Attack Capability Research Articles

SecDefender: Detecting low-quality models in multidomain federated learning systems

Federated learning (FL) is an innovative distributed learning paradigm that permits multiple parties to train models collaboratively while protecting individual privacy. However, it encounters security challenges, making it vulnerable to several adversarial attacks and leading to compromising model performance. Existing research on FL poisoning attacks and defense techniques tends to be application-specific, primarily emphasizing attack capabilities. However, it fails to consider inherent vulnerabilities in FL and the impact of attack intensity. To our knowledge, no existing work has delved into these issues within a multi-domain FL environment. This paper addresses these concerns by investigating the consequences of targeted label-flipping attacks within FL systems and comprehensively examining the effects of the attacks in single-label, double-label, and triple-label scenarios with different levels of poisoning intensities. Additionally, we investigate the influence of a temporal label-flipping attack, where we study the impact of adversaries available only for specific federated training rounds. Moreover, we propose a novel server-based defense mechanism called SecDefender to detect low-quality models in both IID and non-IID settings of multi-domain environments. Our approach is rigorously evaluated against state-of-the-art alternatives using six benchmark datasets: CIC-Darknet2020, Fashion-MNIST, FEDMNIST, GTSR, HAR, and MNIST. Extensive experiments demonstrate that our proposed SecDefender significantly enhances its performance by over 65% in terms of source class recall, maintaining a low attack success rate. Consequently, there is a 1 to 2% enhancement in global model accuracy compared to existing approaches.

A Proactive Decoy Selection Scheme for Cyber Deception using MITRE ATT&CK

Cyber deception allows compensating the late response of defenders countermeasures to the ever evolving tactics, techniques, and procedures (TTPs) of attackers. This proactive defense strategy employs decoys resembling legitimate system components to lure stealthy attackers within the defender environment, slowing and/or denying the accomplishment of their goals. In this regard, the selection of decoys that can expose the techniques used by malicious users plays a central role to incentivize their engagement. However, this is a difficult task to achieve in practice, since it requires an accurate and realistic modeling of the attacker capabilities and his possible targets. In this work, we tackle this challenge and we design a decoy selection scheme that is supported by an adversarial modeling based on empirical observation of real-world attackers. We take advantage of a domain-specific threat modeling language using MITRE ATT&CK© framework as source of attacker TTPs targeting enterprise systems. In detail, we extract the information about the execution preconditions of each technique as well as its possible effects on the environment to generate attack graphs modeling the adversary capabilities. Based on this, we formulate a graph partition problem that minimizes the number of decoys detecting a corresponding number of techniques employed in various attack paths directed to specific targets. We compare our optimization-based decoy selection approach against several benchmark schemes that ignore the preconditions between the various attack steps. Results reveal that the proposed scheme provides the highest interception rate of attack paths using the lowest amount of decoys.

Closing the Gap: Leakage Contracts for Processors with Transitions and Glitches

Security verification of masked software implementations of cryptographic algorithms must account for microarchitectural side-effects of CPUs. Leakage contracts were proposed to provide a formal separation between hardware and software verification, ensuring interoperability and end-to-end security for independently verified components. However, previously proposed leakage contracts did not consider a class of ephemeral hardware effects called glitches, which leaves a considerable gap between security models and the capabilities of real-world attackers. We address this issue by extending the model for leakage contracts to account for glitches and transitions. We further present the first end-to-end verification tool for transient leakage contracts. Our hardware and software verification rely on the same contract as a single source of truth, facilitating fully machine-checked verification from the hardware gate level to the software. By allowing contracts to be written in the C programming language we make power contracts more accessible and intuitive for system-level engineers. To showcase the efficacy of our approach, we apply it to the RISC-V Ibex core. We show that it is possible to write a power contract for Ibex without any modifications to the hardware design. Using this contract, we prove end-to-end security between masked software and gate-level hardware.

Self-Organizing Optimization Based on Caputo’s Fractional Order Gradients

This paper analyses the condition necessary to guarantee no divergence for Caputo’s fractional order gradient descent (C-FOG) algorithm on multivariate functions. C-FOG is self-organizing, computationally efficient, simple, and understandable. It converges faster than the classical gradient-based optimization algorithms and converges to slightly different points when the order of the fractional derivative is different. The additional freedom of the order is very useful in situations where the diversity of convergence is required, and it also allows for more precise convergence. Comparative experiments on a typical poor conditioned function and adversarial sample generation frameworks demonstrate the convergence performance of C-FOG, showing that it outperforms currently popular algorithms in terms of convergence speed, and more excitingly, the diversity of convergence allows it to exhibit stronger and more stable attack capability in adversarial sample generation procedures (The code for experiments is available at: https://github.com/mulertan/self_optimizing/tree/main, accessed on 30 April 2024).

The method of assessing the effectiveness of the security of confidential data of the distributed information system

The paper proposes a method of assessing the effectiveness of the security of confidential data of a distributed information system, based on a model for determining the current threats to the security of confidential data in the information system, on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, it uses sufficient and necessary indicators, excludes expert errors , increases the detection of actual threats to the security of confidential information system data by 5%, reduces the cost of purchasing information protection tools from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the information system. The proposed approach differs from existing ones by an automated process, the need to involve highly qualified specialists in the field of information security, and low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types. The task of ensuring the security of confidential data is urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet. The existing methods of identifying current threats to information security and assessing the effectiveness of the security of confidential data cannot be used at all stages of the life cycle of distributed information systems, they do not take into account the following indicators in the complex: IT infrastructure of distributed systems, current threats to information security, security requirements of confidential data, their cost as important indicators when solving these problems. One of the most important tasks of ensuring the security of confidential data is the evaluation of the effectiveness of the protection system. In this regard, the goal of the research is to improve the quality of the assessment of the effectiveness of the security of confidential data of a distributed information system by determining sufficient and necessary indicators using modern information technologies, which allow the most effective solution of the following tasks: determining the parameters of the adaptive production fuzzy neural systems, which most suitable for solving the tasks, the application of Data Science technologies in data processing, algorithms of fuzzy output.

An Adversarial Example Method Based on Dropping Information to Improve Attack Capability

At present, deep neural network has been widely used in many research fields. However, with the in-depth research on artificial intelligence research, it is found that artificial intelligence technology based on deep neural networks bringsconvenience coming with potential security risks. For example, an attacker may misguide the image classification model to output a wrong result with high confidence by adding slight perturbations to a clean image via the adversarial example method. Compared with the previous methods of adding additional information to the images to generate adversarial examples, Ranjie Duan et al. proposed the AdvDrop algorithm. In this algorithm, adversarial examples are generated by deleting the existing information of the images, which is realized by adjusting the quantization step. However, in the quantization process, the AdvDrop algorithm does not consider the different effects of different gradient values of the quantization table on the adversarial effect. In this regard, AdvDrop+ is proposed, that is, in each iteration, the quantization tables are updated according to the gradient numerical values scaled with a factor. To find the proper scaling factor, we find the gradient value of the highest frequency in the gradient histogram and compute its logarithm and the final result is the scaling factor. The experiments show that AdvDrop+ has better attack performance than AdvDrop under the setting of target attack with nearly the same image distortion. At the same time, AdvDrop+ retains the characteristic of AdvDrop, which can drop information.

A Security Study of Multimodel Artificial Intelligence System: Adaptive Retention Attack for Object Detection System with Multifocus Image Fusion Model

Image preprocessing models are usually employed as the preceding operations of high‐level vision tasks to improve the performance. The adversarial attack technology makes both these models face severe challenges. Prior research is focused solely on attacking single object detection models, without considering the impact of the preprocessing models (multifocus image fusion) on adversarial perturbations within the object detection system. Multifocus image fusion models work in conjunction with the object detection models to enhance the quality of the images and improve the capability of object detection system. Herein, the problem of attacking object detection system that utilizes multifocus image fusion as its preprocessing models is addressed. To retain the attack capabilities of adversarial samples against as many perturbations as possible, new attack method called adaptive retention attack (ARA) is proposed. Additionally, adversarial perturbations concentration mechanism and image selection mechanism, which, respectively, enhance the transferability and attack capability of ARA‐generated adversarial samples. Extensive experiments have demonstrated the feasibility of the ARA. The results confirm that the ARA method can successfully bypass multifocus image fusion models to attack the object detection model.

A performance comparison of utility functions for game theory based weapon-target assignment

The weapon-target assignment problem has been considered as an essential issue for military applications to provide a protection for defended assets. The goal of a typical weapon-target assignment problem is to maximize the expected survivability of the valuable assets. In this study, defense of naval vessels that encounter aerial targets is considered. The vessels are assumed to have different types of weapons having various firepower and cost as well as the incoming targets may have different attack capabilities. In a typical scenario, in addition to protecting assets, it is also desirable to minimize the cost of weapons. Therefore, an asset-based static weapon-target assignment problem is considered in order to both maximize the expected survivability of the assets and minimize the weapon budget. Thus, a co-operative game theory based solution is proposed which relates the utilities of the individuals to the global utility and reach the Nash equilibrium.

ATTACK-COSM: attacking the camouflaged object segmentation model through digital world adversarial examples

The camouflaged object segmentation model (COSM) has recently gained substantial attention due to its remarkable ability to detect camouflaged objects. Nevertheless, deep vision models are widely acknowledged to be susceptible to adversarial examples, which can mislead models, causing them to make incorrect predictions through imperceptible perturbations. The vulnerability to adversarial attacks raises significant concerns when deploying COSM in security-sensitive applications. Consequently, it is crucial to determine whether the foundational vision model COSM is also susceptible to such attacks. To our knowledge, our work represents the first exploration of strategies for targeting COSM with adversarial examples in the digital world. With the primary objective of reversing the predictions for both masked objects and backgrounds, we explore the adversarial robustness of COSM in full white-box and black-box settings. In addition to the primary objective of reversing the predictions for masked objects and backgrounds, our investigation reveals the potential to generate any desired mask through adversarial attacks. The experimental results indicate that COSM demonstrates weak robustness, rendering it vulnerable to adversarial example attacks. In the realm of COS, the projected gradient descent (PGD) attack method exhibits superior attack capabilities compared to the fast gradient sign (FGSM) method in both white-box and black-box settings. These findings reduce the security risks in the application of COSM and pave the way for multiple applications of COSM.

Enhancing reinforcement learning based adversarial malware generation to evade static detection

The anti-detection capabilities of adversarial malware examples have drawn the attention of antivirus vendors and researchers. In black-box scenarios where internal information of the target model cannot be accessed, with the ability of the reinforcement learning (RL) agents to adjust strategies based on the feedback from the environment, existing RL-based methods enable evasion of Windows PE malware detectors. However, obtaining evasion rewards as positive feedback in the black-box setting proves challenging, resulting in low training efficiency. To address this issue, we introduce the intrinsic curiosity reward into the framework to motivate the agent to explore unknown state spaces and learn effective evasion strategies. Additionally, we employ the generative adversarial network (GAN) to obtain varying synthetic data, which replaces random or benign bytes as adversarial payloads for the agent's action content, improving attack capabilities and reducing the risk of hard-coded adversarial perturbations being anchored. We compare the attack performance with other RL-based baseline methods, and experimental results show that our framework is more flexible and effective, achieving a 63%-85% attack success rate against EMBER, FireEye and MalConv. Even if defensive measures are taken, the proposed method still has a certain attack capability, and the success rate remains between 48%-67%.

Segment Shards: Cross-Prompt Adversarial Attacks against the Segment Anything Model

Foundation models play an increasingly pivotal role in the field of deep neural networks. Given that deep neural networks are widely used in real-world systems and are generally susceptible to adversarial attacks, securing foundation models becomes a key research issue. However, research on adversarial attacks against the Segment Anything Model (SAM), a visual foundation model, is still in its infancy. In this paper, we propose the prompt batch attack (PBA), which can effectively attack SAM, making it unable to capture valid objects or even generate fake shards. Extensive experiments were conducted to compare the adversarial attack performance among optimizing without prompts, optimizing all prompts, and optimizing batches of prompts as in PBA. Numerical results on multiple datasets show that the cross-prompt attack success rate (ASR∗) of the PBA method is 17.83% higher on average, and the attack success rate (ASR) is 20.84% higher. It is proven that PBA possesses the best attack capability as well as the highest cross-prompt transferability. Additionally, we introduce a metric to evaluate the cross-prompt transferability of adversarial attacks, effectively fostering research on cross-prompt attacks. Our work unveils the pivotal role of the batched prompts technique in cross-prompt adversarial attacks, marking an early and intriguing exploration into this area against SAM.

DifAttack: Query-Efficient Black-Box Adversarial Attack via Disentangled Feature Space

This work investigates efficient score-based black-box adversarial attacks with high Attack Success Rate (ASR) and good generalizability. We design a novel attack method based on a Disentangled Feature space, called DifAttack, which differs significantly from the existing ones operating over the entire feature space. Specifically, DifAttack firstly disentangles an image's latent feature into an adversarial feature and a visual feature, where the former dominates the adversarial capability of an image, while the latter largely determines its visual appearance. We train an autoencoder for the disentanglement by using pairs of clean images and their Adversarial Examples (AEs) generated from available surrogate models via white-box attack methods. Eventually, DifAttack iteratively optimizes the adversarial feature according to the query feedback from the victim model until a successful AE is generated, while keeping the visual feature unaltered. In addition, due to the avoidance of using surrogate models' gradient information when optimizing AEs for black-box models, our proposed DifAttack inherently possesses better attack capability in the open-set scenario, where the training dataset of the victim model is unknown. Extensive experimental results demonstrate that our method achieves significant improvements in ASR and query efficiency simultaneously, especially in the targeted attack and open-set scenarios. The code is available The code is available at https://github.com/csjunjun/DifAttack.git.

Mirage: cyber deception against autonomous cyber attacks in emulation and simulation

AbstractAs the capabilities of cyber adversaries continue to evolve, now in parallel to the explosion of maturing and publicly-available artificial intelligence (AI) technologies, cyber defenders may reasonably wonder when cyber adversaries will begin to also field these AI technologies. In this regard, some promising (read: scary) areas of AI for cyber attack capabilities are search, automated planning, and reinforcement learning. As such, one possible defensive mechanism against future AI-enabled adversaries is that of cyber deception. To that end, in this work, we present and evaluate Mirage, an experimentation system demonstrated in both emulation and simulation forms that allows for the implementation and testing of novel cyber deceptions designed to counter cyber adversaries that use AI search and planning capabilities.

Model of current threats to security of confiden-tial data in divisional information systems

The paper proposes a model for determining actual threats to the information security of distributed information systems, based on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, uses sufficient and necessary indicators, excludes expert errors, increases the detection of the number of actual threats to information security of distributed systems by 5 %, reduces the cost of purchasing information protection equipment from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the distributed information system, the list of existing protection tools in the distributed information system.
 The proposed approach differs from existing ones in the following: lack of involvement of highly qualified specialists in the field of information security; the process is automated, has a low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types.
 The task of ensuring the security of confidential information becomes the most urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet.
 Existing methods of modeling current threats to information security and assessing the effectiveness of the information protection system cannot be used at all stages of the life cycle of distributed information systems - they do not take into account the following indicators in the complex: IT infrastructure of distributed information systems, current threats to information security, security requirements for confidential information, a list of means of protecting confidential information and their value as important indicators when solving these problems.
 In order to achieve the goals of ensuring the security of confidential information, it is necessary to: organize the effective creation of an information protection system (information security system), effective modeling (identification of the list) of current threats to information security, identification of the current violator, and also provide the opportunity to conduct a qualitative assessment of the effectiveness of the information security (protection) system.
 One of the most important tasks of ensuring the security of confidential information is the assessment of the effectiveness of the protection (security) system. In this regard, the goal of the work (research) is to improve the quality of the evaluation of the effectiveness of the protection (security) systems of distributed information systems by determining sufficient and necessary evaluation indicators using modern (promising) information technologies that allow the most effective solution of the following tasks: determination operating parameters of adaptive production fuzzy neural systems, which are most suitable for solving the tasks, application of Data Science technologies in data processing, fuzzy output algorithms.

An approach to describing the courses of air enemy action using intelligent information technologies

The article analyzes the approach to describing the courses of air enemy action for further automation of the decision-making process for air enemy destruction. The analysis has shown that the development of air attack capabilities justifies the necessity to increase the level of efficiency in the decision-making process by responsible persons through the introduction of intelligent information technologies, such as expert systems and decision support systems, into the automation complexes of the Air Force. It is proposed to use the calculation of first-order predicates to formalize knowledge and aggregate it in the form of a knowledge base that will allow the decision maker to deploy his air defense forces and means to effectively destroy means of air attack.

Detection and isolation of wormhole nodes in wireless ad hoc networks based on post-wormhole actions

The wormhole attack is one of the most treacherous attacks projected at the routing layer that can bypass cryptographic measures and derail the entire communication network. It is too difficult to prevent a priori; all the possible countermeasures are either too expensive or ineffective. Indeed, literature solutions either require expensive hardware (typically UWB or secure GPS transceivers) or pose specific constraints to the adversarial behavior (doing or not doing a suspicious action). The proposed solution belongs to the second category because the adversary is assumed to have done one or more known suspicious actions. In this solution, we adopt a heuristic approach to detect wormholes in ad hoc networks based on the detection of their illicit behaviors. Wormhole and post wormhole attacks are often confused in literature; that’s why we clearly state that our methodology does not provide a defence against wormholes, but rather against the actions that an adversary does after the wormhole, such as packet dropping, tampering with TTL, replaying and looping, etc. In terms of contributions, the proposed solution addresses the knock-out capability of attackers that is less targeted by the researcher’s community. In addition, it neither requires any additional hardware nor a change in it; instead, it is compatible with the existing network stack. The idea is simulated in ns2.30, and the average detection rate of the proposed solution is found to be 98-99%. The theoretical time to detect a wormhole node lies between 0.07-0.71 seconds. But, from the simulation, the average detection and isolation time is 0.67 seconds. In term of packet loss, the proposed solution has a relatively overhead of ≈\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\approx$$\\end{document} 22%. It works well in static and mobile scenarios, but the frame losses are higher in mobile scenarios as compared to static ones. The computational complexity of the solution is O(n). Simulation results advocate that the solution is effective in terms of memory, processing, bandwidth, and energy cost. The solution is validated using statistical parameters such as Accuracy, Precision, F1-Score and Matthews correlation coefficient (Mcc\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$M_{cc}$$\\end{document}).

Optical Asymmetric Cryptosystem Based on Dynamic Foveated Imaging and Bidimensional Empirical Mode Decomposition

In this paper, we propose an asymmetric cryptosystem based on dynamic foveated imaging and bidimensional empirical mode decomposition (BEMD). Firstly, a novel dynamic foveated imaging algorithm is developed to transform a plaintext image to a globally ambiguous and locally clear image. Then, the image is passed through a phase-truncated Fourier transform system to generate a white noise image. The resulting image is encoded using BEMD to produce an encrypted image. The proposed cryptosystem offers two distinct decryption methods, allowing the receiver to obtain a decrypted image from a specific frame or a combination of frames, depending on the unique keys. This encryption scheme significantly expands the key space and strengthens the system’s anti-iterative attack capability. Numerical simulation results demonstrate the effectiveness, security and robustness of the proposed cryptosystem.

Improving Threat Mitigation Through a Cybersecurity Risk Management Framework: A Computational Design Science Approach

ABSTRACT Cyberattacks have been increasing in volume and intensity, necessitating proactive measures. Cybersecurity risk management frameworks are deployed to provide actionable intelligence to mitigate potential threats by analyzing the available cybersecurity data. Existing frameworks, such as MITRE ATT&CK, provide timely mitigation strategies against attacker capabilities yet do not account for hacker data when developing cyber threat intelligence. Therefore, we developed a novel information technology artifact, ATT&CK-Link, which incorporates a novel transformer and multi-teacher knowledge distillation design, to link hacker threats to this broadly used framework. Here, we illustrated how hospital systems can use this framework to proactively protect their cyberinfrastructure against hacker threats. Our ATT&CK-Link framework has practical implications for cybersecurity professionals, who can implement our framework to generate strategic, operational, and tactical cyber threat intelligence. ATT&CK-Link also contributes to the information systems knowledge base by providing design principles to pursue targeted cybersecurity analytics, risk management, and broader text analytics research through simultaneous multi-modal (e.g., text and code) distillation and classification.

On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving.

The existence of real-world adversarial examples (RWAEs) (commonly in the form of patches) poses a serious threat for the use of deep learning models in safety-critical computer vision tasks such as visual perception in autonomous driving. This article presents an extensive evaluation of the robustness of semantic segmentation (SS) models when attacked with different types of adversarial patches, including digital, simulated, and physical ones. A novel loss function is proposed to improve the capabilities of attackers in inducing a misclassification of pixels. Also, a novel attack strategy is presented to improve the expectation over transformation (EOT) method for placing a patch in the scene. Finally, a state-of-the-art method for detecting adversarial patch is first extended to cope with SS models, then improved to obtain real-time performance, and eventually evaluated in real-world scenarios. Experimental results reveal that even though the adversarial effect is visible with both digital and real-world attacks, its impact is often spatially confined to areas of the image around the patch. This opens to further questions about the spatial robustness of real-time SS models.

An anti-impersonation attack electronic health record sharing scheme based on proxy re-encryption and blockchain.

Many current electronic medical record (EMR) sharing schemes that use proxy re-encryption and blockchain do not fully consider the potential threat of malicious node impersonation attacks. This oversight could lead to data leakage as attackers masquerade as legitimate users or proxy nodes during the sharing process. To deal with this problem, we propose an EMR sharing scheme based on proxy re-encryption and blockchain to protect against impersonation attacks. First, we prevent the potential threat of impersonation attacks by generating a shared temporary key and assigning tasks to multiple proxy nodes. Second, we use a random function to ensure that the selection of encrypted proxy nodes is fair. Third, we use a combination of blockchain and the InterPlanetary File System to solve the problem of insufficient storage capacity of shared processes and ensure the storage security of EMRs. Through the security proof, our scheme guarantees anti-impersonation, anti-collusion, and anti-chosen plaintext attack capability in the sharing process of EMRs. Additionally, experiments on the blockchain platform, namely Chain33, show that our scheme significantly increases efficiency.