Attack Model Research Articles

Consensus-Based Power System State Estimation Algorithm Under Collaborative Attack

Due to its vulnerability to a variety of cyber attacks, research on cyber security for power systems has become especially crucial. In order to maintain the safe and stable operation of power systems, it is worthwhile to gain insight into the complex characteristics and behaviors of cyber attacks from the attacker’s perspective. The consensus-based distributed state estimation problem is investigated for power systems subject to collaborative attacks. In order to describe such attack behaviors, the denial of service (DoS) attack model for hybrid remote terminal unit (RTU) and phasor measurement unit (PMU) measurements, and the false data injection (FDI) attack model for neighboring estimation information, are constructed. By integrating these two types of attack models, a different consensus-based distributed estimator is designed to accurately estimate the state of the power system under collaborative attacks. Then, through Lyapunov stability analysis theory, a sufficient condition is provided to ensure that the proposed distributed estimator is stable, and a suitable consensus gain matrix is devised. Finally, to confirm the viability and efficacy of the suggested algorithm, a simulation experiment on an IEEE benchmark 14-bus power system is carried out.

Jamming Attacks Detection Based on IGWO for Optimization of Fast Correlation-Based Feature extraction in Wireless Communication

Background: Wireless networks are essential communication technologies that prevent cable installation prices and burdens. Because of this technology's pervasive usage, wireless network safety is a significant problem. Owing to distributed and open wireless medium aspects, attackers might use different jamming methods to exploit physical and MAC layer protocol vulnerabilities. In addition, jamming attacks require to be accurately grouped so that suitable countermeasures can be considered. Given the potential severity of such attacks, precisely identifying and classifying them is critical for implementing effective responses. The motivation for this paper is the need to improve the detection and categorization of jamming signals using modern machine learning algorithms, consequently enhancing wireless network security and reliability. Objective: In this paper, we compare some machine learning models' efficiency for diagnosing jamming signals. Methods: Such algorithms refer to support vector machine (SVM) and k-nearest neighbors (KNN). We checked the signal features that recognize jamming signals. After the jamming attack model, the developed grey wolf optimizer version known as IGWO (improved grey wolf optimizer) has been discussed for feature extraction of software usability. Four separate metrics were employed as features to detect jamming attacks in order to evaluate the machine learning models. This novel feature extraction method is crucial for improving the accuracy of jamming detection. Results: The measurements of these parameters were gathered through a simulation of a real setting. And generated a large dataset using these parameters. Conclusion: The simulation results illustrate that the KNN algorithm based on jamming detection could diagnose jammers having a minimal likelihood of false alarms and a high level of accuracy.

Feasibility study of data-driven wall interference correction framework for subsonic wind tunnel

Although the classical method is widely used for wall interference correction in wind tunnel testing, its reliability and accuracy for complex and unconventional geometries are rather limited. Studies on the evaluation of wall interference and the improvement of correction methods are desirable to enhance the reliability and generality for various geometric configurations. This study proposes a wall interference correction framework based on a deep neural network (DNN) ensemble using data obtained from the numerical panel method. The panel method is validated by comparing the results with those of Reynolds-averaged Navier-Stokes simulations. An automated process was established to generate a large amount of training data, and 600,000 datasets were generated based on the geometric parameters of the wind tunnel, test model, and angles of attack. The input variables of the DNN were determined through sensitivity analysis of the data. To alleviate the randomness of the initial weights and data distribution in the generation process of the DNN model, 20 DNNs with the same multi-layer perceptron structure were trained, and a DNN ensemble model was constructed using five ensemble members with high predictability. The accuracy of the DNN-ensemble based correction models were evaluated by comparing the correction results for the testing data.

Security of partially corrupted quantum repeater networks

Abstract Quantum Key Distribution allows two parties to establish a secret key that is secure against computationally unbounded adversaries. To extend the distance between parties, quantum networks are vital. Typically, security in such scenarios assumes the absolute worst case: namely, an adversary has complete control over all repeaters and fiber links in a network and is able to replace them with perfect devices, thus allowing her to hide her attack within the expected natural noise. In a large-scale network, however, such a powerful attack may be infeasible. In this paper, we analyze the case where the adversary can only corrupt a subset of the repeater network connecting Alice and Bob, while some portion of the network near Alice and Bob may be considered safe from attack (though still noisy). We derive a rigorous finite key proof of security assuming this attack model, and show that improved performance and noise tolerances are possible. Our proof methods may be useful to other researchers investigating partially corrupted quantum networks, and our main result may be beneficial to future network operators.

Catch the Cyber Thief: A Multi-Dimensional Asymmetric Network Attack–Defense Game

This paper presents a novel multi-dimensional asymmetric game model for network attack–defense decision-making, called “Catch the Cyber Thief”. The model is built upon the concept of partially observable stochastic games (POSG) and is designed to systematically incorporate multi-dimensional asymmetry into network attack–defense problems. The attack agent is called a “thief” who wants to control a key host by exploring the unfamiliar network environment, and the defense agent is called a “police” who needs to catch the opponent before its goal is accomplished. The results indicate that the asymmetry of network attack and defense is not only influenced by attack and defense strategies but also by spatio-temporal factors such as the attacker’s initial position, network topology, and defense lag time. In addition, we have found that there may exist the “attack rhythm,” which makes “how to maintain a good attack rhythm” and “how to generate a robust defense strategy against different attackers” worth exploring. Compared with existing attack–defense game models, our game model can better generate a direct mapping relationship with real elements, enabling us to understand network attack and defense interactions better, recognize security risks, and design defense strategies that can directly serve real-world decision-making.

Risk Assessment of UAV Cyber Range Based on Bayesian–Nash Equilibrium

In order to analyze the choice of the optimal strategy of cyber security attack and defense in the unmanned aerial vehicles’ (UAVs) cyber range, a game model-based UAV cyber range risk assessment method is constructed. Through the attack and defense tree model, the risk assessment method is calculated. The model of attack and defense game with incomplete information is established and the Bayesian–Nash equilibrium of mixed strategy is calculated. The model and method focus on the mutual influence of the actions of both sides and the dynamic change in the confrontation process. According to the calculation methods of different benefits of different strategies selected in the offensive and defensive game, the risk assessment and calculation of the UAV cyber range are carried out based on the probability distribution of the defender’s benefits and the attacker’s optimal strategy selection. An example is given to prove the feasibility and effectiveness of this method.

Formal Security Analysis of the OpenID FAPI 2.0 Family of Protocols: Accompanying a Standardization Process

FAPI 2.0 is a suite of Web protocols developed by the OpenID Foundation’s FAPI Working Group (FAPI WG) for third-party data sharing and digital identity in high-risk environments. Even though the specifications are not completely finished, several important entities have started to adopt the FAPI 2.0 protocols, including Norway’s national HelseID, Australia’s Consumer Data Standards, as well as private companies like Authlete and Australia-based connectID; the predecessor FAPI 1.0 is in widespread use with millions of users. The FAPI WG asked us to accompany the standardization of the FAPI 2.0 protocols with a formal security analysis to proactively identify vulnerabilities before widespread deployment and to provide formal security guarantees for the standards. In this paper, we report on our analysis and findings. Our analysis is based on a detailed model of the Web infrastructure, the so-called Web Infrastructure Model (WIM), which we extend to be able to carry out our analysis of the FAPI 2.0 protocols including important extensions like FAPI-CIBA. Based on the (extended) WIM and formalizations of the security goals and attacker model laid out in the FAPI 2.0 specifications, we provide a formal model of the protocols and carry out a formal security analysis, revealing several attacks. We have worked with the FAPI WG to fix the protocols, resulting in several amendments to the specifications. With these changes in place, we have adjusted our protocol model and formally proved that the security properties hold true under the strong attacker model defined by the FAPI WG.

Modeling and detection of false data injection attacks in cyber-physical distribution system with load aggregator interaction

With the increasing number of users and multi-type loads accessing the cyber–physical distribution system (CPDS), the bidirectional interaction between the system becomes more and more frequent. The Load aggregator (LA) also plays an increasingly important role in the interaction process. However, the LA’s high dependence on information and lack of security measures make it vulnerable to attacks, so this paper analyzes the interactive security of the LAs from two points. Considering the game process between the LAs and users from the attacker’s point of view, this paper puts forward an attack strategy aiming cost function of the LAs, establishes a bi-level multi-objective programming attack model of false data injection attacks(FDIAs), and proposes an attack detection method based on the multi-state matching method and improved similar daily data preprocessing generative adversarial network (P-GAN) from the defender’s point of view to defend against the above attack strategy. Furthermore, a hybrid detection mechanism combining event triggering and periodic detection is proposed to ensure response speed and adaptability of detection. The effectiveness of the proposed attack model and the detection method is verified by simulation analysis.

Secure distributed estimation via an average diffusion LMS and average likelihood ratio test

Secure distributed estimation algorithms are designed to protect against a spectrum of attacks by exploring different attack models and implementing strategies to enhance the resilience of the algorithm. These models encompass diverse scenarios such as measurement sensor attacks and communication link attacks, which have been extensively investigated in existing literature. This paper, however, focuses on a specific type of attack: the multiplicative sensor attack model. To counter this, the paper introduces the Average diffusion least mean square (ADLMS) algorithm as a viable solution. Furthermore, the paper introduces the Average Likelihood Ratio Test (ALRT) detector, which provides a straightforward detection criterion. In the presence of communication link attacks, the paper considers the manipulation attack model and presents an ALRT adversary detector. The analysis extends to these ALRT detectors, encompassing the calculation of adversary detection probability and false alarm probability, both achieved in closed form. The paper also provides the mean convergence analysis of the proposed ADLMS algorithm. Simulation results reveal that the proposed algorithms exhibit enhanced performance compared to the DLMS algorithm, while the incremental complexity remains only marginally higher than that of the DLMS algorithm.

New Adversarial Image Detection Based on Sentiment Analysis.

Deep neural networks (DNNs) are vulnerable to adversarial examples, while adversarial attack models, e.g., DeepFool, are on the rise and outrunning adversarial example detection techniques. This article presents a new adversarial example detector that outperforms state-of-the-art detectors in identifying the latest adversarial attacks on image datasets. Specifically, we propose to use sentiment analysis for adversarial example detection, qualified by the progressively manifesting impact of an adversarial perturbation on the hidden-layer feature maps of a DNN under attack. Accordingly, we design a modularized embedding layer with the minimum learnable parameters to embed the hidden-layer feature maps into word vectors and assemble sentences ready for sentiment analysis. Extensive experiments demonstrate that the new detector consistently surpasses the state-of-the-art detection algorithms in detecting the latest attacks launched against ResNet and Inception neutral networks on the CIFAR-10, CIFAR-100, and SVHN datasets. The detector only has about 2 million parameters and takes less than 4.6 ms to detect an adversarial example generated by the latest attack models using a Tesla K80 GPU card.

Link Stealing Attacks Against Inductive Graph Neural Networks

A graph neural network (GNN) is a type of neural network that is specifically designed to process graph-structured data. Typically, GNNs can be implemented in two settings, including the transductive setting and the inductive setting. In the transductive setting, the trained model can only predict the labels of nodes that were observed at the training time. In the inductive setting, the trained model can be generalized to new nodes/graphs. Due to its flexibility, the inductive setting is the most popular GNN setting at the moment. Previous work has shown that transductive GNNs are vulnerable to a series of privacy attacks. However, a comprehensive privacy analysis of inductive GNN models is still missing. This paper fills the gap by conducting a systematic privacy analysis of inductive GNNs through the lens of link stealing attacks. We propose two types of link stealing attacks, i.e., posterior-only attacks and combined attacks. We define threat models of the posterior-only attacks with respect to node topology and the combined attacks by considering combinations of posteriors, node attributes, and graph features. Extensive evaluation on six real-world datasets demonstrates that inductive GNNs leak rich information that enables link stealing attacks with advantageous properties. Even attacks with no knowledge about graph structures can be effective. We also show that our attacks are robust to different node similarities and different graph features. As a counterpart, we investigate two possible defenses and discover they are ineffective against our attacks, which calls for more effective defenses.

A detection model for false data injection attacks in smart grids based on graph spatial features using temporal convolutional neural networks

Due to the intelligence and opening of future generation cyber–physical power systems, smart grids are vulnerable to the emergency of cyber-attacks aiming at the cyber–physical systems. Among these attacks, false data injection (FDI) attacks are particularly concerning in smart grids due to their stealthiness. Attackers can tamper with data transmitted through communication networks, influencing the analysis results of the control center, leading it to make wrong decisions and thereby undermining the stability of smart grids. The inability of traditional bad data detection models to detect false data injection attacks poses huge security risks to smart grids. For this reason, a new attack detection model using spatial–temporal features is proposed. The proposed detection model includes the following two parts: spatial features extraction and temporal convolutional network. First, graph convolutional operations are employed to disentangle the interactions among buses and extract spatial features of measurement; Then, the temporal convolutional network model is used to extract the temporal features. Through these processes, the proposed detection model can effectively identify the injected false data injection attacks in smart grids. The detection performance and robustness of the proposed FDI attack detection model are tested through simulations on IEEE 14-bus and 118-bus grid systems.

SeCTIS: A framework to Secure CTI Sharing

The rise of IT-dependent operations in modern organizations has heightened their vulnerability to cyberattacks. Organizations are inadvertently enlarging their vulnerability to cyber threats by integrating more interconnected devices into their operations, which makes these threats both more sophisticated and more common. Consequently, organizations have been compelled to seek innovative approaches to mitigate the menaces inherent in their infrastructure. In response, considerable research efforts have been directed towards creating effective solutions for sharing Cyber Threat Intelligence (CTI). Current information-sharing methods lack privacy safeguards, leaving organizations vulnerable to proprietary and confidential data leaks. To tackle this problem, we designed a novel framework called SeCTIS (Secure Cyber Threat Intelligence Sharing), integrating Swarm Learning and Blockchain technologies to enable businesses to collaborate, preserving the privacy of their CTI data. Moreover, our approach provides a way to assess the data and model quality and the trustworthiness of all the participants leveraging some validators through Zero Knowledge Proofs. Extensive experimentation has confirmed the accuracy and performance of our framework. Furthermore, our detailed attack model analyzes its resistance to attacks that could impact data and model quality.

Stochastic Evolutionary Analysis of an Aerial Attack–Defense Game in Uncertain Environments

Aiming at the problem of random environment interference in the process of strategy interaction and the behavioral evolution of an aerial attack–defense game, this paper considers the influence of the difference in the performance and value between both game players in terms of strategy evolution; explores the randomness of the complex battlefield environment, the uncertainty of the behavioral state of game players, and the limitations of the emergent situation; constructs a mathematical model of the stochastic evolution of an aerial-coordinated attack–defense game in uncertain environments; and studies the stability of the strategy interaction and behavioral decision-making process of both players of the aerial attack–defense game. Simulation results show that many factors of the performance and value between both game players have a greater impact on the strategy evolution trend in both game players, which not only causes changes in the results of the strategy selection but also affects the rate of strategy evolution for the game players. In addition, random environmental factors cause a certain degree of interference to the strategy evolution process of the game players, which usually accelerates the game players’ strategy evolution rate and greatly affects the evolution process of the game players’ strategy. This study can provide a theoretical basis and feasible reference for improving mission decision-making, response mechanisms, and system modeling of an aerial attack–defense game, which has important theoretical value and practical significance.

A Convolution Neural Network and Genetic Algorithm-based Abnormity Detection Model for Cyber Attacks

A Convolution Neural Network and Genetic Algorithm-based Abnormity Detection Model for Cyber Attacks

Intelligent Trajectory Prediction Algorithm for Hypersonic Vehicle Based on Sparse Associative Structure Model

The Hypersonic Glide Vehicle (HGV) has become a focal point in military competitions among nations. Predicting the real-time trajectory of an HGV is of significant importance for aerospace defense interception and assessing enemy combat intentions. Existing prediction methods are limited by the need for large data samples and poor general applicability. To address these challenges, this paper presents a novel trajectory forecasting approach based on the Sparse Association Structure Model (SASM). The SASM can uncover the relationship among known data, transfer associative relationships to unknown data, and improve the generalization of the model. Firstly, a trajectory database is established for different maneuvering modes based on the six-degree-of-freedom motion equations and models of attack and bank angles of the HGV. Subsequently, three trajectory parameters are selected as prediction variables according to the maneuvering characteristics of the HGV. A parameters prediction model based on the SASM is then constructed to predict trajectory parameters. The SASM model demonstrates high accuracy and generalization in forecasting the trajectories of three different HGV types. Experimental results show a 50.35% reduction in prediction error and a 48.7% decrease in average processing time compared to the LSTM model, highlighting the effectiveness of the proposed method for real-time trajectory forecasting.

An effective attack detection framework using multi-scale depth-wise separable 1DCNN via fused grasshopper-based lemur optimizer in IoT routing system

A secured IoT routing model against different attacks has been implemented to detect attacks like replay attacks, version attacks, and rank attacks. These attacks cause certain issues like energy depletion, minimized packet delivery, and loop creation. By mitigating these issues, an advanced attack detection approach for secured IoT routing techniques with a deep structured scheme is promoted to attain an efficient attack detection rate over the routing network. In the starting stage, the aggregation of data is done with the help of IoT networks. Then, the selected weighted features are subjected to the Multiscale Depthwise Separable 1-Dimensional Convolutional Neural Networks (MDS-1DCNN) approach for attack detection, in which the parameters in the 1-DCNN are tuned with the aid of Fused Grasshopper-aided Lemur Optimization Algorithm (FG-LOA). The parameter optimization of the FG-LOA algorithm is used to enlarge the efficacy of the approach. Especially, the MDS-1DCNN model is used to detect different attacks in the detection phase. The attack nodes are mitigated during the routing process using the developed FG-LOA by formulating the fitness function based on certain variables such as shortest distance, energy, path loss and delay, and so on in the routing process. Finally, the performances are examined through the comparison with different traditional methods. From the validation of outcomes, the accuracy value of the developed attack detection model is 96.87%, which seems to be better than other comparative techniques. Also, the delay analysis of the routing model based on FG-LOA is 17.3%, 12.24%, 10.41%, and 15.68% more efficient than the classical techniques like DHOA, HBA, GOA, and LOA, respectively. Hence, the effectualness of the offered approach is more enriched than the baseline approaches and also it has mitigated diverse attacks using secured IoT routing and different attack models.

On emergent mobile phone-based social engineering cyberattacks in developing countries: The case of the Zambian ICT sector

The number of registered SIM cards and active mobile phone subscribers in Zambia in 2020 surpassed the population of the country. This development and the integration of mobile phone systems with financial payment systems has not come without a cost. Cyberattackers, using various social engineering techniques have jumped onto the bandwagon to defraud unsuspecting users. Considering the aforesaid, this paper presents a high-order analytical approach towards mobile phone-based social engineering cyberattacks (phishing, SMishing, and vishing) in Zambia which seek to defraud benign victims. This paper presents a baseline study to reiterate the problem at hand. The research used a mixed-methods approach, combining quantitative and qualitative data, and adopted a hybrid descriptive research design. Furthermore, an attack model and an evaluation framework were devised to ascertain the most prevalent types of mobile phone-based cyberattacks. Based on logistic regression analysis, the findings indicate that the most prevalent type of mobile phone-based social engineering cyberattack in Zambia is SMishing. Based on the results and observed insights, recommendations to mitigate these emergent social engineering cyberattacks were suggested. This research serves as a valuable baseline for understanding and addressing the growing challenges posed by mobile phone-based cyberattacks in Zambia's evolving technological landscape.

Sample selection of adversarial attacks against traffic signs

In the real world, the correct recognition of traffic signs plays a crucial role in vehicle autonomous driving and traffic monitoring. The research on its adversarial attack can test the security of vehicle autonomous driving system and provide enlightenment for improving the recognition algorithm. However, with the development of transportation infrastructure, new traffic signs may be introduced. The adversarial attack model for traffic signs needs to adapt to the addition of new types. Based on this, class incremental learning for traffic sign adversarial attacks has become an interesting research field. We propose a class incremental learning method for adversarial attacks on traffic signs. First, this method uses Pinpoint Region Probability Estimation Network (PRPEN) to predict the probability of each pixel being attacked in old samples. It helps to identify the high attack probability regions of the samples. Subsequently, based on the size of high probability pixel concentration area, the replay sample set is constructed. Old samples with smaller concentration areas receive higher priority and are prioritized for incremental learning. The experimental results show that compared with other sample selection methods, our method selects more representative samples and can train PRPEN more effectively to generate probability maps, thereby better generating adversarial attacks on traffic signs.

Secured web application based on CapsuleNet and OWASP in the cloud

The tremendous use of sensitive and consequential information in the advanced web application confronts the security issues. To defend the web application while it processing the information must requires the security system. The detection of attacks of web is made by the payload or HTTP request-based detection in association with the scholars. Some of the scholars provide secured attack model detection; however, it fails to achieve the optimal detection accuracy. In concern with these issues, we propose an innovative technique for the attack detection the web applications. The proposed attack detection is based on the novel deep CapsuleNet based technique and the process begins with pre-processing steps known as decoding, generalization, tokenization/standardization and vectorization. After the pre-processing steps the information are passed to deep CapsuleNet for extracting the features for attaining the temporal dependencies from the sequential data. The subtle patterns in the information also detected using the proposed work. Simulation is effectuated to demonstrate the effectiveness of the proposed work and compared with other existing works. Our proposed system provides better accuracy in detecting the attacks than the state-of-art works.