Network Attacks Research Articles

Detection and mitigation of DDoS attacks based on multi-dimensional characteristics in SDN

Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.

OTI-IoT: A Blockchain-based Operational Threat Intelligence Framework for Multi-vector DDoS Attacks

The Internet of Things (IoT) refers to a complex network comprising interconnected devices that transmit their data via the Internet. Due to their open environment, limited computation power, and absence of built-in security, IoT environments are susceptible to various cyberattacks. Denial of service (DDoS) attacks are among the most destructive types of threats. The Multi-vector DDoS attack is a contemporary and formidable form of DDoS wherein the attacker employs a collection of compromised IoT devices as zombies to initiate numerous DDoS attacks against a target server. A Blockchain-based Operational Threat Intelligence framework, OTI-IoT, is proposed in this article to counter multi-vector DDoS attacks in IoT networks. A “Prevent-then-Detect” methodology was utilized to deploy the OTI-IoT framework in two distinct stages. During Phase 1, the consortium Blockchain network validators employ the IPS module, composed of a smart contract for attack prevention and access control, and Proof of Voting consensus, to thwart attacks. Validators are outfitted with deep learning-based IDS instances to detect multi-vector DDoS attacks during Phase 2. Alert messages are generated by the IDS module’s alert generation and propagation smart contract in response to identifying malicious IoT sources. The feedback loop from the IDS module to the IPS module prevents incoming traffic from malicious sources. The proposed OTI framework capabilities are realized as an outcome of combining and storing the outcomes of the IDS and IPS modules on the consortium Blockchain. Each validator maintains a shared ledger containing information regarding threat sources to ensure robust security, transparency, and integrity. The operational execution of OTI-IoT occurs on an individual Ethereum Blockchain. The empirical findings indicate that our proposed framework is most suitable for real-time applications due to its ability to lower attack detection time, decreased block validation time, and higher attack prevention rate.

A zero-dimensional perovskite with high-efficiency luminescence and transient response for advanced information encryption

Due to the increasingly complex network attacks and advancements in computational technology, finding new and efficient encryption techniques is an urging task. As a promising material, the application of perovskite luminescent materials in information encryption is limited to pre-planned specific scenarios or applications, lacking the ability to respond to temporary demands. In this work, we have designed a novel cadmium-based zero-dimensional perovskite, TEA2CdCl4, which presents blue luminescence centered at 413 nm originating from organic cations. Upon Sb3+ doping, it not only exhibits intense red emission at 623 nm with a high photoluminescence quantum efficiency up to 100 %, but also brings outstanding resistance to thermal quenching. Especially, an ultrafast response speed could be achieved during decryption process which has been verified by first-principles calculations. Based on the advantages, a large-area optical anti-counterfeiting paper for temporary information encryption transmission is designed, which not only verifies the potential for secure information transmission and protection, but also introduces a new concept for the application of organic–inorganic hybrid perovskites in the field of information encryption.

MOMTA-HN: A Secure and Reliable Multi-Objective Optimized Multipath Transmission Algorithm for Heterogeneous Networks

With the rapid development of heterogeneous network technologies, such as mobile edge computing, satellite communications, self-organizing networks, and the wired Internet, satisfying users’ increasingly diversified and complex communication needs in dynamic and evolving network environments has become a critical research topic. Ensuring secure and reliable information transmission is essential for stable network operation in these complex environments. Addressing this challenge, this study proposed a secure and reliable multi-objective optimized multipath transmission algorithm for heterogeneous networks to enhance security and reliability during data transmission. The core principle of this algorithm was that multipath transmission can provide additional protection through redundant paths. This redundancy ensured that even if one path is attacked or fails, alternative paths can maintain data integrity and reachability. In this study, we employed the Optimized Non-dominated Sorting Genetic Algorithm II (ONSGA-II) to determine the range of the initial population and filter suitable paths by optimizing them according to different demand objectives. In the path selection process, we introduced an innovative deletion graph method, which ensures that redundant paths do not share any common links with the original paths, except when there are unique links. This approach enhances the independence of transmission paths and improves the security of the transmission process. It effectively protects against security threats such as single points of failure and link attacks. We have verified the effectiveness of the algorithm through a series of experiments, and the proposed algorithm can provide decision-makers with high-reliability and low-latency transmission paths in heterogeneous network environments. At the same time, we verified the performance of the algorithm when encountering attacks, which is superior to other classical algorithms. Even in the face of network failures and attacks, it can maintain a high level of data integrity and security.

Sensor Network Attack Synthesis against Fault Diagnosis of Discrete Event Systems.

This paper investigates the problem of synthesizing network attacks against fault diagnosis in the context of discrete event systems (DESs). It is assumed that the sensor observations sent to the operator that monitors a system are tampered with by an active attacker. We first formulate the process of online fault diagnosis under attack. Then, from the attack viewpoint, we define a sensor network attacker as successful if it can degrade the fault diagnosis in the case of maintaining itself as undiscovered by the operator. To verify such an attacker, an information structure called a joint diagnoser (JD) is proposed, which describes all possible attacks in a given attack scenario. Based on the refined JD, i.e., stealthy joint diagnoser (SJD), we present an algorithmic procedure for synthesizing a successful attacker if it exists.

RPL*: An Explainable AI-based routing protocol for Internet of Mobile Things

The Internet of Mobile Things (IoMT) is an emerging paradigm of Internet of Things (IoT) with special focus on enabling mobility to the ‘things’. Several IoMT applications such as group of robots or drones performing collaborative search and rescue operation, identification of mines, warehouse management, goods delivery, etc can be considered as examples of IoMT systems. In the applications mentioned above, the nodes may send the information in a multi-hop manner to the root or coordinator node which may be static or mobile. While the Routing Protocol for Low Power and Lossy Networks (RPL) is extensively utilized in static IoT networks, it encounters significant limitations in handling mobility and providing resilience against routing attacks in mobile IoT networks. In this work, we propose a modified RPL, RPL* which is robust to handling mobility in nodes and is resilient towards routing attacks. In RPL*, any deviation from the normal behaviors of the network are identified as anomalies using an unsupervised Explainable Artificial Intelligence (XAI) strategy. In RPL*, we propose a novel mobility detection mechanism that will identify the mobility in the network in an energy efficient manner without incurring additional communication overhead. To maintain the connectivity with parent node, we propose a novel proactive connectivity management mechanism in RPL* which will ensure a smooth transition from one parent to another if required, thus avoiding the network partitioning due to mobility. The performance analysis of the system has demonstrated an improvement in packet delivery ratio of the mobile nodes by 40% due to the proposed RPL* when compared to RPL. Also, the proposed XAI strategy provided an F1-score of over 95% for the detection of sink hole and black hole attacks in the tested IoMT network scenarios. It was observed that RPL* improves the performance of the IoMT network when compared to RPL. However it may be noted that the mechanisms introduced to support mobility does not lead to a drop in PDR or increase in control packet overhead for static networks. Hence, RPL* can be considered as an alternative to RPL for IoT as well as IoMT networks.

Performance Study on the Use of Genetic Algorithm for Reducing Feature Dimensionality in an Embedded Intrusion Detection System

Intrusion Detection Systems play a crucial role in a network. They can detect different network attacks and raise warnings on them. Machine Learning-based IDSs are trained on datasets that, due to the context, are inherently large, since they can contain network traffic from different time periods and often include a large number of features. In this paper, we present two contributions: the study of the importance of Feature Selection when using an IDS dataset, while striking a balance between performance and the number of features; and the study of the feasibility of using a low-capacity device, the Nvidia Jetson Nano, to implement an IDS. The results, comparing the GA with other well-known techniques in Feature Selection and Dimensionality Reduction, show that the GA has the best F1-score of 76%, among all feature/dimension sizes. Although the processing time to find the optimal set of features surpasses other methods, we observed that the reduction in the number of features decreases the GA processing time without a significant impact on the F1-score. The Jetson Nano allows the classification of network traffic with an overhead of 10 times in comparison to a traditional server, paving the way to a near real-time GA-based embedded IDS.

CFDI: Coordinated false data injection attack in active distribution network

AbstractThe active distribution network (ADN) can obtain measurement data, estimate system states, and control distributed energy resources (DERs) and flexible loads to ensure voltage stability. However, the ADN is more vulnerable to cyber attacks due to the recent wave of digitization and automation efforts. In this article, false data injection (FDI) attacks are focused on and they are classified into two types, that is, type I attacks on measurement data and type II attacks on control commands. After studying the impact of these two FDI attacks on the ADN, a new threat is revealed called coordinated FDI attack, which can maximize the voltage deviation by coordinating type I and type II FDI attacks. From the attacker's perspective, the scheme of CFDI is proposed and an algorithm is developed to find the optimal attack strategy. The feasibility of CFDI attacks has been validated on a smart distribution testbed. Moreover, simulation results on an ADN benchmark have demonstrated that CFDI attacks could cause remarkable voltage deviation that may deteriorate the stability of the distribution network. Moreover, the impact of CFDI attacks is higher than pure type I or type II attacks. To mitigate the threat, some countermeasures against CFDI attacks are also proposed.

Resilient distributed model predictive control of state‐delayed linear parameter varying systems with quantitative communication against denial of service attacks

AbstractThis work presents a resilient distributed model predictive control (MPC) method for linear parameter varying (LPV) systems with state delays and attacks in communication networks. Coordinations are required for distributed MPC (DMPC) to achieve the global performance of centralized MPC (CMPC). However, control performance can be severely degraded by unreliable communication networks, for example, with denial of service (DoS) attacks. A resilient control framework is derived to address the unreliable communications in DMPC. A global system is divided into subsystems for the distributed control purpose. To deal with the model uncertainties and state delays, a “min‐max” DMPC algorithm is presented with a buffer to ensure resilience against DoS attacks. A quantization scheme is introduced to quantize the control information exchanged between subsystems. An iterative interaction scheme is proposed to exchange feedback control laws among subsystems. The stability of the closed‐loop system under the proposed algorithm is ensured by using a Lyapunov function method. The effectiveness of the proposed DMPC is demonstrated through two simulation examples.

Efficient SFC Protection Method against Network Attack Risks in Air Traffic Information Networks

With the continuous development of the civil aviation industry toward digitalization and intelligence, the closed architecture of traditional air traffic information networks struggles to meet the rapidly growing demands for air traffic services. Network function virtualization (NFV) is one of the key technologies that can address the rigidity of traditional air traffic information networks. NFV technology has facilitated the flexible deployment of air traffic services, but it has also expanded the attack surface of the network. In addressing the network attack risks faced by service function chains (SFCs) in NFV environments, a SFC protection method based on honeypots and backup technology (PBHB) is proposed to reduce the resource cost of protecting air traffic information networks while enhancing network security. Initially, PBHB utilizes the TAPD algorithm to deploy the primary VNFs as closely as possible to the shortest path between the source and destination endpoints, thus aiming to reduce SFC latency and save bandwidth resource costs. Subsequently, the RAHDR algorithm is employed to install honeypot VNFs in each physical platform that is at risk of side-channel attacks, thus updating the deployment status of honeypot VNFs in real time based on the VNF lifecycle in order to offer primary protection for SFCs. Lastly, the BDMPE algorithm was used to calculate the backup scheme with the highest protection efficiency to implement secondary protection for the SFCs that still do not meet the security requirements. Through experiments, the maximum backup limit for SFCs in PBHB was determined, confirming its satisfactory performance across various SFC arrival rates. Furthermore, performance comparisons with other SFC protection methods revealed that PBHB achieves optimizations in resources cost while ensuring SFC security and latency.

A dual-head output network attack detection and classification approach for multi-energy systems

In today’s digital age, multi-energy systems (MES) have become an indispensable part of the social infrastructure, providing people with diversified energy support such as electricity, gas, water and so on. However, with the increasing popularity and networking of MES, the network security threats they face are becoming more and more serious, especially the threat of network attacks. This makes it essential to detect attacks on MES and precisely classify attack types in order to establish effective defense strategies. In this paper, a Dual-Head output network attack detection and classification method based on parallel CNN-BiLSTM network is proposed. The method adopts a parallel structure and can process different aspects of information at the same time, speeding up the training and inference process of the whole network, making the system respond more quickly to potential network attacks, and improving real-time and efficiency. The multi-model fusion structure can give full play to the advantages of CNN and BiLSTM in processing different types of data, so that the system can capture attack characteristics more comprehensively in many aspects, and improve the overall detection and classification performance. The dual-head output not only improves the system’s ability to accurately detect attacks, but also can effectively classify different types of attacks in detail, which helps to formulate more targeted defense strategies. In addition, in order to effectively evaluate our proposed method, the network traffic data required for the experiment were collected in an environment very similar to the actual operating environment of a multi-energy system. Finally, the experiment verifies that our method can not only realize effective detection of network attacks, but also accurately classify different types of attacks.

Explainable Spark-based PSO Clustering for Intrusion Detection

Given the exponential growth of available data in large networks, the existence of rapid, transparent and explainable intrusion detection systems has become of high necessity to effectively discover attacks in such huge networks. To deal with this challenge, we propose a novel explainable intrusion detection system based on Spark, Particle Swarm Optimization (PSO) clustering and eXplainable Artificial Intelligence (XAI) techniques. Spark is used as a parallel processing model for the effective processing of large-scale data, PSO is integrated for improving the quality of the intrusion detection system by avoiding sensitive initialization and premature convergence of the clustering algorithm and finally, XAI techniques are used to enhance interpretability and explainability of intrusion recommendations by providing both micro and macro explanations of detected intrusions. Experiments are conducted on several large collections of real datasets to show the effectiveness of the proposed intrusion detection system in terms of explainability, scalability and accuracy. The proposed system has shown high transparency in assisting security experts and decision-makers to understand and interpret attack behavior.

Review and analysis of existing systems for detecting network attacks

Review and analysis of existing systems for detecting network attacks

Phase-locking-free all-optical matching system for 100 Gbaud QPSK optical signal

Photonic firewall is a monitoring protection device that will directly detect and locate optical network attacks at the optical layer, which can effectively ensure the security of optical networks. An all-optical matching system is the core part of photonic firewall, which determines the performance of a photonic firewall, so it is of great significance to research and develop all-optical matching system for high-speed and high-order modulation formats signals. At present, an all-optical matching system for binary modulation formats is relatively mature, but the all-optical matching system for high-order phase modulation format signals is still limited by how to solve the problem of phase synchronization. In this paper, a new all-optical matching system based on self-interference matching is proposed for quadrature phase shift keying (QPSK) optical signal, which avoids the introduction of local target sequence optical signals and phase-locking circuits. The theoretical analysis and simulation verification are conducted for the designed system. The results demonstrate that the system can accurately identify and locate 4-symbol or 8-symbol target sequences in the input QPSK optical signals with 16-symbol and 32-symbol data sequences at a data rate of 100 Gbaud.

Investigation on situation awareness model of unmanned aerial vehicle groups communication network based on adversarial network

With the widespread application and development of unmanned aerial vehicle (UAV) technology, ensuring the security and stability of UAV swarm communication networks has become crucial. Given the diverse forms of interference and attacks in current networks, this poses a serious threat to the normal operation of UAV swarm communication. Therefore, how to accurately identify and effectively counter these network threats has become the focus of research. This study comprehensively evaluates the core technology of UAV swarm communication network situational awareness and constructs a situational awareness model based on adversarial networks. The model utilizes adversarial network technology and combines data collection and processing to design four experiments to comprehensively evaluate the performance of the model in different scenarios. The experimental results show that as the amount of data gradually increases, the performance of the model also improves. When processing 100, 1000, and 10,000 data points, the model achieved accuracies of 0.955, 0.962, and 0.982, respectively. Furthermore, the experimental results also indicate that effective noise suppression measures can significantly improve the accuracy and stability of the situational awareness model. Additionally, it is noted that different model structures will affect training duration, accuracy, and stability. Although increasing network scale may lead to increased computational complexity and latency, its accuracy is correspondingly improved. The adversarial network-based situational awareness model proposed in this study can accurately identify and effectively counter interference and attacks in UAV swarm communication networks, thereby providing solid protection for the collaborative combat and information sharing of UAV swarms.

Censorship data-driven DNS resolution anomaly detection: An ensemble algorithm model with multivariate feature fusion

The Domain Name System (DNS), as a critical component of Internet infrastructure, is crucial for maintaining network stability and security. However, vulnerabilities in the DNS resolution process make it susceptible to various network attacks. Current DNS resolution anomaly detection methods are challenged by the scarcity of diverse anomalous sample data and the difficulty in accurately capturing such anomalies. To address those challenges, we firstly introduce a proactive anomaly detection method based on bidirectional national censorship behavior, abbreviated as CB-BiDAM. This method can collect diverse anomalous resolution data from multiple network spaces, covering common types of resolution anomalies and effectively solving the problem of sample scarcity. Further, we extract multidimensional features from four key aspects: response content, DNS attributes, resolution paths, and timing, to gain a deeper understanding of the relationship between multifaceted information in the DNS resolution process and anomalous events. Finally, based on these multidimensional features, we construct a DNS resolution anomaly detection model named DRADC, using a stacked ensemble approach. Through a series of comparative experiments, the DRADC model significantly outperforms existing machine learning algorithms in key metrics such as accuracy (97.48%), recall (96.87%), and F1 score (97.09%). Feature ablation experiments further demonstrates that incorporating multidimensional features significantly improves model performance, with a 3% increase in accuracy and a 3.5% increase in precision compared to models relying solely on response content features. By providing an accurate detection model for DNS resolution anomalies, this study aids network administrators in more effectively identifying and countering network attacks. Additionally, our research also contributes to the detection and response to domain censorship mechanisms, which is crucial for maintaining the openness and free flow of the Internet.

An empirical study of reflection attacks using NetFlow data

Reflection attacks are one of the most intimidating threats organizations face. A reflection attack is a special type of distributed denial-of-service attack that amplifies the amount of malicious traffic by using reflectors and hides the identity of the attacker. Reflection attacks are known to be one of the most common causes of service disruption in large networks. Large networks perform extensive logging of NetFlow data, and parsing this data is an advocated basis for identifying network attacks. We conduct a comprehensive analysis of NetFlow data containing 1.7 billion NetFlow records and identified reflection attacks on the network time protocol (NTP) and NetBIOS servers. We set up three regression models including the Ridge, Elastic Net and LASSO. To the best of our knowledge, there is no work that studied different regression models to understand patterns of reflection attacks in a large network. In this paper, we (a) propose an approach for identifying correlations of reflection attacks, and (b) evaluate the three regression models on real NetFlow data. Our results show that (a) reflection attacks on the NTP servers are not correlated, (b) reflection attacks on the NetBIOS servers are not correlated, (c) the traffic generated by those reflection attacks did not overwhelm the NTP and NetBIOS servers, and (d) the dwell times of reflection attacks on the NTP and NetBIOS servers are too small for predicting reflection attacks on these servers. Our work on reflection attacks identification highlights recommendations that could facilitate better handling of reflection attacks in large networks.

Dynamics-Aware Adversarial Attack of Adaptive Neural Networks

Dynamics-Aware Adversarial Attack of Adaptive Neural Networks

Optimizing IoT Intrusion Detection Using Balanced Class Distribution, Feature Selection, and Ensemble Machine Learning Techniques.

Internet of Things (IoT) devices are leading to advancements in innovation, efficiency, and sustainability across various industries. However, as the number of connected IoT devices increases, the risk of intrusion becomes a major concern in IoT security. To prevent intrusions, it is crucial to implement intrusion detection systems (IDSs) that can detect and prevent such attacks. IDSs are a critical component of cybersecurity infrastructure. They are designed to detect and respond to malicious activities within a network or system. Traditional IDS methods rely on predefined signatures or rules to identify known threats, but these techniques may struggle to detect novel or sophisticated attacks. The implementation of IDSs with machine learning (ML) and deep learning (DL) techniques has been proposed to improve IDSs' ability to detect attacks. This will enhance overall cybersecurity posture and resilience. However, ML and DL techniques face several issues that may impact the models' performance and effectiveness, such as overfitting and the effects of unimportant features on finding meaningful patterns. To ensure better performance and reliability of machine learning models in IDSs when dealing with new and unseen threats, the models need to be optimized. This can be done by addressing overfitting and implementing feature selection. In this paper, we propose a scheme to optimize IoT intrusion detection by using class balancing and feature selection for preprocessing. We evaluated the experiment on the UNSW-NB15 dataset and the NSL-KD dataset by implementing two different ensemble models: one using a support vector machine (SVM) with bagging and another using long short-term memory (LSTM) with stacking. The results of the performance and the confusion matrix show that the LSTM stacking with analysis of variance (ANOVA) feature selection model is a superior model for classifying network attacks. It has remarkable accuracies of 96.92% and 99.77% and overfitting values of 0.33% and 0.04% on the two datasets, respectively. The model's ROC is also shaped with a sharp bend, with AUC values of 0.9665 and 0.9971 for the UNSW-NB15 dataset and the NSL-KD dataset, respectively.

An Identity Authentication Method Of Configuration Terminal Based On Audio Feature Recognition In Smart Distribution Network

Abstract A smart distribution network contains a large number of data acquisition terminals used to monitor the operation status of the distribution network and control the operation parameters, some of which are located in outdoor and other unsafe environments. If the attacker operates and configures the distribution network terminal by pretending to be a legitimate configuration device, it will become a springboard to infiltrate the main station of the internal network or misreport fault information, which may result in the leakage of sensitive data and even destroy the running state of the equipment. Identity authentication is the first line of defense to ensure the safe and stable operation of equipment. At present, the commonly used identity authentication technologies such as certificate authentication and key authentication have certain security vulnerabilities at different levels, which make it increasingly difficult to prevent the ever-changing network attack technology. According to the characteristics of physical unclonable facility (PUF), which is used to describe the hidden characteristics of the device and is directly related to the hardware, this paper proposes a method to authenticate the validity of the power distribution network configuration terminal based on the audio feature, which collects the frequency response characteristics of the hardware from the audio sensor of the configuration device as the identification information to identify the validity of the configuration device.