Injection Attacks Research Articles

Adaptive estimator-based nonsingular fast terminal sliding mode control of robotic manipulator systems under FDI attacks and actuator failure

This paper is focused on the adaptive estimator-based super-twisting nonsingular fast terminal sliding mode control of manipulator systems with false data injection (FDI) attacks and actuator failure. First, a novel mathematical model is established for the robotic manipulator systems with parameter perturbation, FDI attacks, actuator failure, external disturbance, and joint friction. As the dynamics of FDI attacks are often unknown or unpredictable, a novel adaptive fixed-time estimator-based defense method is designed to actively eliminate the negative effects induced by the FDI attacks. Meanwhile, an adaptive super-twisting nonsingular fast terminal sliding mode controller (NFTSMC) is designed to realize rapid convergence and desirable tracking precision. After that, the fixed-time stability of the manipulator systems are proved using the Lyapunov function. Finally, the comparative simulation verifies the superiority of the proposed control strategy over the current control methods.

Self-Healing Control of Nuclear Power Plants Under False Data Injection Attacks

The transition from analog to digital instrumentation and control (I&C) systems introduces new threats caused by cyberattacks in the nuclear industry. This paper proposes a self-healing strategy to respond to a false data injection attack that targets digital I&C systems, which is a type of cyberattack commonly targeting nuclear power plants with the potential to cause serious physical impacts. This resilience strategy for self-healing control contains three components: (1) an anomaly detection model that can detect false data injection attacks, (2) a device-level control that utilizes inferred values to perform control under a detected false data injection, and (3) a system-level control that leverages another controller that is not under attack to lead the system back to a safe operation state when the device-level control is unavailable. Anomaly detection and device-level control use an autoencoder while system-level control utilizes reinforcement learning. The proposed self-healing resilience strategy is demonstrated with a generic pressurized water reactor (GPWR) simulator under false data injections, targeting the steam generator water level. The results show that the proposed strategy effectively leads the system back to a normal operation state under various false data injection cases.

Comprehensive review of machine learning models for sql injection detection in e-commerce

With the steady expansion of online commerce, e-commerce sites have become increasingly attractive targets for hackers. These sites serve millions of customers and often hold valuable, confidential, and sometimes financial information in their databases. One particularly dangerous type of attack is SQL injection, which exploits vulnerabilities in web applications to influence backend databases, posing significant threats to such platforms. Traditional defenses like desktop firewalls, input validation, and parameterized queries provide some level of protection but are often insufficient against newer injection variations and sophisticated attackers. The utilization of machine learning to enhance cybersecurity against more advanced threats has been demonstrated as a promising approach. This systematic review examines how various machine learning algorithms are applied to detect SQL injection attacks that could potentially harm e-commerce systems. By identifying and analyzing the relevant literature, this review highlights the effectiveness of different algorithms and their practical applications in enhancing the security of online commerce platforms. More specifically, five techniques were assessed on both real and synthetic datasets: Logistic Regression, Naive Bayes, Random Forest, Artificial Neural Network, and two combined models (Logistic Regression & Naive Bayes, and Artificial Neural Network & Random Forest). The findings indicate that Random Forest performed better than other algorithms in the decision tree family, attributed to its ability to balance precision and recall effectively. However, limitations such as using a single dataset and the computational complexity of some models were noted. This review provides insights for practitioners on selecting appropriate detection models and outlines approaches to address current limitations through future work. Addressing these limitations could involve using more diverse datasets, optimizing computational efficiency, and exploring advanced ensemble methods and neural network architectures.

Composite sliding mode control for cyber‐physical systems with multi‐source disturbances and false data injection attack

AbstractThis paper investigates the sliding mode control problem for cyber‐physical systems subject to multi‐source disturbances and actuator false data injection attacks simultaneously. Firstly, a series of extended state observers are designed to estimate the unknown multi‐source disturbances. For the actuator false data injection attacks, a sliding mode observer is designed to online estimate the values of attacks. Then, by introducing the disturbance and attack estimations, a dynamic sliding manifold and a composite sliding mode controller are constructed. Under the proposed approach, the unknown disturbances and false data injection attacks can be timely estimated and compensated, which can improve the disturbance rejection ability and guarantee security of the cyber‐physical system. Lyapunov theory is utilized to prove the stability of the closed‐loop system. Finally, simulations of both the numerical example and application to a power converter system demonstrate the effectiveness and superiority of the proposed composite sliding mode control approach.

Analysis of Manual and Automated Methods Effectiveness in Website Penetration Testing for Identifying SQL Injection Vulnerabilities

This research aims to identify vulnerabilities to SQL Injection attacks on websites through penetration testing using quantitative and descriptive methods. In the current digital era, data and information security has become a crucial aspect. One of the frequent threats is SQL Injection attacks, where attackers insert malicious SQL commands into queries executed by web applications. This study utilizes tools such as Burp Suite to identify and exploit vulnerabilities in a login form created by the researchers. The research process begins with the Pre-Engagement Interactions phase, which includes information gathering and setting the testing scope. Subsequently, Vulnerability Testing is conducted to evaluate existing weaknesses. The exploitation of vulnerabilities is performed using the 'OR'1'='1 technique, which successfully demonstrates that the website is vulnerable to SQL Injection attacks. The results of this study indicate that the login form on the website is susceptible to SQL Injection due to insufficient input validation and the use of dynamic SQL queries without prepared statements. Implementing stricter input validation techniques and using prepared statements has proven effective in enhancing website security. This research makes a significant contribution to the field of information system security, particularly in the prevention of SQL Injection attacks. The results of this study can serve as a practical guide for web developers in improving the security of their applications and provide a deeper understanding of the threats and mitigation techniques for SQL Injection.

Distributed control for DC microgrids with cyber attacks and constraints: A fault-tolerant model predictive controller

Communication security issues pose severe challenges to stability of microgrid system. This paper designs a cooperative control method based on fault-tolerant distributed model predictive control (DMPC) for DC microgrid against possible false information injection (FDI) attacks and communication constraints problems. First, a state variable is defined based on the voltage and current information, thereby deriving a system model of the microgrid under the cyber-physical framework. Then, since a combined uncertainty term consisting of attacks and disturbances exists in the constructed system model, an expanded state observer (ESO) is proposed to observe the uncertainty term. Further, based on the constructed system model and the designed ESO, a fault-tolerant distributed model predictive controller is designed. In the controller, DMPC is utilized to constrain the communication information and ensure the boundedness of the communication state and physical state. Simulation results indicate that the proposed DMPC-based distributed control method can achieve stable voltage regulation and accurate current sharing, and maintain smooth operation even under FDI attack, which verifies the feasibility for the proposed method.

Comparative Analysis of the Performance of Decision Tree and Random Forest Algorithms in SQL Injection Attack Detection

Comparative Analysis of the Performance of Decision Tree and Random Forest Algorithms in SQL Injection Attack Detection

Extended state observer-based fault-tolerant control for an unmanned surface vehicle under asynchronous injection and deception attacks

Extended state observer-based fault-tolerant control for an unmanned surface vehicle under asynchronous injection and deception attacks

Securing Bipartite Nonlinear Fractional-Order Multi-Agent Systems against False Data Injection Attacks (FDIAs) Considering Hostile Environment

This study investigated the stability of bipartite nonlinear fractional-order multi-agent systems (FOMASs) in the presence of false data injection attacks (FDIAs) in a hostile environment. To tackle this problem we used signed graph theory, the Razumikhin methodology, and the Lyapunov function method. The main focus of our proposed work is to provide a method of stability for FOMASs against FDIAs. The technique of Razumikhin improves the Lyapunov-based stability analysis by supporting the handling of the intricacies of fractional-order dynamics. Moreover, utilizing signed graph theory, we analyzed both hostile and cooperative interactions between agents within the MASs. We determined the system stability requirements to ensure robustness against erroneous data injections through comprehensive theoretical investigation. We present numerical examples to illustrate the robustness and efficiency of our proposed technique.

Fault-tolerant deep learning inference on CPU-GPU integrated edge devices with TEEs

CPU-GPU integrated edge devices and deep learning algorithms have received significant progress in recent years, leading to increasingly widespread application of edge intelligence. However, deep learning inference on these edge devices is vulnerable to Fault Injection Attacks (FIAs) that can modify device memory or execute instructions with errors. We propose DarkneTF, a Fault-Tolerant (FT) deep learning inference framework for CPU-GPU integrated edge devices, to ensure the correctness of model inference results by detecting the threat of FIAs. DarkneTF introduces algorithm-based verification to implement the FT deep learning inference. The verification process involves verifying the integrity of model weights and validating the correctness of time-intensive calculations, such as convolutions. We improve the Freivalds algorithm to enhance the ability to detect tiny perturbations by strengthening randomization. As the verification process is also susceptible to FIAs, DarkneTF offloads the verification process into Trusted Execution Environments (TEEs). This scheme ensures the verification process’s security and allows for accelerated model inference using the integrated GPUs. Experimental results show that GPU-accelerated FT inference on HiKey 960 achieves notable speedups ranging from 3.46x to 5.57x compared to FT inference on a standalone CPU. The extra memory overhead incurred FT inference remains at an exceedingly low level, with a range of 0.46% to 10.22%. The round-off error of the improved Freivalds algorithm is below 2.50×10−4, and the accuracy of detecting FIAs is above 92.73%.

A new bi-level model for the false data injection attack on real-time electricity market considering uncertainties

State Estimation (SE) plays a critical role in various applications of power systems including the electricity market. False Data Injection Attacks (FDIAs) are capable of manipulating the power system SE process aiming to gain financial profits by the players. In this paper, the potential economic influences of FDIA on SE and consequently the Real-Time (RT) electricity market are examined. Therefore, a new bi-level optimization framework is proposed to realistically model the FDIAs from the attacker perspective. At the upper-level, the attacker intends to intelligently choose the most critical congested transmission lines and manipulate their associated meter readings to maximize the expected financial profitability. At the lower-level, the RT market-clearing model is formulated under the influence of FDIA. Considering the incomplete attacker's prior knowledge of the network topology i.e., connection/disconnection of transmission lines, the angles of the phase-shifting transformers, and the real-time load uncertainty, the proposed formulation is extended to a new bi-level scenario-driven stochastic model. The developed attack model, which must remain undetectable by the system operator in all scenarios, is solved using the Karush–Kuhn–Tucker (KKT) approach. The correctness and effectiveness of the proposed optimization scheme have been validated in GAMS software using CONOPT and OQNLP solvers based on the IEEE 14-bus test system and also comparative results are presented to demonstrate the merits of the proposed formulation.

Two channels event‐triggered robust H‐infinity control of Luire industrial cyber physical systems under data injection attacks

AbstractBy fully taking the effects of data injection attacks, nonlinear disturbances and limited communication resources, the stability of Lurie industrial cyber physical systems with the time‐varying delays is investigated. The two channels event‐triggered dynamic robust control (ERHIC) strategy is proposed for achieving the stability of systems. On one hand, a dynamic output feedback controller is designed to ensure the stable operation of the system under attacks. On other hand, the measurement channel and the control channel (two channels) event‐triggered mechanisms are designed to improve the utilization rate of system resources. The simulation results with the size of capacitor voltage and inductor current under data injection attacks as the object verity the correctness and the effectiveness of the proposed two channels event‐triggered robust H‐infinity control method and the feasibility of the designed dynamic output feedback controller are verified by the simulation results.

OPTIONS attack detection in WSN using Optimized Multitask Multi-Attention Residual Shrinkage Convolutional Neural Network

The rapid increase in Internet users has made web applications essential for daily services, rendering them targets for various cyber-attacks like path traversal, zero-day attacks, and injection attacks. While traditional security measures can prevent many familiar attacks, they are often ineffective against OPTIONS attacks, which involve injecting malicious code via hyperlinks to obstruct user access to legitimate webpage content. To address this novel challenge, we propose the OAD-WSN-MMRCNN technique, leveraging an Optimized Multitask Multi-Attention Residual Shrinkage Convolutional Neural Network for OPTIONS attack detection in Wireless Sensor Networks (WSNs). This approach begins by selecting a CPU parameters dataset for attack detection, followed by pre-processing with a Variational Bayesian-Based Maximum Correntropy Cubature Kalman Filter to remove redundant data. Key features such as handles, threads, processor, context switch, deferred procedure call (DPC), interrupt delta, CPU socket, and core are extracted using a variable velocity strategy particle swarm optimization algorithm. The MMRCNN, optimized with the Tyrannosaurus Optimization Algorithm, is then employed to detect normal and OPTIONS attacks. Implemented in Python, the efficacy of OAD-WSN-MMRCNN is evaluated using metrics such as energy consumption, target window, accuracy, precision, F-measure, recall, and CPU utilization. Experimental results demonstrate that OAD-WSN-MMRCNN outperforms existing techniques, achieving a 20 % improvement in detection accuracy and a 25 % reduction in energy consumption, highlighting its effectiveness and potential for enhancing web application cyber security.

CFDI: Coordinated false data injection attack in active distribution network

AbstractThe active distribution network (ADN) can obtain measurement data, estimate system states, and control distributed energy resources (DERs) and flexible loads to ensure voltage stability. However, the ADN is more vulnerable to cyber attacks due to the recent wave of digitization and automation efforts. In this article, false data injection (FDI) attacks are focused on and they are classified into two types, that is, type I attacks on measurement data and type II attacks on control commands. After studying the impact of these two FDI attacks on the ADN, a new threat is revealed called coordinated FDI attack, which can maximize the voltage deviation by coordinating type I and type II FDI attacks. From the attacker's perspective, the scheme of CFDI is proposed and an algorithm is developed to find the optimal attack strategy. The feasibility of CFDI attacks has been validated on a smart distribution testbed. Moreover, simulation results on an ADN benchmark have demonstrated that CFDI attacks could cause remarkable voltage deviation that may deteriorate the stability of the distribution network. Moreover, the impact of CFDI attacks is higher than pure type I or type II attacks. To mitigate the threat, some countermeasures against CFDI attacks are also proposed.

A novel passive-active detection system for false data injection attacks in industrial control systems

With the increasing occurrence of incidents causing significant damage due to attacks on Industrial Control Systems (ICSs), people pay attention to the cyber security of ICSs. This study improves existing active detection mechanisms and proposes an integrated passive-active detection system to detect False Data Injection Attacks (FDIA) for ICS. Since it is challenging to detect FDIA in current operational practices, the method presented in this research not only compares passive received system data with predefined rules to detect attacks but also launches active detection by controlling actuators to find attackers and achieve comprehensive detection of FDIA targeting ICS. This work dynamically adjusts the frequency of launching active detection through risk assessment, aiming to minimize the impact on operational efficiency during low-risk periods and reduce the time required for detecting attacks during high-risk periods. The experimental results show that using the proposed system, when false data differs by 10 % from accurate data, the detection rate can reach 99.9 %, which is 22.5 % higher than active detection by the random launch method when false data differs by 5 % from accurate data, the detection rate can reach 95.4 %, which is 18.2 % higher than active detect by randomly launch method, and even if false data only differs by 3 % from accurate data, the detection rate can reach 92.9 %, which is 16.5 % higher than active detect by randomly launch method.

A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model

In recent years, various Remote Code Execution vulnerabilities on the Internet have been exposed frequently; thus, more and more security researchers have begun to pay attention to the detection of Remote Code Execution attacks. In this paper, we focus on three kinds of common Remote Code Execution attacks: XML External Entity, Expression Language Injection, and Insecure Deserialization. We propose a packet content-oriented Remote Code Execution attack payload detection model. For the XML External Entity attack, we propose an algorithm to construct the use-definition chain of XML entities, and implement detection based on the integrity of the chain and the behavior of the chain’s tail node. For the Expression Language Injection and Insecure Deserialization attack, we extract 34 features to represent the string operation and the use of sensitive classes/methods in the code, and then train a machine learning model to implement detection. At the same time, we build a dataset to evaluate the effect of the proposed model. The evaluation results show that the model performs well in detecting XML External Entity attacks, achieving a precision of 0.85 and a recall of 0.94. Similarly, the model performs well in detecting Expression Language Injection and Insecure Deserialization attacks, achieving a precision of 0.99 and a recall of 0.88.

Monitoring and Reconstruction of Actuator and Sensor Attacks for Lipschitz Nonlinear Dynamic Systems Using Two Types of Augmented Descriptor Observers

Fault data injection attacks may lead to a decrease in system performance and even a malfunction in system operation for an automatic feedback control system, which has motive to develop an effective method for rapidly detecting such attacks so that appropriate measures can be taken correspondingly. In this study, a secure descriptor estimation technique is proposed for continuous-time Lipschitz nonlinear cyber physical systems affected by actuator attacks, sensor attacks, and unknown process uncertainties. Specifically, by forming a new state vector composed of original system states and sensor faults, an equivalent descriptor dynamic system is built. A proportional and derivate sliding-mode observer is presented so that the system states, sensor attack, and actuator attack can be reconstructed successfully. The observer gains are obtained by using linear matrix inequality to secure robustly stable estimation error dynamics. Moreover, a robust descriptor fast adaptive observer estimator is presented as a complement. Finally, the efficacy levels of the proposed design approaches are validated using a vertical take-off and landing aircraft system. Comparison studies are also carried out to assess the tracking performances of the proposed algorithms.

Event-based secure control for cyber-physical systems against false data injection attacks

This paper mainly studies an event-based secure control problem for cyber-physical systems against false data injection (FDI) attacks. First, a dynamic event-triggered transmission protocol is established to schedule the transmitted data from the sensor to the controller. Subsequently, an imperfect FDI attack model is constructed considering the real network environment, which would bypass the traditional residual-based detection methods. To overcome this drawback, an attack detection strategy based on secure history information is designed, which effectively mitigates the negative impact of uncertainty on the detection results. Based on the detection results, an event-based secure linear quadratic Gaussian control scheme is designed, which can guarantee system performance and reduce the communication load effectively. Finally, a simulation experiment verifies that the proposed control method outperforms other algorithms in the literature, and the detection accuracy is increased by 91% to 98%.

Web Application Firewall (WAF) Design to Detect and Anticipate Hacking in Web-Based Applications

Data leakage cases have recently been rampant in Indonesia. One of the biggest is the leak of user data from BPJS Health in 2021, this data leak is certainly very detrimental to users. This research develops a Web Application Firewall (WAF) using ModSecurity and OWASP Core Rule Set to protect web applications from SQL Injection and XSS attacks. The methodology involves analyzing the functionality of the existing system using UML, with DVWA and WordPress as test objects. Results showed 100% SQL Injection and 99.8% XSS attack detection, with logs recording attacks in real-time. The findings emphasize the importance of WAF integration with web application built-in security, making significant contributions in the design and implementation of resilient WAFs, as well as improving resilience against evolving cyber threats.

Fully Distributed Hierarchical ET Intrusion- and Fault-Tolerant Group Control for MASs With Application to Robotic Manipulators

This paper studies group synchronization tracking problem for a class of high-order multi-agent systems (MASs) with nonidentical and unknown direction faults (NUDFs) under multiple cyber attacks (i.e., denial-of-service (DoS) attacks and false data injection attacks (FDIAs)). Be motivated by this, a fully distributed hierarchical (cyber layer and physical layer) Zeno-free event-triggered (ET) intrusion-and fault-tolerant controller is presented based on Nussbaum-type gain technique, where a positive inter-event time exists in the state-dependent asynchronous ET mechanism (ETM). The constructed virtual cyber layer realizes the interaction among different agents so as to avoid the interaction in physical processes and thus reduce the error propagation. This two layer controller greatly increase the flexibility of the controller design compared with single-layer control strategies. In addition, a novel Nussbaum function stability lemma (Lemma lem4lem4) is developed for the first time. Based on this lemma, the fully distributed adaptive controller can adjust the direction of the input to match the fault direction with the help of Nussbaum function. Finally, a robotic manipulator example demonstrates the effectiveness and merit of the proposed control scheme. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —In industrial processes, NUDFs and cyber attacks often occur in many different systems, which usually lead to performance degradation or even serious accidents. Typically, NUDFs affect the performance of chemical and industrial processes, circuits, and sensors. Meanwhile, in driverless vehicle platoon, attackers change the control signal through the wireless network, and then issue emergency braking commands, etc. Therefore, this paper designs a fully distributed hierarchical ET intrusion-and fault-tolerant scheme for high-order MASs that are usually used to model ship dynamics, robotic manipulators, and quarter-car active suspension. The control scheme gives solutions to the problem of NUDFs, multiple cyber attacks, and network bandwidth limitations at different layers, and effectively integrates the physical and cyber layers to achieve group synchronization. Meanwhile, a new event-triggered mechanism under the framework of group synchronization is developed to save communication resources. Robotic manipulator simulation studies verify the validity of the proposed scheme.