Attack Behavior Research Articles

Control modeling and optimization of network information security system based on deep learning data interaction

In order to solve the problem of poor network security protection performance of traditional network information security protection systems, the author proposes a network information security system control modeling based on deep learning data interaction. Adopt CY8C2453 type processor to improve system data exchange and data processing speed, enhance system stability through peripheral backplane, and evaluate network information security, at the same time, the authority management mechanism is set, and the general strategy form of the network attack and defense game is defined as a triple, calculate the attacked path in a certain network area and the defense strategy that the defender should choose, so as to complete the network information security protection based on the attack-defense game model. Experimental results show that: The number of attacked information of the system is 58 less than that of the traditional system; In the webpage attack, the number of attacked information of the designed system is 82 less than that of the traditional system; In the data interception attack, the number of attacked information of the designed system is 77 less than that of the traditional system. ConclusionUnder different attack behaviors, the number of successful attacks on the network information security protection system based on the attack-defense game model designed this time is less than the number of successful attacks on the traditional system, which improves the security of network information.

Interaksi Sosial Anak Down Syndrome di Flexi School Banda Aceh

Down syndrome is one of the children with special needs, where the child has an intellectual level that is low or below average. This study aims to find out, provide an overview, and explain about the forms of social interaction carried out by a child with special needs with Down syndrome with teachers and friends in school. This is done in order to provide a true view and picture of the social behavior that appears from children with Down syndrome, where it has not been widely known by educators and the public. This research is a qualitative research with case study method, this research uses purposive sampling technique. This study uses one subject with certain characteristics. Data collection techniques used are: non-participant observation, interviews, questionnaires, and documentation. Data analysis techniques include: (1) data reduction (2) data presentation, and (3) conclusion drawing. The results of data collection conducted from March 2024, found that there are four forms of behavior that appear classified in social behavior and forms of behavior classified as asocial behavior. The intended social behaviors are friendly behavior, sympathetic behavior, cooperative behavior, and competitive behavior. Existing asocial behaviors consist of resistance behavior and attack behavior.

AARF: Autonomous Attack Response Framework for Honeypots to Enhance Interaction Based on Multi-Agent Dynamic Game

Highly interactive honeypots can form reliable connections by responding to attackers to delay and capture intranet attacks. However, current research focuses on modeling the attacker as part of the environment and defining single-step attack actions by simulation to study the interaction of honeypots. It ignores the iterative nature of the attack and defense game, which is inconsistent with the correlative and sequential nature of actions in real attacks. These limitations lead to insufficient interaction of the honeypot response strategies generated by the study, making it difficult to support effective and continuous games with attack behaviors. In this paper, we propose an autonomous attack response framework (named AARF) to enhance interaction based on multi-agent dynamic games. AARF consists of three parts: a virtual honeynet environment, attack agents, and defense agents. Attack agents are modeled to generate multi-step attack chains based on a Hidden Markov Model (HMM) combined with the generic threat framework ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). The defense agents iteratively interact with the attack behavior chain based on reinforcement learning (RL) to learn to generate honeypot optimal response strategies. Aiming at the sample utilization inefficiency problem of random uniform sampling widely used in RL, we propose the dynamic value label sampling (DVLS) method in the dynamic environment. DVLS can effectively improve the sample utilization during the experience replay phase and thus improve the learning efficiency of honeypot agents under the RL framework. We further couple it with a classic DQN to replace the traditional random uniform sampling method. Based on AARF, we instantiate different functional honeypot models for deception in intranet scenarios. In the simulation environment, honeypots collaboratively respond to multi-step intranet attack chains to defend against these attacks, which demonstrates the effectiveness of AARF. The average cumulative reward of the DQN with DVLS is beyond eight percent, and the convergence speed is improved by five percent compared to a classic DQN.

Enhancing core–periphery robustness of networks against link-based attacks with imprecise information

Core-Periphery structure, as a critical mesoscale structure, is commonly found in diverse real-world networks, in which nodes are endogenously categorized as core or peripheral nodes by the underlying interconnection patterns. It plays an important role in sustaining the intrinsic order and functional behavior of networked systems. However, despite the study on inherent core–periphery vulnerabilities to node removals, little is known on the core–periphery robustness when networks are suffering from the attacks that happen on links between nodes, especially for the more practical situations where attackers have limited ability to obtain precise network information. In this paper, a novel index is proposed for measuring the capacity of the core–periphery structure to resist link-based attacks. By introducing an attack precision parameter, we establish a unified evaluation framework for link-based attacks with imprecise information, which divides attack behaviors into localized attacks and non-localized attacks, and treats the usual random attacks and targeted attacks as the two special situations of our non-localized case. Several enhancing algorithms guided by our index with local search strategy are exquisitely devised, and experimental results are provided to demonstrate the efficacy of our framework and algorithms that remarkably improve the core–periphery robustness against link-based attacks with imprecise information.

Central amygdala is related to the reduction of aggressive behavior by monosodium glutamate ingestion during the period of development in an ADHD model rat.

Monosodium glutamate (MSG), an umami substance, stimulates the gut-brain axis communication via gut umami receptors and the subsequent vagus nerves. However, the brain mechanism underlying the effect of MSG ingestion during the developmental period on aggression has not yet been clarified. We first tried to establish new experimental conditions to be more appropriate for detailed analysis of the brain, and then investigated the effects of MSG ingestion on aggressive behavior during the developmental stage of an ADHD rat model. Long-Evans, WKY/Izm, SHR/Izm, and SHR-SP/Ezo were individually housed from postnatal day 25 for 5 weeks. Post-weaning social isolation (PWSI) was given to escalate aggressive behavior. The resident-intruder test, that is conducted during the subjective night, was used for a detailed analysis of aggression, including the frequency, duration, and latency of anogenital sniffing, aggressive grooming, and attack behavior. Immunohistochemistry of c-Fos expression was conducted in all strains to predict potential aggression-related brain areas. Finally, the most aggressive strain, SHR/Izm, a known model of attention-deficit hyperactivity disorder (ADHD), was used to investigate the effect of MSG ingestion (60 mM solution) on aggression, followed by c-Fos immunostaining in aggression-related areas. Bilateral subdiaphragmatic vagotomy was performed to verify the importance of gut-brain interactions in the effect of MSG. The resident intruder test revealed that SHR/Izm rats were the most aggressive among the four strains for all aggression parameters tested. SHR/Izm rats also showed the highest number of c-Fos + cells in aggression-related brain areas, including the central amygdala (CeA). MSG ingestion significantly decreased the frequency and duration of aggressive grooming and attack behavior and increased the latency of attack behavior. Furthermore, MSG administration successfully increased c-Fos positive cell number in the intermediate nucleus of the solitary tract (iNTS), a terminal of the gastrointestinal sensory afferent fiber of the vagus nerve, and modulated c-Fos positive cells in the CeA. Interestingly, vagotomy diminished the MSG effects on aggression and c-Fos expression in the iNTS and CeA. MSG ingestion decreased PWSI-induced aggression in SHR/Izm, which was mediated by the vagus nerve related to the stimulation of iNTS and modulation of CeA activity.

Hybridization of concrete by the inclusions of kaolin, alumina and silica fume: Performance evaluation

Concrete is the prime source, which fulfils the applications for construction in various forms. The prime roles of concrete industries are reducing material usage, enrichment of compressive strength, and flexural strength of concrete usage. This research focuses on recycling kaolin (mining waste) and silica fume, a great potential material for replacing coarse aggregate gravel stone and fine aggregate sand in conventional concrete as a hybrid. The developed concrete contained 5% nano alumina (Al2O3), 10% of kaolin waste (KW), and 5, 10, and 15% of silica fume (SF), and its behavior like compressive strength, flexural strength, water absorption, and acid attack behavior is studied. The molecular structure of crystalline is analyzed via X-ray diffraction (XRD). The 15% SF blended with 5% alumina and 10% KW cured within 28 and 90 days recorded high compressive and flexural strength (44 ± 1.76 MPa and 4.3 ± 0.17 MPa). XRD pattern proved their alumina, SF, and KW and found that the concrete blended with 5% alumina, 10% KW, and 15 wt% SF(90 days cured concrete) showed low water absorption (3.1 ± 0.12%). The effect of sulfuric acid behavior on weight reduction was 0.78% compared to CC1 (concrete cube without Al2O3, SF, and KW).

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Faced with the challenges of security strategy design brought about by the complexity of attack behavior and the dynamism of network structure, dynamic hierarchical intelligent defense methods have shown their effectiveness. However, in complex network environments, their application requires a higher level of coordination mechanisms. Therefore, this paper proposes a hierarchical multi-agent reinforcement learning network attack and defense game and cooperative defense decision-making method, which autonomously and efficiently completes the formulation of defense strategies and defense behavior responses. Firstly, we construct a Stackelberg hypergame model of cyberspace conflicts, and under the condition of information loss, characterize the multi-layer dynamic defense coordination response mechanism. Secondly, By utilizing a hierarchical multi-agent reinforcement learning method as the driving force for game evolution, we sequentially solve the Nash equilibrium of the game, and form a dynamic autonomous defense strategy. Finally, we construct a hierarchical multi-agent reinforcement learning framework, which decouples the defense decision problem, reduces the dimension of the defense action space and the exploration difficulty of the strategy space, and learns coordinated defense strategies more efficiently. We used the CybORG (Cyber Operations Research Gym) environment for simulation. We compared and analyzed the autonomously generated cyber defense strategies with other related works, verifying the superior coordination performance of our method in defense strategy generation and control.

Web Attack Detection Based on Honeypots and Logistic Regression Algorithm

Web security has emerged as one of the most prominent concerns in the realm of cybersecurity. Traditional rule-based methods for detecting web attacks often rely on manual rule definition and pattern matching, leaving them inadequate in accurately identifying new and intricate attack patterns. In the face of these challenges, machine learning techniques have demonstrated potential and advantages. This paper presents a web attack detection method based on honeypots and the logistic regression algorithm. It involves the cleansing, filtering, and analysis of web logs captured by honeypots, followed by the vectorization of the textual data contained in these logs. The logistic regression algorithm is employed to train and test the classification of the text vectors, generating a logistic regression model. This model is then used to predict newly generated web logs, enabling effective dynamic web attack detection. Experimental evaluations using collected datasets are conducted, comparing the proposed method with the support vector machine approach. The results demonstrate that this method achieves rapid and accurate detection and recognition of web attack behaviors while ensuring performance efficacy.

VTT-LLM: Advancing Vulnerability-to-Tactic-and-Technique Mapping through Fine-Tuning of Large Language Model

Vulnerabilities are often accompanied by cyberattacks. CVE is the largest repository of open vulnerabilities, which keeps expanding. ATT&CK models known multi-step attacks both tactically and technically and remains up to date. It is valuable to correlate the vulnerability in CVE with the corresponding tactic and technique of ATT&CK which exploit the vulnerability, for active defense. Mappings manually is not only time-consuming but also difficult to keep up-to-date. Existing language-based automated mapping methods do not utilize the information associated with attack behaviors outside of CVE and ATT&CK and are therefore ineffective. In this paper, we propose a novel framework named VTT-LLM for mapping Vulnerabilities to Tactics and Techniques based on Large Language Models, which consists of a generation model and a mapping model. In order to generate fine-tuning instructions for LLM, we create a template to extract knowledge of CWE (a standardized list of common weaknesses) and CAPEC (a standardized list of common attack patterns). We train the generation model of VTT-LLM by fine-tuning the LLM according to the above instructions. The generation model correlates vulnerability and attack through their descriptions. The mapping model transforms the descriptions of ATT&CK tactics and techniques into vectors through text embedding and further associates them with attacks through semantic matching. By leveraging the knowledge of CWE and CAPEC, VTT-LLM can eventually automate the process of linking vulnerabilities in CVE to the attack techniques and tactics of ATT&CK. Experiments on the latest public dataset, ChatGPT-VDMEval, show the effectiveness of VTT-LLM with an accuracy of 85.18%, which is 13.69% and 54.42% higher than the existing CVET and ChatGPT-based methods, respectively. In addition, compared to fine-tuning without outside knowledge, the accuracy of VTT-LLM with chain fine-tuning is 9.24% higher on average across different LLMs.

An unsupervised adversarial autoencoder for cyber attack detection in power distribution grids

Detection of cyber attacks in smart power distribution grids with unbalanced configurations poses challenges due to the inherent nonlinear nature of these uncertain and stochastic systems. It originates from the intermittent characteristics of the distributed energy resources (DERs) generation and load variations. Moreover, the unknown behavior of cyber attacks, especially false data injection attacks (FDIAs) in the distribution grids with complex temporal correlations and the limited amount of labeled data increases the vulnerability of the grids and imposes a high risk in the secure and reliable operation of the grids. To address these challenges, this paper proposes an unsupervised adversarial autoencoder (AAE) model to detect FDIAs in unbalanced power distribution grids integrated with DERs, i.e., PV systems and wind generation. The proposed method utilizes long short-term memory (LSTM) in the structure of the autoencoder to capture the temporal dependencies in the time-series measurements and leverages the power of generative adversarial networks (GANs) for better reconstruction of the input data. The advantage of the proposed data-driven model is that it can detect anomalous points for the system operation without reliance on abstract models or mathematical representations and data labels. To evaluate the efficacy of the approach, it is tested on IEEE 13-bus and 123-bus systems with historical meteorological data (wind speed, ambient temperature, and solar irradiance) as well as historical real-world load data under three types of data falsification functions. The comparison of the detection results of the proposed model with other data-driven methods verifies its superior performance in detecting cyber attacks in unbalanced power distribution grids.

Interconnected Takagi-Sugeno system and fractional SIRS malware propagation model for stabilization of Wireless Sensor Networks

This paper is devoted to investigate the dynamical behaviors of malware attack on a familiar kind of complex heterogeneous networks, namely Wireless Sensor Network, and discuss an effective immunization treatment based on fractional interconnected Takagi-Sugeno (T-S) fuzzy systems. Our approach is based on the mathematical modeling to establish a controlled fractional network-based SIRS malware propagation model that better describes the attacking behavior of malicious objects on Wireless Sensor Network. After that, we point out some qualitative properties of the proposed network-based SIRS malware propagation model such as the existence of positively invariant set, backward bifurcation and asymptotic behavior. Especially, in order to study the model's stability, we evaluate an epidemiological threshold value R0, namely basic reproductive ratio, which ensures the existence of at least one endemic equilibrium P⁎ and the local asymptotic stability of malware-free equilibrium P0. As a consequence of theoretical result, the malware-free equilibrium P0 is unstable when R0>1 and hence, the rest of this paper is to address a stabilization problem for the proposed controlled network-based model and establish some sufficient conditions related to linear matrix inequalities and positive definite matrices. Finally, we illustrate the obtained theoretical results by a computational example.

B-CAT: a model for detecting botnet attacks using deep attack behavior analysis on network traffic flows

AbstractThreats on computer networks have been increasing rapidly, and irresponsible parties are always trying to exploit vulnerabilities in the network to do various dangerous things. One way to exploit vulnerabilities in a computer network is by employing malware. Botnets are a type of malware that infects and attacks targets in groups. Botnets develop quickly; the characteristics of initially sporadic attacks have grown into periodic and simultaneous. This rapid development has proved that the botnet is advanced and requires more attention and proper handling. Many studies have introduced detection models for botnet attack activity on computer networks. Apart from detecting the presence of botnet attacks, those studies have attempted to explore the characteristics of botnets, such as attack intensity, relationships between activities, and time segment analysis. However, there has been no research that explicitly detects those characteristics. On the other hand, each botnet characteristic requires different handling, while recognizing the characteristics of the botnet can help network administrators make appropriate decisions. Based on these reasons, this research builds a detection model that can recognize botnet characteristics using sequential traffic mining and similarity analysis. The proposed method consists of two main processes. The first is training to build a knowledge base, and the second is testing to detect botnet activity and attack characteristics. It involves dynamic thresholds to improve the model sensitivity in recognizing attack characteristics through similarity analysis. The novelty includes developing and combining analytical techniques of sequential traffic mining, similarity analysis, and dynamic threshold to detect and recognize the characteristics of botnet attacks explicitly on actual behavior in network traffic. Extensive experiments have been conducted for the evaluation using three different datasets whose results show better performance than others.

Golden jackal optimization for economic load dispatch problems with complex constraints

This research paper uses the golden jackal optimization (GJO), a novel meta-heuristic algorithm, to address power system economic load dispatch (ELD) problems. The GJO emulates the hunting behavior of golden jackals. GJO algorithm uses the cooperative attacking behavior of golden jackals to tackle complicated optimization problems efficaciously. The objective of ELD problem is to distribute power system load requirement to the different generators with a minimum total fuel cost of generation. ELD problems are highly complex, non-linear, and non-convex optimization problems while considering constraints namely valve point loading effect (VPL) and prohibited operating zones (POZs). The proposed GJO algorithm is applied to solve complex, non-linear, and non-convex ELD problems. Six different test systems having 6, 10, 13, 40, and 140 generators with various constraints are used to validate the usefulness of the suggested GJO method. Simulation outcomes of the test system are compared with various algorithms reported in the algorithms such as particle swarm optimization (PSO), ant colony optimization (ACO), and backtracking search algorithm (BSA). Results show that the proposed GJO algorithm produces minimal fuel cost and has good convergence in solving ELD problems of power system engineering.

Data-based adaptive predictive bipartite consensus for nonlinear multiagent systems against DoS attacks

This article investigates a Denial-of-Service (DoS) attack problem for nonlinear unknown discrete-time multiagent systems (MASs) to implement bipartite consensus tracking tasks with fixed and switching topologies. Firstly, an equivalent linearization data model of each agent is constructed using a pseudo partial derivative approach, where only one parameter needs to be estimated using input/output data of the controlled MASs. Meanwhile, the DoS attack behavior is described by a Bernoulli distribution process, and both cooperative and competitive relationships among agents are investigated. Moreover, an increment prediction compensator is designed to reduce the effect of DoS attacks. A data-based adaptive predictive bipartite consensus control algorithm is formulated. The corresponding theoretical analysis indicates that tracking errors of MASs with fixed and switching topologies converge to a small range around zero. Finally, several simulations and hardware tests further verify the proposed scheme’s effectiveness.

Anomaly based multi-stage attack detection method.

Multi-stage attacks are one of the most critical security threats in the current cyberspace. To accurately identify multi-stage attacks, this paper proposes an anomaly-based multi-stage attack detection method. It constructs a Multi-Stage Profile (MSP) by modeling the stable system's normal state to detect attack behaviors. Initially, the method employs Doc2Vec to vectorize alert messages generated by the intrusion detection systems (IDS), extracting profound inter-message correlations. Subsequently, Hidden Markov Models (HMM) are employed to model the normal system state, constructing an MSP, with relevant HMM parameters dynamically acquired via clustering algorithms. Finally, the detection of attacks is achieved by determining the anomaly threshold through the generation probability (GP). To evaluate the performance of the proposed method, experiments were conducted using three public datasets and compared with three advanced multi-stage attack detection methods. The experimental results demonstrate that our method achieves an accuracy of over 99% and precision of 100% in multi-stage attack detection. This confirms the effectiveness of our method in adapting to different attack scenarios and ultimately completing attack detection.

Class imbalance and concept drift invariant online botnet threat detection framework for heterogeneous IoT edge

Heterogeneous networks (HetIoT) of high-capacity and resource-constrained IoT devices and their edge associations for on-device distributed critical workloads—called the edge-of-things (EoT)—attract short-burst, botnet-based zero-day attacks that exploit latent vulnerabilities due to heterogeneous device properties, dynamic operational contexts, and insufficient security scrutiny of the constituent proprietary devices. Such a scenario necessitates a device-specific network intrusion detection (NID) technique for localizing the threat space and updated rule learning through online (real-time) model retraining. Furthermore, scarce labeled knowledge base and high levels of class imbalance of NID datasets complicate the ID system design process for EoT environments, as online detection cannot afford computationally expensive data balancing techniques; this necessitates a class imbalance invariant traffic inference technique for data preprocessing. Therefore, we propound the ONIDS online NID technique, which consists of a two-fold solution for the above problems. First, we propose a Beta distribution-based inference technique for efficient traffic behavior approximation—invariant of class imbalance and capable of non-cumulative traffic processing of smaller sample sizes. Then, we put forth an online ID technique called ELMO for class imbalance invariant time-bound training of smaller sample sizes on resource-constrained device-specific network traffic. Together, they are invariant of traffic class imbalances and adaptable to resultant concept drift categories exhibited by HetIoT attack behaviors. ONIDS has low memory and compute footprints and can efficiently process large and small amounts of traffic, making it suitable for online and offline NID. It also exhibits qualitative and quantitative superiority—particularly on smaller data samples.

Advanced Persistent Threat Group Correlation Analysis via Attack Behavior Patterns and Rough Sets

In recent years, advanced persistent threat (APT) attacks have become a significant network security threat due to their concealment and persistence. Correlation analysis of APT groups is vital for understanding the global network security landscape and accurately attributing threats. Current studies on threat attribution rely on experts or advanced technology to identify evidence linking attack incidents to known APT groups. However, there is a lack of research focused on automatically discovering potential correlations between APT groups. This paper proposes a method using attack behavior patterns and rough set theory to quantify APT group relevance. It extracts two types of features from threat intelligence: APT attack objects and behavior features. To address the issues of inconsistency and limitations in threat intelligence, this method uses rough set theory to model APT group behavior and designs a link prediction method to infer correlations among APT groups. Experimental results on publicly available APT analysis reports show a correlation precision of 90.90%. The similarity coefficient accurately reflects the correlation strength, validating the method’s efficacy and accuracy.

False data injection in distribution system: Attacker's perspective

The distribution system is digitizing and occupying cyberspace with the help of information and communication technologies (ICTs). It is vulnerable to cyber-attacks like false data injection (FDI) and denial-of-services (DoS). However, limited research on cyber-attacks in the distribution system is reported in the literature, and these attacks are of serious concern to distribution system operators (DSOs). The DSO's primary challenge is to understand the attacker's perspective for FDI attack construction. Thus, the work presented in this paper aims to provide an in-depth insight for DSO to apprehend the attacker's perspective, attack flow, and the nature of the FDI attack vector. The prior knowledge of attack flow to DSO can help to protect critical infrastructures from cyber-attacks. Thus, this work comprehends the attacker's behaviour for deploying the optimal budget to disrupt the distribution system operation therein by injecting a stealthy FDI vector. The attacker is resource-constrained in terms of budget and network information. Therefore, the optimal budget for attack initiation is proposed and formulated as a multi-objective optimization problem to minimize the investment and maximize the economic loss for the DSO. Constructing the attack vectors for the attacker is challenging in the limited network information. It is complex because of network characteristics such as multi-phase configurations & an unbalanced nature, and higher resistance to reactance (r/x) ratio. Thus, the FDI attack vector construction is proposed based on non-linear programming optimization and sensitivity analysis considering partial information from the distribution system. The simulation results are presented and compared with available methods in the literature to validate the efficacy of the proposed methods.

Dynamic sliding window‐cooperative spectrum sensing against massive SSDF attack in interweave cognitive internet of things

AbstractTo improve spectrum utilization, cognitive radio (CR) enables unauthorized internet of thing (IoT) devices to opportunistically access the channel underutilized by the primary user (PU) in a cognitive IoT (CIoT). To this end, cooperative spectrum sensing (CSS) plays a crucial role in CR technology, which leverages the spatial diversity of corroborative IoT devices to accurately detect the PU signal. However, this open cooperative paradigm may suffer from spectrum sensing data falsification (SSDF) attack in which malicious IoT devices intentionally mislead the fusion center (FC) by providing false sensing results to make an incorrect global decision regarding the PU status. To effectively characterize the attack behavior of malicious IoT devices, we propose a massive SSDF attack model described by the attack cycle and malicious ratio within a sensing period to characterize the malicious behaviors. Additionally, we introduce a delivery evaluation mechanism and propose a dynamic sliding window‐CSS (DSW‐CSS) to mitigate the impact of massive SSDF attack. Moreover, we introduce a sequential reporting mechanism to further reduce the number of samples required by the global decision‐making of the FC. Finally, simulation results show the flexibility and aggressiveness of the proposed attack model and demonstrate the correctness and effectiveness of DSW‐CSS.

Observed-Mode-Dependent Nonfragile Control of Networked Control Systems Under Hidden DoS Attacks

This paper develops a methodology on observed-mode-dependent non-fragile control for networked control systems subject to denial-of-service attacks, which takes the strong concealment of attack behavior into account. To describe complex switching phenomenon between different forms of attacks that the adversary may launch on communication channels, the semi-Markov chain is introduced. DoS attacks with stealth characteristic is analyzed from hidden semi-Markov jump systems perspective by constructing a double-layer stochastic process consisting of semi-Markov chain and observed mode sequence. With the aid of emission probability, an observed-mode-dependent non-fragile controller is designed, which can still stabilize the system even if actual attack modes are unavailable. By utilizing the Lyapunov function that depends on actual attack modes and observed ones, sufficient conditions to ensure the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\delta$</tex-math></inline-formula> -error mean square stability of the closed-loop system is deduced. Eventually, a simulation related to the mass-spring-damper system with single channel and an example of the unmanned ground vehicle with two channels are studied, both of which demonstrate the feasibility and validity.