Attack Detection Probability Research Articles

Asymptotic Learning Requirements for Stealth Attacks on Linearized State Estimation

Information-theoretic stealth attacks are data injection attacks that minimize the amount of information acquired by the operator about the state variables, while simultaneously limiting the Kullback-Leibler divergence between the distribution of the measurements under attack and the distribution under normal operation with the aim of controling the probability of attack detection. For Gaussian distributed state variables, attack construction requires knowledge of the second order statistics of the state variables, which is estimated from a finite number of past realizations using a sample covariance matrix. Within this framework, the attack performance is studied for the attack construction with the sample covariance matrix. This results in an analysis of the amount of data required to learn the covariance matrix of the state variables used on the attack construction. The ergodic attack performance is characterized using asymptotic random matrix theory tools, and the variance of the attack performance is bounded. The ergodic performance and the variance bounds are assessed with simulations on IEEE test systems.

Redundancy Planning for Cost Efficient Resilience to Cyber Attacks

We investigate the extent to which redundancy (including with diversity) can help mitigate the impact of cyber attacks that aim to reduce system performance. Using analytical techniques, we estimate impacts, in terms of monetary costs, of penalties from breaching Service Level Agreements (SLAs), and find optimal resource allocations to minimize the overall costs arising from attacks. Our approach combines attack impact analysis, based on performance modeling using queueing networks, with an attack model based on attack graphs. We evaluate our approach using a case study of a website, and show how resource redundancy and diversity can improve the resilience of a system by reducing the likelihood of a fully disruptive attack. We find that the cost-effectiveness of redundancy depends on the SLA terms, the probability of attack detection, the time to recover, and the cost of maintenance. In our case study, redundancy with diversity achieved a saving of up to around 50 percent in expected attack costs relative to no redundancy. The overall benefit over time depends on how the saving during attacks compares to the added maintenance costs due to redundancy.

Collaborative autonomous system based wireless security in signal processing using deep learning techniques

Intelligent signal processing offers a variety of methods for communication system design and operation, including fuzzy logic, neural networks and evolutionary computation. This study proposes a novel technique for designing a mobile sensor network algorithm based on wireless security to provide a secure as well as energy-efficient communication system that allows sensor swarms to move while maintaining optimal sensor node spacing. Here signal feature extraction has been done using cuckoo Meta search algorithm (Cu_MeSA) and classification using Fuzzy based Boltzmann convolution machine neural network with (Fuz_Bol_ConVMNN) architecture. The experimental results shows that the output signal of feature extraction and classification with comparative parametric analysis in terms of packet arrival rate, network lifespan, energy optimization, probability of attack detection, throughput.

Design of False Data Injection Attack on Distributed Process Estimation

Herein, design of false data injection attack on a distributed cyber-physical system is considered. A stochastic process with linear dynamics and Gaussian noise is measured by multiple agent nodes, each equipped with multiple sensors. The agent nodes form a multi-hop network among themselves. Each agent node computes an estimate of the process by using its sensor observation and messages obtained from neighboring nodes, via Kalman-consensus filtering. An external attacker, capable of arbitrarily manipulating the sensor observations of some or all agent nodes, injects errors into those sensor observations. The goal of the attacker is to steer the estimates at the agent nodes as close as possible to a pre-specified value, while respecting a constraint on the attack detection probability. To this end, a constrained optimization problem is formulated to find the optimal parameter values of a certain class of linear attacks. The parameters of linear attack are learnt on-line via a combination of stochastic approximation based update of a Lagrange multiplier, and an optimization technique involving either the Karush-Kuhn-Tucker (KKT) conditions or online stochastic gradient descent. The problem turns out to be convex for some special cases. Desired convergence of the proposed algorithms are proved by exploiting the convexity and properties of stochastic approximation algorithms. Finally, numerical results demonstrate the efficacy of the attack.

Black-Hole Attack Mitigation in Medical Sensor Networks Using the Enhanced Gravitational Search Algorithm

In today’s world, one of the most severe attacks that wireless sensor networks (WSNs) face is a Black-Hole (BH) attack which is a type of Denial of Service (DoS) attack. This attack blocks data and injects infected programs into a set of sensors in a group to capture packets before reached to the target. Therefore, raw data in the BH region is thwarted and is unable to reach its destination. The network is susceptible to various types of attacks as it is accessible to all types of users and minimizing the energy depletion without compromising the network lifetime is an NP-hard problem. Even though numerous protocols came into effect to overcome the BH attack and to enhance the security of packet delivery in WSNs, Simulated Annealing Black-hole attack Detection (SABD) based Enhanced Gravitational Search Algorithm (EGSA) is yet another implemented strategy to reduce the BH attacks. EGSA-SABD detects and isolates the BH infectors in WSNs. Initially, sensor nodes are hierarchically clustered using similar residual energy to reduce energy consumption. Then, the BH attack possibility in a deployed node is evaluated to find the existence of BH nodes in the region. In the end, EGSA-SABD is employed to detect and quarantine BH attackers in WSNs. The performance of EGSA-SABD is evaluated with certain metrics such as BH attack detection probability rate (BHatt_Prate), energy consumption (Ec), Duration of BH attack detection (Attduration), Packet delivery ratio (Pdr). Based on the experimental observations, the EGSA-SABD outperforms the BHatt_Prate by 13% and also reduces the energy consumption by 21%.

Cyber-Physical Attacks Against State Estimators Based on a Finite Frequency Approach

This paper studies the design problem of the attack strategy for cyber-physical systems (CPSs). In this paper, a finite frequency attack strategy is designed for CPSs such that the performance of the state estimator can be reduced with a low attack detection probability. Different from the existing methods with a predefined finite frequency range, the attack strategy is designed for the system to satisfy H_/H <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">∞</sub> performance index in different finite frequency ranges in the proposed method, and a suitable frequency interval can be selected as that of the attack signal. Since the property of the finite frequency of the attack signal could be made full use of such that a good attack effect can be obtained in the proposed method. Finally, an example is given to illustrate the effectiveness of the developed method.

Game-Theoretic Framework for Malicious Controller Detection in Software Defined Networks

The separation of control and data plane in Software Defined Networking (SDN) introduces new security threats. A compromised controller can leverage its position to perform attacks by installing malicious rules in switches while avoiding detection. Current approaches propose broadcast of flow-setup requests to multiple controllers simultaneously and to check consistency of forwarding rules to install the correct rule and identify compromised controllers. However, such approaches result in heavy load on the control plane, resulting in longer response times to requests and higher network cost to accommodate the increased load. To alleviate this issue, we propose a game-theory based framework to detect a malicious controller without overloading the control plane. Instead of broadcasting every request to multiple controllers, switches randomly broadcast requests on the basis of a randomization strategy obtained by the Stackelberg game, whose solution results in a randomization strategy that maximizes the detection probability of a malicious controller. We formulate a two-level optimization problem in the context of our game-theoretic framework that aims to maximize the attack detection probability among the set of controllers by mapping switches to controllers and obtaining randomization strategies for each controller. We develop <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Midas</i> (MalIcious controller Detection mApping Strategy), a heuristic algorithm to obtain an effective solution to the optimization problem in reasonable time. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Midas</i> achieves minimum detection probability within 12% of the optimal solution. Further, it achieves at least 80% of min-max ratio of load at the controllers, implying higher fairness in load distribution compared to optimal solution, a state-of-art algorithm and a baseline heuristic.

Malicious relay detection using sentinels: A stochastic geometry framework

Next generation wireless networks are under high risk of security attacks due to increased connectivity and information sharing among peer nodes. Some of the nodes could potentially be malicious, intending to disrupt or tamper sensitive data transfer in the network. In this paper, we present a detailed analysis of the sentinel based data integrity attack detection of malicious relays using a stochastic geometry framework. We assume a practical channel model for each wireless link and apply a stochastic geometry approach to interference modeling. Two detection schemes depending on the level of connectivity between sentinel devices are proposed: isolated and co-operative detection. For both schemes, attack detection probability is derived as a function of important network parameters, and the minimum density of sentinels to achieve a given detection probability is calculated. It will be shown that a reasonable attack detection probability can be achieved even when the sentinel node density is much lower than the relay node density.

Simulating cyber-physical systems: Identifying vulnerabilities for design and manufacturing through simulated additive manufacturing environments

Cyber-physical systems have been widely adopted in a number of industries, including healthcare, critical infrastructure, and manufacturing. The connectivity of machines, which characterizes cyber-physical systems and provides many of their benefits, leaves them vulnerable to cyber-attacks. Within manufacturing, cyber-attacks can compromise end-use parts, resulting in catastrophic part failure. Researchers have recently started to investigate the vulnerabilities within connected additive manufacturing machines, demonstrating vulnerabilities and proposing mitigation strategies. While informative, findings from past work are limited by the physical machines used in experiments, making results difficult to generalize to other systems. Further, physical experiments take time, waste stock material, and may not be generalizable for other machines. The goal of this work is to provide a digital testbed for future research to characterize the vulnerabilities of manufacturing CPS and develop new methods to effectively identify compromised parts. This paper proposes and validates an inexpensive and accessible simulation to accurately predict the physical output of a fused deposition modeling additive manufacturing machine. This simulation allows for efficient testing of attack vectors and determine the probability of attack detection using quality control methods. This study lays the groundwork for future research exploring the vulnerabilities in engineering design processes as manufacturers become increasingly reliant on connected production equipment.

Stealth Attacks on the Smart Grid

Random attacks that jointly minimize the amount of information acquired by the operator about the state of the grid and the probability of attack detection are presented. The attacks minimize the information acquired by the operator by minimizing the mutual information between the observations and the state variables describing the grid. Simultaneously, the attacker aims to minimize the probability of attack detection by minimizing the Kullback-Leibler (KL) divergence between the distribution when the attack is present and the distribution under normal operation. The resulting cost function is the weighted sum of the mutual information and the KL divergence mentioned above. The tradeoff between the probability of attack detection and the reduction of mutual information is governed by the weighting parameter on the KL divergence term in the cost function. The probability of attack detection is evaluated as a function of the weighting parameter. A sufficient condition on the weighting parameter is given for achieving an arbitrarily small probability of attack detection. The attack performance is numerically assessed on the IEEE 30-Bus and 118-Bus test systems.

Security Against False Data-Injection Attack in Cyber-Physical Systems

In this paper, secure, remote estimation of a linear Gaussian process via observations at multiple sensors is considered. Such a framework is relevant to many cyber-physical systems and Internet-of-things applications. Sensors make sequential measurements that are shared with a fusion center; the fusion center applies a filtering algorithm to make its estimates. The challenge is the presence of a few unknown malicious sensors which can inject anomalous observations to skew the estimates at the fusion center. The set of malicious sensors may be time varying. The problems of malicious sensor detection and secure estimation are considered. First, an algorithm for secure estimation is proposed. The proposed estimation scheme uses a novel filtering and learning algorithm, where an optimal filter is learned over time by using the sensor observations in order to filter out malicious sensor observations while retaining other sensor measurements. Next, a novel detector to detect injection attacks on an unknown sensor subset is developed. Numerical results demonstrate up to 3-dB gain in the mean-squared error and up to $\text{75} \%$ higher attack detection probability under a small false alarm rate constraint, against a competing algorithm that requires additional side information.

Consistent eavesdropping attack of two eavesdroppers on the ping-pong protocol with GHZ-triplets of qubits

In this paper has been analyzed the eavesdropping attackof two eavesdroppers on the ping-pong protocol withthree-qubit entangled Greenberger – Horne – Zeilingerstates. The expression for probability of attack detectionby legitimate users at attack of two eavesdroppers dependingon probabilities of detection them attacks separatelyare obtained. It is shown that an increase in thenumber of attackers in the quantum channel leads to anincrease in the probability of detecting these attacks bylegitimate users. The expressions for the maximum eavesdroppers'amount of information during a consistentattack of two eavesdroppers on the ping-pong protocolwith GHZ-triplets are obtained. It is indicated that themaximum eavesdroppers' amount of information determinedby the same expression as in the case of oneeavesdropper's attack, only the expression for the probabilityof attack detection is changed. It is shown that theping-pong protocol with GHZ-triplets is vulnerable toeavesdropping attack of two eavesdroppers not morethan to one eavesdropper's attack. It is shown that resultsof paper could be extend to the ping-pong protocols withn-qubit GHZ-states at any n.

Mobile Beacon Based Wormhole Attackers Detection and Positioning in Wireless Sensor Networks

Wormhole attack is a severe attack that can be easily launched by a pair of external attackers in hostile wireless sensor networks. In the wormhole attack, an attacker sniffs packets at one point in the network, and tunnels them through the wormhole link to the other attacker at another point of the network, which broadcasts them to its neighbors. Such kind of procedure can easily deteriorate the normal functionality of the networks. In this paper, we propose a novel wormhole attackers detection and positioning scheme based on mobile beacon, which can not only detect the existence of wormhole attacks, but also accurately localize the attackers for the system to eliminate them out of the network. The main idea is to detect whether the communication between the mobile beacon and each of the static beacons violates the communication properties and then the attacker can be estimated as the center of its communication area by determining the intersection point of the chords’ perpendicular bisector. The simulation results illustrate that our proposed scheme can obtain a high wormhole attack detection probability as well as a high attackers positioning accuracy.

Increasing the security of the ping–pong protocol by using many mutually unbiased bases

In this paper we propose an extended version of the ping-pong protocol and study its security. The proposed protocol incorporates the usage of mutually unbiased bases in the control mode. We show that, by increasing the number of bases, it is possible to improve the security of this protocol. We also provide the upper bounds on eavesdropping average non-detection probability and propose a control mode modification that increases the attack detection probability.

Security of ping-pong protocol based on pairs of completely entangled qudits

Quantum secure direct communication protocols offer confidential transmission of classic information over quantum channel without prior key agreement. The ping-pong based protocols provide asymptotic security and detailed analysis of security level provided by each variant of the protocol is required. The paper presents a general method of calculation of the eavesdropped information as a function of the attack detection probability. The method is applied to the ping-pong protocol based on completely entangled pairs of qudits. The upper and lower bounds on the amount of the leaked information and eavesdropping detection probability are provided.

Security of the quantum direct communication based on pairs of completely entangled qudits

Quantum secure direct communication protocols offer confidential transmission of classic information over the quantum channel without a prior key agreement. The ping-pong based protocols provide asymptotic security and detailed analysis of the security level provided by each variant of the protocol is required. The paper presents a general method of calculation of the eavesdropped information as a function of the attack detection probability. The method is applied to the ping-pong protocol based on completely entangled pairs of qudits. The lower and upper bound on the amount of the leaked information is provided.

Non-coherent attack on the ping-pong protocol with completely entangled pairs of qutrits

The general individual (non-coherent) attack on the ping-pong protocol with completely entangled pairs of three-dimensional quantum systems (qutrits) is analyzed. The expression for amount of the eavesdropper's information as functions from probability of attack detection is derived. It is shown, that the security of the ping-pong protocol with pairs of qutrits is higher the security of the protocol with pairs of qubits. It is also shown, that with the use by legitimate users in a control mode two mutually unbiased measuring bases the ping-pong protocol with pairs of qutrits, similar to the protocol with groups of qubits, possesses only asymptotic security and requires additional methods for its security amplification.

АналіЗ стІйкостІ трьоХ ВаріантіВ пінГ–понГ протоколУ дО атакИ пасивнОгО перехопленнЯ

Based on the analysis of eavesdropping attacks on the three variants of the ping–pong protocol the estimations of information leakage depending on probability of attack detection are obtained. It is shown, that the information capacity and security of various variants of the ping–pong protocol are in the inverse proportion.

Detecting Bioterror Attack

To the Editor: In a recent article (1), Kaplan et al. addressed the problems in detecting a bioterror attack from blood-donor screening. The main point of this comment is the used by Kaplan et al. to derive the probability of detecting an attack. The simplification used by Kaplan et al. leads to a probability that does not account for the size of the exposed population and can lead to incorrect results and misinterpretations. Consider a single bioterror attack that infects a proportion p of an exposed population of size N at time τ = 0, such that the initial number of infected is I0= Np. The quantity of interest is the probability D(τ) of finding at least one positive blood donation and detecting the attack within time τ. For attacks conducted with contagious agents that could lead to an epidemic, Kaplan et al. used the early approximation solution of the classic epidemic models (2) to describe the progression of the number of infected persons. Consequently, the resulting probability of attack detection [noted Des(τ)] is dependent only upon the initial size of the release I0 , the basic reproductive number R0 (the mean number of secondary cases per initial index case), and other variables (the blood screening window ω, the mean number k of blood donations per person and per unit of time, and the mean duration of infectiousness 1/r) (Appendix). Early approximation can lead to unreliable results because it is valid only at earlier stages of the epidemics and in the limit where the proportion p of initially infected is much smaller than the intrinsic steady proportion (R0 – 1) / R0 of the epidemics (Appendix). Relaxing this approximation and using the full solution for the progression of the number of infected persons leads to the probability D(τ)that takes into account the size of the exposed population (Appendix). The latter is important because, in contrast to Des(τ)that leads to the same conclusion, D(τ) indicates that the probabilities of detecting an attack within two exposed populations of different sizes, but with the same numbers of initially infected, are not identical. As illustrated in the Figure, when the other variables are fixed, D(τ)decreases as the proportion p of initially infected increases because the epidemic size decreases as p approaches the threshold (R0 – 1) / R0 . These subtleties of a simple epidemic model are even less reliable when using the blood screening to detect a bioterror attack with agents that cause diseases of very short incubation period. Figure Probability of attack detection delay for a contagious agent. Dashed line represents the early approximation Des(τ), solid lines the full solution (where the numbers represent the fraction p of the population initially infected), and the symbol ... Nonetheless, detecting a bioterror attack is very similar to detecting the response of pathogen-specific immunoglobulin M antibodies (as an indicator of recent contact of hosts with pathogens) within a population of hosts by using serologic surveys. Therefore, the reasoning developed for a bioterror attack can be extended and applied to detect and time the invasion or early circulation of certain pathogens within a population. In that perspective, it might be useful to develop an analysis that includes more details of the epidemic progression within this framework.