Complex Cyber Attacks Research Articles

Decentralized Secure Load Frequency Control for Multi-Area Power Systems Under Complex Cyber Attacks

Decentralized Secure Load Frequency Control for Multi-Area Power Systems Under Complex Cyber Attacks

The implications of Artificial Intelligence (AI) on cybersecurity: A detailed review for multidomain industry

Cyber threats are becoming increasingly complicated and diverse, posing serious risks to individuals, businesses, and organizations in the cybersecurity sector. The cybersecurity industry needs to change to combat these new dangers as cybercriminals are always coming up with new ways to get past protections. This paper investigates how artificial intelligence (AI) may both simplify and improve cybersecurity efforts. AI has transformed the industry by offering cutting-edge defensive technologies, but it also gives cybercriminals new tools at their disposal to automate and enhance their hacking methods. The effect of AI on authentication procedures—which are crucial for protecting network access—is given special attention. This paper emphasizes the critical need for creative remedies to defend against more complex cyberattacks by examining the dual nature of AI in cybersecurity.

Strategi Pengembangan Sistem Keamanan Terpadu untuk Melindungi Sistem Operasi Windows dari Ancaman Cyber

The Windows operating system has become one of the main targets for cyber attackers because of its popularity among computer users. Therefore, developing an effective integrated security system is essential to protect the Windows operating system from various cyber threats. This journal discusses integrated security system development strategies that include the use of encryption technology, firewalls, malware scanning, system updates, and user awareness. Apart from that, this journal also discusses the implementation of an integrated security strategy to protect the Windows operating system from increasingly complex cyber attacks. The goal of this journal is to provide strategic guidance for IT security professionals and researchers in developing an effective integrated security system to protect the Windows operating system from ever-evolving cyber threats.

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

In the dynamic landscape of cyberspace, organizations face a myriad of coordinated advanced threats that challenge the traditional defense paradigm. Cyber Threat Intelligence (CTI) plays a crucial role, providing in-depth insights into adversary groups and enhancing the detection and neutralization of complex cyber attacks. However, attributing attacks poses significant challenges due to over-reliance on malware samples or network detection data alone, which falls short of comprehensively profiling attackers. This paper proposes an IPv4-based threat attribution model, IPAttributor, that improves attack characterization by merging a real-world network behavior dataset comprising 39,707 intrusion entries with commercial threat intelligence from three distinct sources, offering a more nuanced context. A total of 30 features were utilized from the enriched dataset for each IP to create a feature matrix to assess the similarities and linkage of associated IPs, and a dynamic weighted threat segmentation algorithm was employed to discern attacker communities. The experiments affirm the efficacy of our method in pinpointing attackers sharing a common origin, achieving the highest accuracy of 88.89%. Our study advances the relatively underexplored line of work of cyber attacker attribution, with a specific interest in IP-based attribution strategies, thereby enhancing the overall understanding of the attacker’s group regarding their capabilities and intentions.

Analysis of modern intelligent methods for protecting critical information infrastructure

Critical information infrastructure (CII), including the financial sector, plays a key role in ensuring the sustainable functioning of economic systems and the financial stability of States. However, the growing digitalization of the financial industry and the introduction of innovative technologies are opening up new attack vectors for attackers. Modern cyber attacks are becoming more sophisticated, and traditional defenses are proving ineffective against new, previously unknown threats. There is an urgent need for more flexible and intelligent cybersecurity systems. Thus, the subject of the study is modern intelligent methods and technologies for protecting critical information infrastructure (CII) from cyber attacks. The object of the research is methods and means of ensuring the protection of critical information infrastructure using artificial intelligence and machine learning technologies. The methodological basis of this study is a comprehensive analysis of the scientific literature on the use of intelligent methods and technologies to protect critical information infrastructure. During the review and critical analysis of relevant scientific publications, key problems and unresolved tasks requiring further scientific research and practical developments in this subject area were identified. This methodological approach allowed us to form a holistic view of the current state and prospects for the development of intelligent cybersecurity tools for critical financial systems, as well as to identify priority areas for further research. The main directions of scientific novelty of this research are: 1. A detailed review of promising approaches based on artificial intelligence and machine learning technologies to ensure effective protection of CII organizations from modern complex cyber attacks. 2. Identification and analysis of a number of key scientific and technical problems that need to be solved to increase reliability, interpretability and trust in intelligent cybersecurity systems, including issues of robustness to attacks, active online learning, federated and differential private data processing. 3. Identification of promising areas for further research and development in the field of application of specialized methods of secure and trusted AI to protect critical financial infrastructure. Thus, this research makes a significant contribution to the development of scientific and methodological apparatus and practical solutions for the use of intelligent methods to ensure cybersecurity.

Advanced Cyber Attack Detection Using Generative Adversarial Networks and NLP

A key difficulty in the ever-changing cybersecurity scene is the detection of sophisticated cyber-attacks. Because new threats are so much more sophisticated and difficult to detect, traditional tactics typically fail. A new technique to improving cyber-attack detection skills is explored in this study. It uses Generative Adversarial Networks (GANs) and Natural Language Processing (NLP). Using GANs' realistic data generation capabilities, possible attack paths are simulated, creating a strong dataset for training detection systems. At the same time, natural language processing (NLP) methods are used to decipher the mountain of textual information produced by cyberspace, including incident reports, communication patterns, and logs. Our approach is based on building a fake dataset using GANs that mimics the features of advanced cyberattacks. A detection model is then trained using this dataset. Simultaneously, we improve the detection model's capacity to spot intricate and nuanced assault patterns by processing and analysing text-based data using natural language processing approaches. We use a benchmark cybersecurity dataset to test the integrated method. The experimental findings show that our GAN-NLP based detection system outperforms existing systems, which have an average accuracy of 85.3%, by a wide margin. It achieves a recall of 93.2%, precision of 92.5%, and accuracy of 94.7%. These findings prove that GANs and NLP work well together to identify complex cyberattacks. Finally, GANs and NLP together provide a potent instrument for better cyber-attack detection. A scalable solution that can adapt to the ever-changing nature of cyber threats is offered by this integrated approach, which also increases detection accuracy and efficiency. Improving the models and investigating their use in a real-world cybersecurity setting will be the primary goals of future research.

DFSat: Deep Federated Learning for Identifying Cyber Threats in IoT-based Satellite Networks

The integration of satellite systems with smart computing and networking technologies, such as the Internet of Things (IoT), has intensely augmented sophisticated cyberattacks against satellite environments. Resisting cyber threats to complex and large-scale satellite configurations has been enormously challenging, owing to the deficiency of high-quality samples of attack data collected from distributed satellite networks. This study proposes a novel federated learning-based deep learning framework for intrusion detection, named DFSat, to identify cyberattacks from IoT-integrated satellite networks. We develop a distributed deep learning-enabled attack detection method using a recurrent neural network. We then build a federated learning architecture which, utilizes several IoT-integrated satellite networks to preserve the privacy and security of DFSat's parameters throughout the learning process. Extensive experiments have been conducted using communication rounds on an IoT-based network dataset to validate the efficiency of DFSat. The results revealed that the proposed framework significantly distinguishes complex cyberattacks, outperforming recent state-of-the-art intrusion detection techniques, validating its usefulness as a viable deployment framework in IoT-integrated satellite networks.

Model of four cyber attack information environments

The basis of the functioning of the modern cyber defense infrastructure of the corporate IT system is the procedure of comparing current events in the computer environment with the security event indicator. If the indicator matches the corresponding event, security information about this event is generated and transmitted to the SIEM for analysis. Based on the results of the analysis, a decision is made about the existence of a cyber security incident. At the next stage, a decision is made and implemented, which restores the state of cyber security. A mandatory condition for the effective cyber defense infrastructure is the availability of knowledge about possible cyber threats and relevant signs (indicators) of security events at the technical level of computer systems. Cyber threat intelligence (CTI) is responsible for forming signs of security events. In the conditions of large-scale application of common repetitive cyberattacks, the main function of CTI was to identify simple technical features called indicators of compromise (IOCs). Bit sequences (signatures) are used as such IOCs. In the conditions of large-scale application of complex cyberattacks, the task of developing such APT attack forecasting maps that allow the formation of security event attributes pattern (SEAP) for automated detection by computer means of cyber defense infrastructure becomes urgent. The article is devoted to the development of a model that, with the help of an attribute-transfer approach to the essence of information, allows to formalize the processes of cyber protection. The model visually details and combines the events that reveal the essence of the APT attack preparation and implementation, the processes of protection and the task of cyber threat intelligence to determine specific data for the means of an effective cyber defense infrastructure. The level of detail of the model allows the application of known mathematical constructions to describe security events and security information. This approach simplifies the forming algorithms for automating cyber protection processes.

Asynchronous secure controller design for singularly perturbation stochastic semi-Markov jump CPSs with the memory-based dynamic event-triggered scheme against complex cyber-attacks

In this paper, the problem of asynchronous secure controller design for singular perturbation stochastic semi-Markov jump systems (SPSS-MJSs) against complicated cyber-attacks is addressed. Firstly, the unified framework for multi-channel spoofing attacks and DoS attacks is properly established for CPSs with the unreliable communication network. Then, by introducing a register, we propose the memory-based dynamic event-triggered scheme (MDETS), which can save resources for the bandwidth limited network to a certain degree. Since the mode information of Markov chain for the secure controller is often unavailable, a hidden Markov model (HMM) is used to formulate the asynchronous situation between the mode of original system and the constructed controller. Further, by constructing Lyapunov functionals and utilizing linear matrix inequality (LMI) techniques, the obtained closed-loop SPSS-MJSs are endowed with an exponential stability criterion. And the co-design of the asynchronous secure controller and MDETS is presented. Finally, a practical example of the specific small capacitance circuit system is offered to verify the feasibility and superiority of the developed method.

Smart Grid Cyber-Physical Situational Awareness of Complex Operational Technology Attacks: A Review

The smart grid (SG), regarded as the complex cyber-physical ecosystem of infrastructures, orchestrates advanced communication, computation, and control technologies to interact with the physical environment. Due to the high rewards that threats to the grid can realize, adversaries can mount complex cyber-attacks such as advanced persistent threats-based and coordinated attacks to cause operational malfunctions and power outages in the worst scenarios: The latter of which was reflected in the Ukrainian power grid attack. Despite widespread research on smart grid security, the impact of targeted attacks on control and power systems is anecdotal. This article reviews the smart grid security from collaborative factors, emphasizing the situational awareness (SA). Specifically, we propose a threat modeling framework and review the nature of cyber-physical attacks to understand their characteristics and impacts on the smart grid’s control and physical systems. We examine the existing threats detection and defense capabilities, such as intrusion detection systems (IDSs), moving target defense (MTD), and co-simulation techniques, along with discussing the impact of attacks through situational awareness and power system metrics. We discuss the human factor aspects for power system operators in analyzing the impacts of cyber-attacks. Finally, we investigate the research challenges with key research gaps to shed light on future research directions.

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

Protection against a growing number of increasingly sophisticated and complex cyberattacks requires the real-time acquisition of up-to-date information on identified threats and their potential impact on an enterprise’s operation. However, the complexity and variety of IT/OT infrastructure interdependencies and the business processes and services it supports significantly complicate this task. Hence, we propose a novel solution here that provides security awareness of critical infrastructure entities. Appropriate measures and methods for comprehensively managing cyberspace security and resilience in an enterprise are provided, and these take into account the aspects of confidentiality, availability, and integrity of the essential services offered across the underlying business processes and IT infrastructure. The abstraction of these entities as business objects is proposed to uniformly address them and their interdependencies. In this paper, the concept of modeling the cyberspace of interdependent services, business processes, and systems and the procedures for assessing and predicting their attributes and dynamic states are depicted. The enterprise can build a model of its operation with the proposed formalism, which takes it to the first level of security awareness. Through dedicated simulation procedures, the enterprise can anticipate the evolution of actual or hypothetical threats and related risks, which is the second level of awareness. Finally, simulation-driven analyses can serve in guiding operations toward improvement with respect to resilience and threat protection, bringing the enterprise to the third level of awareness. The solution is also applied in the case study of an essential service provider.

Roles and Challenges of AI-Based Cybersecurity: A Case Study

Nowadays, organizations face complex cyber-attacks that are difficult to counter with traditional protections. Therefore, many modern organizations tend to use AI-based cybersecurity systems to secure their assets and infrastructure and to reduce the level of potential risks.
 Because of the lack of clarity of the AI roles in cybersecurity and the ambiguity of the related challenges, this study aims to explore the most prominent roles of AI-based cybersecurity related to information security in the prevention phase, the detection phase and the response phase. The study also aims to determine the most prominent challenges facing AI-based cybersecurity.
 To achieve the goals of this study, we adopt a case-study methodology that origins from the general framework which is information security and ends with the specific framework which is AI-based cybersecurity. After designing a matrix to analyze the case study, the study concludes nine important roles for AI-based cybersecurity distributed over the three phases. Three roles are in the prevention phase, which are automated assessment of security vulnerabilities, awareness and training and authentication. Two roles are in the detection phase; namely, detection of intrusion and security breaches and detection of spams and phishing and four rules are in the response stage, which are analyzing malware, automating routine tasks, deploying traps and topple attackers and isolating important assets.
 The study also identifies eight elements that represent the most prominent challenges facing AI-based cybersecurity: regulations and principles, trust, accountability, privacy, bias, training datasets, human resources and financial costs. In conclusion, the study presents a set of recommendations drawn from the results.

Classification of Firewall Log Data Using Multiclass Machine Learning Models

These days, we are witnessing unprecedented challenges to network security. This indeed confirms that network security has become increasingly important. Firewall logs are important sources of evidence, but they are still difficult to analyze. Artificial Intelligence (AI), Machine Learning (ML), and Deep Learning (DL) have emerged as effective in developing robust security measures due to the fact that they have the capability to deal with complex cyberattacks in a timely manner. This work aims to tackle the difficulty of analyzing firewall logs using ML and DL by building multiclass ML and DL models that can analyze firewall logs and classify the actions to be taken in response to received sessions as “Allow”, “Drop”, “Deny”, or “Reset-both”. Two sets of empirical evaluations were conducted in order to assess the performance of the produced models. Different features set were used in each set of the empirical evaluation. Further, two extra features, namely, application and category, were proposed to enhance the performance of the proposed models. Several ML and DL algorithms were used for the evaluation purposes, namely, K-Nearest Neighbor (KNN), Naïve Bayas (NB), J48, Random Forest (RF) and Artificial Neural Network (ANN). One interesting reading in the experimental results is that the RF produced the highest accuracy of 99.11% and 99.64% in the first and the second experiments respectively. Yet, all other algorithms have also produced high accuracy rates which confirm that the proposed features played a significant role in improving the firewall classification rate.

Improved event-triggered finite-time H ∞ control for neural networks subject to mixed-type communication attacks

ABSTRACT This paper discusses the problem of finite-time stabilisation for neural networks (NNs) subject to mixed-type communication attacks via an improved dynamic event-triggered scheme (DETS). The complex cyber-attacks considered consist of three common types of attacks: replay attacks, deception attacks, and denial-of-service (DoS) attacks. Different from most articles which use independent Bernoulli variables to model the cyber-attacks, this paper considers these attacks into a unified Markovian jump framework for modelling. In order to save the limited network communication resources, the improved DETS is adopted. An appropriate Lyapunov–Krasovskii functional (LKF) containing the proposed improved DETS condition is constructed, and sufficient conditions are obtained to guarantee finite-time stabilisation of the system. Then, according to a set of feasible linear matrix inequalities (LMIs), the co-design of event-trigger and controller is given. Finally, two numerical examples are provided to demonstrate the effectiveness of our method.

Anomaly Detection in the Internet of Vehicular Networks Using Explainable Neural Networks (xNN)

It is increasingly difficult to identify complex cyberattacks in a wide range of industries, such as the Internet of Vehicles (IoV). The IoV is a network of vehicles that consists of sensors, actuators, network layers, and communication systems between vehicles. Communication plays an important role as an essential part of the IoV. Vehicles in a network share and deliver information based on several protocols. Due to wireless communication between vehicles, the whole network can be sensitive towards cyber-attacks.In these attacks, sensitive information can be shared with a malicious network or a bogus user, resulting in malicious attacks on the IoV. For the last few years, detecting attacks in the IoV has been a challenging task. It is becoming increasingly difficult for traditional Intrusion Detection Systems (IDS) to detect these newer, more sophisticated attacks, which employ unusual patterns. Attackers disguise themselves as typical users to evade detection. These problems can be solved using deep learning. Many machine-learning and deep-learning (DL) models have been implemented to detect malicious attacks; however, feature selection remains a core issue. Through the use of training empirical data, DL independently defines intrusion features. We built a DL-based intrusion model that focuses on Denial of Service (DoS) assaults in particular. We used K-Means clustering for feature scoring and ranking. After extracting the best features for anomaly detection, we applied a novel model, i.e., an Explainable Neural Network (xNN), to classify attacks in the CICIDS2019 dataset and UNSW-NB15 dataset separately. The model performed well regarding the precision, recall, F1 score, and accuracy. Comparatively, it can be seen that our proposed model xNN performed well after the feature-scoring technique. In dataset 1 (UNSW-NB15), xNN performed well, with the highest accuracy of 99.7%, while CNN scored 87%, LSTM scored 90%, and the Deep Neural Network (DNN) scored 92%. xNN achieved the highest accuracy of 99.3% while classifying attacks in the second dataset (CICIDS2019); the Convolutional Neural Network (CNN) achieved 87%, Long Short-Term Memory (LSTM) achieved 89%, and the DNN achieved 82%. The suggested solution outperformed the existing systems in terms of the detection and classification accuracy.

An Intelligent System to Detect Advanced Persistent Threats in Industrial Internet of Things (I-IoT)

The Industrial Internet of Things (I-IoT) is a manifestation of an extensive industrial network that interconnects various sensors and wireless devices to integrate cyber and physical systems. While I-IoT provides a considerable advantage to large-scale industrial enterprises, it is prone to significant security challenges in the form of sophisticated attacks such as Advanced Persistent Threat (APT). APT is a serious security challenge to all kinds of networks, including I-IoT. It is a stealthy threat actor, characteristically a nation-state or state-sponsored group that launches a cyber attack intending to gain unauthorized access to a computer network and remain undetected for a longer period. The latest intrusion detection systems face several challenges in detecting such complex cyber attacks in multifarious networks of I-IoT, where unpredictable and unexpected cyber attacks of such sophistication can lead to catastrophic effects. Therefore, these attacks need to be accurately and promptly detected in I-IoT. This paper presents an intelligent APT detection and classification system to secure I-IoT. After pre-processing, several machine learning algorithms are applied to detect and classify complex APT signatures accurately. The algorithms include Decision Tree, Random Forest, Support Vector Machine, Logistic Regression, Gaussian Naive Bayes, Bagging, Extreme Gradient Boosting and Adaboost, which are applied on a publicly available dataset KDDCup99. Moreover, a comparative analysis is conducted among ML algorithms to select the appropriate one for the targeted domain. The experimental results indicate that the Adaboost classifier outperforms the others with 99.9% accuracy with 0.012 s execution time for detecting APT attacks. Furthermore, results are compared with state-of-the-art techniques that depict the superiority of the proposed system. This system can be deployed in mission-critical scenarios in the I-IoT domain.

Data analytics for cybersecurity enhancement of transformer protection

Electric power substations are experiencing an accelerated pace of digital transformation including the deployment of LAN-based IEC 61850 communication protocols that facilitate accessibility to substation data while also increasing remote access points and exposure to complex cyberattacks. In this environment, machine learning algorithms will play a vital role in cyberattack detection and mitigation and natural questions arise as to the most effective models in the context of smart grid substations. This paper compares the performance of three autoencoder-based anomaly detection systems including linear, fully connected, and convolutional autoencoders, as well as long short-term memory (LSTM) neural network for cybersecurity enhancement of transformer protection. The simulation results indicated that the LSTM model outperforms the other models for detecting cyberattacks targeting asymmetrical fault data. The linear autoencoder, fully connected autoencoder and 1D CNN further outperform the LSTM model for detecting cyberattacks targeting the symmetrical fault data.

CLAP: A Cross-Layer Analytic Platform for the Correlation of Cyber and Physical Security Events Affecting Water Critical Infrastructures

Water CIs are exposed to a wide number of IT challenges that go from the cooperation and alignment between physical and cyber security teams to the proliferation of new vulnerabilities and complex cyber-attacks with potential disastrous consequences. Although novel and powerful solutions are proposed in the literature, most of them lack appropriate mechanisms to detect cyber and physical attacks in real time. We propose a Cross-Layer Analytic Platform (denoted as CLAP) developed for the correlation of Cyber and Physical security events affecting water CIs. CLAP aims to improve the detection of complex attack scenarios in real time based on the correlation of cyber and physical security events. The platform assigns appropriate severity values to each correlated alarm that will guide security analysts in the decision-making process of prioritizing mitigation actions. A series of passive and active attack scenarios against the target infrastructure are presented at the end of the paper to show the mechanisms used for the detection and correlation of cyber–physical security events. Results show promising benefits in the improvement of response accuracy, false rates reduction and real-time detection of complex attacks based on cross-correlation rules.

A Cyber Kill Chain Approach for Detecting Advanced Persistent Threats

The number of cybersecurity incidents is on the rise despite significant investment in security measures. The existing conventional security approaches have demonstrated limited success against some of the more complex cyber-attacks. This is primarily due to the sophistication of the attacks and the availability of powerful tools. Interconnected devices such as the Internet of Things (IoT) are also increasing attack exposures due to the increase in vulnerabilities. Over the last few years, we have seen a trend moving towards embracing edge technologies to harness the power of IoT devices and 5G networks. Edge technology brings processing power closer to the network and brings many advantages, including reduced latency, while it can also introduce vulnerabilities that could be exploited. Smart cities are also dependent on technologies where everything is interconnected. This interconnectivity makes them highly vulnerable to cyber-attacks, especially by the Advanced Persistent Threat (APT), as these vulnerabilities are amplified by the need to integrate new technologies with legacy systems. Cybercriminals behind APT attacks have recently been targeting the IoT ecosystems, prevalent in many of these cities. In this paper, we used a publicly available dataset on Advanced Persistent Threats (APT) and developed a data-driven approach for detecting APT stages using the Cyber Kill Chain. APTs are highly sophisticated and targeted forms of attacks that can evade intrusion detection systems, resulting in one of the greatest current challenges facing security professionals. In this experiment, we used multiple machine learning classifiers, such as Naïve Bayes, Bayes Net, KNN, Random Forest and Support Vector Machine (SVM). We used Weka performance metrics to show the numeric results. The best performance result of 91.1% was obtained with the Naïve Bayes classifier. We hope our proposed solution will help security professionals to deal with APTs in a timely and effective manner.

РЕШЕНИЕ ЗАДАЧИ АВТОМАТИЗАЦИИ ПРОЦЕССОВ ЗАЩИТЫ СТРАТЕГИЧЕСКИ ВАЖНЫХ РЕСУРСОВ ПРЕДПРИЯТИЯ ОТ КОМПЛЕКСНЫХ КИБЕР-АТАК НА ОСНОВЕ АНАЛИЗА ТАКТИК ЗЛОУМЫШЛЕННИКОВ

The purpose of the scientific work is maximum safety provision for industrial company resources. To achieve the purpose specified there is a necessity in the solution of the problem in the prevention of most dangerous modern cyber-attacks the attacks of APT (advanced persistent threats) class – complex cyber-attacks directed to the infrastructure changes of company basic automated systems. 
 Most modern industrial enterprises are related to the objects of critical information infrastructure: the development of state strategically significant branches and population safety depend on their operation quality.
 Within the limits of the problem specified in the paper there are analyzed basic criminal tactics methods, revealed their peculiarities and offered corresponding measures for counteraction. 
 Besides, in the paper there are used methods for the information analysis of two basic tactics of criminals: “white” advantages – the “white” move first; “pawn attack” – inconspicuous penetration into majority of company systems with the purpose of their operation analysis and further reset. 
 In the paper there are revealed peculiarities of APT cyber-attacks, in particular, the stages of passive observation (analysis of company systems operation) and active intervention (changes introductions into in work algorithms). 
 The work novelty consists in the developed module structure of the automated protective system which includes a maximum possible amount of modern methods to ensure resources safety. 
 As a result of the analysis carried it was defined that the most efficient counteraction to APT cyber-attacks is the application of a complex approach including preventive protective measures.