Attack Model Research Articles

Research on differential privacy protection method based on user tendency.

It is a new attack model to mine user's activity rule from user's massive data. In order to solve the privacy leakage problem caused by user tendency in current privacy preserving methods, an extended differential privacy preserving method based on user's tendency is proposed in the paper. By constructing a Markov chain, and using the Markov decision process, it equivalently expresses user's tendency as measurable state transition probability, which can transform qualitative descriptions of user's tendency into a quantitative representation to achieve an accurate measurement of the user tendency. An extended (P,ε)-differential privacy protection method is proposed in the work, by introducing a privacy model parameter R, it combines the quantified user's propensity probability with a differential privacy budget parameter, and it can dynamically add different noise amounts according to the user's tendency, so as to achieve the purpose of protecting the user's propensity privacy information and improve data availability. Finally, the feasibility and effectiveness of the proposed method was verified by experiments.

Examining indicators of complex network vulnerability across diverse attack scenarios

Complex networks capture the structure, dynamics, and relationships among entities in real-world networked systems, encompassing domains like communications, society, chemistry, biology, ecology, politics, etc. Analysis of complex networks lends insight into the critical nodes, key pathways, and potential points of failure that may impact the connectivity and operational integrity of the underlying system. In this work, we investigate the topological properties or indicators, such as shortest path length, modularity, efficiency, graph density, diameter, assortativity, and clustering coefficient, that determine the vulnerability to (or robustness against) diverse attack scenarios. Specifically, we examine how node- and link-based network growth or depletion based on specific attack criteria affect their robustness gauged in terms of the largest connected component (LCC) size and diameter. We employ partial least squares discriminant analysis to quantify the individual contribution of the indicators on LCC preservation while accounting for the collinearity stemming from the possible correlation between indicators. Our analysis of 14 complex network datasets and 5 attack models invariably reveals high modularity and disassortativity to be prime indicators of vulnerability, corroborating prior works that report disassortative modular networks to be particularly susceptible to targeted attacks. We conclude with a discussion as well as an illustrative example of the application of this work in fending off strategic attacks on critical infrastructures through models that adaptively and distributively achieve network robustness.

A research on attack and defense models of network security

This paper analyzes the attack and defense model in network security. For attack models, this paper focuses on Distributed Denial of Service (DDoS), Advanced Persistent Threat (APT), Man-in-the-Middle Attack (MITM), Trojan House, and Cross Site Script Attack (XSS). For each attack model, this article analyses the attack principle and attack effect and summarizes the advantages and disadvantages of various attack models. In the defense model, this paper studies policy, protection, detection, response (P2DR) and the zero-trust model. This paper introduces the basic principle and defense strategy of the P2DR model and analyzes the advantages and disadvantages of this model. At the same time, this paper also introduces the concept and basic principle of the zero-trust model and analyzes its advantages over the traditional security model. The comprehensive analysis shows that different defense strategies need to be adopted for different attack models. When choosing a defense model, it is necessary to choose the most suitable model according to the specific situation. The research of this paper has certain practical significance for improving the level of network security.

Current sharing control strategy with uncertainties and network attacks for electric vehicle charging station

AbstractAlthough the electric vehicle supplied through distributed generators (DGs) is one of the most promising methods to reduce carbon emission and has been widely studied, the accurate current sharing regarding multi‐bus DC charging stations considering uncertainties and network attacks is rarely studied. Based on this, a fully distributed current sharing control strategy is presented, which can improve the reliability of system under denial of service (DoS). Firstly, the DC charging station system (DCCSS) with uncertainties is modelled. Primary control is designed to provide stable voltage and inaccurate current sharing. Furthermore, the state‐space function considering power coupling among different DC buses is built, which lays the foundation for the design of the following control. Then, the model of DoS attacks is proposed. Based on this, the fully distributed consensus control is proposed to achieve the accurate current sharing for DCCSS under DoS. Meanwhile, a method for solving the control gain without global information is given and proved. Moreover, it can be solved by LMI toolbox. As a comparison, a common control strategy is introduced that only considers the uncertainties. Finally, the feasibility of the proposed method is verified through comparison of simulation results.

A practical multi-tab website fingerprinting attack

The rapid development of Internet of Things technology has allowed a massive number of devices to be connected, resulting in a lot of private data being transmitted over the network. To protect the security and privacy, anonymous communication technologies such as Tor are widely deployed. They use complex mechanisms such as encryption and multi-hop forwarding to hide the communication relationship and content. However, much existing work on the website fingerprinting attack has proven that there is still a risk of privacy disclosure. Website fingerprinting attacks can extract side channel information from encrypted traffic to form a fingerprint that identifies the victim’s destination website. But most work is conducted in the ideal environments, assuming the absence of background traffic, which raises doubts about the effectiveness in the real world. In this paper, we relax the strong assumptions of the attack model and propose a practical multi-tab website fingerprinting attack. We first constructed a CNN model to distinguish whether the unknown traffic is generated by accessing a single web page or multiple web pages. Then we design a split point recognition method based on the BalanceCascade algorithm to separate the overlapping traffic. Furthermore, we build recognition models based on ResNet and multi-head self-attention mechanism to identify the tail-missing and head-overlapping traffic sequences respectively. Extensive experiments are carried out in the real-world scenario to evaluate the proposed method. When the time interval is randomly selected within 5–15s, we achieve an accuracy of 77.34% in split point recognition. And the accuracy of identifying the two pages is 88.19% and 63.02% respectively.

GDE model: A variable intrusion detection model for few-shot attack

With the formation and popularity of the Internet of Things(IoT), the difficulty of protecting IoT infrastructure and smart devices from a few-shot of ever-changing malicious attacks has increased significantly. Traditional intrusion detection models in static mode cannot defend against intelligent attacks that change in real time and are good at reconnaissance, and it is difficult to achieve effective detection of few-shot attacks. Therefore, to solve the above problems, this paper proposes a variable few-shot intrusion detection model GDE Model for IoT, which contains a data processing module consisting of an improved Gramian Angular Fields(GAF), a data augmentation module consisting of an improved Denoising Diffusion Probabilistic Models(DDPM), and an image classification module consisting of a variable network ETNet V2 obtained from a neural architecture search based on efficient net v2. The one-dimensional network traffic data collected from a real network environment is converted into two-dimensional images and fed into the above model for learning and training, so as to construct a variable intrusion detection model that combines accuracy and inference speed. To evaluate the work of this paper, different categories of evaluation metrics were selected and experiments were conducted on each module and the overall model separately. The experimental results show that the proposed intrusion detection model achieves variable functionality with an accuracy of up to 99.20% for few-shot detection and an average inference time as low as 23ms, which can be used not only for IoT but also for different network environments and attack types.

Dynamics analysis and cryptographic implementation of a fractional-order memristive cellular neural network model

Due to the fact that a memristor with memory properties is an ideal electronic component for implementation of the artificial neural synaptic function, a brand-new tristable locally active memristor model is first proposed in this paper. Here, a novel four-dimensional fractional-order memristive cellular neural network (FO-MCNN) model with hidden attractors is constructed to enhance the engineering feasibility of the original CNN model and its performance. Then, its hardware circuit implementation and complicated dynamic properties are investigated on multi-simulation platforms. Subsequently, it is used toward secure communication application scenarios. Taking it as the pseudo-random number generator (PRNG), a new privacy image security scheme is designed based on the adaptive sampling rate compressive sensing (ASR-CS) model. Eventually, the simulation analysis and comparative experiments manifest that the proposed data encryption scheme possesses strong immunity against various security attack models and satisfactory compression performance.

IoTSecSim: A framework for modelling and simulation of security in Internet of things

The proliferation of the Internet of Things (IoT) devices has provided attackers with tremendous opportunities to launch various cyber-attacks. It has been challenging to analyse the impact of cyber-attacks and evaluate the effectiveness of defences in real IoT environments due to the scale and heterogeneity of IoT networks. In this work, we propose a novel simulation framework and a software tool, IoT Security Simulator (IoTSecSim). IoTSecSim is operated based on a framework we propose for modelling and simulating cyber-attacks and various defences in IoT networks. IoTSecSim is not only able to support the creation of an IoT network with flexible settings of IoT devices and topology information but also models the attack behaviours, node-level, and network-level defences. Moreover, a systematic security evaluation can be performed by comparing the results based on the calculation of security metrics. We perform simulations with case studies on Mirai malware and its variants to model cyber-attack behaviours on IoT networks and evaluate the impact of these attacks and the effectiveness of defence techniques via IoTSecSim. Then, we carry out a sensitivity analysis to justify that the simulation results produced by IoTSecSim are accurate and feasible when compared with related works. We also perform a comparative performance analysis with four combinations of cyber-attack behaviours and show that these behaviours can influence IoT malware propagation in different situations. We consider multiple attacker models and deploy conventional defence techniques (including firewall, intrusion detection, and vulnerability patching) to investigate the effectiveness of defence techniques. IoTSecSim provides a generalised and extensible simulation framework that enables users to model emerging cyber-attacks against IoT networks and evaluate the effectiveness of defences against these attacks. This helps users focus on the design and performance evaluation of new defences before the actual implementation and deployment of the defences are required.

Analysis of hybrid attack and defense based on block withholding strategy

As the most influential digital cryptocurrency in the world, Bitcoin is widely recognized for its Proof of Work (PoW) consensus mechanism. However, the blockchain system based on PoW has also encountered many attacks and threats. Most of the current research focuses on analyzing the impact of a single attack on revenue while ignoring the effect of hybrid attacks on the blockchain system and attack revenue. We aim to study the impact of hybrid attacks and defensive measures. In this paper, we extend the block withholding attack model based on the existing selfish mining model and add bribery attacks to the attack model. We compare the benefits under different computing capabilities and theoretically analyze the defense model to prevent attacks. Finally, we compare the advantages of attackers under the attack model and the defense model. Our experiments show that different attack combinations can have negative effects, and the defense model with hidden target values can solve block withholding attacks well.

Current Situation and Prospect of Game Theory based Network Security Methods

The attack and defense model of network security based on game theory has developed into an effective network security model. It is a hot topic in the field of network and information security to use the idea of game theory to attack and defend the network security. This paper analyzes the general model of game theory in the field of security. This paper also analyzes the general model of network security attack and defense game. This paper also analyzes the game theory model of cryptographic protocol. This paper studies the existing network security methods based on game theory, reviews the development and evolution process and technical core of network security based on game theory, and compares the specificity of network security models based on game theory. Finally, the paper discusses the problems in the field of network security based on game theory, and tries to forecast its future development trend.

Membership inference attack on differentially private block coordinate descent.

The extraordinary success of deep learning is made possible due to the availability of crowd-sourced large-scale training datasets. Mostly, these datasets contain personal and confidential information, thus, have great potential of being misused, raising privacy concerns. Consequently, privacy-preserving deep learning has become a primary research interest nowadays. One of the prominent approaches adopted to prevent the leakage of sensitive information about the training data is by implementing differential privacy during training for their differentially private training, which aims to preserve the privacy of deep learning models. Though these models are claimed to be a safeguard against privacy attacks targeting sensitive information, however, least amount of work is found in the literature to practically evaluate their capability by performing a sophisticated attack model on them. Recently, DP-BCD is proposed as an alternative to state-of-the-art DP-SGD, to preserve the privacy of deep-learning models, having low privacy cost and fast convergence speed with highly accurate prediction results. To check its practical capability, in this article, we analytically evaluate the impact of a sophisticated privacy attack called the membership inference attack against it in both black box as well as white box settings. More precisely, we inspect how much information can be inferred from a differentially private deep model's training data. We evaluate our experiments on benchmark datasets using AUC, attacker advantage, precision, recall, and F1-score performance metrics. The experimental results exhibit that DP-BCD keeps its promise to preserve privacy against strong adversaries while providing acceptable model utility compared to state-of-the-art techniques.

A blockchain-empowered framework for decentralized trust management in Internet of Battlefield Things

The security of the Internet of Battlefield Things (IoBT) is greatly challenged by malicious intrusions from external environments. To protect IoBT from such intrusions, it is crucial to implement trust management (TM) at the node level. However, the decentralized and dynamic nature of IoBT means that participating nodes have no predetermined trust relationships. To address this issue, we propose a blockchain-empowered framework to achieve decentralized TM in IoBT. We begin by introducing a network model that integrates the space and ground segments with portable ping-pong stations. In the absence of fixed infrastructure, these stations enable rapid networking among combat units in IoBT. We also leverage these stations to form a blockchain network that manages decentralized trusts among IoBT nodes. Our blockchain-empowered TM framework consists of three algorithmic components: (i) Local Trust Computation: each IoBT node uses a local trust computation algorithm to compute the local trusts of its neighboring nodes; (ii) Global Trust Aggregation: portable ping-pong stations use a global trust aggregation algorithm to aggregate the global trusts of IoBT nodes; (iii) Blockchain Consensus Process: the global trusts of IoBT nodes are updated to the blockchain. We have also developed a new consensus algorithm that incentivizes blockchain nodes to proactively maintain the real trusts of IoBT nodes. We conducted several simulations incorporating different attack models of malicious nodes and system setups to comprehensively evaluate the performance of our TM framework. The simulation results demonstrate that our blockchain-empowered decentralized TM effectively suppresses the probability of successful attacks and thus improves the security of IoBT. In summary, our proposed framework offers a promising solution for achieving decentralized TM in IoBT, and we believe that it has the potential to significantly enhance the security of this rapidly developing field.

DMRA: Model Usability Detection Scheme Against Model-Reuse Attacks in the Internet of Things

Internet of Things (IoT) devices can utilize deep learning to boost their intelligence, but also suffer from the long model training process. IoT devices thus may reuse public pre-trained models to expedite the training through transfer learning. However, pre-trained models may be subject to model-reuse attacks initiated by malicious deep learning servers, causing models to misclassify targeted data, which poses a threat to the security of IoT devices. In this work, we propose a new model usability detection scheme, the Defense against Model-Reuse Attacks (DMRA), suitable for IoT scenarios. DMRA employs a variant of Lagrange’s mean value theorem to reverse-check the model, which is computationally efficient, thus, suitable for resource-constrained devices. Experimental evaluations on different datasets firstly validate that model-reuse attacks can attack models in federated learning. And then demonstrate that DMRA detects such insidious attacks with up to 80% success rate at a lightweight computational cost.

LAVA: Log Authentication and Verification Algorithm

Log files provide essential information regarding the actions of processes in critical computer systems. If an attacker modifies log entries, then critical digital evidence is lost. Therefore, many algorithms for secure logging have been devised, each achieving different security goals under different assumptions. We analyze these algorithms and identify their essential security features. Within a common system and attacker model, we integrate these algorithms into a single (parameterizable) “meta” algorithm called LAVA that possesses the union of the security features and can be parameterized to yield the security features of former algorithms. We present a security and efficiency analysis and provide a Python module that can be used to provide secure logging for forensics and incident response.

МЕТОДИКА ОБНАРУЖЕНИЯ АТАК В САМООРГАНИЗУЮЩИХСЯ ДЕЦЕНТРАЛИЗОВАННЫХ БЕСПРОВОДНЫХ СЕНСОРНЫХ СЕТЯХ

The work is devoted to the development of an attack model and a technique for detecting attacks in self-organizing decentralized wireless sensor networks. The proposed model describes possible types of attacks and their characteristics, taking into account the properties of self-organization and decentralization. The methodology is focused on the protection of wireless sensor networks deployed on the ground, used for emergency response, and describes the stages of the process of building and configuring an attack detection mechanism based on data collection algorithms in wireless sensor networks and the use of machine learning methods. The analysis of possible types of data that need to be collected at the nodes of wireless sensor networks to detect attacks is carried out. The distinctive features of the proposed technique include the sets of features used that characterize specific types of attacking influences and allow detecting attacks with high values of the detection quality indicator. On the fragment of the hardware-software prototype of wireless sensor networks used in the work with an attack detection mechanism built into it, an experiment was conducted to check the quality of attack detection, confirming the correctness of the proposed technique.

Vulnerability analysis and modeling false data injection attack against voltage source converter in renewable generation power system

With the increasing penetration of renewable resources, more power electronic devices that need communication with control centers may bring a novel risk of cyber attacks. This paper investigates the vulnerability of the hierarchical control and proposes a false data injection attack (FDIA) constructing algorithm against voltage source converters. The attack can be accomplished via a physical attack generator or falsification via attacking supervisory control and data acquisition system. By developing the FDIA model against state estimation, the proposed attack model can circumvent bad data detection in the secondary control loop. The tests are carried out on a single converter infinite bus benchmark and an IEEE 34-bus system. The results show that the proposed attack model can mislead the system to produce threatening oscillation.

Modeling and assessing load redistribution attacks considering cyber vulnerabilities in power systems

Introduction: Load Redistribution (LR) attacks, as a common form of false data injection attack, have emerged as a significant cybersecurity threat to power system operations by manipulating load buses’ measurements at substations. Existing LR attack methods typically assume that any substation can be equally attacked, contributing to the analysis of LR attacks in power systems. However, the diversity of cyber vulnerabilities in substation communication links implies varying costs associated with falsifying load buses’ measurements. Thus, quantitatively evaluating these costs and analyzing the impact of LR attacks on power systems within cost constraints holds practical significance.Methods: In this paper, we employ a Bayesian attack graph model to characterize the intrusion process through cyber vulnerabilities. The costs of falsifying load buses’ measurements at substations are quantitatively evaluated using the mean time-to-compromise model. Subsequently, from the attacker’s perspective, we propose a bi-level optimization model for LR attacks, considering the mean time to compromise in conjunction with limited attack resources and power flow constraints.Results: Simulations conducted on the IEEE 14-bus system illustrate the influence of cyber vulnerabilities on LR attacks within power systems. Furthermore, we verify that the attack scenario of the existing LR attack model aligns with a case of the proposed bi-level LR attack model when there is sufficient attack time to compromise all communication links.Discussion: The findings of this research demonstrate that the impact of cyber vulnerabilities on LR attacks can be quantified by assessing the attack costs. Effective management of LR attacks can be achieved under cost constraints through optimization methods. These insights contribute to enhancing network security strategies for power systems, mitigating potential threats posed by LR attacks in power system operations.

Аналитический обзор подходов к обнаружению вторжений, основанных на федеративном обучении: преимущества использования и открытые задачи

To provide an accurate and timely response to different types of attacks, intrusion detection systems collect and analyze a large amount of data, which may include information with limited access, such as personal data or trade secrets. Consequently, such systems can be seen as an additional source of risks associated with handling sensitive information and breaching its security. Applying the federated learning paradigm to build analytical models for attack and anomaly detection can significantly reduce such risks because locally generated data is not transmitted to any third party, and model training is done locally - on the data sources. Using federated training for intrusion detection solves the problem of training on data that belongs to different organizations, and which, due to the need to protect commercial or other secrets, cannot be placed in the public domain. Thus, this approach also allows us to expand and diversify the set of data on which machine learning models are trained, thereby increasing the level of detectability of heterogeneous attacks. Due to the fact that this approach can overcome the aforementioned problems, it is actively used to design new approaches for intrusion and anomaly detection. The authors systematically explore existing solutions for intrusion and anomaly detection based on federated learning, study their advantages, and formulate open challenges associated with its application in practice. Particular attention is paid to the architecture of the proposed systems, the intrusion detection methods and models used, and approaches for modeling interactions between multiple system users and distributing data among them are discussed. The authors conclude by formulating open problems that need to be solved in order to apply federated learning-based intrusion detection systems in practice.

A Comprehensive Study on Cyber Attacks in Communication Networks in Water Purification and Distribution Plants: Challenges, Vulnerabilities, and Future Prospects.

In recent years, the Internet of Things (IoT) has had a big impact on both industry and academia. Its profound impact is particularly felt in the industrial sector, where the Industrial Internet of Things (IIoT), also known as Industry 4.0, is revolutionizing manufacturing and production through the fusion of cutting-edge technologies and network-embedded sensing devices. The IIoT revolutionizes several industries, including crucial ones such as oil and gas, water purification and distribution, energy, and chemicals, by integrating information technology (IT) with industrial control and automation systems. Water, a vital resource for life, is a symbol of the advancement of technology, yet knowledge of potential cyberattacks and their catastrophic effects on water treatment facilities is still insufficient. Even seemingly insignificant errors can have serious consequences, such as aberrant pH values or fluctuations in the concentration of hydrochloric acid (HCI) in water, which can result in fatalities or serious diseases. The water purification and distribution industry has been the target of numerous hostile cyber security attacks, some of which have been identified, revealed, and documented in this paper. Our goal is to understand the range of security threats that are present in this industry. Through the lens of IIoT, the survey provides a technical investigation that covers attack models, actual cases of cyber intrusions in the water sector, a range of security difficulties encountered, and preventative security solutions. We also explore upcoming perspectives, illuminating the predicted advancements and orientations in this dynamic subject. For industrial practitioners and aspiring scholars alike, our work is a useful, enlightening, and current resource. We want to promote a thorough grasp of the cybersecurity landscape in the water industry by combining key insights and igniting group efforts toward a safe and dependable digital future.

Simplified Modeling of MITM Attacks for Block Ciphers: New (Quantum) Attacks

The meet-in-the-middle (MITM) technique has led to many key-recovery attacks on block ciphers and preimage attacks on hash functions. Nowadays, cryptographers use automatic tools that reduce the search of MITM attacks to an optimization problem. Bao et al. (EUROCRYPT 2021) introduced a low-level modeling based on Mixed Integer Linear Programming (MILP) for MITM attacks on hash functions, which was extended to key-recovery attacks by Dong et al. (CRYPTO 2021). However, the modeling only covers AES-like designs. Schrottenloher and Stevens (CRYPTO 2022) proposed a different approach aiming at higher-level simplified models. However, this modeling was limited to cryptographic permutations.In this paper, we extend the latter simplified modeling to also cover block ciphers with simple key schedules. The resulting modeling enables us to target a large array of primitives, typically lightweight SPN ciphers where the key schedule has a slow diffusion, or none at all. We give several applications such as full breaks of the PIPO-256 and FUTURE block ciphers, and reduced-round classical and quantum attacks on SATURNIN-Hash.