Probability Of Attack Research Articles

Blockchain-Based Decentralized Replay Attack Detection for Large-Scale Power Systems

Large-scale power systems are composed of regional utilities with assets that stream sensor readings in real time. In order to detect cyberattacks, the globally acquired, real-time sensor data needs to be analyzed in a centralized fashion. However, owing to operational constraints, such a centralized sharing mechanism turns out to be a major obstacle. In this article, we propose a blockchain-based decentralized framework for detecting coordinated replay attacks with full privacy of sensor data. We develop a Bayesian inference mechanism employing locally reported attack probabilities that is tailor made for a blockchain framework. We compare our framework to a traditional decentralized algorithm based on the broadcast gossip framework both theoretically as well as empirically. With the help of experiments on a private Ethereum blockchain, we show that our approach achieves good detection quality and significantly outperforms gossip-driven approaches in terms of accuracy, timeliness, and scalability.

Comparison of the Most Important Models of Investments in Cyber and Information Security

Purpose of the article: Cyber security has become a key factor in determining the success or failure of companies that rely on information systems. However, this entails considerable investment. Typical investments in information technology aim to create value, while investments in cyber security aim to minimise losses caused by cyber-attacks. In the case of investment in cyber and information security, therefore, we must evaluate the amount of loss that will never actually occur. This is a complicated problem, and several approaches have been proposed over the years to estimate the cost-benefit balance of security investments.Methodology/methods: This paper is based on previous research (Podešva et al., 2021), where two most used methods of the ROI / ROSI (Bojanc, 2008) and Gordon-Loe model (Gordon, Loeb, 2002) were identified in the field of investments in cyber and information security. Both methods are described and the advantages and limitations for further research are identified.Scientific aim: The main goal is to select the most suitable method for further research in the field of investment in cyber and information security.Findings: ROI / ROSI does not seem suitable for further research because it only tells us what percentage of return on in-vestment will be provided during a given period. The separate use of this method (ROI / ROSI) provides us with very limited results and it is necessary to combine it with other methods. On the other hand, the Gordon-Loeb model is much more complex despite several limitations, especially for coefficients ʎ and t. Further research will therefore focus on the constant t (probability of attack on a given information set) and its value will be modelled based on the SIR epidemic model on network with standard incidents (Podešva, Koch 2019).Conclusions: At present, there is no standardised approach to decision-making and the size of investments in cyber and in-formation security. This is a very complex issue, and it is very difficult to find one universal model. Nevertheless, there are several models that help in this decision-making process, and as the most appropriate method for further research is Gordon Loe model

FedCC: Federated Learning with Consensus Confirmation for Byzantine Attack Resistance (Student Abstract)

In federated learning (FL), a server determines a global learning model by aggregating the local learning models of clients, and the determined global model is broadcast to all the clients. However, the global learning model can significantly deteriorate if a Byzantine attacker transmits malicious learning models trained with incorrectly labeled data. We propose a Byzantine-robust FL algorithm that, by employing a consensus confirmation method, can reduce the success probability of Byzantine attacks. After aggregating the local models from clients, the proposed FL server validates the global model candidate by sending the global model candidate to a set of randomly selected FL clients and asking them to perform local validation with their local data. If most of the validation is positive, the global model is confirmed and broadcast to all the clients. We compare the performance of the proposed FL against Byzantine attacks with that of existing FL algorithms analytically and empirically.

The concept of assessing the risks of cybersecurity of the information system of the critical infrastructure object

Ensuring cyber and information security for critical infrastructure is achieved through the implementation of an appropriate set of information security management measures, which can be provided in the form of software policies, methods, procedures, organizational structures and functions. Information security requirements are determined, in particular, by systematic risk assessment of information security, which can be one of the elements of the predicted approach to identifying hazards in the provision of services to service participants in the information interaction of the information system. The paper presents conceptual provisions for assessing and managing cybersecurity risks of the critical infrastructure information system. The proposed concept involves the definition of: areas of security threats to the information system; involved information assets and calculation of their value; assessment of the probability of attacks on the information system; assessment of the probability of success of attacks on the information system and more. Risk assessment methods are proposed that take into account the probability of success of an attack and the probability of an attack occurring, which makes it possible to eliminate the shortcomings inherent in known approaches and provide more accurate identification of attack methods associated with the attacker's behavior. The concept of cybersecurity risk assessment and the methodology for analyzing and assessing security threats that are presented in the work correspond to approaches to building risk-oriented information security management systems and can become the basis for developing an information security system in the information system of a critical infrastructure object.

Game Theoretic Physical Layer Authentication for Spoofing Detection in UAV Communications

In this paper, we propose a game theoretic framework for secure physical layer authentication (PLA) by applying the spatial correlations of received signal strength (RSS) in the air-to-ground channels between an unmanned aerial vehicle (UAV), a legitimate transmitter, and a spoofer. Based on our hypothesis model, we first derive the false alarm rate and miss detection rate for the UAV receiver. We then formulate a zero-sum PLA game where the UAV receiver selects its RSS detection threshold while the spoofer selects its attack probability to maximize their respective utilities. We derive the Nash equilibrium (NE) and its existence condition for the proposed PLA game. Monte Carlo simulation results accurately verify our analytical expressions for the false alarm rate and miss detection rate. Numerical results highlight the complex interplay between the detection threshold, spoofing attack probability and UAV altitude in the derived NE.

Toward Mobile Distributed Ledgers

Advances in mobile computing have paved the way for new types of distributed applications that can be executed solely by mobile devices on device-to-device (D2D) ecosystems (e.g., crowdsensing). Sophisticated applications, like cryptocurrencies, need distributed ledgers to function. Distributed ledgers, such as blockchains and directed acyclic graphs (DAGs), employ consensus protocols to add data in the form of blocks. However, such protocols are designed for resourceful devices that are interconnected via the Internet. Moreover, existing distributed ledgers are not deployable to D2D ecosystems since their storage needs are continuously increasing. In this work, we introduce and analyse Mneme, a DAG-based distributed ledger that can be maintained solely by mobile devices. Mneme utilizes two novel consensus protocols: Proof-of-Context (PoC) and Proof-of-Equivalence (PoE). PoC employs users’ context to add data on Mneme. PoE is executed periodically to summarize data and produce equivalent blocks that require less storage. We analyze Mneme’s security and justify the ability of PoC and PoE to guarantee the characteristics of distributed ledgers: persistence and liveness. Furthermore, we analyze potential attacks from malicious users and prove that the probability of a successful attack is inversely proportional to the square of the number of mobile users who maintain Mneme.

Intrusion prevention system using convolutional neural network for wireless sensor network

Now-a-days, there is exponential growth in the field of wireless sensor network. In wireless sensor networks (WSN’s), most of communication happen through wireless media hence probability of attacks increases drastically. With the help of intrusion prevention system, we can classify user activities into two categories, normal and suspicious activity. There is need to design effective intrusion prevention system by exploring deep learning for WSN. This research aims to deal with proposing algorithms and techniques for intrusion prevention system using deep packet inspection based on deep learning. In this, we have proposed deep learning model using convolutional neural network. The proposed model includes two steps, intrusion detection and intrusion prevention. The proposed model learns useful feature representations from large amount of labeled data and then classifies them. In this work, convolutional neural network is used to prevent intrusion for WSN. To evaluate and check the effectiveness of the proposed system, the wireless sensor network dataset (WSNDS) dataset is used and the tests are performed. The test results show that proposed system has an accuracy of 97% and works better than existing system. The proposed work can be used as future benchmark for the deep learning and intrusion prevention research communities.

Resilient sliding mode control of multiple autonomous underwater vehicles under stochastic DoS attack

This paper is concerned with the security sliding mode-based leader-following control of multiple autonomous unmanned underwater vehicles (AUVs) system subject to stochastic DoS attacks. Firstly, a Bernoulli variable is used to describe the phenomenon of stochastic DoS attacks between controllers and actuators, and the attack probability is known for controller design. Secondly, the closed-loop system is established by taking the integral sliding mode control scheme and stochastic DoS attacks into account. Then, the conditions of stochastic stability for system are given by using the stochastic systems analysis method and the model decomposition technique. In the simulation part, a group of AUVs models is used to verify the validity of the proposed state consensus control scheme. The simulation example shows that all the state can achieve consensus even in presence of randomly launched DoS attack.

Secure biometric hashing against relation-based attacks via maximizing min-entropy

With its irreversibility, low computational cost, and high storage efficiency, biometric hashing is widely used in privacy-preserving biometric recognition systems, yet its security has been recently challenged due to the emergence of relation-based attacks (RA). To address this issue, we model and analyse the RA, and discover that maximizing the conditional min-entropy of the signs of inter-class distance differences in the original space and hash space can minimize the leakage of the distance relation on the original biometric. Consequently, we develop a Secure Biometric Hashing scheme against Relation-Based Attacks (SBH-RA). SBH-RA maximizes the conditional min-entropy by using the cosine function as a distance mapping function. Meanwhile, it learns hash codes by a classification loss and quantization loss to ensure the accuracy of recognition. Our study demonstrates that SBH-RA not only offers higher security but also yields comparable or even superior recognition performance over existing biometric hashing methods experimentally and theoretically. Given 1024 bits hash codes from SBH-RA, it brings a decrease of 21% in Equal Error Rate on face dataset LFW compared with widely used Biohashing. Besides, even under white-box attacks, the probability of a successful attack is smaller than 1.69×2−346.

Beetle iridescence induces an avoidance response in naïve avian predators

It has recently been found that iridescence, a taxonomically widespread form of animal coloration defined by a change in hue with viewing angle, can act as a highly effective form of camouflage. However, little is known about whether iridescence can confer a survival benefit to prey postdetection and, if so, which optical properties of iridescent prey are important for this putative protective function. Here, we tested the effects of both iridescence and surface gloss (i.e. specular reflection) on the attack behaviour of prey-naïve avian predators. Using real and artificial jewel beetle, Sternocera aequisignata , wing cases, we found that iridescence provides initial protection against avian predation by significantly reducing the willingness to attack. Importantly, we found that the main factor explaining this aversion is iridescence, not multiple colours per se, with surface gloss also having an independent effect. Our results are important because they demonstrate that even when prey are presented up close and against a mismatching background, iridescence may confer a survival benefit by inducing hesitation or even, as sometimes observed, an aversion response in attacking birds. Furthermore, this means that even postdetection, prey do not necessarily need to have secondary defences such as sharp spines or toxins for iridescence to have a protective effect. Taken together, our results suggest that reduced avian predation could facilitate the initial evolution of iridescence in many species of insects and that it is the defining feature of iridescence, its colour changeability, that is important for this effect. • Iridescence and gloss are usually associated with display, but can they also defend? • We tested naïve birds' willingness to attack glossy and iridescent prey. • Iridescence reduced attack probability, with gloss also having an independent effect. • Iridescence and gloss could provide a survival benefit to prey, even postdetection.

Enhanced GNSS Spoofing Detector via Multiple-Epoch Inertial Navigation Sensor Prediction in a Tightly-Coupled System

Global navigation satellite system (GNSS) signals have open structure and weak power, which is vulnerable to spoofing attacks. The Innovation-based detection technique has been proved effective for spoofing detection in an integrated navigation system. However, it employs spoofed priori estimate of pseudorange to construct innovation, showing shortcomings like limited detection probability for slowly-varying spoofing attacks, long time to alarm (TTA), and high false alarm probability. This work proposes an enhanced innovation-based spoofing detector via multiple-epoch inertial navigation sensor (INS) prediction. An additional INS unit is added, which is corrected by extended Kalman Filter (EKF) every <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${N}$ </tex-math></inline-formula> epoch. Its output is used to replace the spoofed priori estimate in the EKF and then construct an improved innovation. Compared with the conventional innovation, the improved one can be immune to spoofing during multiple epochs and accumulate more abnormal energy due to spoofing attacks. In addition, an innovation bias mitigation method is presented, which exploits the mean of innovation of previous epochs to predict the immediate innovation bias and thus reduces the probability of false alarm. The overall spoofing detection performance is evaluated using both simulation data and hardware-based experiment data collected in Beihang university. A driving test was also carried out to verify its performance in complex urban conditions. Results show that the proposed detector significantly improves the detection performance under slowly-varying spoofing attacks and reduces the probability of false alarm compared with the conventional detector.

Stochastic Denial-of-Service Attack Allocation in Leader-Following Multiagent Systems

In this article, an intelligent attacker is considered, which aims to prevent leader-following multiagent systems from achieving consensus. The attacker randomly injects denial-of-service (DoS) attacks to some communication channels in the network, which make the corresponding attacked edges disconnected. The minimum number of communication channels needed to be jammed by the attacker to guarantee the system fails to achieve the consensus is provided based on the Max-Flow Min-Cut lemma and an algorithm to generate the minimum attacked edges is proposed. Furthermore, a lower bound and an upper bound of the attack probability to destroy the consensusability of the system are provided, respectively. Finally, numerical simulations are given to illustrate the results.

An experimental analysis of risk effects in attacker‐defender games

AbstractThis paper reports results of two‐person games in which a defender chooses between high and low alert states, and an attacker chooses whether to attack or wait. Low alerts and attacks are risky because successful attacks are costly for the defender and failed attacks are costly for the attacker. The Nash equilibrium, even allowing for risk aversion, has the stark property that a reduction in the attacker's cost has no effect on the attack probability. In contrast, high attack costs are associated with lower attack rates in a laboratory experiment conducted with monetary payoffs. The empirical analysis is focused on explaining strategic behavior as it is affected by risk aversion and behavioral “noise” in strategic best responses. A model incorporating both of these features outperforms others. Generalized comparative static results for changes in attack costs and risk aversion are proved in the context of a nonparametric quantal response equilibrium.

Provable training of a ReLU gate with an iterative non-gradient algorithm

In this work, we demonstrate provable guarantees on the training of a single ReLU gate in hitherto unexplored regimes. We give a simple iterative stochastic algorithm that can train a ReLU gate in the realizable setting in linear time while using significantly milder conditions on the data distribution than previous such results.Leveraging certain additional moment assumptions, we also show a first-of-its-kind approximate recovery of the true label generating parameters under an (online) data-poisoning attack on the true labels, while training a ReLU gate by the same algorithm. Our guarantee is shown to be nearly optimal in the worst case and its accuracy of recovering the true weight degrades gracefully with increasing probability of attack and its magnitude.For both the realizable and the non-realizable cases as outlined above, our analysis allows for mini-batching and computes how the convergence time scales with the mini-batch size. We corroborate our theorems with simulation results which also bring to light a striking similarity in trajectories between our algorithm and the popular S.G.D. algorithm — for which similar guarantees as here are still unknown.

Forensic Analysis on Internet of Things (IoT) Device Using Machine-to-Machine (M2M) Framework

The versatility of IoT devices increases the probability of continuous attacks on them. The low processing power and low memory of IoT devices have made it difficult for security analysts to keep records of various attacks performed on these devices during forensic analysis. The forensic analysis estimates how much damage has been done to the devices due to various attacks. In this paper, we have proposed an intelligent forensic analysis mechanism that automatically detects the attack performed on IoT devices using a machine-to-machine (M2M) framework. Further, the M2M framework has been developed using different forensic analysis tools and machine learning to detect the type of attacks. Additionally, the problem of an evidence acquisition (attack on IoT devices) has been resolved by introducing a third-party logging server. Forensic analysis is also performed on logs using forensic server (security onion) to determine the effect and nature of the attacks. The proposed framework incorporates different machine learning (ML) algorithms for the automatic detection of attacks. The performance of these models is measured in terms of accuracy, precision, recall, and F1 score. The results indicate that the decision tree algorithm shows the optimum performance as compared to the other algorithms. Moreover, comprehensive performance analysis and results presented validate the proposed model.

A Reputation Game on Cyber-Security and Cyber-Risk Calibration

To analyze strategic interactions arising in the cyber-security context, we develop a new reputation game model in which an attacker can pretend to be a normal user and a defender may have to announce attack detection at a certain point of time without knowing whether he has been attacked. We show the existence and uniqueness of sequential equilibrium in Markov strategies, and explicitly characterize the players’ equilibrium strategies. Using our model, we suggest empirical and theoretical ways of calibrating the attack probability, which is an important element of cyber-risks.

A quality of service‐aware high‐security architecture design for software‐defined network powered vehicular ad‐hoc networks using machine learning‐based blockchain routing

AbstractSoftware‐defined networks (SDNs) have proven to be highly flexible for vehicular ad‐hoc network (VANET) routing. This is due to packet‐level and bandwidth‐level controls available with SDNs. But SDNs have inherent security issues which include forwarding device attacks, control plane threats, communication channel vulnerability, etc. To counter these attacks, this paper initially proposes a proof‐of‐work‐based blockchain framework that can reduce attack probability by 99%. But, the overall network quality of service (QoS) reduces in terms of end‐to‐end delay, energy consumption, and throughput. To improve these parameters and maintain a high level of security, this work proposes a machine‐learning algorithm that optimizes blockchain parameters in a QoS‐aware manner. These parameters include selected chain length, encryption block length, etc. The machine learning algorithm is inspired by Q‐Learning and aims at reducing the performance effect of blockchain operations on the overall QoS of VANETs. Thus, the underlying network uses sidechain‐based blockchain implementation, which makes it faster, more secure, and less complex when compared with single‐chain implementations. Upon observing the results, it is seen that the proposed architecture can reduce the end‐to‐end delay by 15%, energy consumption by 18%, and increase overall throughput by 38% when compared with existing blockchain‐based SDN VANET architectures.

Assessment of Cybersecurity Risks: Maritime Automated Piloting Process

A modern society is a combination of several critical infrastructures, of which international and national maritime transportation systems are essential parts. Digitalization makes it possible to increase levels of autonomy in maritime systems. It also means fully existing cyberenvironments in maritime processes. In cyberenvironments, it is crucial there is trustable information communication between system elements of the process, alongside the usability, reliability, and integrity of systems data in the operating environment. In order to develop maritime autonomy in Finland the Sea4Value / Fairway (S4VF) research program has been developed. At the first stage of the program, the main goal is to create automated fairway piloting feature in the near future. An automated remote piloting process, “ePilotage,” will be a complex system of systems entity. This paper provides a research approach to investigating the cybersecurity risks at the system levels of process. It emphasizes the importation of comprehensive risk assessment to increase the cybersecurity of fairway operations. The findings of the study are located in cybersecurity risks in critical information flows between the main system blocks of the fairway process. The research question is “How can the cybersecurity risks of automated remote fairway operations be evaluated?” The main findings are related to the probabilities of the risks in all levels of process stakeholders’ responsibilities. Risk assessment methodology, that has been described, is based on attack probabilities against probabilities to defend actions of adversarial in use of communication technologies. Risks assessment factors have been identified and the risk assessment tool have been proposed.

Denial-of-Service Attacks Pre-Emptive and Detection Framework for Synchrophasor Based Wide Area Protection Applications

Synchrophasor technology has been very effective in addressing complex protection problems. Based on the experimental study of the impact of denial-of-service (DoS) cyberattacks on synchrophasor-assisted protection scheme, “adaptive dependability/security bias protection scheme,” a DoS pre-emptive and detection framework is presented in this article. The suggested structure helps in the identification of different types of DoS attacks (targeting data availability) and address resolution protocol (ARP) spoofing (compromising data confidentiality) via unique fingerprints developed using Wireshark network data. Redundant PDC datastream and random data path selector module (RDPS) in the framework help reduce the probability of a successful DoS attack. However, during a successful attack, the framework ensures that a healthy PDC datastream is used by the end application. The proposed methodology's efficacy has been verified using a western system coordinating council 9 bus, and IEEE 39 bus test systems on the real-time digital simulator (RTDS) based cyberphysical wide area measurement system testbed with industrial standard hardware phasor measurement units (PMUs). The results show that the proposed framework can effectively improve the performance of the synchrophasor-based adaptive dependability/security bias scheme during DoS attacks and avoid maloperation of the protective devices, which enhances the power system's stability.

Blood trail of expansion? Long‐term patterns of livestock depredation by wolves in Poland

AbstractAs the wolf Canis lupus populations continue to recover across Europe, livestock depredation becomes increasingly challenging for their effective conservation. We aim to (1) analyze the spatiotemporal variation in wolf attacks on livestock in relation to the landscape structure, livestock species, and the phase of wolf expansion in Poland and (2) discuss the implications for conservation and management in an expanding, protected wolf population. From 2008 to 2018, farmers reported 5499 attacks on livestock with 13,164 killed individuals, and the number of attacks increased 2.7‐fold at the country scale. Sheep were among the most frequently killed livestock, and surplus killing (&gt;2 killed individuals) was relatively common in captive deer and sheep depredation. The attacks were patchily distributed; 59% of all kills occurred in municipalities constituting 1% of the country surface. The probability and number of attacks were positively influenced by forest and pasture cover, and by the occurrence of depredation in previous years. Spatial variation and long‐term dynamics in livestock depredation by wolves can be attributed to different husbandry practices and phases of wolf recovery in three regions of the country. Our results indicate that accelerating increase in depredation rates during the initial phases of wolf recovery is likely to be followed by stabilization or decrease in attacks. A detailed spatiotemporal analysis of wolf–livestock conflict can help in management decisions in areas with ongoing wolf population recovery.