Attack Resources Research Articles

What Makes Bureaucracies Politically Resilient? Evidence from Brazil’s Covid‐19 Vaccination Campaign

This article sheds new light on the drivers of bureaucratic resilience in the face of presidential attacks, an understudied but politically salient topic. Scholars have long shown how political advocacy can protect bureaucracies from presidential attacks on policy regulation. We argue, however, that advocacy is insufficient to defend bureaucracies against attacks on policy implementation, which occurs largely outside the formal political arena. Through a case study of Brazil’s successful Covid‐19 vaccination campaign, we call attention to two additional forms of support for agencies under attack–resource provision and social activism–that come into play during the implementation phase of policy. In conjunction with political advocacy, resource provision and social activism bolster bureaucracies under attack by filling in where other forms of support fall short.

Three-layer and robust planning models to evaluate the strategies of defense layer, attack layer, and operation layer for optimal protection in natural gas pipeline network

Using game theory techniques, a three-layer planning model (THLPM) for the defense, attack, and operational layers has been established to address malicious damage to pipelines. A robust planning model was developed for situations with uncertain attack resources. In this model, the defense layer protects critical infrastructure within the network to minimize losses. The attack layer targets unprotected facilities based on the defensive strategy. The operational layer formulates the optimal pipeline transmission strategy based on the decisions of the defense and attack layers. By utilizing the duality theorem, the THLPM is transformed into a two-layer planning problem, which is then linearized and solved using a decomposition algorithm. Taking a specific ring-shaped pipeline network as an example, the study analyzes the significant role of backup pipelines in enhancing system resilience and evaluates the offensive and defensive strategies of THLPM. The effectiveness of THLPM in protecting the network was assessed, showing that when defense and attack resources are invested at levels 3 and 10, respectively, operational costs of the network are reduced by 54.2 % compared to a scenario without any defenses. The methods proposed in this paper are applicable to other pipeline systems.

Modeling and assessing load redistribution attacks considering cyber vulnerabilities in power systems

Introduction: Load Redistribution (LR) attacks, as a common form of false data injection attack, have emerged as a significant cybersecurity threat to power system operations by manipulating load buses’ measurements at substations. Existing LR attack methods typically assume that any substation can be equally attacked, contributing to the analysis of LR attacks in power systems. However, the diversity of cyber vulnerabilities in substation communication links implies varying costs associated with falsifying load buses’ measurements. Thus, quantitatively evaluating these costs and analyzing the impact of LR attacks on power systems within cost constraints holds practical significance.Methods: In this paper, we employ a Bayesian attack graph model to characterize the intrusion process through cyber vulnerabilities. The costs of falsifying load buses’ measurements at substations are quantitatively evaluated using the mean time-to-compromise model. Subsequently, from the attacker’s perspective, we propose a bi-level optimization model for LR attacks, considering the mean time to compromise in conjunction with limited attack resources and power flow constraints.Results: Simulations conducted on the IEEE 14-bus system illustrate the influence of cyber vulnerabilities on LR attacks within power systems. Furthermore, we verify that the attack scenario of the existing LR attack model aligns with a case of the proposed bi-level LR attack model when there is sufficient attack time to compromise all communication links.Discussion: The findings of this research demonstrate that the impact of cyber vulnerabilities on LR attacks can be quantified by assessing the attack costs. Effective management of LR attacks can be achieved under cost constraints through optimization methods. These insights contribute to enhancing network security strategies for power systems, mitigating potential threats posed by LR attacks in power system operations.

Complete stealthiness false data injection attack design in multisensor systems with attack resource constraints

AbstractThis article is concerned with the attack design problem of multisensor cyber‐physical systems. Compared with the existing results developed for the single‐sensor system, the attacker is limited to modify partial sensors. To avoid generating alarm for the given detect mechanism, the correlation influence between the attacked and normal sensors is eliminated in the designed stealthiness condition. Then the trace of error covariance is used to measure the attack effect and the coupling information between sensors is also involved. By using the design freedom of stealthiness condition, the detailed attack parameters design and attacked channels selection strategy are derived to achieve the optimal attack performance via a two‐stage method including backstepping and eigenvalue sorting techniques. Finally, numerical simulation examples are provided to verify the effectiveness and advantages of the proposed attack method.

Optimal cooperative cyber–physical attack strategy against gas–electricity interconnected system

In the context of the in-depth integration of the cyber system and the physical system, cooperative cyber–physical attacks (CCPAs) pose an increasing threat to the security and economy of the integrated energy system (IES). In this article, considering a gas–electricity interconnected IES, a new bi-level programming model is formulated to study the impact of the CCPA strategies on the economy of the IES. At the upper level, from the attacker’s perspective, an attack decision model is built to maximize the operational expenditure of the IES subject to the attack resource constraints. At the lower level, from the dispatcher’s perspective, an optimal scheduling model is established to minimize the operation cost in the case of the IES suffering from the CCPAs. Since the bi-level programming model is mixed-integer, nonlinear, and non-convex, a joint solution method (PSO+Yalmip+Cplex) is proposed to compute the optimal CCPA strategies. The impacts of the CCPA strategies on the economic dispatch (ED) of the IES are evaluated via numerical simulations.

A tri-level optimal defense method against coordinated cyber-physical attacks considering full substation topology

In recent years, power systems have been facing an increasing risk of malicious attacks. As modern power systems have a greater reliance on communication and automatic control systems, coordinated cyber-physical attacks will cause more serious consequences for the reliable power supply than traditional malicious attacks. To enhance the resilience of power systems against coordinated attacks, a defense method to allocating hardening resources is proposed in this paper considering the full substation topology and the multi-stage response process of power systems. The problem is formulated as a tri-level optimization model involving interactions among the defender, the attacker, and the operator, in which the synergy impact of three attack forms is considered, i.e., physical attacks causing short-circuiting, cyber attacks causing protective relay misoperation, and cyber attacks causing protective relay maloperation. A graph-based analytical model is established to characterize the impact process of such coordinated attacks on power systems. Case studies are conducted on the IEEE RTS 24-bus system. The influence mechanism of coordinated cyber-physical attacks involving protective relays on power systems is systematically revealed. Results show that the proposed method can effectively defend against the above-mentioned coordinated attacks, and enhance the resilience level of power systems. In addition, a sensitivity analysis is implemented on the influence of attack resources and defense resources on the unserved energy at each stage of the system.

Online Weapon-target Assignment based on Distributed Auction Mechanism

To solve the problem of online weapon-target assignment (OWTA) in the integration of large-scale search and attack in unknown environment, an OWTA algorithm based on distributed auction mechanism is presented. Aiming at the problem that the traditional combinatorial optimization algorithm needs to set up the global battlefield situation in advance, considering the consumability of resources in the attack process, the integrated search and attack task flow is established. Considering the communication restricted environment, the unmanned aerial vehicles (uavs) are grouped, with centralized architecture within the group and distributed structure between the groups, and the corresponding distributed auction mechanism is constructed to achieve OWTA within the communication range limited. In order to solve the problem that it is difficult to ensure the time consistency of the coordinated attack target, a dubins cooperative path planning based on cooperative particle swarm optimization (CPSO) algorithm is proposed. Particle swarm optimization algorithm is used to adjust the radius of the dubins path of each bomb, so that the uav in the same group can hit the target simultaneously without collision and have the shortest flight range. The simulation results show that the designed distributed auction algorithm takes into account the consumption of attack resources, and quickly redistributes the firepower to the new targets in the dynamic uncertain environment, which ensures the maximization of the execution efficiency of the multi-machine cluster fire allocation task.

False data injection attack in smart grid: Attack model and reinforcement learning-based detection method

The smart grid, as a cyber-physical system, is vulnerable to attacks due to the diversified and open environment. The false data injection attack (FDIA) can threaten the grid security by constructing and injecting the falsified attack vector to bypass the system detection. Due to the diversity of attacks, it is impractical to detect FDIAs by fixed methods. This paper proposed a false data injection attack model and countering detection methods based on deep reinforcement learning (DRL). First, we studied an attack model under the assumption of unlimited attack resources and information of complete topology. Different types of FDIAs are also enumerated. Then, we formulated the attack detection problem as a Markov decision process (MDP). A deep reinforcement learning-based method is proposed to detect FDIAs with a combined dynamic-static detection mechanism. To address the sparse reward problem, experiences with discrepant rewards are stored in different replay buffers to achieve efficiency. Moreover, the state space is extended by considering the most recent states to improve the perception capability. Simulations were performed on IEEE 9,14,30, and 57-bus systems, proving the validation of attack model and efficiency of detection method. Results proved efficacy of the detection method in different scenarios.

Economic Loss Utilized Probabilistic Defense against Load Redistribution Attacks by Selecting Optimal Critical Measuring Units

State Estimation (SE) reflects the real time operation of power system network in the present cyber-physical power world. However, prior research works depict that bad/false undetectable data can be injected into the system on compromising measuring devices like Remote Terminal Units or Phasor Measurement Units. If an attacker intrudes into the cyber network and injects successful undetectable bad data, then that attack is popular as False Data Injection Attack (FDIA). One practical FDIA is Load Redistribution Attack (LRA), which target bus active power injections and line active power flows. LRA harms SE and subsequently disturbs Security Constrained Economic Dispatch (SCED) which result in severe rise of power generation and load shedding costs. Hence to maintain grid’s security, defense is one of the optimistic options. Attacker or defender won’t have access or control over all units. So, certain critical measuring units must be considered to attack or defend the system. In this research article, a procedure is developed to select optimal critical units subjected to all possible attack resources and load variations. The developed procedure is analyzed on three loading scenarios of modified IEEE-14 bus test system. These critical units are set as basis to find an optimal attack-defense strategy among possible strategies, which is accomplished by static zero-sum game theory in which economic loss is utility. This study provides an in-sight of consequences due to LRA, critical units’ selection under load variations and probabilistic optimal attack-defense strategy of the modified IEEE-14 bus system at three loading conditions.Graphical Abstract

Research on NTP Nonlinear Reflection Attack Identification Based on AHP Multidimensional Matrix in Global COVID-19 Environment

Under the influence of the global epidemic, various businesses have moved online one after another. With the rise of emerging industries such as online medical treatment, online education, and online conference, the proportion of attacks in the network service industry has increased year by year. UDP-FLOOD is still the primary scenario of DDoS attacks. Among them, with a large number of attack resources and most of them are high configuration servers, NTP (Network Time Protocol) reflection has become the most common UDP reflection attack method, accounting for 59% of the overall distribution. Therefore, establishing an efficient NTP attack detection system is a very important content to prevent network malicious attacks. At present, NTP-attacking based defensed methods mainly include IP filtering, hop mapping, and response packet detection, but they all have obvious weaknesses. Among them, the IP detection scheme can only detect historical attack IP, the implementation of hop mapping scheme is complex, and the resource overhead of response packet detection scheme is too large. Therefore, this paper proposes a nonlinear detection algorithm based on AHP multidimensional matrix quad information entropy. Through simulation experiments, the change of quad information entropy of attack intensity from 10% to 100% is counted. The detection rate based on the traditional target IP and target port algorithm is only 50% and 60%, which is significantly lower than this algorithm. Experiments show that the detection rate of this algorithm is higher.

HiAtGang: How to Mine the Gangs Hidden Behind DDoS Attacks

Identifying and determining behaviors of attack gangs is not only an advanced stage of the network security event tracing and analysis, but also a core step of large-scale combat and punishment of cyber attacks. Most of the work in the field of distributed denial of service (DDoS) attack analysis has focused on DDoS attack detection, and a part of the work involves the research of DDoS attack sourcing. We find that very little work has been done on the mining and analysis of DDoS attack gangs. DDoS attack gangs naturally have the attributes of human community relations. We propose a framework named HiAtGang, in which we define the concept of the gang detection in DDoS attacks and introduce the community analysis technology into DDoS attack gang analysis. Different attacker clustering algorithms are compared and analyzed. Based on analysis results of massive DDoS attack events that recorded by CNCERT/CC (The National Computer Network Emergency Response Technical Team/Coordination Center of China), the effective gang mining and attribute calibration have been achieved. More than 250 DDoS attack gangs have been successfully tracked. Our research fills the gaps in the field of the DDoS attack gang detection and has supported CNCERT/CC in publishing “Analysis Report on DDoS Attack Resources” for three consecutive years and achieved a good practical effect on combating DDoS attack crimes.

An Optimal DoS Attack Strategy Disturbing the Distributed Economic Dispatch of Microgrid

As a promising method with excellent characteristics in terms of resilience and dependability, distributed methods are gradually used in the field of energy management of microgrid. However, these methods have more stringent requirements on the working conditions, which will make the system more sensitive to communication failures and cyberattacks. As a result, it is both theoretical merits and practical values to investigate the malicious effect of cyber attacks on microgrid. This paper studies the distributed economic dispatch problem (EDP) under denial-of-service (DoS) attacks for the microgrid, in which each generator can communicate with its neighbors and has the computational capability to implement local operation. Firstly, a DoS attack model is proposed, in which the DoS attacker intentionally jams the communication channel to deteriorate the performance of the microgrid. Then, the evolution mechanism of the dispatch system of the microgrid under different attack scenarios is adequately discussed. On this basis, an optimal attack strategy based on enumerating-search algorithm is presented to allocate the limited attack resources reasonably, so as to maximize the effect of DoS attacks. Finally, the validity of the theoretical studies about the attack effect under different scenarios and the effectiveness of the proposed enumerating-search-based optimal attack strategy are illustrated through the simulation examples on the IEEE 57-bus system and IEEE 39-bus system, respectively.

Resource allocation among multiple targets for a defender-attacker game with false targets consideration

Appropriate resource allocation among multiple targets plays a vital role in the defender-attacker game. Traditional methods seldom consider the optimal resource allocation with more than one strategy among multiple targets. Accordingly, we assume that the defender moves first, allocating resources in deploying different false targets and strengthening the genuine ones among multiple targets. The attacker moves after observing the defender's move, distributing resources in identifying false targets and then attacking the genuine ones concerning multiple targets. Each player aims to maximize their own overall expected utility given any of the other player's move. The optimal resource distribution between target intelligence/protection for the defender and target identification/attack efforts among multiple targets for the attacker is studied. We model and obtain analytical equilibrium results under various parameter settings. Our results show that increased intelligence (impact) contest intensities lead to lower (higher) attacker resources in intelligence (attack). Moreover, the zero-sum game where both players share the same preferences without additional payoff consideration results in the worst losses for the defender. The forgoing method offers an original way to approach the resource allocation problems in security defense fields.

Performance Analysis of Least Significant Bit Based Watermarking Technique Under Various Types of Attacks

Digital information transferred through internet should be protection from unauthorized and attack resource using one of the information security system method, one of these methods was digital watermarking was used in order to prevent information from various types of attack adversary since it satisfies all security system requirements (authentication, integrity and confident). Digital watermarking is used digital image for several purposes such as authentication, copyright, and many purposes. This paper we embedded (number of bits) MSB of watermark image in the (number of bits) LSB of cover image by proposed embedding algorithm, where the ratio of appearing information of the watermark in the watermarked image depends on a number bits embedded. Such that increasing the number bits increase the information display. The performance of the algorithm for watermarking and quality of reconstructed image have been measured in terms of MSE and PSNR. This paper produced performance analysis of image watermarking technique depend on least significant bit against several attacks (Gaussian, salt and pepper noise, Poisson and Speckle). The result of the attack appears that salt and pepper attack give best result than other types when it applied on the original image and watermarked image. Simulation results show that best results were achieved against Salt and Pepper attack in terms of less MSE and high PSNR. MATLAB language is used for implementing the suggested Algorithm.

Research on Robustness of Critical information infrastructure Based on Attack-Defensive Game Model

Because the traditional network robustness research ignores the confrontation process and information asymmetry conditions, this paper analyzes the impact of information asymmetry conditions on the robustness and simulates the information asymmetry conditions through a perturbation model. Based on the stackelberg game, an attack-defensive game model under asymmetric information is established, by solving the game equilibrium solution, the defensive resource allocation strategy that optimizes the network robustness is obtained. The simulation results show that when attack resources are scarce, the attacker tends to respond with a low priority attack; when the attack resources are abundant, the attacker tends to have a high priority attack response. Under the mixed defensive strategy corresponding to the equilibrium solution of the game, the optimization rate of the defender's robustness payoff compared with the expected return under the pure strategy reached 4% to 12%.

Enabling realistic health data re-identification risk assessment through adversarial modeling.

Re-identification risk methods for biomedical data often assume a worst case, in which attackers know all identifiable features (eg, age and race) about a subject. Yet, worst-case adversarial modeling can overestimate risk and induce heavy editing of shared data. The objective of this study is to introduce a framework for assessing the risk considering the attacker's resources and capabilities. We integrate 3 established risk measures (ie, prosecutor, journalist, and marketer risks) and compute re-identification probabilities for data subjects. This probability is dependent on an attacker's capabilities (eg, ability to obtain external identified resources) and the subject's decision on whether to reveal their participation in a dataset. We illustrate the framework through case studies using data from over 1000000 patients from Vanderbilt University Medical Center and show how re-identification risk changes when attackers are pragmatic and use 2 known resources for attack: (1) voter registration lists and (2) social media posts. Our framework illustrates that the risk is substantially smaller in the pragmatic scenarios than in the worst case. Our experiments yield a median worst-case risk of 0.987 (where 0 is least risky and 1 is most risky); however, the median reduction in risk was 90.1% in the voter registration scenario and 100% in the social media posts scenario. Notably, these observations hold true for a wide range of adversarial capabilities. This research illustrates that re-identification risk is situationally dependent and that appropriate adversarial modeling may permit biomedical data sharing on a wider scale than is currently the case.

Attack Strategies on Networks With a Budget Constraint

In this paper, we develop solutions to the problem of identifying the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k most vital cut-sets</i> of a network under limited attacking resources in a network interdiction context. We treat three different versions of the problem, each having a different objective: namely, the highest probability of a successful attack, the least cost attack, and the least expected cost attack combining both success probability and attacking cost. We introduce a budget constraint to reflect the resource limitation of the attacker. We consider both the case of disjoint and non-disjoint cut-sets to target. We develop a simulation-optimization approach accounting for various techniques including the shortest path problem and the min-cut problem. The solution method is found to be very efficient even for large-scale networks. We implement the suggested algorithms for illustration purposes.

Profitable Double-Spending Attacks

Our aim in this paper is to investigate the profitability of double-spending (DS) attacks that manipulate an a priori mined transaction in a blockchain. It was well understood that a successful DS attack is established when the proportion of computing power an attacker possesses is higher than that of the honest network. What is not yet well understood is how threatening a DS attack with less than 50% computing power used can be. Namely, DS attacks at any proportion can be a threat as long as the chance to make a good profit exists. Profit is obtained when the revenue from making a successful DS attack is greater than the cost of carrying out one. We have developed a novel probability theory for calculating a finitetime attack probability. This can be used to size up attack resources needed to obtain the profit. The results enable us to derive a sufficient and necessary condition on the value of a transaction targeted by a DS attack. Our result is quite surprising: we theoretically show how a DS attack at any proportion of computing power can be made profitable. Given one’s transaction value, the results can also be used to assess the risk of a DS attack. An example of profitable DS attack against BitcoinCash is provided.

Worst Case Attacks on Distributed Resources Systems

How should an attacker, who wishes to hurt (deny) service, attack resources on a geographically distributed system in order to maximize the damage inflicted? Should attack efforts focus on a small number of regions (sites) or rather spread over many regions to yield wide spread effect? Consequently, how resources should be optimized as to minimize the gain of a damage-maximizing attacker? These are the questions that motivate this research and are at its core.

Robustness of Internet of Battlefield Things (IoBT): A Directed Network Perspective.

Through the combination of various intelligent devices and the Internet to form a large-scale network, the Internet of Things (IoT) realizes real-time information exchange and communication between devices. IoT technology is expected to play an essential role in improving the combat effectiveness and situation awareness ability of armies. The interconnection between combat equipment and other battlefield resources is referred to as the Internet of Battlefield Things (IoBT). Battlefield real-time data sharing and the cooperative decision-making among commanders are highly dependent on the connectivity between different combat units in the network. However, due to the wireless characteristics of communication, a large number of communication links are directly exposed in the complex battlefield environment, and various cyber or physical attacks threaten network connectivity. Therefore, the ability to maintain network connectivity under adversary attacks is a critical property for the IoBT. In this work, we propose a directed network model and connectivity measurement of the IoBT network. Then, we develop an optimal attack strategy optimization model to simulate the optimal attack behavior of the enemy. By comparing with the disintegration effect of some benchmark strategies, we verify the optimality of the model solution and find that the robustness of the IoBT network decreases rapidly with an increase of the unidirectional communication links in the network. The results show that the adversary will change the attack mode according to the parameter settings of attack resources and network communication link density. In order to enhance the network robustness, we need to adjust the defense strategy in time to deal with this change. Finally, we validated the model and theoretical analysis proposed in this paper through experiments on a real military network.