Class Of Cyber Attacks Research Articles

Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain

Recently, an increasing number of cyber-attacks in the medical field has resulted in great losses in the health care industry, since medical information plays an essential role in human health. To introduce a comprehensive survey about possible cyber-attacks and solutions for these attacks, our paper first presents a brief overview of the necessary background of the dataflow in the medical domain and then identifies the vulnerabilities in each stage of the dataflow. Then, according to the weaknesses identified in the medical system, a classification of cyber-attacks is presented. Additionally, the paper presents research on previous work that focuses on solving these cyber-attacks and identifies the strengths and limitations of the solutions for each attack. More importantly, for data storage assurance, our paper discusses several cybersecurity architectures for the medical domain from the existing literature. The countermeasures from previous papers and architectures that are still weak in terms of resource depletion, attack reduction, applicability, etc. are addressed. Finally, the paper discusses and recommends solutions for future work to decrease cyber-attacks in the medical field so that human health can be guaranteed.

Detection of False Data Injection Attacks in Smart Grid Utilizing ELM-Based OCON Framework

False data injection (FDI) attacks, as a new class of cyberattacks, bring a severe threat to the security and reliable operation of the smart grid by damaging the state estimation of the power system. To address this issue, an extreme learning machine (ELM)-based one-class-one-network (OCON) framework is proposed for detecting the FDI attacks in this paper. Under this framework, to effectively detect bus-based FDI attacks and identify the bus node being attacked, the subnets of state identification layer in OCON adopt the ELM algorithm to accurately divide the false data and the normal data. After that, a global layer is employed to analyze whether the bus node associated with its corresponding subnet is attacked by false data utilizing the results from the state identification layer. Finally, in order to improve the resilience of the power system, a prediction recovery strategy is proposed to remedy the detected false data by exploiting the spatial correlation of power data. The proposed framework is tested on the IEEE 14 bus system using real load data from New York independent system operator. The simulation results demonstrate that the proposed framework not only accurately recognizes the multiple bus nodes under the FDI attacks but also efficiently recovers the data injected by false data.

Анализ и классификация кибератак на электронную техническую документацию железнодорожной автоматики и телемеханики

Objective: To analyze modifications of cyberattacks on online technical documentation of railroad security systems. Methods: The specificity of railroad automation and telemechanics (RAT) documentation maintenance in electronic document management systems was estimated and presented. Also the assessment of enforceability of cyberattacks under actual operating conditions was given. Results: The possibility of critical failure of train control systems resulting from cyber faults of error type in technical documentation was demonstrated. A classification of cyberattacks on electronic databases of technical documentation was introduced. Vulnerability of the latter was uncovered. Practical importance: The necessity to develop special security measures for electronic databases of RAT technical documentation was justified. It concerned cyber faults of error type. Moreover, practical implementation alternatives of security methods in case of cyberattacks were introduced.

The system of technical diagnostics of the industrial safety information network

This research is devoted to problems of safety of the industrial information network. Basic sub-networks, ensuring reliable operation of the elements of the industrial Automatic Process Control System, were identified. The core tasks of technical diagnostics of industrial information safety were presented. The structure of the technical diagnostics system of the information safety was proposed. It includes two parts: a generator of cyber-attacks and the virtual model of the enterprise information network. The virtual model was obtained by scanning a real enterprise network. A new classification of cyber-attacks was proposed. This classification enables one to design an efficient generator of cyber-attacks sets for testing the virtual modes of the industrial information network. The numerical method of the Monte Carlo (with LPτ - sequences of Sobol), and Markov chain was considered as the design method for the cyber-attacks generation algorithm. The proposed system also includes a diagnostic analyzer, performing expert functions. As an integrative quantitative indicator of the network reliability the stability factor (Kstab) was selected. This factor is determined by the weight of sets of cyber-attacks, identifying the vulnerability of the network. The weight depends on the frequency and complexity of cyber-attacks, the degree of damage, complexity of remediation. The proposed Kstab is an effective integral quantitative measure of the information network reliability.

Threat Analysis in the Network-Centric Environment

Abstract The paper presents an analysis of the threats that one can face in the cyberspace and dangers affect the safety of a state and its citizens. The authors compare definitions of terrorism, particularly focusing on issues related to cyber terrorism. They explain concepts associated to terrorist activities in the network-centric environment. Next, the evolution of the threats awaiting in the Internet has been presented. Moreover, classification of cyber-attacks and current dangers that may occur in ICT systems has been analysed.

Cyber Attack Detection System based on Improved Support Vector Machine

This paper presents a novel cyber attack classification approach using improved Support Vector Machine (iSVM) by modifying Gaussian kernel. The Support Vector Machine (SVM) is based on machine learning technique known to perform well at various pattern recognition tasks; such as image classification, text categorization and handwritten character recognition. The cyber attack detection is basically a pattern classification problem, in which classification of normal pattern is done from the abnormal pattern (attack). Although, traditional SVM is better classifier in terms of fast training, scalable and generalization capability. Performance of traditional SVM is enhanced in this work by modifying Gaussian kernel to enlarge the spatial resolution around the margin by a conformal mapping, so that the separability between attack classes is increased. It is based on the Riemannian geometrical structure induced by the kernel function. In the proposed method, class specific Cyber Attack Detection System which combines feature reduction technique and improved support vector machine classifier. This technique has two phases, in the first phase we reduced the redundant features of the original KDDCUP2009 dataset by Generalized Discriminant Analysis (GDA). In the second phase we used improved Support Vector Machine (iSVM) classifier to classify the reduced dataset obtained from first phase. Result shows that iSVM gives 100% detection accuracy for Normal and Denial of Service (DOS) classes and comparable to false alarm rate, training, and testing times.

A Hybrid Intrusion Detection System Based on Multilayer Artificial Neural Network and Intelligent Feature Selection

Abstract. Increased intrusions into computer networks and cyber-attacks have rendered the immunization of cyberspace one of the most important issues of managers and experts in the recent years. Since cyber-attacks have become more sophisticated and hackers have become more professional, mere use techniques such as firewall, cryptography, biometrics, and antiviruses is not sufficient anymore. Therefore, it is necessary to employ efficient intrusion detection systems. Considering 5 classes of cyber-attacks, a detection intrusion system, of abuse detection type, based on the combination of a multilayer artificial neural network and an intelligent feature selection method was introduced in this research. The research results indicated that the feature selection phase using the proposed method yielded more favorable outcomes than the compared method in terms of the evaluation criteria.

Cyber-Attack Classification using Improved Ensemble Technique based on Support Vector Machine and Neural Network

Cyber-attack classification and detection process is based on the fact that intrusive activities are different from normal system activities .Its detection is a very complex process in network security. In current network security scenario various types of cyber-attack family exist, some are known family and some are unknown one . The detection of known attack is not very difficult it generally uses either signature base approach or rule based approach, but to find out the unknown one is a challenging task. Intrusion detection is a process for this .One of the major developments in machine learning in the past decade is the ensemble method, which finds highly accurate classifier by combining many moderately accurate component classifiers. This paper addresses using of an ensemble classification methods for intrusion detection. The paper proposes a cascaded support vector machine classifier or an improved ensemble classifier using multiple kernel function. The multiple kernel is Gaussian in nature. The graph based /neural network technique used for feature collection of different types of cyber-attack data. The proposed algorithm is very efficient in comparison of pervious method.

A Chaotic Complexity Measure for Cognitive Machine Classification of Cyber-Attacks on Computer Networks

Today's evolving cyber security threats demand new, modern, and cognitive computing approaches to network security systems. In the early years of the Internet, a simple packet inspection firewall was adequate to stop the then-contemporary attacks, such as Denial of Service (DoS), ports scans, and phishing. Since then, DoS has evolved to include Distributed Denial of Service (DDoS) attacks, especially against the Domain Name Service (DNS). DNS based DDoS amplification attacks cannot be stopped easily by traditional signature based detection mechanisms because the attack packets contain authentic data, and signature based detection systems look for specific attack-byte patterns. This paper proposes a chaos based complexity measure and a cognitive machine classification algorithm to detect DNS DDoS amplification attacks. In particular, this paper computes the Lyapunov exponent to measure the complexity of a flow of packets, and classifies the traffic as either normal or anomalous, based on the magnitude of the computed exponent. Preliminary results show the proposed chaotic measure achieved a detection (classification) accuracy of about 98%, which is greater than that of an Artificial Neural Network. Also, contrary to available supervised machine learning mechanisms, this technique does not require any offline training. This approach is capable of not only detecting offline threats, but has the potential of being applied over live traffic flows using DNS filters.

English

Cyber attack detection and classification is major challenge for web and network security. The increasing data traffic in network and web invites multiple cyber attack. The dynamic nature and large number of attribute of cyber data faced a problem of detection and prevention. In current research trend various method and framework are proposed by different authors. These framework and proposed method is based on data mining and neural network approach. Data mining offers various techniques such as clustering, classification, rule generation and temporal event mining; these techniques are very efficient for detection process of cyber attack. The application of neural network in cyber attack classification use as feature reduction technique. Feature reduction is very important task in cyber attack classification; because the cyber attack data consists of huge amount of features. This paper presents various method of cyber attack detection and classification technique based on data mining and neural network approach along with IDS evaluation criteria and dataset used for validated of IDS is also discussed here.

An Ensemble Approach for Cyber Attack Detection System: A Generic Framework

Cyber attack detection is based on assumption that intrusive activities are noticeably different from normal system activities and thus detectable. A cyber attack would cause loss of integrity, confidentiality, denial of resources. The fact is that no single classifier able to give maximum accuracy for all the five classes (Normal, Probe, DOS, U2R and R2L). We have proposed a Cyber Attack Detection System (CADS) and its generic framework, which performs well for all the classes. This is based on Generalized Discriminant Analysis (GDA) algorithm for feature reduction of the cyber attack dataset and an ensemble approach of classifiers for classification of cyber attacks. The ensemble approach of classifiers classifies cyber attack based on the union of the subsets of features. Thus it can detect a wider range of attacks. The C4.5 and improved Support Vector Machine (iSVM) classifiers are combined as a hierarchical hybrid classifier (C4.5-iSVM) and an ensemble approach combining the individual base classifiers and hybrid classifier for best classification of cyber attacks. The experimental results illustrate that the proposed Cyber Attack Detection System is having improved detection accuracy for all the classes of attacks.

Methodology of building multicriterion differential-game models and methods

The paper gives a methodology of analysis and synthesis of multicriterion differential-game models and methods of modeling the processes of cyber attack. Established methodology of uniform systems approaches allows the synthesis of multicriterion differential-game methods of cyber attacks modeling that involve the use of the systems of appropriate models with various degrees of accuracy, from the models of security evaluation to the models of cyber attack dynamics prediction. Application of the methodology facilitates the integration of advanced information security systems into the newly created information technologies, that along with the solution of basic assigned tasks, solve the problem of information security and are sustainable to the predicted class of cyber attacks and parameters that characterize them. The results of the methodology are reflected both in quantitative and qualitative forms, which does not contradict the basic tenets of the theory of complex systems.