Attack Vectors Research Articles

Dynamic Reconfiguration for Resilient State Estimation Against Cyber Attacks

The increasing complexity and connectivity of critical infrastructures makes it increasingly likely that they will be subject to malicious attacks that compromise operation. Recent studies have shown that these systems are vulnerable to a wide range of cyber-attacks, including False Data Injection (FDI) attacks that bypasses conventional detection techniques. Conventional security monitoring, protection, and control tools are based primarily on passive defense strategies. In this paper, we propose an approach for active defense that improves system security and the detection rate of FDI attacks. The key insight for this approach is that emerging micro-grids can utilize distributed energy resources to dynamically reconfigure the system (e.g. power flow paths), across multiple acceptable configurations. Instead of using information from only a single static configuration to detect FDI attacks, our proposed approach uses <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">dynamic reconfiguration</i> to compare measured and estimated states under multiple configurations to accurately detect FDI attacks. We describe an implementation and supporting infrastructure for a secure reconfigurable microgrid. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Dynamic reconfiguration</i> also makes it more difficult for attackers to gain knowledge on the system's parameters, which increases the difficulty for attackers to construct hidden attack vectors. We evaluate our approach in the specific scenario of emerging micro-grids. We develop a novel technique for state estimation using multiple configurations and demonstrate that this approach significantly improves FDI detection accuracy.

Machine Learning Methods for Attack Detection in Smart Grid

Abstract: In the realm of smart grids attack detection, statistical learning poses challenges across various attack scenarios, whether measurements are obtained either online or in batch mode. This approach categorizes measurements into two groups: secure and attacked, leveraging machine learning algorithms. The suggested method offers a framework for detecting attacks, aiming to address limitations arising from the sparse nature of the problem and leveraging any available past system knowledge. Through decision- and feature-level fusion, established batch and online learning methods are employed to tackle the attack detection challenge. To uncover unobservable attacks using statistical learning techniques, the relationships between the geometric and statistical characteristics of the attack vectors within the attack scenarios and the learning algorithms are scrutinized

OpenFL: A scalable and secure decentralized federated learning system on the Ethereum blockchain

Decentralized Federated Learning (FL) offers a paradigm where independent entities collaboratively train a machine learning model while preserving the privacy of their datasets. Integrating blockchain technology into decentralized FL frameworks is critical to establishing the trust necessary for user participation. However, existing FL systems using blockchain often struggle with scalability, latency, and privacy issues, particularly in permissionless blockchain contexts. This paper proposes OpenFL, a novel, collateral-backed reputation system implemented on the Ethereum blockchain. This system aims to foster trust among participants in a decentralized FL environment. We present a fully autonomous smart contract platform specifically tailored to facilitate FL processes among anonymous users. Furthermore, we address potential security concerns by detailing our strategies to mitigate various attack vectors. To validate our system’s efficacy, we conducted experiments on the Ethereum Ropsten testnet using the MNIST and CIFAR-10 datasets. Our findings demonstrate OpenFL’s capability to overcome the inherent limitations of permissionless blockchains while highlighting the significance of open-access protocols in this context. OpenFL can potentially broaden the participant base in trust-sensitive applications by reducing entry barriers, thus substantially contributing to decentralized machine learning.

Quantum Deep Neural Network Based Classification of Attack Vectors on the Ethereum Blockchain

INTRODUCTION: The implementation of robust security protocols is imperative in light of the exponential growth of blockchain-based platforms such as Ethereum. The importance of developing more effective strategies to detect and counter potential attacks is growing in tandem with the sophistication of the methods employed by attackers. In this study, we present a novel approach that leverages quantum computing to identify and predict attack vectors on the Ethereum blockchain. OBJECTIVES: The primary objective of this study is to suggest an innovative methodology for enhancing the security of Ethereum by leveraging quantum computing. The purpose of this study is to demonstrate that QRBM and QDN are efficient in identifying and predicting security flaws in blockchain transactions. METHODS: We combined methods from quantum computing with social network research approaches. An enormous dataset containing both genuine Ethereum transactions and a carefully chosen spectrum of malicious activity indicative of popular attack vectors was used to train our model, the QRBM. Thanks to the dataset, the QRBM was able to learn to distinguish between typical and out-of-the-ordinary activities. RESULTS: In comparison to more conventional deep learning models, the QRBM showed substantially better accuracy when it came to identifying transaction behaviours. The model's improved scalability and efficiency were made possible by its quantum nature, which is defined by features like entanglement and superposition. Specifically, the QRBM handled non-informative inputs better and solved problems faster. CONCLUSION: This study paves the way for further investigation into quantum-enhanced cybersecurity measures and highlights the promise of quantum neural networks in strengthening the security of blockchain technology. According to our research, quantum computing has the potential to be an essential tool in creating Ethereum-style blockchain security systems that are more advanced, efficient, and resilient.

Endpoint cybersecurity: When smart devices turn stupid

With the proliferation of ever-cheaper IoTs (or smart devices) from smart doorbells to WiFi security cameras and baby monitors and hybrid work arrangements involving relaxed BYOD (Bring Your Own Device) policies, cybersecurity education must build awareness on the threats that endpoints pose. While securing corporate networks from cyberattack gains much attention, there is a dearth of educational material that exemplifies the processes by which endpoints are used in hacks, and how to build defenses against endpoint vulnerabilities. This teaching case provides a Defense in Depth (DiD) learning framework on how to defend industrial cyber-physical systems, digital infrastructure and assets. The case illustrates the applicability of a DiD framework independent of attack vector yet particular to endpoint vulnerabilities and shows how lessons from the past can help defend and mitigate future cyberattacks.

BertRLFuzzer: A BERT and Reinforcement Learning Based Fuzzer (Student Abstract)

We present a novel tool BertRLFuzzer, a BERT and Reinforcement Learning (RL) based fuzzer aimed at finding security vulnerabilities for Web applications. BertRLFuzzer works as follows: given a set of seed inputs, the fuzzer performs grammar-adhering and attack-provoking mutation operations on them to generate candidate attack vectors. The key insight of BertRLFuzzer is the use of RL with a BERT model as an agent to guide the fuzzer to efficiently learn grammar-adhering and attack-provoking mutation operators. In order to establish the efficacy of BertRLFuzzer we compare it against a total of 13 black box and white box fuzzers over a benchmark of 9 victim websites with over 16K LOC. We observed a significant improvement, relative to the nearest competing tool in terms of time to first attack (54% less), new vulnerabilities found (17 new vulnerabilities), and attack rate (4.4% more attack vectors generated).

Model-based adaptive security control strategy against false data injection attacks in cyber–physical systems

This paper addresses the problem of adaptive security control for cyber–physical systems (CPSs) under external nonlinear disturbances and false data injection (FDI) attacks on actuators. To address FDI attacks, a full-order disturbance estimator is proposed for eliminating disturbances in the forward channel. Furthermore, an attack model based on the system state vector is developed to estimate the attack vector by considering potential attacks that can induce state errors between the reference model and the actual system. Subsequently, a novel model-based adaptive security control (MASC) strategy is devised using attack compensation and state feedback. The key advantage of our proposed strategy lies in its ability to effectively mitigate the adverse effects of attacks while accounting for nonlinear disturbances. Finally, experimental validation conducted on a brushless DC motor speed control system demonstrates the capability of achieving high output tracking accuracy.

Anomaly Detection for the MIL-STD-1553B Multiplex Data Bus Using an LSTM Autoencoder

Due to the modernization of commercial and military aircraft, real-time systems and their connectivity to ground based networks, including the Internet, that were thought to be “air-gapped”, are becoming more susceptible to cyber-attack. Most real-time systems that communicate using the Military Standard 1553B Multiplex data bus (MIL-STD-1553B) protocol do not have the ability to detect cyber-attacks. These systems were originally developed with safety and redundancy in mind, not security. These two factors introduce attack vectors to MIL-STD-1553B communication buses and expose associated avionics systems to exploitation. Recent approaches to anomaly detection for the MIL-STD-1553B data bus have leveraged statistical analysis, Markov Chain modelling, remote terminal fingerprinting and signature-based detection. However, their comparative effectiveness is unknown. Regarding the statistical analysis technique, the lack of accuracy and precision in detecting the start and stop time of anomalous events are not ideal for conducting investigations due to the sheer volume of messages still required to be manually analysed. Deep learning techniques offer an effective means of anomaly detection and applying these techniques to the MIL-STD-1553B data bus could provide more accurate and precise detection times when anomalies or attacks are present, when compared to known statistical analysis, leading to more efficient forensic investigations of anomalous events.

Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in Healthcare

This technical paper investigates the vulnerabilities and potential threats posed by emerging technologies, specifically Bluetoothenabled patient pacemakers. With the advancements in healthcare technology, pacemakers now utilize Bluetooth connectivity for real-time monitoring and data transmission, offering patients and healthcare providers an important convenience. However, this technology also introduces significant security risks, leaving these life-sustaining devices susceptible to malicious attacks. Through an in-depth analysis of existing research, real-life incidents, and vulnerabilities identified by experts in the field, this paper will underscore the critical vulnerabilities present in pacemaker systems. Examples, including findings from researchers such as Billy Rios, Jonathon Butts, and Marie Moe, demonstrate the potential severity of these vulnerabilities. From remote control manipulation to unauthorized access to sensitive medical data, the threats posed by these vulnerabilities are substantial and potentially life-threatening. Moreover, this paper outlines advanced mitigation strategies essential for protecting patient pacemakers against these security risks. Recommendations include end-to-end encryption, whitelist device pairing, intrusion detection systems, and regular firmware updates, highlight the collaborative efforts required from patients, healthcare providers, and manufacturers to mitigate these risks effectively. This paper’s findings underscore the urgent need for robust cybersecurity measures in the design, implementation, and maintenance of pacemaker systems. Addressing these vulnerabilities is key for ensuring patient safety, maintaining privacy, and building trust in healthcare technology. The implications of this research extend beyond pacemaker security, emphasizing the broader importance of cybersecurity in medical devices and the importance of ongoing research and regulatory initiatives to protect patient health.

False data injection in distribution system: Attacker's perspective

The distribution system is digitizing and occupying cyberspace with the help of information and communication technologies (ICTs). It is vulnerable to cyber-attacks like false data injection (FDI) and denial-of-services (DoS). However, limited research on cyber-attacks in the distribution system is reported in the literature, and these attacks are of serious concern to distribution system operators (DSOs). The DSO's primary challenge is to understand the attacker's perspective for FDI attack construction. Thus, the work presented in this paper aims to provide an in-depth insight for DSO to apprehend the attacker's perspective, attack flow, and the nature of the FDI attack vector. The prior knowledge of attack flow to DSO can help to protect critical infrastructures from cyber-attacks. Thus, this work comprehends the attacker's behaviour for deploying the optimal budget to disrupt the distribution system operation therein by injecting a stealthy FDI vector. The attacker is resource-constrained in terms of budget and network information. Therefore, the optimal budget for attack initiation is proposed and formulated as a multi-objective optimization problem to minimize the investment and maximize the economic loss for the DSO. Constructing the attack vectors for the attacker is challenging in the limited network information. It is complex because of network characteristics such as multi-phase configurations & an unbalanced nature, and higher resistance to reactance (r/x) ratio. Thus, the FDI attack vector construction is proposed based on non-linear programming optimization and sensitivity analysis considering partial information from the distribution system. The simulation results are presented and compared with available methods in the literature to validate the efficacy of the proposed methods.

False data injection attack against smart power grid based on incomplete network information

In power systems, False Data Injection (FDI) attack can covertly mislead the state estimation of the power system and lead to inestimable damage. Traditional studies on FDI attack usually assume that the attacker has complete network information of the power grid. However, this assumption is often difficult to be achieved due to the good protection of data in the control center. In this paper, an FDI attack approach with incomplete network information is proposed against AC state estimation. In addition to constructing an attack vector to modify the selected state, this approach also gives the attack range of the state. Through the analysis of the residuals we propose a method to extend the range that can evade bad data detector. Simulation in the IEEE14 and IEEE118 bus systems verify the feasibility and stealth of the model.

Incremental Learning, Incremental Backdoor Threats

Class incremental learning from a pre-trained DNN model is gaining lots of popularity. Unfortunately, the pre-trained model also introduces a new attack vector, which enables an adversary to inject a backdoor into it and further compromise the downstream models learned from it. Prior works proposed backdoor attacks against the pre-trained models in the transfer learning scenario. However, they become less effective when the adversary does not have the knowledge of the downstream tasks or new data, which is more practical and considered in this paper. To this end, we design the first latent backdoor attacks against incremental learning. We propose two novel techniques, which can effectively and stealthily embed a backdoor into the pre-trained model. Such backdoor can only be activated when the pre-trained model is extended to a downstream model with incremental learning. It has a very high attack success rate, and is able to bypass existing backdoor detection approaches. Extensive experiments confirm the effectiveness of our attacks over different datasets and incremental learning methods, as well as strong robustness against state-of-the-art backdoor defense mechanisms including <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Neural Cleanse</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fine-Pruning</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">STRIP</i> .

Listen to your key: Towards acoustics-based physical key inference

Physical locks are one of the most prevalent mechanisms for securing objects such as doors. While many of these locks are vulnerable to lock-picking, they are still widely used as lock-picking requires specific training with tailored instruments and easily raises suspicion. To overcome the limitations of lockpicking, we propose a novel attack vector that leverages the audio recording of the key insertion in order to infer the shape of victim’s key, namely, bittings (or cut depths) which form the secret of a key. In particular, we show that computing the timing interval between audible click sounds that occur during key insertion enables inferring the bitting information, i.e., shape of the physical key. Such an audio-based attack has several advantages—unlike lock-picking, it minimizes the attacker’s physical access to the lock, thus reducing the risks of them being apprehended. Second, as the attack only requires a microphone to launch the attack (e.g., a smartphone microphone), it significantly lowers the bar for the required expertise of the attacker. Despite the advantages, there are several challenges in extracting the required key-related signal from the audio. In this talk, we will discuss how we overcome the challenges and present initial results depicting the feasibility of audio-based key inference. This talk is based on two conference papers submitted to ACM HotMobile 2020 and USENIX Security 2021 on the same topic.

Cyber-Physical Attack Launched From EVSE Botnet

With the development of electric vehicles, millions of electric vehicle service equipment (EVSE) are integrated into the power grid. These EVSEs are weakly protected from cyber-attacks. By exploiting vulnerabilities, attackers could establish a botnet integrating hundred-MW-level EVSE loads from the Internet. Dynamic load-altering attack (DLAA) is powerful to amplify the load disturbance to destabilize the power grid. However, different from large-scale loads controlled by existing DLAA, the EVSE botnet is formulated by tens of thousands of bots widely distributed on various power grid nodes, rendering it challenging to be coordinated. In this paper, we analyze the approach to launching a DLAA from the distributed EVSE botnet. Firstly, we adopt a time-division model to evaluate the impact of communication limitations on the attack vectors of the botnet. Then we develop an analytical model to calculate the coordinated effect of attack vectors from different nodes and with varying phase angles; thus, we provide a foundation for the optimal coordination of distributed bots. Subsequently, considering the power grid has adopted defense measures to eliminate or suppress the attack, we formulate an optimization algorithm to make the attack robust against these potential defense measures. Numerical simulations validate the effectiveness of the proposed approach.

Quantum-Assisted Activation for Supervised Learning in Healthcare-Based Intrusion Detection Systems

Intrusion detection systems (IDS) are amongst the most important automated defense mechanisms in modern industry. It is guarding against many attack vectors, especially in healthcare, where sensitive information (patient&#x2019;s medical history, prescriptions, electronic health records, medical bills/debts, and many other sensitive data points) is open to compromise from adversaries. In the big data era, classical machine learning has been applied to train IDS. However, classical IDS tend to be complex: either using several hidden layers susceptible to over-fitting on training data or using overly complex architectures such as convolutional neural networks (CNNs), long-short term memory systems (LSTMs), and recurrent neural networks (RNNs). This paper explored the combination of principles of quantum mechanics and neural networks to train IDS. A hybrid classical-quantum neural architecture is proposed with a quantum-assisted activation function that successfully captures patterns in the dataset while having less architectural memory footprint than classical solutions. The experimental results are demonstrated on the popular KDD99 dataset while comparing our solution to other classical models.

Mitigating ransomware attacks through cyber threat intelligence and machine learning

&lt;div&gt;In the face of escalating cyber threats, particularly the rampant and sophisticated nature of ransomware attacks, organizations are compelled to adopt a proactive and multi-faceted strategy for mitigation. The fusion of machine learning (ML) algorithms enables the system to dynamically adapt and evolve in response to evolving attack vectors and tactics employed by cybercriminals. This paper presents a comprehensive approach that synergistically integrates ML and cyber threat intelligence (CTI) to fortify defenses against ransomware assaults. The proposed methodology incorporates three distinct machine learning techniques, namely random forest (RF), extreme gradient boosting (XGBoost), and adaptive boosting (AdaBoost). Empirical evidence derived from the study affirms the efficacy of this approach in effectively discriminating between malicious and ransom software, achieving a notable identification rate of 98.55%. The incorporation of CTI enhances the strategic posture by providing actionable insights into the threat landscape. The proposed focuses on identifying and neutralizing ransomware, aligning with contemporary cybersecurity imperatives, offering a proactive defense against ransomware attacks, ultimately safeguarding critical assets, and preserving the integrity of digital ecosystems.&lt;/div&gt;

Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough

Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough

Analysis of modern intelligent methods for protecting critical information infrastructure

Critical information infrastructure (CII), including the financial sector, plays a key role in ensuring the sustainable functioning of economic systems and the financial stability of States. However, the growing digitalization of the financial industry and the introduction of innovative technologies are opening up new attack vectors for attackers. Modern cyber attacks are becoming more sophisticated, and traditional defenses are proving ineffective against new, previously unknown threats. There is an urgent need for more flexible and intelligent cybersecurity systems. Thus, the subject of the study is modern intelligent methods and technologies for protecting critical information infrastructure (CII) from cyber attacks. The object of the research is methods and means of ensuring the protection of critical information infrastructure using artificial intelligence and machine learning technologies. The methodological basis of this study is a comprehensive analysis of the scientific literature on the use of intelligent methods and technologies to protect critical information infrastructure. During the review and critical analysis of relevant scientific publications, key problems and unresolved tasks requiring further scientific research and practical developments in this subject area were identified. This methodological approach allowed us to form a holistic view of the current state and prospects for the development of intelligent cybersecurity tools for critical financial systems, as well as to identify priority areas for further research. The main directions of scientific novelty of this research are: 1. A detailed review of promising approaches based on artificial intelligence and machine learning technologies to ensure effective protection of CII organizations from modern complex cyber attacks. 2. Identification and analysis of a number of key scientific and technical problems that need to be solved to increase reliability, interpretability and trust in intelligent cybersecurity systems, including issues of robustness to attacks, active online learning, federated and differential private data processing. 3. Identification of promising areas for further research and development in the field of application of specialized methods of secure and trusted AI to protect critical financial infrastructure. Thus, this research makes a significant contribution to the development of scientific and methodological apparatus and practical solutions for the use of intelligent methods to ensure cybersecurity.

Attacks on Machine Learning Models Based on the PyTorch Framework

This research delves into the cybersecurity implications of neural network training in cloud-based services. Despite their recognition for solving IT problems, the resource-intensive nature of neural network training poses challenges, leading to increased reliance on cloud services. However, this dependence introduces new cybersecurity risks. The study focuses on a novel attack method exploiting neural network weights to discreetly distribute hidden malware. It explores seven embedding methods and four trigger types for malware activation. Additionally, the paper introduces an open-source framework automating code injection into neural network weight parameters, allowing researchers to investigate and counteract this emerging attack vector.

Solving Degree Bounds for Iterated Polynomial Systems

For Arithmetization-Oriented ciphers and hash functions Gröbner basis attacks are generally considered as the most competitive attack vector. Unfortunately, the complexity of Gröbner basis algorithms is only understood for special cases, and it is needless to say that these cases do not apply to most cryptographic polynomial systems. Therefore, cryptographers have to resort to experiments, extrapolations and hypotheses to assess the security of their designs. One established measure to quantify the complexity of linear algebra-based Gröbner basis algorithms is the so-called solving degree. Caminata &amp; Gorla revealed that under a certain genericity condition on a polynomial system the solving degree is always upper bounded by the Castelnuovo-Mumford regularity and henceforth by the Macaulay bound, which only takes the degrees and number of variables of the input polynomials into account. In this paper we extend their framework to iterated polynomial systems, the standard polynomial model for symmetric ciphers and hash functions. In particular, we prove solving degree bounds for various attacks on MiMC, Feistel-MiMC, Feistel-MiMC-Hash, Hades and GMiMC. Our bounds fall in line with the hypothesized complexity of Gröbner basis attacks on these designs, and to the best of our knowledge this is the first time that a mathematical proof for these complexities is provided. Moreover, by studying polynomials with degree falls we can prove lower bounds on the Castelnuovo-Mumford regularity for attacks on MiMC, Feistel-MiMC and Feistel-MiMCHash provided that only a few solutions of the corresponding iterated polynomial system originate from the base field. Hence, regularity-based solving degree estimations can never surpass a certain threshold, a desirable property for cryptographic polynomial systems.