Computer Network Attacks Research Articles

The Degrees of Force Exercised in the Cyber Battlespace

IntroductionEach instance of communication via the Internet depends on the transfer of confidential, readily available, and authenticated information. If this information is read, altered, or forged in any way, it jeopardizes the secure and safe operation of any service depending on the transfer of data. Thus, the exploitation of data can be leveraged in ways that can have devastating effects on modem societies. The problem with a networked society is that the international conventions on the use of force fail to sufficiently safeguard the world from the instability caused by computer attacks. This article seeks to remedy the situation by defining what kinds of actions carried out via computerized networks constitute a use of armed force or armed conflict.This article applies the existing Laws of Armed Conflict (LOAC) to three cases of computer-based attacks carried out by nation-states. In doing so, the aim is to highlight the legal limitations on actions that can be taken to respond to computer attacks. The first examination involves the wave of cyber attacks that precluded the 2008 South Ossetia War between Russia and Georgia. The second case addresses the United States' covert operation, codenamed Olympic Games. For this case, the analysis will be focused on the Stuxnet computer program. The third case utilizes LOAC to assess the acts of digital espionage carried out by the Chinese People's Liberation Army Unit 61398.Using LOAC as a legal rubric, the cases suggest that there are three distinct interpretations of computer-based operations. The case of the 2008 South Ossetia War constitutes a situation in which using computers to attack another country can be interpreted as a use of force and as an act of armed conflict. The Olympic Games operation reveals that a computer-based attack can be considered a use of force but not an act of armed conflict. The analysis of the actions of Unit 61398 shows a perspective on computer attacks that are neither a use of force nor an act of armed conflict. Each case expresses unique characteristics of operations in cyberspace. Therefore, in order to develop a legal understanding of these cases, the analysis favors an effects-based assessment of cyber attacks, pioneered by Michael Schmitt and expressed in the Tallinn Manual on the International Law Applicable to Cyber Warfare.* 1Developing a Legal Framework of Cyber Attacks Through an EffectsBased ApproachComputer-based attacks represent a subset of actions that can be described as information operations. Information operations (10) are defined as actions taken by the military in times of peace or war to affect adversary information and information systems while defending one's own information and information systems.2 Broadly speaking, 10 refers to radar jamming, psychological, and electronic means of carrying out operations. A subset of electronic 10 is called computer network operations (CNO). CNO are defined as operations to attack, deceive, degrade, disrupt, deny, exploit, and defend electronic information and infrastructure.3 Two sub-elements of CNO are attack and defense. Computer network attacks (CNA) are defined as actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers themselves.4 If the information within a computer that controls the water level in a nuclear power plant suffers any disruption to the information flow, it can have devastating physical effects.5 Each case presented in this article represents a form of CNA with its own unique effect. The effects highlighted by each case range from denial of service and theft of information to physical destruction.Due to the relatively new nature of state-sponsored international cyber attacks, this article addresses the existing body of international treaty law that includes the prohibitions on the use of force and self-defense as found in the United Nations Charter. …

The method of abnormality detection caused by cyber attacks in computer networks

One of the security solutions are intrusion detection systems, constructed on the principles of abnormality. Such systems are usually based on mathematical methods that require a lot of time to produce statistics. There is therefore a need for more effective methods based on peer-based approaches. For this task solution it is proposed the method based on mathematical models and methods of fuzzy logic, and containing eight basic steps (method selection of fuzzy data processing; selection of how to define the importance factor, formation of sets of attacks and parameters, formation of standards parameters, formation of multiple heuristic rules, definition of matrix initialization, formation of result) that show the process of abnormal condition detection, generated by a specific type of cyber-attacks in the IS. This method can be used to create or improve existing systems of cyber attacks detection in computer networks.

Computer Network Attacks: A Potential Roadmap

An attempt to set forth a few basic guidelines with regard to dealing with Computer Network Attacks.

The Principle of Distinction and Cyber War in International Armed Conflicts

Computer Network Attacks (CNAs) do not automatically come within the framework of the definition of ‘attack’ in conformity with the law of armed conflict (LOAC). Consequently, some so-called CNAs (especially, those used only as means of intelligence gathering) do not qualify as ‘attacks’ in the sense of LOAC. Only CNAs entailing ‘violence’ do. CNAs constituting ‘attacks’ in the LOAC sense are governed by the same rules that apply to kinetic attacks. In particular, they are subject to the application of the cardinal principle of distinction between combatants/military objectives and civilians/civilian objects. Consequently, deliberate attacks against civilians/civilian objects are prohibited, and so are indiscriminate attacks. An important extrapolation of the principle of distinction is the principle of proportionality, whereby—when lawful targets are attacked—collateral damage to civilians/civilian objects must not be expected to be ‘excessive’ compared with the military advantage anticipated. This is a complex construct, applying to CNAs as much as to other attacks. Feasible precautions must be taken prior to any attack, including a CNA. When a civilian is engaged in any form in a CNA, the act constitutes direct participation in hostilities and the actor loses civilian protection from attack.

A Computer Network Attack Taxonomy and Ontology

Computer network attacks differ in the motivation of the entity behind the attack, the execution and the end result. The diversity of attacks has the consequence that no standard classification exists. The benefit of automated classification of attacks, means that an attack could be mitigated accordingly. The authors extend a previous, initial taxonomy of computer network attacks which forms the basis of a proposed network attack ontology in this paper. The objective of this ontology is to automate the classification of a network attack during its early stages. Most published taxonomies present an attack from either the attacker's or defender's point of view. The authors’ taxonomy presents both these points of view. The framework for an ontology was developed using a core class, the “Attack Scenario”, which can be used to characterize and classify computer network attacks.

Cyberwar: A New ‘Absolute Weapon’? The Proliferation of Cyberwarfare Capabilities and Interstate War

This article examines the implications of the proliferation of cyberwarfare capabilities for the character and frequency of war. Consideration of strategic logic, perceptions, and bargaining dynamics finds that the size of the effect of the proliferation of cyberwarfare capabilities on the frequency of war will probably be relatively small. This effect will not be constant across all situations; in some cases the advent of cyberwarfare capabilities may decrease the likelihood of war. On the other hand, the use of computer network attack as a brute force weapon will probably become increasingly frequent.

RepCIDN: A Reputation-based Collaborative Intrusion Detection Network to Lessen the Impact of Malicious Alarms

Distributed and coordinated attacks in computer networks are causing considerable economic losses worldwide in recent years. This is mainly due to the transition of attackers' operational patterns towards a more sophisticated and more global behavior. This fact is leading current intrusion detection systems to be more likely to generate false alarms. In this context, this paper describes the design of a collaborative intrusion detection network (CIDN) that is capable of building and sharing collective knowledge about isolated alarms in order to efficiently and accurately detect distributed attacks. It has been also strengthened with a reputation mechanism aimed to improve the detection coverage by dropping false or bogus alarms that arise from malicious or misbehaving nodes. This model will enable a CIDN to detect malicious behaviors according to the trustworthiness of the alarm issuers, calculated from previous interactions with the system. Experimental results will finally demonstrate how entities are gradually isolated as their behavior worsens throughout the time.

Computer network attack evaluation based on incremental relevance vector machine algorithm

Computer network attack evaluation based on incremental relevance vector machine algorithm

A Comprehensive Survey on Approaches to Intrusion Detection System

As there is a wide spread of Internet services all over the world, many kinds and large number of security threats are increasing. Since it is not technically feasible to build a system with no vulnerabilities, Intrusion detection System, which can effectively detect intrusion accesses have attracted attention. Various architectures and different soft computing based approaches have been proposed to detect computer network attacks. In this paper we present a survey of intrusion detection systems. The survey was about the existing types, techniques and approaches of intrusion detection systems in the literature.

An exploration of defensive deception in industrial communication networks

Process control networks constitute a vantage point for computer network attacks on electrical power infrastructures such as power plants and electrical substations. Consequently those networks represent a critical point of network defense in power grid computer networks. In this paper we discuss research that draws on military deception to conduct a cognitive hacking into the attacker’s mind at the process control network level. This research enables the defender to influence the attacker’s target selection process, and thus pilot it towards simulated physical processes and equipment. A hijacked target selection process causes the attacker to generate specific network traffic that makes a significant contribution to the detection of the ongoing network intrusion. Our cognitive hacking approach is based on displays created via simulation of the appearance of physical processes and equipment. The main counter attack vectors employed consist of emission of deceptive network traffic and exploitation of information conversion as means of concealing deceptive simulation. We have implemented this research as a small proof of concept prototype, and thus in the paper we also discuss an analysis of its deception effects via application of signal detection theory.

Improving the accuracy of network intrusion detectors by input-dependent stacking

Network intrusion detectors analyze network traffic for detecting attacks in computer networks. Achieving a high detection accuracy and in particular a low number of false alarms is crucial for their practical use. In this paper a new stacking approa

Application of Partial-Connected Dynamic and GA-Optimized Neural Networks to Misuse Detection Using Categorized and Ranked Input Features

The number of attacks in computer networks has grown extensively, and many new intrusive methods have appeared. Intrusion detection is known as an effective method to secure the information and communication systems. In this paper, the performance of Elman and partial-connected dynamic neural network (PCDNN) architectures are investigated for misuse detection in computer networks. To select the most significant features, logistic regression is also used to rank the input features of mentioned neural networks (NNs) based on the Chi-square values for different selected subsets in this work. In addition, genetic algorithm (GA) is used as an optimization search scheme to determine the sub-optimal architecture of investigated NNs with selected input features. International knowledge discovery and data mining group (KDD) dataset is used for training and test of the mentioned models in this study. The features of KDD data are categorized as basic, content, time-based traffic, and host-based traffic features. Empirical results show that PCDNN with selected input features and categorized input connections offers better detection rate (DR) among the investigated models. The mentioned NN also performs better in terms of cost per example (CPE) when compared to other proposed models in this study. False alarm rate (FAR) of the PCDNN with selected input features and categorized input connections is better than other proposed models, as well. Normal 0 false false false EN-US X-NONE AR-SA MicrosoftInternetExplorer4

A Danger Theory Inspired Security Evaluation Paradigm for Computer Network

Inspired by the potential interesting ideas of the danger theory, a novel security evaluation paradigm for network security, it is called DTPSE, is proposed in this paper. Within DTPSE, computer network attacks are regarded as bacterium, which are dangerous, and induce danger signals through simulating cells undergoing injury, or stress or 'bad cell death'; the network evaluation centre can dynamically aware the security risk by fusion the danger signals received from host-based sensors. Theoretical analysis shows that the proposed paradigm is feasible. Thus, it provides a novel solution to information security risk assessment.

The Study on Network Attacks Based on Automaton Theory

Because the lack of a mature intrusion detection technology theory basis so far, this is very important to use mathematical method description and to study various complex attack behavior. The attack is corresponding to the program run about automata recognition characteristics of the attack. Because an attack is very complex, so it is difficult to use a unified automata model to test various computer network attacks. But automata model, which is used to describe the different network attacks are not independent exist mutual relationship.

Proposal for an ad hoc computer network in the military electronic systems department at the military academy applying bluetooth technology

The historical development of the Bluetooth module is given in the introduction of this paper. The importance of the Bluetooth standard for wireless connection on small distances is shown as well. The organization of the Department of Military Electronic Systems is presented with its area of duties, subordinate sections and deployment. The concept of a local area network for this Department, using Bluetooth technology, includes network topology and working regimes based on the main characteristics and technical specifications for the connection with Bluetooth technology. The Department's disperse computer network is proposed as a scatter net where one piconetwork includes the Head of Department and the Heads of Sections while other piconetworks are formed from the Heads of Sections and their subordinates. The security aspect of the presented network deals with basic computer network attack categories, protection methods and aspects. The paper concludes with some recommendations for the local area network using Bluetooth technology with respect to its economical and security aspects as well as to the managing principles of the Department.

Twelve Principles of Computer Network Operations

A growing number of uniformed military and government entities are practicing new military disciplines of cyber defense, including computer network defense, computer network exploitation, and computer network attack. This paper provides a practitoner's view of principles of operations in this emerging military domain.

Intelligent Intrusion Detection Based on Genetically Tuned Artificial Neural Networks

Artificial intelligence techniques and in particular neural networks (ANN) have been widely employed in an Intrusion Detection System (IDS) design. Due to their high learning ability, their application allows achieving higher performance in various applications. However, they can improve the resource consumption at the same time. This design goal, which is very important in a real life IDS design has received much less attention so far. The paper investigates the optimization methods of improving the ANN-based IDS performance along with the resource consumption. A particular consideration is given to partially connected neural networks that open another way of tuning the ANN structure toward the application. The study examines the choice of the connectivity ratio and its optimization with genetic algorithms. Various genetic algorithms parameters are tested in computer network attacks detection and recognition problems. The results are analyzed and IDS design recommendations are provided.

Coupled Petri nets for computer network risk analysis

This paper presents a framework for quantifying the risk induced by the potential for cyber attacks levied against network-supported operations. It also permits a formal assessment of candidate risk management policies that address network host vulnerabilities and host-process coupling. The framework incorporates a novel application of Petri net state coverability analysis coupled with process failure mode analysis. It extends previous work on Petri nets for attack analysis in three ways: (i) new metrics that quantify risk as a function of Petri net state and techniques for evaluating the metrics based on the minimal coverability set of a Petri net; (ii) a new method for coupling a Petri net representation of a computer network attack to a process failure modes model; and (iii) a new method for identifying high-value risk management opportunities. The paper concludes by presenting an application of the analysis techniques to evaluate risk in process control networks.

Combatant Status and Computer Network Attack

The national security implications of computer network attacks (CNA) have become far-reaching and have prompted major adjustments to our nation’s defense structure and strategy. One of the current President’s early executive acts created a national Cyberczar to coordinate U.S. defenses against CNA. Meanwhile, the Department of Defense has recognized cyberspace as a realm of combat operations equivalent in importance to land, sea and space, creating a new Cyber Command believed to be capable of launching offensive CNA. This Article examines the critical question of combatant status in such CNA – specifically, who, under the existing law of war, may lawfully participate in CNA? Existing accounts evaluate combatant status in CNA under traditional criteria applicable to kinetic and line-of-sight warfare. This Article argues such approaches are outmoded and induce states to engage in practices that amount to no more than empty formalism. With historical, textual, and normative analysis, this Article argues that state sanction or imprimatur is an appropriate standard for evaluating combatant status in CNA. The analytical framework proposed not only aligns with existing law and emerging state practice, but may also resolve the question of status in other remote combat engagements.

Computer Network Attacks in the Grey Areas of Jus ad Bellum and Jus in Bello

Computer Network Attacks in the Grey Areas of Jus ad Bellum and Jus in Bello