Attack Detection Method Research Articles

The detection mechanism for false data injection attack via the ellipsoidal set‐membership approach

AbstractThe false data injection (FDI) attack detection problem in cyber‐physical systems (CPSs) is investigated in this paper. A novel attack detection algorithm is proposed based on the ellipsoidal set‐membership approach. In comparison to the existing FDI attack detection methods, the developed attack detection approach in this paper neither requires predefined thresholds nor specific statistical characteristics of the attacks. In order to guarantee that the estimation ellipsoid contains normal states despite the unknown but bounded (UBB) process and measurement noises, the one‐step ellipsoidal set‐membership estimation method is put forward. In addition, a convex optimization algorithm is introduced to calculate the gain matrix of the observer recursively. Moreover, with the help of the state estimation ellipsoid, the residual ellipsoid can be obtained for attack detection. Whether a detector can detect the FDI attack depends on the relationship between the residual value and residual ellipsoidal set. Finally, the effectiveness of the proposed method is demonstrated by a numerical simulation example.

Unsupervised Models with LOF and PCA for Robust DDOS Attack Detection

The need for robust and efficient Distributed Denial of Service (DDoS) attack detection methods has become increasingly evident in today's networked world. Existing approaches, while commendable, often exhibit limitations that hinder their effectiveness. This paper introduces an innovative approach that leverages Local Outlier Factor (LOF) in conjunction with Principal Component Analysis (PCA) for unsupervised DDoS attack detection. Existing methods often fall short in addressing the evolving nature of DDoS attacks, struggling to maintain precision, accuracy, and recall rates. Our proposed model addresses these limitations by harnessing the power of LOF and PCA, offering a more adaptive and dynamic detection framework. LOF enables the identification of outliers in network traffic patterns, while PCA reduces the dimensionality of the data, enhancing the model's efficiency and speed. The advantages of our approach are manifold. It not only achieves superior performance in terms of precision, accuracy, recall, speed, and Area Under the ROC Curve (AUC) when compared to existing methods but also ensures a higher level of adaptability in detecting emerging DDoS attack vectors & sets. This adaptability is critical in today's ever-evolving threat landscape. The impact of this work extends beyond the realm of academia. In practical terms, our model offers network administrators a potent tool for safeguarding their infrastructures against DDoS attacks. By improving detection rates and reducing false positives, it contributes to the overall security posture of networks, ensuring uninterrupted services and enhanced user experience levels.

A detection method of wormhole attack in power communication sensor networks based on hops

Aiming at the problems of low accuracy of determining attack nodes and large detection error in the wormhole attack detection method of power communication sensor networks, a wormhole attack detection method based on hops is proposed. Firstly, the working process of power communication sensor network nodes is analyzed; Regard the node area as a closed circle, set the distance between nodes and communication radius in the area, and determine the wormhole attack location; Then, introduce the hop number, replace the linear distance between attack nodes with the hop distance of hop number, the centroid position is calculated by polygon calculation, the node hop distance is determined, and the wormhole attack probability is calculated; Finally, the average hop distance between wormhole attack nodes is calculated, and the path hop distance of attack behavior is corrected with the help of objective function and minimum mean square error criterion to complete attack detection. The experimental results show that the detection accuracy of this method is 98%, and the detection error is only 2.6%, so it has application value.

Application-Layer DDoS Attack Detection Using Explicit Duration Recurrent Network-Based Application-Layer Protocol Communication Models

Existing application-layer distributed denial of service (AL-DDoS) attack detection methods are mainly targeted at specific attacks and cannot effectively detect other types of AL-DDoS attacks. This study presents an application-layer protocol communication model for AL-DDoS attack detection, based on the explicit duration recurrent network (EDRN). The proposed method includes model training and AL-DDoS attack detection. In the AL-DDoS attack detection phase, the output of each observation sequence is updated in real time. The observation sequences are based on application-layer protocol keywords and time intervals between adjacent protocol keywords. Protocol keywords are extracted based on their identification using regular expressions. Experiments are conducted using datasets collected from a real campus network and the CICDDoS2019 dataset. The results of the experiments show that EDRN is superior to several popular recurrent neural networks in accuracy, F1, recall, and loss values. The proposed model achieves an accuracy of 0.996, F1 of 0.992, recall of 0.993, and loss of 0.041 in detecting HTTP DDoS attacks on the CICDDoS2019 dataset. The results further show that our model can effectively detect multiple types of AL-DDoS attacks. In a comparison test, the proposed method outperforms several state-of-the-art approaches.

An observational mechanism for detection of distributed denial-of-service attacks

<span>This study proposes a continuous mechanism for detecting distributed denial of service (DDoS) attacks from network traffic data. The mechanism aims to systematically organise traffic data and prepare them for DDoS attack detection using convolutional deep-learning neural networks. The proposed mechanism contains ten phases covering activities, including data preprocessing, feature selection, data labelling, model building, model evaluation, DDoS detection, attack pattern identification, alert creation, notification delivery, and periodical data sampling. The evaluation results suggested that the detection model built based on convolutional deep-learning neural networks and relevant network traffic features provided 97.2% detection accuracy. The study designed a holistic mechanism that considers the systematic network traffic data management for continuous monitoring and good performance of DDoS attack detection. The proposed mechanism could provide a solution for network traffic data management and enhance the existing methods for DDoS attack detection. In addition, it generally contributes to the cybersecurity body of knowledge.</span>

Spatial Sparsity-Based Pilot Attack Detection and Transmission Countermeasure for Cell-Free Massive MIMO System

In this article, we investigate the security performance of a cell-free (CF) massive multiple-input–multiple-output (MIMO) system that is composed of a large number of randomly distributed access points (APs) and multiple users. There may be an eavesdropper who launches an active pilot attack during uplink channel estimation stage to eavesdrop on information in data transmission stage, which threaten the security of the system. A spatial sparsity-based pilot attack detection (SS-based-PAD) method is proposed in this study to determine whether there is an active eavesdropper. Different data transmission schemes were developed according to the detection results. In the presence of an eavesdropper, rate maximization power allocation (SRM-PA) algorithm is proposed to maximize the security of the eavesdropped user. On the contrary, achievable rate equalization power allocation (ARE-PA) algorithm is proposed to provide fair services for all legitimate users. Moreover, an AP selection scheme and corresponding conjugate beamforming are used to enhance the security performance of the system and mitigate the impact of a pilot spoofing attack.

Modbus/RS-485 Attack Detection on Communication Signals with Machine Learning

Modbus/RS-485 is one of the most popular standards used worldwide at the edges of industrial control systems (ICSs) as field buses. These networks were traditionally secured by isolating them from others, but nowadays, they are connected and function as components of a whole ICS. An attack on a field bus will deceive global control and can result in severe security incidents. In this paper, we propose a novel unobtrusive communication signal monitoring method for attack detection on this type of field bus with machine learning. We define five types of field-bus attacks and develop datasets with ground truth labels on our real-world testbed. In our performance evaluation, supervised learning with extreme gradient boosting (XGBoost) achieved the best with an accuracy of 0.9999 for attack detection and classification. 1D convolutional neural network (1D-CNN) achieved alternatively. Unsupervised learning with an MLP-autoencoder achieved the area under the curves of receiver operating characteristics between 0.9992 and 0.9999 for anomaly detection. These results indicate that our proposed unobtrusive monitoring method can achieve a high detection rate for field-bus attacks.

SDSIOT: An SQL Injection Attack Detection and Stage Identification Method Based on Outbound Traffic

An SQL Injection Attack (SQLIA) is a major cyber security threat to Web services, and its different stages can cause different levels of damage to an information system. Attackers can construct complex and diverse SQLIA statements, which often cause most existing inbound-based detection methods to have a high false-negative rate when facing deformed or unknown SQLIA statements. Although some existing works have analyzed different features for the stages of SQLIA from the perspectives of attackers, they primarily focus on stage analysis rather than different stages’ identification. To detect SQLIA and identify its stages, we analyze the outbound traffic from the Web server and find that it can differentiate between SQLIA traffic and normal traffic, and the outbound traffic generated during the two stages of SQLIA exhibits distinct characteristics. By employing 13 features extracted from outbound traffic, we propose an SQLIA detection and stage identification method based on outbound traffic (SDSIOT), which is a two-phase method that detects SQLIAs in Phase I and identifies their stages in Phase II. Importantly, it does not need to analyze the complex and diverse malicious statements made by attackers. The experimental results show that SDSIOT achieves an accuracy of 98.57% for SQLIA detection and 94.01% for SQLIA stage identification. Notably, the accuracy of SDSIOT’s SQLIA detection is 8.22 percentage points higher than that of ModSecurity.

A new face presentation attack detection method based on face-weighted multi-color multi-level texture features

A new face presentation attack detection method based on face-weighted multi-color multi-level texture features

Distributed elastic recovery strategy of AC/DC hybrid microgrid under false data injection attack

AbstractThe AC/DC hybrid microgrid, which integrates AC microgrid and DC microgrid, greatly improves the flexibility of distributed energy. However, it is imperative to acknowledge that the microgrid in question is accompanied by a significantly elevated network security risk. To solve this problem, this article proposes a false data injection attack detection and alarm method based on active power output. The detection algorithm is capable of detecting attacks at any location within the microgrid and mitigating the impact of communication delay. Moreover, a distributed elastic recovery strategy based on the aforementioned detection algorithm is proposed. This strategy aims to expeditiously restore the compromised agent to its rated state. Finally, a simulation model is developed to demonstrate the effectiveness of the proposed strategy.

A Novel Model-Based Reinforcement Learning for Online Anomaly Detection in Smart Power Grid

Smart grids must detect cyber-attacks early to ensure their safety and reliability. There have been many outlier detection methods presented in the studies, varying from those requiring instance-by-instance decisions t the online diagnosing methods that require the use of accurate models of an attack. This study proposes a novel intelligent online anomaly or attack detection method based on the partially observable Markov decision procedure (POMDP). The proposed model may be categorized as a general detection method according to the reinforcement learning (RL) architecture for POMDP which can help the learning process based on the award concept. The performance of the proposed model is verified using the IEEE test system. Based on numerical results, the suggested RL-based algorithm shows to be very effective in detecting cyber-attacks against the smart grid quickly and accurately.

Face presentation attack detection: Research opportunities and perspectives

The rapid development of biometric methods and their implementation in practice has led to the widespread attacks called spoofing, which are purely biometric vulnerabilities, but are not used in conjunction with other IT security solutions. Although biometric recognition as a branch of computer science dates back to the 1960s, attacks on biometric systems have become more sophisticated since the 2010s due to great advances in pattern recognition. It should be noted that face recognition is the most attractive topic for deceiving recognition systems. Popular presentation attacks, such as print, replay and mask attacks, have demonstrated a high security risk for SOTA face recognition systems. Many Presentation Attack Detection (PAD) methods (also known as face anti-spoofing methods or countermeasures) have been proposed that can automatically detect and mitigate such targeted attacks. The article presents a systematic survey in face anti-spoofing with prognostic trends in this research area. A brief description of 16 outstanding previous surveys on the face PAD field is mentioned, from which it is possible to trace how this scientific topic has developed. SOTA in PAD provides an analysis of a wide range of the PAD methods, which are categorized into two unbalanced groups: digital (feature-based) and physical (sensor-based) methods. Generalization of deep learning methods as a recent trend aimed at improving recognition results requires special attention. This survey presents five types of generalization such as transfer learning, anomaly detection, few-shot and zero-shot learning, auxiliary supervision, and multi-spectral methods. A summary of over than 40 existing 2D/3D face spoofing databases is a guideline for those who want to select databases for experiments. One can also find a description of performance evaluation metrics and testing protocols. In addition, we discuss trends and perspectives in the emerging field of facial biometrics.

Interactive anomaly-based DDoS attack detection method in cloud computing environments using a third party auditor

Cloud computing environments are indispensable components of the majority of information technology organizations and users' lives. Despite multiple benefits of cloud computing environments, cloud users (CUs) as well as cloud service providers (CSPs) may experience unpleasant conditions by detrimental results of distributed denial of service (DDoS) attacks such as unavailability of cloud services or lengthy response times of the services. In this paper, we provide a threshold anomaly-based DDoS attack detection method to protect cloud environments against DDoS attack. Our proposed method is introduced to reduce DDoS attack consequences in CSPs. Our suggested method includes three newly defined components: 1. A third party auditor (TPA) which acquires direct interaction with each datacenter of the CSP, 2. A zone delimiter (ZD) which encapsulates the sensitive internal specifications of a CSP from TPA, and 3. A protocol which is defined to coordinate TPA, ZD, and CSPs for DDoS attack detection via TPA. We analyze our proposed method by determining and conducting a simulation strategy for an intrusion detection system in CSPs. Results illustrate that interactive communication between TPA and datacenters of CSPs improves the user experience of CUs in the time of DDoS attacks by reducing excessive attack filtering stages. Moreover, by using an intrusion detection system (IDS), we investigate efficiency of the proposed method to recover CSPs from DDoS attacks. We further indicate the efficiency of our proposed method by providing accuracy and qualitative comparisons with other existing methods.

A DDoS Attack Detection Method Using Conditional Entropy Based on SDN Traffic

To detect each network attack in an SDN environment, an attack detection method is proposed based on an analysis of the features of the attack and the change in entropy of each parameter. Entropy is a parameter used in information theory to express a certain degree of order. However, with the increasing complexity of networks and the diversity of attack types, existing studies use a single entropy, which does not discriminate correctly between attacks and normal traffic and may lead to false positives. In this paper, we propose new state determination standards that use the normal distribution characteristics of the entropy value at the time which an attack did not occur, subdivide the normal and abnormal range represented by the entropy value, improving the accuracy of attack determination. Furthermore, we show the effectiveness of the proposed method by numerical analysis.

Mathematical modeling analysis of potential attack detection in topology network based on convolutional neural network

New network attack platforms such as personal to personal botnets pose a great threat to cyberspace, but there is no corresponding detection method to detect them. In order to improve the security of topological networks, this research designs a mathematical modeling analysis method for potential attack detection based on convolutional neural networks. This method determines the potential attack risk assessment function through the feature extraction of vulnerable areas in network topology and the probability model of potential attacks, and then detects potential attacks by means of convolutional neural network data modeling. The experimental results show that the false detection rate and missed detection rate of the three methods for potential attacks are lower than 9% and 8% respectively, but the false detection rate and missed detection rate of the method given in the study are the lowest, and can always be kept below 5%. At the same time, the detection time of potential attacks of this method is shorter than that of the other two detection methods. The detection of potential attacks provides a technical guarantee for the safe operation of the network.

Security Analysis for Dynamic State Estimation of Power Systems With Measurement Delays.

This article is centered on the cybersecurity research of dynamic state estimation for power systems with measurement delays. Relying on mixed measurements from phasor measurement units (PMUs) and remote terminal units (RTUs), a delayed measurement model is constructed. A modified state estimator based on the Kalman filter (KF) is designed, which can obtain the optimal estimated states under measurement delays. Moreover, the measurement data transmitted from the sensor to the estimator are vulnerable to cyberattacks. Especially, false data-injection (FDI) attacks are frequently encountered in the power system state estimation (PSSE) process. In the case of measurement delays, an FDI attack strategy is designed to interfere with the state estimator and evade detection by the chi-square detector. By utilizing the attacked estimated information and the uncorrupted measurement information, two measurement residual vectors are designed. According to these two residual vectors, a chi-square-based attack detection method is proposed, which has the ability to detect the attack without being affected by the delayed measurements. The proposed KF algorithm and attack detection method are implemented on an IEEE 14-bus system and they are confirmed to be effective and feasible.

A Survey on Feature Selection Techniques Based on Filtering Methods for Cyber Attack Detection

Cyber attack detection technology plays a vital role today, since cyber attacks have been causing great harm and loss to organizations and individuals. Feature selection is a necessary step for many cyber-attack detection systems, because it can reduce training costs, improve detection performance, and make the detection system lightweight. Many techniques related to feature selection for cyber attack detection have been proposed, and each technique has advantages and disadvantages. Determining which technology should be selected is a challenging problem for many researchers and system developers, and although there have been several survey papers on feature selection techniques in the field of cyber security, most of them try to be all-encompassing and are too general, making it difficult for readers to grasp the concrete and comprehensive image of the methods. In this paper, we survey the filter-based feature selection technique in detail and comprehensively for the first time. The filter-based technique is one popular kind of feature selection technique and is widely used in both research and application. In addition to general descriptions of this kind of method, we also explain in detail search algorithms and relevance measures, which are two necessary technical elements commonly used in the filter-based technique.

A new framework for APT attack detection based on network traffic

Advanced Persistent Threat (APT) attack detection and monitoring has attracted a lot of attention recently when this type of cyber-attacks is growing in both number and dangerous levels. In this paper, a new APT attack model, which is the combination of three different neural network layers including: Multi-layer Perceptron (MLP), Inference (I), and Graph Convolutional Networks (GCN) is proposed. The new model is named MIG for short. In this model, the MLP layer is in charge of aggregating and extracting properties of the IPs based on flow network in Network traffic, while the Inference layer is responsible for building IP information profiles by grouping and concatenating flow networks generated from the same IP. Finally, the GCN layer is used for analyzing and reconstructing IP features based on the behavior extraction process from IP information records. The APT attacks detection method based on network traffic using this MIG model is new, and has yet been proposed and applied anywhere. The novelty and uniqueness of this method is the combination of many different data mining techniques in order to calculate, extract and represent the relationship and the correlation between APT attack behaviors based on Network traffic. In MIG model, many meaningful anomalous properties and behaviors of APT attacks are synthesized and extracted, which help improve the performance of APT attack detection. The experimental results showed that the proposed method is meaningful in both theory and practice since the MIG model not only improves the ability to correctly detect APT attacks in network traffic but also minimizes false alarms.

Implementation of art therapy assisted by the internet of medical things based on blockchain and fuzzy set theory

This work aims to improve the stability and efficiency of the Internet of Medical Things (IoMT), strengthen the security and privacy of personal information, and create a healthy and safe network environment. First, art therapy in the current medical environment is discussed, and the security defenses of the IoMT supporting art therapy are studied. Then, a security defense method for IoMT is proposed by combining basic Blockchain knowledge with the Fuzzy Sets Theory. Specifically, a Density-awarded Fuzzy C-means (DFCM) algorithm is developed to solve the clustering issue of unbalanced data sets. Besides, the Fuzzy Support Vector Machine (FSVM) model is used to classify data points far from the sample center to increase classification accuracy. In the simulation experiment, the DFCM algorithm achieves a pleasing clustering effect on the four data sets, involving the data sets with density changes and imbalanced sample points within the cluster. Moreover, the combination of DFCM and FSVM (DFCM-FSVM) for attack detection in the Internet of Things (IoT) realizes the optimal accuracy in the detection of different behaviors compared with similar algorithms; the detection accuracy of normal behavior, scheduled attack, gray hole attack, and black hole attack is 99.8%, 89.8%, 99.4%, and 91.5%, respectively. This work creatively proposes a hybrid intrusion detection method based on fuzzy theory. As the second line of defense in security protection, it plays a critical role and is suitable for the network environment of the perception layer. In conclusion, the attack detection method based on Blockchain combined with the Fuzzy Sets Theory can precisely identify potential attacks in abnormal data, which has important practical value for maintaining data security and the regular operation of the IoMT.

Building a Unified Data Falsification Threat Landscape for Internet of Things/Cyberphysical Systems Applications

We lay out a blueprint of a complete and parameterized threat landscape for data falsification/false data injection attacks on telemetry data collected from Internet of Things/cyberphysical systems applications under zero-trust assumptions, helping to enable better validation of anomaly-based attack detection methods.