Attack Patterns Research Articles

Dynamic Data Abstraction-Based Anomaly Detection for Industrial Control Systems

Industrial control systems (ICS) are critical networks directly linked to the value of core national and societal assets, yet they are increasingly becoming primary targets for numerous cyberattacks today. The ICS network, a fusion of operational technology (OT) and information technology (IT) networks, possesses a broad attack vector, and attacks targeting ICS often take the form of advanced persistent threats (APTs) exploiting zero-day vulnerabilities. However, most existing ICS security techniques have been adaptations of security technologies for IT networks, and security measures tailored to the characteristics of ICS data are currently insufficient. To mitigate cyber threats to ICS networks, this paper proposes an anomaly detection technique based on dynamic data abstraction. The proposed method abstracts ICS data collected in real time using a dynamic data abstraction technique based on noise reduction. The abstracted data are then used to optimize both the update rate and the detection accuracy of the anomaly detection model through model adaptation and incremental learning processes. The proposed approach updates the model by quickly reflecting data on new attack patterns and their distributions, effectively shortening the dwell time in response to APTs utilizing zero-day vulnerabilities. We demonstrate the attack response performance and detection accuracy of the proposed dynamic data abstraction-based anomaly detection technique through experiments using the SWaT dataset generated from a testbed of an actual ICS process. The experiments show that the proposed model achieves high accuracy with a small number of abstracted data while rapidly learning new attack pattern data in real-time without compromising accuracy. The proposed technique can effectively respond to cyberattacks targeting ICS by quickly learning and reflecting trends in attack patterns that exploit zero-day vulnerabilities.

Times of trouble—seasonal variation in number and severity of attacks on sheep caused by large carnivores and eagles in Sweden

Wildlife managers and livestock owners can choose from a multitude of interventions to prevent carnivore attacks on domestic animals, ranging from light and sound deterrents to fencing and lethal control. To guide management and make the best and most cost-effective choice of interventions, knowledge about where and when these measures are needed the most is important. By identifying spatiotemporal patterns of carnivore attacks, resources can be used more efficiently to prevent such attacks. We used a Swedish nationwide, long-term data set to identify inter- and intra-seasonal variation in probability, number, and severity (number of killed or injured per attack) of large carnivore attacks on sheep. Our results show that there are specific “times of trouble”, regarding the number of attacks from golden eagle (Aquila chrysaetos) in late spring, and from brown bears (Ursus arctos), lynx (Lynx lynx), and wolves (Canis lupus) in late summer. Additionally, for brown bears and wolves, the severity of attacks varied throughout the grazing season with a peak in the latter part of the summer. The results can be used for guidance of temporal prioritisation of preventive interventions to reduce the probability, number, and severity of large carnivore attacks on sheep.

Patterns of neuromyelitis optica spectrum disorder attacks in different age groups and sexes depending on the status of immunosuppressive therapy: A retrospective cohort study.

The association between onset age and sex with relapse risk in neuromyelitis optica spectrum disorder (NMOSD) remains inconclusive. We aimed to describe the clinical features of patients with NMOSD in different age groups and sexes and to analyse relapse characteristics pre- and post-immunosuppressive therapy (IST). Patients with NMOSD were retrospectively reviewed from our clinical centre's database. Demographic and clinical data, attack presentation, and disease course pre- and post-IST were investigated. We also analysed the effect of onset age on the annualized relapse rate and relapse risk according to sex and IST status. Interactions on the additive scale between onset age and sex were analysed. A restricted cubic spline was used to analyse potential nonlinear correlations. Longitudinal changes in the Expanded Disability Status Scale score across NMOSD attacks were analysed using linear mixed-effect models. In total, 533 patients experienced 1394 attacks pre-IST and 753 relapses post-IST. Older age at onset was correlated with more myelitis attacks but fewer optic neuritis attacks, with no sex-related differences in attack presentation. Pre-IST, relapse risk increased with age at onset in women, while a U-shaped correlation between onset age and relapse risk was found in men. Post-IST, an inverted U-shaped association between the predicted relapse risk and onset age was observed in women. Conversely, a negative correlation between the predicted relapse risk and onset age was found in men. Overall, a higher ratio of myelitis attacks was found post-IST. Patients of different onset ages and sexes had different relapse patterns before and after IST.

ConLBS: An Attack Investigation Approach Using Contrastive Learning with Behavior Sequence.

Attack investigation is an important research field in forensics analysis. Many existing supervised attack investigation methods rely on well-labeled data for effective training. While the unsupervised approach based on BERT can mitigate the issues, the high degree of similarity between certain real-world attacks and normal behaviors makes it challenging to accurately identify disguised attacks. This paper proposes ConLBS, an attack investigation approach that combines the contrastive learning framework and multi-layer transformer network to realize the classification of behavior sequences. Specifically, ConLBS constructs behavior sequences describing behavior patterns from audit logs, and a novel lemmatization strategy is proposed to map the semantics to the attack pattern layer. Four different augmentation strategies are explored to enhance the differentiation between attack and normal behavior sequences. Moreover, ConLBS can perform unsupervised representation learning on unlabeled sequences, and can be trained either supervised or unsupervised depending on the availability of labeled data. The performance of ConLBS is evaluated in two public datasets. The results show that ConLBS can effectively identify attack behavior sequences in the cases of unlabeled data or less labeled data to realize attack investigation, and can achieve superior effectiveness compared to existing methods and models.

Patient outcomes associated with subcutaneous C1INH prophylaxis for hereditary angioedema: a retrospective analysis

BackgroundReal-world data on subcutaneous C1INH (C1INH[SC]) usage and patient-level impacts on hereditary angioedema (HAE)-related outcomes and quality of life (QoL) are both lacking and challenging to generate using conventional study methodologies. Using a hybrid study design involving patient interviews supplemented by retrospective medical chart data review, we conducted a real-world assessment of the impact of C1INH(SC) prophylaxis on HAE attack patterns, QoL, and on-demand medication use.MethodsThe study was conducted at seven US sites and included 36 adults with HAE who had been treated with C1INH(SC) long-term prophylaxis following ≥ 12 months of on-demand management only. Patients underwent 30-min interviews, facilitated and analyzed by a trained qualitative research specialist. Medical records were reviewed for 12 months before (pre-index) and after (post-index) initiation of C1INH(SC). Using interview data with descriptive terms converted to numerical values, we compared pre- versus post-index attack frequency, severity, and rescue medication usage.ResultsMean (SD) annualized attack frequency per patient decreased 82.0%, from 38.8 (38.8) attacks/year pre-index to 7.0 (15.3) attacks/year (P < 0.001); the median number of attacks decreased by 97.0% (30 pre-index to 1 post-index). For 20 patients, the annualized attack rate after starting C1INH(SC) prophylaxis was ≤ 1 attack/year; 12 of these patients reported 0 attacks. Mean (SD) attack severity (scale: 0 = none/mild to 4 = very severe) decreased from 2.3 (0.7) pre-index to 0.9 (0.9) post-index (P < 0.001). Mean/median rescue medication use decreased by 77.2%/96.3%. Improved QoL was narratively described for many domains.ConclusionsThese real-world findings indicate that long-term prophylaxis with C1INH(SC) markedly improves important factors that contribute to the goal of achieving total disease control and normalization of patients’ lives, including fewer and less severe attacks, less rescue medication usage, and improved QoL.

Predicting new hackers’ criminal careers: A group-based trajectory approach

The current study employs group-based trajectory modeling to assess the longitudinal attack patterns of new hackers involved in website defacement. Specifically, we track the activity of 241 emergent hackers for one year following their first verified website defacement. In doing so, we find four distinct criminal trajectories: low threat (29.0%), naturally desisting (26.5%), increasingly prolific (22.3%), and persistent threat (22.1%). Hackers classified as low threats engage in few defacements, whereas persistent threats engage in high-frequency attacks. Those labeled as naturally desisting begin their careers with velocity but become less prolific with time. Conversely, those classified as increasingly prolific engage in more attacks as they advance in their criminal careers. Using a series of regression models, we find that digital artifacts and open-source intelligence are predictive of group involvement. The findings presented in this study contribute to our theoretical understanding of the developmental trajectories of hackers, while providing valuable insights in fostering targeted intervention strategies aimed at effectively mitigating and preventing cyber-attacks.

A Geographic Information System (GIS)-Based Investigation of Spatiotemporal Characteristics of Pirate Attacks in the Maritime Industry

A Geographic Information System (GIS)-Based Investigation of Spatiotemporal Characteristics of Pirate Attacks in the Maritime Industry

Impact of computer users on cyber defense strategies

AbstractCybersecurity research often focuses primarily or exclusively on the interactions between the attacker, trying to exploit the computer system, and the defender, trying to protect it. However, including the computer users is important because the users’ requirements are the reason the computer system exists.An extension of the Petri net formalism, Petri Nets with Players, Strategies, and Costs (PNPSC) was used to model cyberattacks described in the MITRE Common Attack Pattern Enumeration and Classification database. PNPSC models include the attacker, defender, and computer user as “players” attempting to achieve competing goals. Each player can observe the current marking of a subset of the PNPSC net's places and change the stochastic firing rates of a subset of the net's transitions in order to achieve their goals. A mapping between the markings of a player's observable places and the desired firing rates of player's controllable transitions is the player's strategy.A reinforcement learning algorithm was integrated with PNPSC models of three cyberattack patterns to learn strategies for the defender in simulations both with and without a representation of the computer user. A simulation experiment showed that the defender's reward was lower and the defender's learned strategy was different when the user was represented. A second simulation experiment and statistical analysis confirmed that the differences were not due simply to randomness. With the user represented, the system defender must balance security against usability. This research provides a more complete cyberattack model and shows that user models are important in future cybersecurity simulation.

Deep Forest-Based E-Commerce Recommendation Attack Detection Model

With the advancement of Internet, recommendation systems have become an indispensable component for every e-commerce platform, playing an increasingly pivotal role in product recommendations. However, due to the recommendation mechanisms of these systems, numerous new attack patterns have emerged. A novel attack pattern targeting e-commerce recommendation systems, termed the “Ride Item’s Coattails” attack, fabricates false click information to deceitfully establish associations between popular products and low-quality products, intending to mislead the e-commerce platform’s recommendation system and promote the sales of substandard products. This article presents a recommendation system attack detection method based on the Deep Forest algorithm to address the challenges of these novel recommendation system attacks. Random forests are used for feature selection, aiming to filter crucial features and reduce feature redundancy. To tackle the issue of extreme class imbalance, a symmetric sampling technique based on k-means centroids is introduced. This approach addresses the incomplete noise filtering and sampling data comprehensiveness issues commonly found in undersampling algorithms. Considering the potential for even more imbalanced data in real-world scenarios, a combined strategy of undersampling and SMOTE resampling is used to handle imbalanced data. The proposed algorithm was trained on e-commerce “Ride Item’s Coattails” attack identification data from Alibaba Cloud’s Tianchi, which originates from genuine recommendation system attack data. The proposed method was compared with various deep learning and machine learning algorithms, such as DLMP and deep neural networks (DNN), for extensive validation. Experiments demonstrate that the proposed technique effectively meets the demands for attack detection.

CAPEC ontology

CAPEC is an effort coordinated by MITRE Corporation. Its aim is attack pattern database structured in taxonomies. CAPEC is available as XML document from its project site. CAPEC structure and content are under permanent change and development. It is still not mature database but may be never will.CAPEC, CWE, and CVE are databases devoted to attacks, weaknesses, and vulnerabilities. They refer each other forming a knowledge ecosystem in cybersecurity area.Traditional approach for knowledge presentation as information does not work well with conceptualizations under dynamics of this ecosystem and particularly of CAPEC. In this paper an alternative approach to CAPEC knowledge presentation is proposed, as ontology. First, CAPEC structure and content are discussed and then ontology structure is introduced. CAPEC as ontology opens doors to ``open world'' concept that is more adequate to ecosystem dynamics.

Enzymatic degradation of poly(ethylene terephthalate) (PET): Identifying the cause of the hypersensitive enzyme kinetic response to increased PET crystallinity

Plastic pollution poses a significant environmental challenge, with poly(ethylene terephthalate) (PET) being a major contributor due to its extensive use in single use applications such as plastic bottles and other packaging material. Enzymatic degradation of PET offers a promising solution for PET recycling, but the enzyme kinetics in relation to the degree of crystallinity (XC) of the PET substrate are poorly understood. In this study, we investigated the hypersensitive enzyme kinetic response on PET at XC from ∼8.5–12% at 50 °C using the benchmark PET hydrolysing enzyme LCCICCG. We observed a substantial reduction in the maximal enzymatic reaction rate (invVmax) with increasing XC, corresponding to a 3-fold reduction in invVmax when the XC of PET increased from 8.6% to 12.2%. The kinetic analysis revealed that the level of the Mobile Amorphous Fraction (XMAF) was a better descriptor for the enzymatic degradation rate response than XC (or (100%-XC)). By continuous monitoring of the enzymatic reaction progress, we quantified the lag phase prolongation in addition to the steady-state kinetic rates (vss) of the reactions and found that the duration of the lag phase of a reaction could be predicted from the vss and XC by multiple linear regression modeling. The linear correlation between the duration of the lag phase and the vss of the enzymatic PET degradation affirmed that the LCCICCG worked via a random/endo-type enzymatic attack pattern. The longer lag phase at increased XC of PET is proposed to be due to increased substrate entanglement density as well as unproductive enzyme binding to the crystalline regions of PET. The findings enhance our understanding of PET enzymatic degradation kinetics and its dependence on substrate composition, i.e., XMAF and XC.

A Hybrid Classification Framework for Network Intrusion Detection with High Accuracy and Low Latency

Network intrusion detection (NIDS) is a crucial task aimed at safeguarding computer networks against malicious attacks. Traditional NIDS methods can be categorized as either misuse-based or anomaly-based, each having its unique set of limitations. Misuse-based approaches excel in identifying known attacks but fall short when dealing with new or unidentified attack patterns. On the other hand, anomaly-based methods are more adept at identifying novel attacks but tend to produce a substantial number of false positives. To enhance the overall performance of NIDS systems, hybrid classification techniques are employed, leveraging the strengths of both misuse-based and anomaly-based methods. In this research, we present a novel hybrid classification approach for NIDS that excels in both speed and accuracy. Our approach integrates a blend of machine learning algorithms, including decision trees, support vector machines, and deep neural networks. We conducted comprehensive evaluations of our approach using various network intrusion datasets, achieving state-of-the-art results in terms of accuracy and prediction speed.

Attack Hypotheses Generation Based on Threat Intelligence Knowledge Graph

Cyber threat intelligence on past attacks may help with attack reconstruction and the prediction of the course of an ongoing attack by providing deeper understanding of the tools and attack patterns used by attackers. Therefore, cyber security analysts employ threat intelligence, alert correlations, machine learning, and advanced visualizations in order to produce sound attack hypotheses. In this paper, we present AttackDB, a multi-level threat knowledge base that combines data from multiple threat intelligence sources to associate high-level ATT&CK techniques with low-level telemetry found in behavioral malware reports. We also present the Attack Hypothesis Generator which relies on knowledge graph traversal algorithms and a variety of link prediction methods to automatically infer ATT&CK techniques from a set of observable artifacts. Results of experiments performed with 53K VirusTotal reports indicate that the proposed algorithms employed by the Attack Hypothesis Generator are able to produce accurate adversarial technique hypotheses with a mean average precision greater than 0.5 and area under the receiver operating characteristic curve of over 0.8 when it is implemented on the basis of AttackDB. The presented toolkit will help analysts to improve the accuracy of attack hypotheses and to automate the attack hypothesis generation process.

Magnets to Adversaries—An Analysis of the Attacks on Public Cloud Servers

Security adversaries are always constantly looking for targets to exploit. The mechanism of exploitation used by security adversaries varies significantly. Many focus on easy compromises as mere pivots to extend their attacks from these exploited systems to continue accomplishing their original goals. The cloud environment is a highly susceptible target for adversaries and provides a solid mechanism for observing adversary behavior. The sheer volume of attacks on the cloud provides insights into the attacker’s objectives and attack patterns, which can be leveraged for protecting infrastructure. This work deep dives into the practices used by adversaries on the commonly exposed protocols in the Amazon Web Services (AWS), Microsoft Azure (Azure), Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) platforms. A robust honeypot model is documented that compares attacker behavior across various ports and protocols running in multiple cloud environments. This work illustrates that adversary activity is highly versatile in the public cloud environment, with an average of 700 new and unique IP addresses found attacking honeypot infrastructure daily. Further, this article illustrates the security safeguards a typical organization can leverage to mitigate the threats from these adversaries constantly probing insecure targets on the cloud platform.

Integrating machine learning detection and encrypted control for enhanced cybersecurity of nonlinear processes

This study presents an encrypted two-tier control architecture integrated with a machine learning (ML) based cyberattack detector to enhance the operational safety, cyber-security, and performance of nonlinear processes. The upper tier of this architecture employs an encrypted nonlinear Lyapunov-based model predictive controller (LMPC) to enhance closed-loop performance, while the lower tier utilizes an encrypted set of linear controllers to stabilize the process. Encrypted signals from the sensors are decrypted at the upper tier for plain text control input computation, while the lower tier computes control inputs in an encrypted space, due to its exclusive use of linear operations. While this design enhances closed-loop performance, it exposes the upper tier to potential cyberattacks. To mitigate this risk, an ML-based detector is developed in the form of a feed-forward neural network, utilizing sensor-derived data for attack detection. Upon attack detection, the control system logic deactivates the performance-enhancing upper tier and relies solely on the cybersecure lower tier for system stabilization. The study also includes a comprehensive stability analysis of the two-tier control structure, establishing error bounds related to quantization and sample-and-hold controller implementations. The proposed control framework can be extended to any nonlinear process that is controlled by a combination of linear and nonlinear controllers to enhance the system cybersecurity. Guidelines such as quantization parameter selection, cyberattack detector development, and sampling time criteria are included to facilitate practical implementation. Simulation results of a nonlinear chemical process network demonstrated the robustness of the encrypted control architecture and cyberattack detector, as well as its ability to detect previously unseen attack patterns.

Observer Design for Detection of Attack Patterns in Cyber-Physical Systems

This article focuses on the design of a Luenberger structure observer with residual generation for the detection of different attack schemes (Denial of Service (DoS) and False Data Injection (FDI)) targeting the sensors and actuators of a discrete cyber-physical system. To simulate a more realistic attack signal, Markovian distribution logic is used to simulate the behavior of the signals. To demonstrate the effectiveness of the proposed scheme, a system of three interconnected tanks is used.

FL-CTIF: A federated learning based CTI framework based on information fusion for secure IIoT

Industrial Internet of Things (IIoT) are evolving and transitioning into virtual entities supported by digital twin technology to optimize existing processes further and improve their efficiency. The virtual representation of the several IIoT departments, such as manufacturing process, packaging, warehousing, and logistics enables predictive maintenance for optimizing local material resources for manufacturing and packaging, improved warehouse space allocation, and delivery schedule optimization. The high volume of data generated from IoT devices are exposed to cyber-attacks using modern attack vectors and thus threaten both physical IIoT environment and its digital twins. Existing intrusion detection systems focus on identifying anomalous traffic using obsolete knowledge of cyber-attack patterns for several attacks, such as ARP poisoning man-in-the-middle attacks, SSL-based attacks using encrypted traffic, and DNS flood-based DDoS traffic. A lack of focus on security using updated and comprehensive Cyber Threat Intelligence (CTI) threatens the security of the IIoT environment. In this paper, we present a Federated Learning based CTI framework based on Information Fusion (FL-CTIF) for securing IIoT environments. We design a comprehensive cyberattack dataset with updated feature selection using Information Fusion to improve the accuracy in identifying cyber-attacks. A federated learning-based ANN model is designed to reduce the model training rounds based on satisfaction level and measure the absence of improvement in each attack vector's average accuracy. The model is evaluated based on model aggregation performance and demonstrates an improved F1 score based on reduced training rounds and reduced CPU consumption. The federated learning model improves accuracy and reduces the false positive rate using the newly merged dataset compared to existing research.

An Ensemble of Text Convolutional Neural Networks and Multi-Head Attention Layers for Classifying Threats in Network Packets

Using traditional methods based on detection rules written by human security experts presents significant challenges for the accurate detection of network threats, which are becoming increasingly sophisticated. In order to deal with the limitations of traditional methods, network threat detection techniques utilizing artificial intelligence technologies such as machine learning are being extensively studied. Research has also been conducted on analyzing various string patterns in network packet payloads through natural language processing techniques to detect attack intent. However, due to the nature of packet payloads that contain binary and text data, a new approach is needed that goes beyond typical natural language processing techniques. In this paper, we study a token extraction method optimized for payloads using n-gram and byte-pair encoding techniques. Furthermore, we generate embedding vectors that can understand the context of the packet payload using algorithms such as Word2Vec and FastText. We also compute the embedding of various header data associated with packets such as IP addresses and ports. Given these features, we combine a text 1D CNN and a multi-head attention network in a novel fashion. We validated the effectiveness of our classification technique on the CICIDS2017 open dataset and over half a million data collected by The Education Cyber Security Center (ECSC), currently operating in South Korea. The proposed model showed remarkable performance compared to previous studies, achieving highly accurate classification with an F1-score of 0.998. Our model can also preprocess and classify 150,000 network threats per minute, helping security agents in the field maximize their time and analyze more complex attack patterns.

A Framework for Synthetic Agetech Attack Data Generation

To address the lack of datasets for agetech, this paper presents an approach for generating synthetic datasets that include traces of benign and attack datasets for agetech. The generated datasets could be used to develop and evaluate intrusion detection systems for smart homes for seniors aging in place. After reviewing several resources, it was established that there are no agetech attack data for sensor readings. Therefore, in this research, several methods for generating attack data were explored using attack data patterns from an existing IoT dataset called TON_IoT weather data. The TON_IoT dataset could be used in different scenarios, but in this study, the focus is to apply it to agetech. The attack patterns were replicated in a normal agetech dataset from a temperature sensor collected from the Information Security and Object Technology (ISOT) research lab. The generated data are different from normal data, as abnormal segments are shown that could be considered as attacks. The generated agetech attack datasets were also trained using machine learning models, and, based on different metrics, achieved good classification performance in predicting whether a sample is benign or malicious.

Detection of application-layer DDoS attacks using machine learning and genetic algorithms

Application-layer Distributed Denial of Service (App-DDoS) attacks continue to be a pervasive problem in cybersecurity, despite the availability of various defensive frameworks. This research addresses the challenges associated with App-DDoS detection and presents a highly effective and adaptable solution for detecting various types of App-DDoS attacks. Motivated by the critical need for improved DDoS detection, our approach achieves dual objectives by accurately detecting both known and unknown DDoS attacks while minimizing false alarms. To achieve this, we combine Random Forest (RF), Gaussian Mixture Models (GMM) and a human with expertise in DDoS to enhance the system's resilience against evolving attack patterns. Furthermore, we prioritize high-quality data curation by utilizing multiple datasets, CICIDS2017 and CICDDoS2019, and incorporating GMM to adapt effectively to varying data distributions over time. In addition, we propose a comprehensive feature selection strategy that addresses the false alarm rate and improves classifier performance by utilizing decision tree (DT) feature importance and the minimum redundancy maximum relevance (MRMR) approach. Moreover, we adopt genetic algorithms (GA) for automated hyper-parameter optimization to ensure efficient and effective DDoS detection. Quantitative analysis shows a significant reduction in false alarms to 0.12% (52 out of 45,149 samples), with the RF classifier achieving outstanding accuracy (99.9%), precision (100%), recall (99.8%), and F1 score (99.9%). Handling unknown App-DDoS attacks, our approach demonstrates remarkable performance across all datasets.