Long Short-Term Memory (Bi-LSTM) for training the input data. The performance of our proposed model is evaluated against several other baseline DL models, and an ablation study is provided. Three key datasets InSDN, UNSW-NB15, and CICIoT 2023 datasets, containing various types of attacks, were used to assess the performance of the model. The proposed model demonstrates an impressive accuracy and detection time over the existing model with lower resource consumption.

Computer vision based distributed denial of service attack detection for resource-limited devices

The growing adoption of Internet of Things (IoT) has rendered them a desirable target for cyber-attacks. One of the biggest threats to these systems is the distributed denial of service (DDoS) attack, which is a botnet-based attack. The reason for the increasing usage of machine learning and deep learning-based intrusion detection systems in IoT network security is their ability to recognize DDoS attack. Recent studies, however, shows how susceptible IoT networks are to these kinds of attacks and detection accuracy can be greatly lowered. While a majority of studies has concentrated on DDoS attack detection for deep learning, little attention has been paid to computer vision, especially image-based artificial intelligence technologies like convolutional neural network (CNN). In this study, we use an image-based dataset to evaluate the effectiveness of CNN, an effective computer vision approach, for DDoS attack detection in IoT contexts. Owing to the small size of the selected dataset and in order to improve the CNN model’s detection efficiency, we implement various data augmentation techniques prior to the model’s training, including scaling, rotation, and vertical and horizontal flipping. Next, we introduce an efficient CNN-based method for detection of DDoS attacks in IoT settings. Ultimately, we came to the conclusion that the statistical significance testing showed that there is a significance difference among the five models employed during the study, and the VGG19 which has higher accuracy (99.74%) and less computing cost (6020.80 s), which enables IoT devices to perform DDoS attack detection with cost-effectiveness.

Effective SQL Injection Detection: A Fusion of Binary Olympiad Optimizer and Classification Algorithm

Since SQL injection allows attackers to interact with the database of applications, it is regarded as a significant security problem. By applying machine learning algorithms, SQL injection attacks can be identified. Problem: In the training stage of machine learning methods, effective features are used to develop an optimal classifier that is highly accurate. The specification of the features with the highest efficacy is considered to be an NP-complete combinatorial optimization challenge. Selecting the most effective features refers to the procedure of identifying the smallest and most effective features in the dataset. The rationale behind this paper is to optimize the accuracy, precision, and sensitivity parameters of the SQL injection attack detection method. Method: In this paper, a method for identifying SQL injection attacks was suggested. In the first step, a particular training dataset that included 13 features was developed. In the second step, to specify the best features of the dataset, a specific binary variety of the Olympiad optimization algorithm was developed. Various machine learning algorithms were used to create the optimal attack detector. Results: Based on the experiments carried out, the suggested SQL injection detector using an artificial neural network and the feature selector can achieve 99.35% accuracy, 100% precision, and 100% sensitivity. Owing to selecting about 30% of the effective features, the proposed method enhanced the efficacy of SQL injection detectors.

Enhancing cybersecurity: A comprehensive approach to addressing the growing threat of cybercrime

The rise of technology and internet usage has revolutionized interactions and business practices but has also significantly increased the prevalence of cybercrime. Cybercrimes, including data theft, ransomware, attacks on critical systems, and botnet-driven attacks, have grown more sophisticated and damaging. Recent research by Mphatheni and Maluleke (2022), Cascavilla, Tamburri, and Heuvel (2021), Shah and Chudasama (2021), Dupont and Whelan (2021), Djenna et al. (2023), and Back and LaPrade (2020) offers a detailed analysis of contemporary cybersecurity challenges and emerging solutions. These studies emphasize the need for a comprehensive approach to combating cybercrime. Mphatheni and Maluleke (2022) highlight the absence of a universal definition for cybercrime, which undermines prevention efforts and overlooks the global economic impact, particularly in Africa. Cascavilla, Tamburri, and Heuvel (2021) stress the importance of advanced machine learning techniques and threat intelligence for detecting cybercrimes across various web layers, advocating for improved risk assessment and anonymity measures. Shah and Chudasama (2021) propose a new cybercrime taxonomy to address gaps in current legislation, especially in regions like India where crimes often stem from data issues or malicious intent. Dupont and Whelan (2021) call for greater integration between cybercriminology and cybersecurity, promoting a continuous approach that fosters better collaboration between security and crime control domains. Djenna et al. (2023) introduce an advanced deep learning method for early botnet attack detection, enhancing forensic investigations and threat response. Back and LaPrade (2020) emphasize updating cybersecurity practices in academic institutions using a Situational Crime Prevention (SCP) framework to improve digital security. Overall, a proactive and coordinated strategy, incorporating new technologies, enhanced practices, and updated legislation, is essential for effective cybercrime prevention and response. Collaboration among governments, the private sector, and academia is crucial for developing robust defenses against escalating cyber threats.

CMShark: A NetFlow and machine-learning based crypto-jacking intrusion-detection method

Crypto-jacking attack is a novel type of cyber-attack on the internet that has emerged because of the popularity of digital currencies. These attacks are the most common type of attacks in the cryptocurrency field because of their specific features such as easy scenario, un-traceability, and ease of secrecy. In crypto-jacking attacks, it is common to embed malicious code inside website scripts. Different techniques have been provided to deal with Crypto-jacking attacks, but crypto-jacking attackers bypass them by limiting resources. The crypto-mining services provided on the internet are legal, and due to the anonymous nature of cryptocurrencies, client identification is a challenging task. Improving the accuracy and performance of the Crypto-jacking attack detection methods are the main objectives of this study. In this paper, a hybrid network-based method to identify these attacks to achieve better and more accurate results. The proposed solution (CMShark) is a combination of machine learning (ML) models, IP blacklisting and payload inspection methods. In the ML model, the packets are classified using size patterns; in IP blacklisting, attacks are detected based on known infected addresses and infected scripts. In payload inspection, the provided information on the packet payload is searched for any suspicious keywords. The proposed method relies solely on the network and is deployed on the edge of the network, making it infrastructureindependent. The proposed detection model reaches an accuracy score of 97.02%, an F1-score of 96.90% a ROC AUC score of 97.20% in input NetFlow classification; and a 93.98% accuracy score, 94.30% F1-score and 97.30% ROC AUC score in output NetFlow classification.

Enhancing Unmanned Marine Vehicle Security: A Periodic Watermark-Based Detection of Replay Attacks

This paper explores a periodic watermark-based replay attack detection method for Unmanned Marine Vehicles modeled in the framework of the Takagi–Sugeno fuzzy system. The precise detection of replay attacks is crucial for ensuring the security of Unmanned Marine Vehicles; however, traditional timestamp-based or encoded measurement-dependent detection approaches often sacrifice system performance to achieve higher detection rates. To reduce the potential performance degradation, a periodic watermark-based detection scheme is developed, in which a compensation signal together with a periodic Gaussian watermark signal is integrated into the actuator. By compensation calculations conducted with all compensatory signals in each period, the position corresponding to a minimum value of the detection function can be derived. Then, the time that the attacks occurred can be ensured with the aid of the comparison between this position with the watermark signal in the same period. An application on a UMV is shown to demonstrate the effectiveness of the presented scheme in detecting replay attacks while minimizing control costs.

Chaos quasi-opposition crayfish based modified new controller designed for hybrid deregulated power environment considering cyber-attack

Frequency security is critical to the stability and dependability of the electrical systems. The integration of renewable energy resources presents new challenges for power networks and frequency security. In order to provide a more reliable control mechanism for improved frequency regulation in multi area deregulated environments with penetrations of renewable energy sources like Solar photovoltaic and wind system has been included considering along with its intermitance nature. Additionally, to get more realistic approach and its analysis, nonlinearities such as generation rate constant and governor dead band has been taken into consideration for the anticipated Load Frequency Control (LFC). A novel modified cascaded Dual-Loop Linear Active Disturbance Rejection based Tilted controller has been proposed for the suggested LFC paradigm. A modified version of the Chaotic Quasi-Opposition Crayfish Optimisation algorithm (CQOCOA) has been offered as a novel optimization approach for optimal parameters of the proposed controller. ITSE has been taken as objective function for optimization purpose. Moreover, a comprehensive detailed examination for the proposed LFC system has been investigated and successfully implemented. The performance has been examined under a variety of operating scenarios, including multiple-step, random load disturbances and Distributed Generation (DG) analysis along with its technical core advancements. This study has been investigated and validated over large multi area power system i.e., IEEE-118 bus system. This work also put forward the deep analysis and implementation of learning-based attack detection and mitigation method for the grid's frequency regulation with cyber-physical model. The effectiveness of the proposed controller has been compared and verified over previous published literature work of international repute. The compressive results analysis provide strong evidence in favour of effectiveness and efficacy of the proposed control methodology. Furthermore, this work also suggests its potential to implement in hybrid multi area power system for enhancing the performance and stability in deregulated power structure.

Developing information technology for evaluating and enhancing application-layer DDoS attack detection methods

The subject matter of this article is the methods to detect distributed denial-of-service (DDoS) attacks at the Hypertext Transfer Protocol (HTTP) level with the purpose of justifying the requirements for creating software capable of identifying malicious web server clients. The goal of this article is to develop an information technology to evaluate the efficiency of DDoS attack detection methods, which will quantify their operating time, memory consumption, and approximate classification accuracy. In addition, this paper proposes hypotheses and a potential approach to improve existing application-layer DDoS attack detection methods with the intention of increasing their accuracy and identification speed. The tasks of this study are as follows: to analyse modern methods for detecting application-layer DDoS attacks; to investigate their features and short­comings; to develop a software system to assess DDoS attack detection methods; to programmatically implement these methods and experimentally measure their performance indicators, specifically: classification ac­curacy, operating time, and memory usage; to compare the efficiency of the investigated methods; to formulate hypotheses and propose an approach to improve existing methods and/or develop new methods based on the results obtained. The methods employed are abstraction, analysis, systematic approach, and empirical research. In particular, the datasets generated by DDoS utilities were processed using the synthetic minority oversampling technique (SMOTE) to balance them. Furthermore, the studied DDoS attack detection methods were implemented, including fitting the required parameters and training artificial neural network models for evaluation. The following results were obtained. The average classification accuracy, operating time, and random-access memory (RAM) consumption during Internet traffic classification were determined for six DDoS attack detection methods under the same conditions. This study has demonstrated that the development of a novel method to detect DDoS attacks at the HTTP level with enhanced accuracy and classification speed is strongly required. The experimental results demonstrate that the time series-based method exhibited the shortest operating time (1.33 ms for 5000 vectors), whereas the deep neural network-based method exhibited the highest average classification accuracy (ranging from 99.07% to 99.97%) and the lowest memory consumption (39.09 KB for 5000 vectors). Conclusions. In this study, a software system was developed to assess the average accuracy of DDoS attack classification methods and measure the computational resources utilized. The scientific novelty of the obtained results lies in the formulation of two hypotheses and a potential approach to the creation of a novel method for detecting DDoS attacks at the HTTP level, which will have both high classification accuracy and a short operating time to surpass previously studied analogues in these respects. The first hypothesis is based on the additional usage of HTTP request attributes during Internet traffic classification. The second hypothesis is to analyse a graph of user transitions between website pages. The article also superficially describes a potential approach that involves the implementation of the described hypotheses as well as the proposed software architecture of an application-layer DDoS attack detection system for the Kubernetes platform and the Istio framework, which addresses the issue of collecting web request parameter values for websites that use the cryptographically secured HTTPS protocol.

Trust Computation Model for IoT devices using Soft Computing and Machine Learning Techniques for Health Care Applications

The calculation of trust for online web services is of utmost importance due to the security risks associated with network devices. various cloud platforms offer diverse services for communicating with various IoT devices and generating predictions based on the collected data. Occasionally, data may be compromised by either internal or external groups through low-impact hacking techniques. Investigating assaults and ensuring the elimination of connections can be a laborious task in a sensitive setting. Despite some progress, there are still many unresolved security issues that provide barriers to addressing security problems. This article seeks to conduct a comprehensive examination of existing security solutions for the lowest layer of the Internet of Things (IoT) and promote the development of more inventive IoT designs for those who invest in them. This paper proposes a system for calculating trust in IoT devices using both supervised and unsupervised machine learning algorithms for non-invasive health care applications. Both strategies were assessed based on trust computation weights and compared with their respective machine learning algorithms. The K-means clustering technique is employed for one strategy, while the SVM algorithm is used for the other approach. The aim of this successful implementation is to identify and eradicate a minor threat that occurs during the trusted execution process. An experimental analysis was conducted using NS2 2.35 in combination with an open-source Java platform. At first, a total of 100 nodes are created in the simulation environment. These nodes are then assessed using a clustering method to determine if they are trustworthy or untrustworthy, resulting in the generation of labels. The experimental research demonstrated the superior efficacy of attack detection in comparison to traditional methods of attack detection.

Feature Interaction-Based Face De-Morphing Factor Prediction for Restoring Accomplice's Facial Image.

Face morphing attacks disrupt the essential correlation between a face image and its identity information, posing a significant challenge to face recognition systems. Despite advancements in face morphing attack detection methods, these techniques cannot reconstruct the face images of accomplices. Existing deep learning-based face de-morphing techniques have mainly focused on identity disentanglement, overlooking the morphing factors inherent in the morphed images. This paper introduces a novel face de-morphing method to restore the identity information of accomplices by predicting the corresponding de-morphing factor. To obtain reasonable de-morphing factors, a channel-wise attention mechanism is employed to perform feature interaction, and the correlation between the morphed image and the real-time captured reference image is integrated to promote the prediction of the de-morphing factor. Furthermore, the identity information of the accomplice is restored by mapping the morphed and reference images into the StyleGAN latent space and performing inverse linear interpolation using the predicted de-morphing factor. Experimental results demonstrate the superiority of this method in restoring accomplice facial images, achieving improved restoration accuracy and image quality compared to existing techniques.

SKT-IDS: Unknown attack detection method based on Sigmoid Kernel Transformation and encoder–decoder architecture

Intrusion Detection Systems (IDS) are crucial in cybersecurity for monitoring network traffic and identifying potential attacks. Existing IDS research largely focuses on known attack detection, leaving a significant gap in research regarding unknown attack detection, where achieving a balance between false alarm rate (identifying normal traffic as attack traffic) and recall rate of unknown attack detection remains challenging. To address these gaps, we propose a novel IDS based on Sigmoid Kernel Transformation and Encoder-Decoder architecture, namely SKT-IDS, where SKT stands for Sigmoid Kernel Transformation. We start with pre-training an attention-based encoder for coarse-grained intrusion detection. Then, we use this encoder to build an encoder–decoder model specifically for 0-day attack detection, training it solely on known traffic using the cosine similarity loss function. To enhance detection, we introduce a Sigmoid Kernel Transformation for feature engineering, improving the discriminative ability between normal traffic and 0-day attacks. Finally, we conducted a series of ablation and comparative experiments on the NSL-KDD and CSE-CIC-IDS2018 datasets, confirming the effectiveness of our proposed method. With a false alarm rate of 1%, we achieved recall rates for unknown attack detection of 65% and 69% on the two datasets, respectively, demonstrating significant performance improvements compared to existing state-of-the-art models.

An LDoS attack detection method based on FSWT time–frequency distribution

The Low-rate Denial-of-Service (LDoS) attack is a stealthy and periodic attack, which belongs to the category of DoS attacks. The LDoS attack maliciously preempts and consumes target resources, causing the targeted network performance to decline and affecting the service quality. The LDoS attack is highly destructive and difficult to detect and defend against due to its abnormal attack behavior. In this paper, we discuss the network traffic behavior in the time domain, frequency domain, and time–frequency domain, and we find that the time–frequency domain contains more detailed information than the time domain and frequency domain alone. Considering the limitations of the existing time–frequency domain transformation methods, an LDoS attack detection method based on Frequency Slice Wavelet Transformation (FSWT) is presented in this paper. The entropy, ratio of energy, contrast, and correlation are extracted from the time–frequency distribution to depict the network traffic, and a decision tree is trained to detect the LDoS attack in this paper. According to the experimental results on NS2, testbed, and the comparative experiment, we conclude that the method presented in this paper performs well.

Distributed finite-time attack detection and estimation of intelligent connected vehicle platoon

ABSTRACT This paper presents a distributed finite-time observer design approach for the problem of intelligent connected vehicles (ICVs) containing both attack signals and unknown disturbances. Firstly, an analysis is conducted on the two types of network attacks that ICVs may encounter, followed by the construction of a dynamic vehicle model and its transformation into a state space equation. Secondly, an intermediate variable is introduced to design a distributed attack estimation observer, which both ensures accurate estimation of the vehicle safety state and attack signal within a limited time and overcomes the constraints of traditional observers. Additionally, sufficient conditions for the finite-time boundedness of the observer error system with H ∞ performance are provided in the form of linear matrix inequalities. Furthermore, an adaptive threshold attack detection method is designed. Finally, the simulation results validate the efficiency of the design methods.

EXCLF: A LDoS attack detection & mitigation model based on programmable data plane

The SDN architecture decouples control plane from data plane, making it more susceptible to various abnormal traffic and network attacks, with LDoS attack being one of them. LDoS attackers periodically send short-duration pulses with high rate to bottleneck links to preempt legitimate TCP traffic bandwidth, severely disrupting the transmission of TCP traffic. Current researches on LDoS attacks are mostly implemented in SDN environments, making them exhibit poor portability during deployment and unavoidable time delays. This paper proposes EXCLF, a LDoS attack detection and mitigation model fully deployed on programmable data plane. To identify LDoS attacks, the model gathers features of the traffic going through the switch and feeds them into a decision tree. Once LDoS attack happens, the model collects data at flow level to pinpoint the attacker and initiates corresponding mitigation measures. Extensive experiments were conducted to evaluate the proposed model, and the results indicate that EXCLF achieves a correct rate of 96.39%, with false positive and false negative rates both below 3%. Additionally, the model demonstrates low detection latency and can quickly respond to attacks. The model proves to be an attack detection and mitigation method with good portability and efficiency.

A composite manifold learning approach with traditional methods for gradient-based and patch-based adversarial attack detection

A composite manifold learning approach with traditional methods for gradient-based and patch-based adversarial attack detection

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.