Attack Profiles Research Articles

A Novel Strategy for Hypersonic Vehicle With Complex Distributed No-Fly Zone Constraints

Aiming at solving trajectory planning problem with complex distributed no-fly zone constraints, this paper proposed a novel obstacle avoidance strategy. For longitudinal motion, an angle of attack adjustment method is employed to adjust lift and design the angle of attack profile, while adjusting the bank angle for range and altitude correction to meet terminal constraints. For lateral motion, this paper developed enhanced attractive, repulsive, and velocity potential fields. Combined with the proposed repulsive force reconstruction method, this effectively resolves the overmaneuvering problem of traditional artificial potential field methods (APFMs) for vehicle. In order to avoid mismatched magnitudes of attractive and repulsive forces, a complementary no-fly zone avoidance strategy based on minimum turn radius is introduced, updating the bank angle command during no-fly zone avoidance. Simulation results indicate that the proposed strategy can address the avoidance of sudden threat, proving to be feasible and effective for handling complex distributed no-fly zone avoidance problems.

A rapid time-coordinated longitudinal guidance method for high-speed vehicle

Compared to the traditional method of adjusting flight time by increasing lateral maneuverability [1-2], a faster time-coordinated longitudinal guidance method for unpowered high-speed vehicles has been proposed in this paper. Firstly, the centroid dynamics model and flight constraint model of unpowered high-speed vehicles were established, and the angle of attack corridor was derived based on quasi-equilibrium gliding conditions (QEGC). Then, to plan a reasonable angle of attack profile, the flight capability of a single vehicle under different constant angles of attack is analyzed, including terminal altitude, terminal velocity, and terminal arrival time. Furthermore, to achieve a long-term high angle of attack flight, a rapid time-coordinated longitudinal guidance method based on a trapezoidal angle of attack profile was proposed. Finally, using the vehicle and its performance parameters from Chapter 3 [3], numerical simulations were conducted under nominal tasks and multi-vehicle collaborative tasks. The simulation results show that under different expected arrival times, this method can quickly plan the angle of attack profile that satisfies time constraints, with high computational efficiency. Moreover, the arrival time adjustment ability of this method is large, which can fully utilize the arrival time capability of the high-speed vehicle. The above research provides more convenient conditions for a collaborative flight of multiple vehicles.

Unsupervised contaminated user profile identification against shilling attack in recommender system

A recommender system is susceptible to manipulation through the injection of carefully crafted profiles. Some recent profile identification methods only perform well in specific attack scenarios. A general attack detection method is usually complicated or requires label samples. Such methods are prone to overtraining easily, and the process of annotation incurs high expenses. This study proposes an unsupervised divide-and-conquer method aiming to identify attack profiles, utilizing a specifically designed model for each kind of shilling attack. Initially, our method categorizes the profile set into two attack types, namely Standard and Obfuscated Behavior Attacks. Subsequently, profiles are separated into clusters within the extracted feature space based on the identified attack type. The selection of attack profiles is then determined through target item analysis within the suspected cluster. Notably, our method offers the advantage of requiring no prior knowledge or annotation. Furthermore, the precision is heightened as the identification method is designed to a specific attack type, employing a less complicated model. The outstanding performance of our model, validated through experimental results on MovieLens-100K and Netflix under various attack settings, demonstrates superior accuracy and reduced running time compared to current detection methods in identifying Standard and Obfuscated Behavior Attacks.

FLAD: Adaptive Federated Learning for DDoS attack detection

Federated Learning (FL) has been recently receiving increasing consideration from the cybersecurity community as a way to collaboratively train deep learning models with distributed profiles of cyber threats, with no disclosure of training data. Nevertheless, the adoption of FL in cybersecurity is still in its infancy, and a range of practical aspects have not been properly addressed yet. Indeed, the Federated Averaging algorithm at the core of the FL concept requires the availability of test data to control the FL process. Although this might be feasible in some domains, test network traffic of newly discovered attacks cannot be always shared without disclosing sensitive information. In this paper, we address the convergence of the FL process in dynamic cybersecurity scenarios, where the trained model must be frequently updated with new recent attack profiles to empower all members of the federation with the latest detection features. To this aim, we propose FLAD (adaptive Federated Learning Approach to DDoS attack detection), an FL solution for cybersecurity applications based on an adaptive mechanism that orchestrates the FL process by dynamically assigning more computation to those members whose attacks profiles are harder to learn, without the need of sharing any test data to monitor the performance of the trained model. Using a recent dataset of DDoS attacks, we demonstrate that FLAD outperforms state-of-the-art FL algorithms in terms of convergence time and accuracy across a range of unbalanced datasets of heterogeneous DDoS attacks. We also show the robustness of our approach in a realistic scenario, where we retrain the deep learning model multiple times to introduce the profiles of new attacks on a pre-trained model.

The Detection of False Data Injection Attack for Cyber–Physical Power Systems Considering a Multi-Attack Mode

Amidst the evolving communication technology landscape, conventional distribution networks have gradually metamorphosed into cyber–physical power systems (CPPSs). Within this transformative milieu, the cyber infrastructure not only bolsters grid security but also introduces a novel security peril—the false data injection attack (FDIA). Owing to the variable knowledge held by cyber assailants regarding the system’s network structure, current achievements exhibit deficiencies in accommodating the detection of FDIA across diverse attacker profiles. To address the historical data imbalances encountered during practical FDIA detection, we propose a dataset balancing model based on generating adversarial network-gated recurrent units (GAN-GRU) in conjunction with an FDIA detection model based on the Transformer neural network. Harnessing the temporal data extraction capabilities of gated recurrent units, we construct a GRU neural network system as the GAN’s generator and discriminator, aimed at data balance. After preprocessing, the balanced data are fed into the Transformer neural network for training and output classification to discern distinct FDIA attack types. This model enables precise classification amidst varying FDIA scenarios. Validation involves testing the model on load data from the IEEE 118-bus system and affirming its high accuracy and effectiveness in detecting power systems after multiple attacks.

Analytical reentry guidance framework based on swarm intelligence optimization and altitude-energy profile

Aimed at improving the real-time performance of guidance instruction generation, an analytical hypersonic reentry guidance framework is presented. The key steps of the novel guidance framework are the parameterization of reentry guidance problems and the optimization of parameters. First, a quintic polynomial function of energy was designed to describe the altitude profile. Then, according to the altitude-energy profile, the altitude, velocity, flight path angle, and bank angle were obtained analytically, which naturally met the terminal constraints. In addition, the angle of the attack profile was determined using the velocity parameter. The swarm intelligent optimization algorithms were used to optimize the parameters. The path constraints were enforced by the penalty function method. Finally, extensive simulations were carried out in both nominal and dispersed cases, and the simulation results showed that the proposed guidance framework was effective, high-precision, and robust in different scenarios.

A novel classification‐based shilling attack detection approach for multi‐criteria recommender systems

AbstractRecommender systems are emerging techniques guiding individuals with provided referrals by considering their past rating behaviors. By collecting multi‐criteria preferences concentrating on distinguishing perspectives of the items, a new extension of traditional recommenders, multi‐criteria recommender systems reveal how much a user likes an item and why user likes it; thus, they can improve predictive accuracy. However, these systems might be more vulnerable to malicious attacks than traditional ones, as they expose multiple dimensions of user opinions on items. Attackers might try to inject fake profiles into these systems to skew the recommendation results in favor of some particular items or to bring the system into discredit. Although several methods exist to defend systems against such attacks for traditional recommenders, achieving robust systems by capturing shill profiles remains elusive for multi‐criteria rating‐based ones. Therefore, in this study, we first consider a prominent and novel attack type, that is, the power‐item attack model, and introduce its four distinct variants adapted for multi‐criteria data collections. Then, we propose a classification method detecting shill profiles based on various generic and model‐based user attributes, most of which are new features usually related to item popularity and distribution of rating values. The experiments conducted on three benchmark datasets conclude that the proposed method successfully detects attack profiles from genuine users even with a small selected size and attack size. The empirical outcomes also demonstrate that item popularity and user characteristics based on their rating profiles are highly beneficial features in capturing shilling attack profiles.

Analytic Time Reentry Cooperative Guidance for Multi-Hypersonic Glide Vehicles

Aiming at the cooperative guidance problem of multi-hypersonic glide vehicles, a cooperative guidance method based on a parametric design and an analytical solution of time-to-go is proposed. First, the hypersonic reentry trajectory optimization problem was transformed into a parameter optimization problem. The parameters were optimized to determine the angle of attack profile and the time to enter the altitude velocity reentry corridor. Then, using the quasi-equilibrium glide condition, the estimation form of the remaining flight time was analytically derived to satisfy accurately the cooperative time constraint. Using the remaining time-to-go and range-to-go, combined with the heading angle deviation corridor, the bank angle command was further calculated. Finally, the swarm intelligence optimization algorithm was used to optimize the design parameters to obtain the cooperative guidance trajectory satisfying the time constraint. Simulations showed that the analytical time reentry cooperative guidance algorithm proposed in this paper can accurately meet the time constraints and cooperative flight accuracy. Monte Carlo simulation experiments verified that the proposed algorithm demonstrates a robust performance.

The Empirical Determinants of Violent Nonstate Actor Drone Adoption

Commercial drone advancements have enabled terrorists with crude airpower, challenging states’ aerial dominance. Today, many groups skillfully use drones for propaganda generation, surveillance and reconnaissance, command and control, and attacks. Despite their obvious value, there is wide variation in adoption begging questions about who is using drones and why. Prominent in practitioner and security provider circles, academics are just skimming the surface of this important phenomenon. The small existing literature suggests that violent nonstate actor drone use is little more than Iran-sponsored jihadist terrorists with territory in the Middle East. Using an original data set on characteristics across 998 armed nonstate groups from 1995 to 2019, we explore the empirical determinants of drone adoption. Although Iran-sponsorship is a significant factor, we find that network affiliations are the strongest predictors of adopting a drone program. We also demonstrate that groups with more intensive attack profiles and narco groups are more likely to pursue unmanned aerial systems. Our study provides the first quantitative probe of the drivers of armed nonstate drone use, putting academic assertions and policy prescriptions on firmer empirical ground.

A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber–Physical Attacks

Transportation networks are fundamental to the efficient and safe functioning of modern societies. In the past, physical and cyber space were treated as isolated environments, resulting in transportation network being considered vulnerable only to threats from the physical space (e.g., natural hazards). The integration of Internet of Things-based wireless sensor networks into the sensing layer of critical transportation infrastructure has resulted in transportation networks becoming susceptible to cyber–physical attacks due to the inherent vulnerabilities of IoT devices. However, current vulnerability assessment methods lack details related to the integration of the cyber and physical space in transportation networks. In this paper, we propose a new vulnerability assessment approach for transportation networks subjected to cyber–physical attacks at the sensing layer. The novelty of the approach used relies on the combination of the physical and cyber space, using a Bayesian network attack graph that enables the probabilistic modelling of vulnerability states in both spaces. A new probability indicator is proposed to enable the assignment of probability scores to vulnerability states, considering different attacker profile characteristics and control barriers. A probability-based ranking table is developed that details the most vulnerable nodes of the graph. The vulnerability of the transportation network is measured as a drop in network efficiency after the removal of the highest probability-based ranked nodes. We demonstrate the application of the approach by studying the vulnerability of a transportation network case study to a cyber–physical attack at the sensing layer. Monte Carlo simulations and sensitivity analysis are performed as methods to evaluate the results. The results indicate that the vulnerability of the transportation network depends to a large extent on the successful exploitation of vulnerabilities, both in the cyber and physical space. Additionally, we demonstrate the usefulness of the proposed approach by comparing the results with other currently available methods. The approach is of interest to stakeholders who are attempting to incorporate the cyber domain into the vulnerability assessment procedures of their system.

Cyber Attacker Profiling for Risk Analysis Based on Machine Learning.

The notion of the attacker profile is often used in risk analysis tasks such as cyber attack forecasting, security incident investigations and security decision support. The attacker profile is a set of attributes characterising an attacker and their behaviour. This paper analyzes the research in the area of attacker modelling and presents the analysis results as a classification of attacker models, attributes and risk analysis techniques that are used to construct the attacker models. The authors introduce a formal two-level attacker model that consists of high-level attributes calculated using low-level attributes that are in turn calculated on the basis of the raw security data. To specify the low-level attributes, the authors performed a series of experiments with datasets of attacks. Firstly, the requirements of the datasets for the experiments were specified in order to select the appropriate datasets, and, afterwards, the applicability of the attributes formed on the basis of such nominal parameters as bash commands and event logs to calculate high-level attributes was evaluated. The results allow us to conclude that attack team profiles can be differentiated using nominal parameters such as bash history logs. At the same time, accurate attacker profiling requires the extension of the low-level attributes list.

Modeling and Defense of Social Virtual Reality Attacks Inducing Cybersickness

Social Virtual Reality Learning Environments (VRLE) offer a new medium for flexible and immersive learning environments with geo-distributed users. Ensuring user safety in VRLE application domains such as education, flight simulations, military training is of utmost importance. Specifically, there is a need to study the impact of “immersion attacks” (e.g., chaperone attack, occlusion) and other types of attacks/faults (e.g., unauthorized access, network congestion) that may cause user safety issues (i.e., inducing of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cybersickness</i> ). In this article, we present a novel framework to quantify the security, privacy issues triggered via immersion attacks and other types of attacks/faults. By using a real-world social VRLE viz., vSocial and creating a novel attack-fault tree model, we show that such attacks can induce undesirable levels of cybersickness. Next, we convert these attack-fault trees into stochastic timed automata (STA) representations to perform statistical model checking for a given attacker profile. Using this model checking approach, we determine the most vulnerable threat scenarios that can trigger high occurrence cases of cybersickness for VRLE users. Lastly, we show the effectiveness of our attack-fault tree modeling by incorporating suitable design principles such as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hardening</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">diversity</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">redundancy</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">principle of least privilege</i> to ensure user safety in a VRLE session.

Numerical analysis of wind turbines blade in deep dynamic stall

This study numerically investigates kinematics of dynamic stall, which is a crucial matter in wind turbines. Distinct movements of the blade with the same angle of attack (AOA) profile may provoke the flow field due to their kinematic characteristics. This induction can significantly change aerodynamic loads and dynamic stall process in wind turbines. The simulation involves a 3D NACA 0012 airfoil with two distinct pure-heaving and pure-pitching motions. The flow field over this 3D airfoil was simulated using Delayed Detached Eddy Simulations (DDES). The airfoil begins to oscillate at a Reynolds number of Re = 1.35 × 105. The given attack angle profile remains unchanged for all cases. It is shown that the flow structures differ notably between pure-heaving and pure-pitching motions, such that the pure-pitching motions induce higher drag force on the airfoil than the pure-heaving motion. Remarkably, heaving motion causes excessive turbulence in the boundary layer, and then the coherent structures seem to be more stable. Hence, pure-heaving motion contains more energetic core vortices, yielding higher lift at post-stall. In contrast to conventional studies on the dynamic stall of wind turbines, current results show that airfoils’ kinematics significantly affect the load predictions during the dynamic stall phenomenon.

Design of Threat Response Modeling Language for Attacker Profile Based on Probability Distribution

Threat modeling and simulation (TMS) was aimed at dynamically capturing the features of attacks, which is a challenging job in complex Industrial Internet of Things (IIoT) control systems due to the complicated relationships among attacks. Recently, Meta Attack Language (MAL) showed its powerful TMS capabilities for representing complex attacks. However, existing methods pay less attention to the impact of changes in threat profiles on the simulation of key attack techniques. This paper proposes a novel method called threat response modeling language (TRMLang) for threat modeling and simulation in complex IIoT attacks. TRMLang obtains attacker information through an automated analysis of cyber threat intelligence (CTI) to build dynamic attacker profiles. Furthermore, it merges attacker features and probabilistic attack graphs in the simulation to improve TMS performance. The experimental results demonstrate that TRMLang can represent and evaluate the security conditions of IIoT control systems with two attack cases by Lazarus Group on SEGRID smart grids.

Endoatmospheric Ascent Optimal Guidance with Analytical Nonlinear Trajectory Prediction

In this paper, an endoatmospheric ascent optimal guidance law with terminal constraint is proposed, which is under the framework of predictor-corrector algorithm. Firstly, a precise analytical nonlinear trajectory prediction with arbitrary Angle of Attack (AOA) profile is derived. This derivation process is divided into two steps. The first step is to derive the analytical trajectory with zero AOA using a regular perturbation method. The other step is to employ pseudospectral collocation scheme and regular perturbation method to solve the increment equation so as to derive the analytical solution with arbitrary AOA profile. The increment equation is formulated by Taylor expansion around the trajectory with zero AOA which remains the second order increment terms. Therefore, the resulting analytical solutions are the nonlinear functions of high order terms of arbitrary AOA values discretized in Chebyshev-Gauss-Legendre points, which has high accuracy. Secondly, an iterative correction scheme using analytical gradient is proposed to solve the endoatmospheric ascent optimal guidance problem, in which the dynamical constraint is enforced by the resulting analytical solutions. It only takes a fraction of a second to get the guidance command. Nominal simulations, Monte Carlo simulations, and optimality verification are carried out to test the performance of the proposed guidance law. The results show that it not only performs well in providing the optimal guidance command, but also has great applicability, high guidance accuracy and computational efficiency. Moreover, it has great robustness even in large dispersions and uncertainties.

Polymorphic Adversarial Cyberattacks Using WGAN

Intrusion Detection Systems (IDS) are essential components in preventing malicious traffic from penetrating networks and systems. Recently, these systems have been enhancing their detection ability using machine learning algorithms. This development also forces attackers to look for new methods for evading these advanced Intrusion Detection Systemss. Polymorphic attacks are among potential candidates that can bypass the pattern matching detection systems. To alleviate the danger of polymorphic attacks, the IDS must be trained with datasets that include these attacks. Generative Adversarial Network (GAN) is a method proven in generating adversarial data in the domain of multimedia processing, text, and voice, and can produce a high volume of test data that is indistinguishable from the original training data. In this paper, we propose a model to generate adversarial attacks using Wasserstein GAN (WGAN). The attack data synthesized using the proposed model can be used to train an IDS. To evaluate the trained IDS, we study several techniques for updating the attack feature profile for the generation of polymorphic data. Our results show that by continuously changing the attack profiles, defensive systems that use incremental learning will still be vulnerable to new attacks; meanwhile, their detection rates improve incrementally until the polymorphic attack exhausts its profile variables.

Social Engineering Attacks on Facebook – A Case Study

Background/Purpose: Facebook is an American business that offer online social networking services. Facebook was founded in 2004 by Harvard University freshmen Mark Zuckerberg, Eduardo Saverin, Dustin Moskovitz, and Chris Hughes. Free access to Facebook enables new users to create profiles, upload photos to existing groups, and start new ones. Every user's profile page has a Timeline area where they can upload material and their social network connections may reply with messages and Status updates informing them of their current location or condition. Additionally, Facebook includes a function called News Feed that notifies users of updates to their friends' profiles and statuses. Users can communicate with one another and exchange private messages using Facebook Messenger. Additionally, Facebook users may express their approval of a type of content by clicking the "Like" button. Every day, more than a billion people use Facebook, making it the most common social network on the planet. Menlo Park, California, is where the company's headquarters are located. Objective: To analyse how Facebook is misused and turned into an attack platform, in order to get sensitive information that can be used to create an attack profile against an individual. Design/Methodology/Approach: SWOT framework is being used to analyse and display information gathered from scholarly publications, web articles, and other sources. Findings/Results: Social Engineering Attacks using Facebook help the attackers to steal sensitive private information from unaware users. Using a false profile is one of the most frequent techniques to execute a large-scale data harvesting attack. Cyber Criminals use Facebook as the main target for social engineering attacks because of its high number of users and popularity. Originality/Value: This paper study gives a brief overview of Social Engineering Attacks on Facebook based on a variety of data collected. Paper Type: Case study-based Research Analysis

Directional Laplacian Centrality for Cyber Situational Awareness

Cyber operations is drowning in diverse, high-volume, multi-source data. To get a full picture of current operations and identify malicious events and actors, analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method rooted in spectral graph theory to discover patterns and anomalies without a priori knowledge of signatures. We derive and propose a new graph-theoretic centrality measure based on the derivative of the graph Laplacian matrix in the direction of a vertex. To build intuition about our measure, we show how it identifies the most central vertices in standard network datasets and compare to other graph centrality measures. Finally, we focus our attention on studying its effectiveness in identifying important IP addresses in network flow data. Using both real and synthetic network flow data, we conduct several experiments to test our measure’s sensitivity to two types of injected attack profiles and show that vertices participating in injected attack profiles exhibit noticeable changes in our centrality measures, even when the injected anomalies are relatively small, and in the presence of simulated network dynamics.

KRONİK OBSTRÜKTİF AKCİĞER HASTALIĞINDA ATAK PROFİLİ: RETROSPEKTİF ÇALIŞMA

Objective: Chronic obstructive pulmonary disease (COPD) is characterized by progressive airflow limitation and exacerbations causing severe mortality and morbidity. The aim of this study is to examine the various clinical characteristics and attack markers of patients who were hospitalized with the diagnosis of COPD exacerbation and followed up in the ward by a physiotherapist.Method: 91 patients were included in the study, which was planned retrospectively. Sociodemographic and clinical characteristics of the patients, Modified Medical Research Board Dyspnoea Scale (mMRC), COPD Assessment Test (CAT), and COPD Combined Assessment Score (GOLD) values were obtained from the physiotherapy registry files.Results: 73 of total 91 patients were male (80.2%) and 18 (19.8%) were female. The mean age of the patients was 72.49±10.10 years. The mean smoking level of the patients was 46.34±39.00 cigarette packs/year. According to GOLD, 34 were group B patients and 57 were group D patients. The mean CAT score was 23.05±8.22 and the mean mMRC score was 2.93±1.01. When the CAT and mMRC scores of the patients in Group B and D were analyzed, a statistically significant difference was found between the two groups (p&amp;lt;0.05). When the relationship between the diagnosis of COPD exacerbation and hospitalized patients' ages and duration of illness was analyzed with Pearson correlation analysis, no statistically significant correlation was found (p&amp;gt;0.05). When the relationship between the CAT and mMRC scores of the patients was analyzed, a statistically significant positive moderate correlation was found (p&amp;lt;0.05, r=0.669).Conclusion: Sociodemographic, physical, and clinical characteristics are the factors that affect the attack profile of COPD, but disease duration and stage, CAT and mMRC score, and long-term oxygen therapy were found to be the main components of attack profile. We think that multidisciplinary approach is required for symptom control with close follow-up in patients who have attack.

Robustness of Air Transportation as Complex Networks:Systematic Review of 15 Years of Research and Outlook into the Future

Air transportation systems are an important part of the critical infrastructure in our connected world. Accordingly, a better understanding and improvements in the resilience of the overall air transportation system are essential to the well-functioning of our society and overall sustainability of human beings. In the literature, network science is increasingly used to better understand the resilience dynamics of air transportation. Given the wide application of tools for network science and the importance of designing resilient air transportation systems, a rich body of studies has emerged in recent years. This review paper synthesizes the related literature that has been published throughout the last 15 years regarding the robustness of air transportation systems. The contributions of this work consist of two major elements. The first part provides a comprehensive discussion and cross-comparison of the reported results. We cover several major topics, including node importance identification, failure versus attack profiles, recovery and improvement techniques, and networks of networks approaches. The second part of this paper complements the review of aggregated findings by elaborating on a future agenda for robust air transportation research. Our survey-style overview hopefully contributes toward a better understanding of the state of the art in this research area, and, in turn, to the improvement of future air transportation resilience and sustainability.