Complex Cyber Attacks Research Articles

CYBER SECURITY IN INFRASTRUCTURES. APPLICATION TO THE COMPONENTS OF A SMART GRID

Nowadays, cybersecurity labs all around the world are trying to specify guidelines intended to improve the security in totally connected systems such as Smart Grids or autonomous vehicles. Smart Grids came up from the necessity of coordinating generation devices and loads, mostly when the penetration of renewable energies is high. Given its nature, its proper operation relies in fast and secure communications. However, the fast growth of this type of infrastructure, perhaps did not allow paying enough attention to the requirements of security to assure an operation resistant to increasingly complex cyberattacks. This paper addresses how to use the latest software and hardware technology to protect the generators and loads belonging a Smart Grid against cyber-attacks by using a secure layer based in digital identity and encryption. The study has been carried out using a laboratory prototype including the latest cybersecurity technology integrated within a renewable power plant belonging a Smart Grid. Finally, advantages and disadvantages have been analyzed. Key Words: Smart Grid, secure communications, cryptographic card, SSL, TLS

Memory Forensic Challenges Under Misused Architectural Features

With increasingly complex cyber attacks occurring every day, memory-based forensic techniques are becoming instrumental in digital investigations. Forensic examiners can unravel what happened on a system by acquiring and inspecting in-memory data. However, the foundation of this analysis can be invalidated if the memory acquisition has been altered. In this paper, we study the feasibility of malicious software misusing architectural features to sabotage memory forensics. The misuse of two architectural features, namely, physical address layout and secure containers, is presented. The first architectural feature explored in this paper is the physical address layout. It is used by the northbridge to route memory access to either physical memory or I/O devices on x86 platforms. Observing this design choice, we propose Hidden in I/O Space (HIveS), which manipulates CPU registers to alter the physical address layout to conceal memory. The system uses a novel I/O shadowing technique to lock a memory region named HIveS memory into I/O address space to prevent access. Two novel techniques, blackbox write and TLB camouflage, are developed to further protect the unlocked HIveS memory against memory forensics while allowing access for attackers. The second architectural feature explored in this paper is hardware-aided secure execution technology. More specifically, hardware-enforced memory encryption in Intel secure guard extension is used in malicious enclave software (Malclaveware) to prevent introspection and memory forensics. A prototype of HIveS is built and tested against a set of memory acquisition tools for both Windows and Linux running on the x86 platform. Malclaveware is also prototyped in Windows to demonstrate the risk. More importantly, we proposed countermeasures and mitigations for the newly discovered attacks. Through these discussions, we aim to raise the awareness of the potential risks of misusing hardware architectural features.

Model-based approach for cyber-physical attack detection in water distribution systems

Modern Water Distribution Systems (WDSs) are often controlled by Supervisory Control and Data Acquisition (SCADA) systems and Programmable Logic Controllers (PLCs) which manage their operation and maintain a reliable water supply. As such, and with the cyber layer becoming a central component of WDS operations, these systems are at a greater risk of being subjected to cyberattacks. This paper offers a model-based methodology based on a detailed hydraulic understanding of WDSs combined with an anomaly detection algorithm for the identification of complex cyberattacks that cannot be fully identified by hydraulically based rules alone. The results show that the proposed algorithm is capable of achieving the best-known performance when tested on the data published in the BATtle of the Attack Detection ALgorithms (BATADAL) competition (http://www.batadal.net).

A model developed for teaching an adaptive system of recognising cyberattacks among non-uniform queries in information systems

The study presents results aimed at further development of models for intelligent and self-educational systems of recognising abnormalities and cyberattacks in mission-critical information systems (MCIS). It has been proven that the existing systems of cyberdefence still significantly rely on using models and algorithms of recognising cyberattacks, which allow taking into account information about the structure of incoming streams or the attackers’ change of the intensity of queries, the speed of the attack, and the duration of the impulse. A mathematical model has been suggested for the system module of intelligent identification of cyberattacks in heterogeneous flows of queries and network forms of cyberattacks. The model recognises heterogeneous incoming flows of queries and any possible change in the query intensity and other parameters of a targeted cyberattack aimed at a MCIS. Simulation models, which had been created in MATLAB and Simulink, were used to research the dynamics of changes in the states of the subsystem of blocking queries in the process of detecting cyberattacks in a MCIS. The probability of solving the problem of recognising cyberattacks in heterogeneous flows of queries and network forms of cyberattacks is 85–98 %, depending on the type of the cyberattack. The results of the modelling allow selection of ways to counter and neutralize the effects of the impact of such targeted attacks and help analyse more sophisticated cyberattacks. The suggested model of recognising complex cyberattacks if attackers use non-uniform flows of queries is more accurate, by 5–7 %, than the other existing models. The developed simulation models enable a 25–30 % decrease in the setup time for projects of cyberdefence systems, including SIRCA for CIS or MCIS.

COMPREHENSIVE APPROACH TO INFORMATION SHARING FOR INCREASED NETWORK SECURITY AND SURVIVABILITY

In this article, a comprehensive approach to information sharing framework aimed at increasing network security and survivability is presented. Currently, in order to defend complex cyber-attacks and sophisticated cybercrime, comprehensive means of ensuring network security and survivability are highly demanded. Comprehensive is understood as (at least) technical, human, organizational, and regulatory dimensions, whereas technical means that both on-line and off-line aspects should be carefully taken into account. The focus of this article is on the technical dimension and, in particular, on information exchange mechanisms for on-line and off-line dimension. Firstly, the on-line information exchange mechanism dedicated for interconnected federated networks is described. Then, a proposition of the off-line network information sharing approach regarding results of the risk assessment, cybersecurity audits, threat ranking, etc., is discussed. Developments and results of information sharing mechanisms in both on-line and off-line network security dimensions are also described.

Economically Complex Cyberattacks

Most people working in cyber security recognize that the interconnections and complexities of our economy can have a huge effect on the destructiveness of cyber attacks. They refer casually to network effects, spillover or knock-on effects. Yet there is little understanding of how such effects actually work, what conditions are necessary to create them, or how to quantify their consequences. People working in cyber security also generally acknowledge that combinations of cyber attacks could be much more destructive than individual attacks. Yet there is little understanding of exactly why this is the case or what the principles would be for combining attacks to produce maximum destruction. These two sets of problems are actually the same. It is by taking account of the interconnections and complexities in our economy that cyber-attackers could devise combinations of attacks to cause greater destruction. To understand how this would work, we need to look at three features of our economy that are responsible for much of its structural complexity: redundancies, interdependencies, and near monopolies. Then, as we examine these features, we need to see how each of them would prompt a different sort of attack strategy.