Attack Detector Research Articles

Detecting load redistribution attacks via support vector models

A machine learning-based detection framework is proposed to detect a class of cyber-attacks that redistribute loads by modifying measurements. The detection framework consists of a multi-output support vector regression (SVR) load predictor and a subsequent support vector machine (SVM) attack detector to determine the existence of load redistribution (LR) attacks utilising loads predicted by the SVR predictor. Historical load data for training the SVR are obtained from the publicly available PJM zonal loads and are mapped to the IEEE 30-bus system. The features to predict loads are carefully extracted from the historical load data capturing both temporal and spatial correlations. The SVM attack detector is trained using normal data and randomly created LR attacks so that it can maximally explore the attack space. An algorithm to create random LR attacks is introduced. The results show that the SVM detector trained merely using random attacks can effectively detect not only random attacks but also intelligently designed attacks. Moreover, using the SVR predicted loads to re-dispatch generation when attacks are detected can significantly mitigate the attack consequences.

Self-supervised network traffic management for DDoS mitigation within the ISP domain

The continuing development of 5G technology increases the number of devices connected to the internet, this provides an increasing potential for cybercriminals to orchestrate detrimental Distributed Denial of Service (DDoS) attacks. The research community continues to develop new techniques to respond to the growing demand for DDoS mitigation. The internet service provider (ISP) provides internet access for users, so the attack traffic arrives at this location before reaching the victim. Deploying the mitigation system within the ISP domain offers an efficient solution. Therefore, we propose a dynamic network traffic managing (DNTM) system, which encompasses an Attack Detector, an IP Prioritiser, a Traffic Manager, and a Netflow Classifier, for the ISP. The IP prioritiser categorises IP addresses into normal and suspicious classes. The Traffic Manager makes use of the existing ISP mechanisms including ingress & egress filtering, rate limiting, blackholing and normal routing to take different mitigation actions. The Netflow Classifier is a hybrid ensemble model that utilises both unsupervised and supervised learning techniques. The classifier employs two self-organising maps (SOMs) to label data to train a supervised ensemble unit, which includes Random Forests, Decision Trees, and Gradient Boosted Trees (SRDG), to get the final classification. The Netflow Classifier achieved over 96% average on recall, precision and F1 score on UDP flood, ICMP flood and TCP flood attack data sets.

Sensor attack detection and isolation based on sliding mode observer for cyber‐physical systems

SummaryThis article investigates the sensor attack detection and isolation problems for cyber‐physical systems under attacked situation. To begin with, an overall system is constructed for the network of dynamic system and all the issues are dealt with for the overall system instead of every subsystem. Then, we prove that the preconditions which are made on the original subsystem can be transferred on to the overall system. After this, for the overall system, a sliding mode observer that is robust to the disturbance but sensitive to the sensor attack is designed as sensor attack detector to issue an alarm when at least one subsystem is attacked. In addition, we cope with the sensor fault isolation problem by building an augmented descriptor system for the overall system and we further prove that the precondition can be kept for the augmented descriptor system. Then, another robust sliding mode observer is designed to reach the goal of attack isolation. Finally, a simulation example is given to verify the effectiveness of the proposed methods.

Disconnection-aware Attack Detection in Networked Control Systems

This study deals with security issues in dynamical networked control systems. The goal is to establish a unified framework of the attack detection stage, which includes the four processes of monitoring the system state, making a decision based on the monitored signal, disconnecting the corrupted subsystem, and operating the remaining system during restoration. This paper, in particular, considers a disconnection-aware attack detector design problem. Traditionally, observer-based attack detectors are designed based on the system model with a fixed network topology and cannot cope with a change of the topology caused by disconnection. The disconnection-aware design problem is mathematically formulated and a solution is proposed in this paper. A numerical example demonstrates the effectiveness of the proposed detector through an inverter-based voltage control system in a benchmark model.

Fog-Based Attack Detection Framework for Internet of Things Using Deep Learning

The number of cyber-attacks and data breaches has immensely increased across different enterprises, companies, and industries as a result of the exploitation of the weaknesses in securing Internet of Things (IoT) devices. The increasing number of various devices connected to IoT and their different protocols has led to growing volume of zero-day attacks. Deep learning (DL) has demonstrated its superiority in big data fields and cyber-security. Recently, DL has been used in cyber-attacks detection because of its capability of extracting and learning deep features of known attacks and detecting unknown attacks without the need for manual feature engineering. However, DL cannot be implemented on IoT devices with limited resources because it requires extensive computation, strong power and storage capabilities. This paper presents a comprehensive attack detection framework of a distributed, robust, and high detection rate to detect several IoT cyber-attacks using DL. The proposed framework implements an attack detector on fog nodes because of its distributed nature, high computational capacity and proximity to edge devices. Six DL models are compared to identify the DL model with the best performance. All DL models are evaluated using five different datasets, each of which involves various attacks. Experiments show that the long short-term memory model outperforms the five other DL models. The proposed framework is effective in terms of response time and detection accuracy and can detect several types of cyber-attacks with 99.97% detection rate and 99.96% detection accuracy in binary classification and 99.65% detection accuracy in multi-class classification.

An enhanced saturation attack and its mitigation mechanism in software-defined networking

Software-Defined Networking (SDN) enables network operators to easily and quickly manage, configure, and optimize network resources via decoupling the control logic from forwarding devices. Such a separation, however, brings multiple potential bottlenecks that can be exploited by attackers to degrade network performance or even disrupt network availability. In this paper, we delve into an enhanced saturation attack, table-miss striking attack, and prove that it is more cost-efficient and powerful than the traditional saturation attack. In response, we propose SDNGuardian, an efficient and protocol-independent defense framework for SDN/OpenFlow networks to mitigate table-miss striking attacks. It stands between the controller platform and other controller applications, and protects the network by leveraging four functional modules: preprocessor to obtain the packet sensitive fields that trigger the controller to issue flow rules; attack detector to notify the signal about the occurrence of the attack; traffic filter to identify the attacked ports and filter traffic based on frequency; rule sweeper to eliminate malicious rules in the switch flow table. All designs of SDNGuardian conform to the OpenFlow, requiring no modification in protocol and additional devices. We implement a prototype of SDNGuardian in the Ryu controller and evaluate its performance in software testbed environments. Experimental results show that SDNGuardian can efficiently mitigate the table-miss striking attack and protect network infrastructure resources with negligible system overhead.

Stealthy Actuator Signal Attacks in Stochastic Control Systems: Performance and Limitations

In this technical note, the tradeoff between the attack detectability and the performance degradation in stochastic cyber-physical systems is investigated. We consider a linear time-invariant system in which the attack detector performs a hypothesis test on the innovation of the Kalman filter to detect malicious tampering with the actuator signals. We adopt a notion of attack stealthiness to quantify the degree of stealth by limiting the maximum achievable exponents of both false alarm probability and detection probability below certain thresholds. And the conditions for any actuator attack to have a specific level of stealthiness are derived. Additionally, we characterize the upper bound of the performance degradation induced by attacks with a given extent of stealthiness that produces independent and identically distributed Gaussian innovations, and design the attack, which achieves the stated upper bound for right-invertible systems. Finally, our results are illustrated via numerical examples.

Analysis of Intrusion Detection System Performance for the Port Scan Attack Detector, Portsentry, and Suricata

The purpose of this study is to analyze the performance of IDS (PSAD, Portsentry and Suricata). The research methodology used was the Network Development Life Cycle (NDLC). The system has designed through several stages (system requirements analysis, system/software installation, configuration and testing software attacks). The system detects and monitors the number of suspicious activities that occur on the server (using a cloud service) or computer network. In the event of a threat, the system will issue a warning and keep records for analysis. The IDS performance tests are differentiated based on three types of attack (port scanning, DDoS SYN flood and brute force attack), the parameters tested include a speed of detection, detection accuracy and resources usage. Test results showed Suricata and PSAD are superior in detection accuracy (100%). Suricata showed better performance in resources usage (average 1.64% CPU, 8.42% disk), portsentry is only superior to RAM usage (26.89%). PSAD was better in the speed of detection (average 4.21s.). The result concluded Suricata and PSAD better performance to be used as network IDS.

Pilot contamination attack detection for multi-cell MU-massive MIMO system

This work presents a low-complexity pilot contamination attack (PCA) detector for a multi-cell multi-user massive multiple-input, multiple-output (MU-MaMIMO) system. An active eavesdropper (Eve) in the reference cell transmits synchronized training sequence of the legitimate user (LU) under attack in order to alter precoder to steel information in the downlink data phase. The detection of an active Eve is vital for the information security and enhances secrecy capacity of the LU. We formulate binary hypotheses for active Eve detection from the contaminated channel estimation. We provide performance analysis of the proposed detector. The comparison of analysis and Monte Carlo runs verifies the accuracy of the analysis. The simulation results demonstrate that the performance of the proposed PCA detector is better than the well-known minimum descriptive length (MDL) method in low SNR regime.

Detection of Face Morphing Attacks Based on PRNU Analysis

Recent research found that attacks based on morphed face images, i.e., morphing attacks, pose a severe security risk to face recognition systems. A reliable morphing attack detection from a single face image remains a research challenge since cameras and morphing techniques used by an attacker are unknown at the time of classification. These issues are commonly overseen while many researchers report encouraging detection performance for training and testing morphing attack detection schemes on images obtained from a single face database employing a single morphing algorithm. In this work, a morphing attack detection system based on the analysis of Photo Response Non-Uniformity (PRNU) is presented. More specifically, spatial and spectral features extracted from PRNU patterns across image cells are analyzed. Differences of these features for bona fide and morphed images are estimated during a threshold-selection stage using the Dresden image database which is specifically built for PRNU analysis in digital image forensics. Cross-database evaluations are then conducted employing an ICAO compliant subset of the FRGCv2 database and a Print-Scan database which is a printed and scanned version of said FRGCv2 subset. Bona fide and morphed face images are automatically generated employing four different morphing algorithms. The proposed PRNU-based morphing attack detector is shown to robustly distinguish bona fide and morphed face images achieving an average D-EER of 11.2% in the best configuration. In scenarios where image sources and morphing techniques are unknown, it is shown to significantly outperform other previously established morphing attack detectors. Finally, the limitations and potential of the approach are demonstrated on a dataset of printed and scanned bona fide and morphed face images.

CIADL: cloud insider attack detector and locator on multi-tenant network isolation: an OpenStack case study

In cloud networks, edging network virtualization technology is widely adopted to protect tenants with isolated networks mainly from threats inside the cloud. However, since tenants completely rely on cloud service provider’s service interface to be aware of their current network policy, malicious admin alone or with concluded tenants is/are fully capable of acquiring any target tenant network data by attacking corresponding policies stored and enforced on the edging end hosts without tenants knowing. Therefore, this paper presents cloud insider attack detector and locator (CIADL) on multi-tenant network isolation for OpenStack. We propose an insider attack threat model with attack category. A layered state model based constructing and attack detection methods are also proposed, enabling efficient policy confliction detection between expected policy on central node and enforcing policy on end hosts. Along with a threat locating method with fine granularity of device policy rules for recovery purpose. We implements the proof of concept system of CIADL, and the experiments and analysis show our method can cover all attack types defined in threat model with low overheads, and scales well with network and policy size and attack number increase. Compared to existing work model with VM–VM state, CIADL state model with NET–NET state gets about 8.5% and 92.3% improvement on construction and verification time costs with most hostile environment (AP = 80%) and largest policy scale (PS = 4000), which suggests CIADL is both efficient and scalable.

False-Data Injection Attack in Electricity Generation System Subject to Actuator Saturation: Analysis and Design

The secure operation of electricity generation system (EGS) is essential to the quality of electricity and the security of energy Internet. In order to design secure control strategy for EGS, the behavior and capacity of adversary and possible attack should be studied. From this point of view and considering the actuator saturation and the false-data injection attack in control input channel of EGS, we analyze the behavior and stealthiness of adversary and design stealthy attack strategies in this paper. First, we prove that the magnitude of effective attack signal is smaller than the magnitude of injected attack signal because of actuator saturation. Second, we find that smaller actuator saturation limit makes the adversary easier to be detected. Finally, two stealthy attack strategies are designed for EGS which incorporates a $\chi ^{2}$ attack detector, and the effectiveness of them are illustrated through simulation.

HAD-TWL: Hot Address Detection-Based Wear Leveling for Phase-Change Memory Systems with Low Latency

Phase-change memory (PCM) is an emerging non-volatile memory device that offers faster access than flash memory does. However, PCM suffers from a critical problem where the number of write operations is limited. The previous practical attack detector (PAD) that uses a small memory space called stack adopts an algebraic mapping-based wear leveling (AWL) algorithm. Thanks to successful detection of malicious attacks, the PAD-AWL dramatically improves the lifetime of PCM. To enhance system factors such as write latency, the proposed method replaces the AWL algorithm with a table-based wear leveling (TWL) algorithm. Since the fixed stack size of the previous PAD is inefficient in detection of attack-like hot addresses, a stack size modulation scheme that enables a hot address detector (HAD) to efficiently counteract various memory write streams is proposed. Compared with the previous AWL-based algorithm, the integration with the TWL algorithm demands only 24 percent of the total number of swaps per write, and the proposed HAD with the stack size modulation scheme achieves the detection rate of 94 percent while reducing the execution time by 57 percent.

Distributed $H_\infty$ Estimation Resilient to Biasing Attacks

We consider the distributed $H_\infty$ estimation problem with an additional requirement of resilience to biasing attacks. An attack scenario is considered, where an adversary misappropriates some of the observer nodes and injects biasing signals into observer dynamics. This paper proposes a procedure for the derivation of a distributed observer, which endows each node with an attack detector, which also functions as an attack compensating feedback controller for the main observer. Connecting these controlled observers into a network results in a distributed observer whose nodes produce unbiased robust estimates of the plant. We show that the gains for each controlled observer in the network can be computed in a decentralized fashion, thus reducing vulnerability of the network.

A Calibratable Detector for Invasive Attacks

Microprobing is commonly used by adversaries to extract firmware or cryptographic keys from microcontrollers. We introduce the calibratable lightweight invasive attack detector (CaLIAD) to detect microprobing attacks. The CaLIAD measures timing imbalances between lines that are caused by the capacitive load of a probe. Compared to protection mechanisms from industry, it does not require an additional protection layer such as meshes do; in contrast to bus encryption, it does not introduce delay cycles. Compared to state-of-the-art low area probing detectors, it can be calibrated and, thus, allows compensating manufacturing variations as well as small layout imbalances. This capability allows us to significantly reduce the detection margin compared to the prior art while maintaining the low rate of false positives. We can finally show that capacitive loads of 23 fF or less can be detected, depending on how the CaLIAD is used. This includes all state-of-the-art commercial microprobes we are aware of.

Towards Resilient UAV: Escape Time in GPS Denied Environment with Sensor Drift

Abstract This paper considers a resilient state estimation framework for unmanned aerial vehicles (UAVs) that integrates a Kalman filter-like state estimator and an attack detector. When an attack is detected, the state estimator uses only IMU signals as the GPS signals do not contain legitimate information. This limited sensor availability induces a sensor drift problem questioning the reliability of the sensor estimates. We propose a new resilience measure, escape time, as the safe time within which the estimation errors remain in a tolerable region with high probability. This paper analyzes the stability of the proposed resilient estimation framework and quantifies a lower bound for the escape time. Moreover, simulations of the UAV model demonstrate the performance of the proposed framework and provide analytical results.

Detection and mitigation of biasing attacks on distributed estimation networks

The paper considers a problem of detecting and mitigating biasing attacks on networks of state observers targeting cooperative state estimation algorithms. The problem is cast within the recently developed framework of distributed estimation utilizing the vector dissipativity approach. The paper shows that a network of distributed observers can be endowed with an additional attack detection layer capable of detecting biasing attacks and correcting their effect on estimates produced by the network. An example is provided to illustrate the performance of the proposed distributed attack detector.

Data-Driven Methods for Stealthy Attacks on TCP/IP-Based Networked Control Systems Equipped With Attack Detectors.

Most of the existing stealthy attack schemes for cyber-physical systems (CPSs) are presented under the assumption that the model parameters of CPS are known to attackers. Presently, there are only a few model-independent stealthy attack approaches, which, however, need the assumption that attackers know sensor measurements and can modify them. This paper aims to remove the aforementioned conservative assumptions and give a stealthy attack methodology for closed-loop CPS with reference signals, that is, transmission control protocol/Internet protocol (TCP/IP)-based networked control systems. To this end, under the condition that the model parameters of the CPS are unknown, a benchmark platform (consisting of an attack detector and a TCP/IP-based networked dc servo system) used for testing the stealthy attack technology is constructed via data-driven methods. A plan is made, which is utilized for eavesdropping the information of the TCP/IP-based CPS. On this basis, an approach to blocking network communications and injecting the false sensor data into the CPS is explored. A closed-loop recursive identification strategy for the dynamic characteristic matrix of the CPS is designed. By employing all of the above-obtained results, a data-driven stealthy attack scheme for the CPS is proposed and, subsequently, its effectiveness and practicability are validated by experiment.

Identity attack detection system for 802.11-based ad hoc networks

Due to the lack of centralized identity management and the broadcast nature of wireless ad hoc networks, identity attacks are always tempting. The attackers can create multiple illegitimate (arbitrary or spoofed) identities on their physical devices for various malicious reasons, such as to launch Denial of Service attacks and to evade detection and accountability. In one scenario, the attacker creates more than one identity on a single physical device, which is called a Sybil attack. In the other one, the attacker creates cloned/replicated nodes. We refer collectively to these attacks as identity attacks. Using these malicious techniques, the attacker would perform activities in the network for which the attacker may not be authorized. In the existing literature, these attacks are often counteracted separately. However, in this paper, we propose a solution to counteract both attacks jointly. Our proposed scheme uses the received signal strength for the detection without using extra hardware (such as GPS, antennae or air monitors) and centralized entities (such as trusted third party or certification authority). Upon the detection of malicious identities, they will be quarantined and will be blacklisted for future data communication by the mobile nodes. Our proposed attack detector detects the presence of Sybil attacks and replication attacks locally by analysing the received signal strength captured by each node. Moreover, we propose a technique that will identify these attacks in the overall network. In both local and global cases, we evaluate our solutions theoretically and via simulation in NS-2. The obtained results demonstrate that it is possible to detect identity attacks with considerable accuracy without causing extra overhead in the form of extra hardware, periodic beacons or expensive localization operations in the wireless ad hoc networks.

Cyber-Physical Attacks With Control Objectives

This paper studies attackers with control objectives against cyber-physical systems (CPS). The system is equipped with its own controller and attack detector, and the goal of the attacker is to move the system to a target state while altering the system's actuator input and sensor output to avoid detection. We formulate a cost function that reflects the attacker's goals, and, using dynamic programming, we show that the optimal attack strategy reduces to a linear feedback of the attacker's state estimate. By changing the parameters of the cost function, we show how an attacker can design optimal attacks to balance the control objective and the detection avoidance objective. Finally, we provide a numerical illustration based on a remotely-controlled helicopter under attack.