Covert Attacks Research Articles

Unveiling the Shadows: A Comprehensive Exploration of Advanced Persistent Threats (APTs) and Silent Intrusions in Cybersecurity

The advent of Advanced Persistent Threats (APTs) and quiet intrusions, which are covert attacks, poses a severe challenge to the modern cybersecurity environment. This thorough study aims to shed light on the intricate world of APTs by exploring several topics, including attack methods, difficulties in detection, and the constantly changing patterns that influence the landscape of digital threats. The foundation of our inquiry is a thorough review of the literature, which makes it possible to identify critical knowledge gaps. Examining past APT efforts provides a crucial background for understanding how these advanced cyber threats have developed. The research approach is described in total, covering techniques, instruments, and strict case study requirements. This creates a solid foundation for an in-depth and perceptive analysis of silent incursions. It paves the way for a thorough investigation and promises a sophisticated comprehension of APTs, their tactics, and the difficulties in identifying and lessening their effects. This study's combination of a detailed research methodology, historical context, and a literature review positions it as a valuable contribution to cybersecurity

Why Did China's Assertive Strategy on The Himalayan Border?

The development of differing perceptions of the Line of Actual Control (LAC) has been one of the constant factors leading to the protracted dispute in the Himalayan border. Since the outbreak of war in 1962, recriminations and clashes between military forces have continued along the 3,488 km disputed area. Since 1980 both parties have continued to make efforts to resolve disputes with a fair and acceptable solution. Unfortunately, the initiations of these peace efforts have always been deadlocked. At first, in responding to India, China preferred to be passive. However, recently China has begun to respond with an assertive behavior. The deployment of army troops, military equipment, covert attacks, and massive infrastructure development was carried out by China in strategic Himalayan border. This study explores the changing of China’s assertive strategy in the Himalayas by employing offensive realism and using qualitative approach. This study has found that the changing behavior of China’s is related protecting its national interests and territorial sovereignty as well as a form of affirming the stability of China's dominance in the region. This study's results will provide an overview that there has been a shift in China's strategy for managing its border conflict with India.

Stealthy Local Covert Attacks on Cyber-Physical Systems

In cyber-physical systems (CPS), the networked structure not only enhances the accessibility of data, but also introduces the risk of cyber attacks. The stealthy attacks that are undetected by the monitoring system, are the most dangerous type of cyber attacks. In this article, we introduce a new attack strategy to call attention to the problem of stealthy cyber attacks on CPS. The proposed attack scenario does not require access to all control input signals and sensor output signals, so it needs fewer disruption resources and is called a local covert attack. We show that the local covert attack can be made completely stealthy by applying the decoupling technique or by combining the basic idea of a covert attack and a zero-dynamics attack. Simulation results are provided to demonstrate the stealthiness of the proposed local covert attacks.

Beatriz Allende: A Revolutionary Life in Cold War Latin America

Beatriz Allende: A Revolutionary Life in Cold War Latin America

Attack-Isolation-Based Resilient Control of Large-Scale Systems Against Collusive Attacks

This paper investigates the resilient stability problem of large-scale systems under covert attacks. Covert attacks are difficult to detect, and the collusion among attacks on different subsystems makes the problem more challenging. To address this issue, a two-stage fixed-time observer is introduced for each subsystem to make the covert attack be exposed to its neighboring subsystems. Based on this, an attack isolation algorithm is developed against non-collusive covert attacks, and the notion of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$r^*$</tex-math></inline-formula> -isolability is introduced to provide a necessary and sufficient condition for the success of attack isolation under the algorithm. To deal with collusive covert attacks, another attack isolation algorithm is further designed, and the notion of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$(r,s)$</tex-math></inline-formula> -isolability is used to provide a sufficient condition for the effectiveness of the algorithm. Based on the proposed attack isolation techniques, a control law is developed to ensure the resilient stability of the system. Finally, two numerical examples are given to illustrate the effectiveness of the theoretical results.

Application of the unified control and detection framework to detecting stealthy integrity cyber-attacks on feedback control systems

This paper addresses issues of detecting stealthy integrity cyber-attacks on automatic control systems. A general form of integrity cyber-attacks that cannot be detected using the established observer-based technique is first introduced as kernel attacks. The well-known replay, zero dynamics and covert attacks are special forms of the kernel attacks. Existence conditions for the kernel attacks are presented. It is demonstrated, in the unified framework of control and detection, that all kernel attacks can be structurally detected when not only the observer-based residual, but also the control signal based residual signals are used for the detection purpose. Two schemes for detecting kernel attacks are then proposed, which allow reliable attack detection without loss of control performance. While the first scheme is similar to the well-established moving target method and auxiliary system aided detection scheme, the second one is realised with encrypted transmissions of control and monitoring signals in the feedback control system, which prevents adversary to gain system knowledge by means of eavesdropping attacks. Both schemes are illustrated by an experimental study on a three-tank control system.

A moving target defence approach for detecting deception attacks on cyber-physical systems

Cyber-physical systems have posed new challenges, affecting their users. The information security of these systems against cyber-attacks is considered one of the most complex issues in a wide range of defences. The present study proposes a new approach for detecting deception attacks based on moving target defence (MTD). The existing MTD algorithms can only recognize few attacks, including integrity attacks on the cyber-physical system, by limiting the adversary's knowledge of the original system. However, the proposed approach detects replay attacks as well. Moreover, a robust defence system is developed to mislead the adversary and make the attack identifiable from the defender's perspective by introducing a chaotic, hybrid, and extended MTD. Thus, three primary deception attacks, including False Data Injection (FDI), covert, and replay attacks, are detectable based on the proposed approach. The effectiveness of the proposed approach is validated by comparing it with continuous watermarking defence in a cyber-physical testbed.

RAMP-IoD: A Robust Authenticated Key Management Protocol for the Internet of Drones

Internet of Drones (IoD) is the interconnection of unmanned aerial vehicles or drones deployed for collecting sensitive data to be used in critical applications. The drones transmit the collected data to the control room (CR) for analysis, while CR sends control commands to the drone to monitor their operations. This exchange of information between the drones and CR takes place through a wireless communication channel, which is susceptible to various security risks. Therefore, it is vital to ensure the confidentiality and integrity of such information in the IoD environment. To this end, authenticated key management (AKM) protocols can be leveraged to provide reliable and secure communication. However, due to the peculiarities associated with IoD environments, it is challenging to devise a robust and resource-efficient AKM protocol. To tackle this challenge, in this article, we propose a robust AKM protocol for IoD (RAMP-IoD). RAMP-IoD uses lightweight cryptography-based authenticated encryption primitive and elliptic-curve cryptography along with a hash function to perform the AKM process. Moreover, RAMP-IoD verifies the user’s authenticity and then sets up a session key (SK) between the user and a specific drone for indecipherable communications. We verify the security of SK using the random oracle model. Scyther-based validation demonstrates that RAMP-IoD is protected against replay and man-in-the-middle attacks. Moreover, the informal analysis illustrates that RAMP-IoD is secure against various covert security attacks. Through a comparative study, we also demonstrate that RAMP-IoD provides enhanced security with low storage, communication, and computational overheads as compared to related AKM protocols.

A resilient control strategy for networked multi-agent systems subject to covert attacks

In this paper, a resilient distributed control scheme against covert attacks for multi-agent networked systems subject to input and state constraints is developed. The idea consists in a clever deployment of predictive arguments with a twofold aim: detection of malicious agent behaviors affecting the normal system operations and consequent specific control actions implementation to mitigate as much as possible undesirable knock-on effects resulting from adversary actions. Specifically, the multi-agent system is organized in terms of a grid topology and set-theoretic receding horizon control ideas are exploited to develop a distributed algorithm capable to recognize the attacked agent. In essence, the resulting solution relies on the combined use of predictive control and set-invariance ideas that are exploited to generate redundant control sequences randomly selected on the actuator side such that the malicious agent is never aware about the effective control action indeed exploited. As a consequence, countermeasures on the sensor-to-controller channel could lead to significantly erroneous data not complying with the expected evolution of the system modeling. Finally, numerical simulations are carried out to show benefits and effectiveness of the proposed approach.

On the Security of Networked Control Systems in Smart Vehicle and Its Adaptive Cruise Control

With the benefits of Internet of Vehicles (IoV) paradigm, come along unprecedented security challenges. Among many applications of inter-connected systems, vehicular networks and smart cars are examples that are already rolled out. Smart vehicles not only have networks connecting their internal components e.g. via Controller Area Network (CAN) bus, but also are connected to the outside world through road side units and other vehicles. In some cases, the internal and external network packets pass through the same hardware and are merely isolated by software defined rules. Any misconfiguration opens a window for the hackers to intrude into vehicles’ internal components e.g. central lock system, Engine Control Unit (ECU), Anti-lock Braking System (ABS) or Adaptive Cruise Control (ACC) system. Compromise of any of these can lead to disastrous outcomes. In this paper, we study the security of smart vehicles’ adaptive cruise control systems in the presence of covert attacks. We define two covert/stealth attacks in the context of cruise control and propose a novel intrusion detection and compensation method to disclose and respond to such attacks. More precisely, we focus on the covert cyber attacks that compromise the integrity of cruise controller and employ a neural network identifier in the IDS engine to estimate the system output dynamically and compare it against the ACC output. If any anomaly is detected, an embedded substitute controller kicks in and takes over the control. We conducted extensive experiments in MATLAB to evaluate the effectiveness of the proposed scheme in a simulated environment.

Covert Attacks Through Adversarial Learning: Study of Lane Keeping Attacks on the Safety of Autonomous Vehicles

Road management systems are to improve in terms of integrity, mobility, sustainability, and safety by the adoption of artificial intelligence and Internet of Things services. This article introduces the concept of covert attacks on autonomous vehicles which can jeopardize the safety of passengers. Covert attacks are designed to manipulate outputs of cyber physical systems through network channels in a way that while the changes are not easily perceptible by human beings, systems are negatively affected in the long run. We argue that future smart vehicles are vulnerable to viruses which can use adversarial learning methods to adapt themselves to hosts and remain stealth for a long period. As a case study, we design a covert attack on the lane keeping system of autonomous vehicles. In the scenario, an intelligent adversary manipulates sensor readings (lane position, curvature, etc.) in order to deceive the controller to drive the vehicle closer to the boundaries. The virus/attacker interactively learns the host vehicle behaviors in terms of lateral deviation and maneuverability and tries to increase the errors to the extent that remains unnoticeable to the driver. This process is carried out through actor-critic learning based on the Newton--Raphson method. We additionally design an intrusion detection system for such covert attacks. We use the GPS data and offline maps to reconstruct road curves and match them against readings. A simulation testbed is developed based on the map of Nurburgring-Grand Prix track to evaluate our models. Results confirm the validity and effectiveness of the proposed models.

A Blended Active Detection Strategy for False Data Injection Attacks in Cyber-Physical Systems

In recent years, different solutions have been proposed to detect advanced stealthy cyber-attacks against networked control systems. In this article, we propose a blended detection scheme that properly leverages and combines two existing detection ideas, namely, watermarking and moving target . In particular, a watermarked signal and a nonlinear static auxiliary function are combined to both limit the attacker's disclosure resources and obtain an unidentifiable moving target. The proposed scheme is capable of detecting a broad class of false data injection attacks, including zero-dynamics, replay, and covert attacks. Moreover, it is shown that the proposed approach mitigates the drawbacks of standard moving target and watermarking defense strategies. Finally, an extensive simulation study is reported to contrast the proposed detector with recent competitor schemes and provide tangible evidence of the effectiveness of the proposed solution.

A degradation-based detection framework against covert cyberattacks on SCADA systems

Supervisory Control and Data Acquisition (SCADA) systems are commonly used in critical infrastructures. However, these systems are typically vulnerable to cyberattacks. Among the different types of cyberattacks, the covert attack is one of the hardest to detect – it is undetectable when the system is operating under normal conditions. In this article, we develop a data-driven detection framework that utilizes the degradation process of the system to detect covert attacks. We derive mathematical characteristics of the degradation processes under covert attacks that are used for developing a sequential likelihood ratio test method for attack detection. We verify our methodology through an extensive numerical study and a case study on a rotating machinery setup. Our results show that the methodology helps detect covert attacks within reasonable delay time and is applicable under real-world settings.

Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the Industry 4.0. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.

Detection of Covert Cyber-Attacks in Interconnected Systems: A Distributed Model-Based Approach

Distributed detection of covert attacks for linear large-scale interconnected systems is addressed in this article. Existing results consider the problem in centralized settings. This article focuses on large-scale systems subject to bounded process and measurement disturbances, where a single subsystem is under a covert attack. A detection methodology is proposed, where each subsystem can detect the presence of covert attacks in neighboring subsystems in a distributed manner. The detection strategy is based on the design of two model-based observers for each subsystem using only local information. An extensive detectability analysis is provided and simulation results on a power network benchmark are given, showing the effectiveness of the proposed methodology for the detection of covert cyber-attacks.

Active Defense by Mimic Association Transmission in Edge Computing

A large amount of real-time data, including user privacy information, control commands, and other sensitive data, are transmitted in edge computing networks. It requires high-speed and reliable data transmission in dynamic edge computing networks. Traditional methods with passive defense cannot cope with the covert and complicated attacks. Edge computing networks require active defense during data transmission. Existing active defense methods based on dynamic network ignore the connectivity and link quality reduced by attacks and do not adjust defense positively. To maximize the defense revenue in moving adjustment strategy, this paper proposes the model of active defense for edge computing network data interaction. In this model, the network topology mimic association protocol is designed to associate multi-paths and multi-parameters automatically. On one hand, considering the transmission reliability and defensive revenue reduction caused by dynamic network transformation, a real-time multi-feature anomaly detection algorithm based on Non-extensive entropy and Renyi cross entropy is proposed. Based on this, a moving communication path alliance can be constructed pseudo-randomly. On the other hand, this paper proposes a Hidden Markov based state prediction model and a mimic transformation strategy for The Network Topology Mimic Association Graph based on predicted states. Combining these two ways improves the data transmission service quality of the active defense technology in edge computing networks. Experiments are carried in simulated power networks. The results show that our method outperforms the popular methods in terms of transmission efficiency, reliability, and anti-attack performance.

Covert Attack Detection Based on Hi/H∞ Optimization for Cyber-Physical Systems

In this paper, a new detection scheme is proposed to detect covert attack in the framework of Hi/H∞ index optimization for cyber-physical system (CPS) which is modeled as a linear discrete time-varying (LDTV) system. First, a random modulation matrix that the attacker cannot know is inserted into the path of the control variables to destroy the stealthiness of covert attacks. Second, a detection filter is constructed which transforms the detection problem into an H-/H∞ or H∞/H∞ index optimization problem. The optimal solution is obtained by solving the Riccati equation. Third, a decision making mechanism is presented to trigger an alarm and further determine whether the cause of alarm is a covert attack or a fault. Finally, a simulation example is given to illustrate the effectiveness of the proposed method.

Covert Channels-based Stealth Attacks in Industry 4.0

Covert Channels-based Stealth Attacks in Industry 4.0

Covert Channels-Based Stealth Attacks in Industry 4.0

Industry 4.0 advent opens several cyber-threats scenarios originally designed for classic information technology (IT), drawing the attention to serious risks for the modern industrial control networks. To cope with this problem, in this paper, we address the security issues related to covert channels applied to industrial networks, identifying the new vulnerability points when ITs converge with operational technologies such as edge computing infrastructures. Specifically, we define two signaling strategies where we exploit the Modbus/transmission control protocol (TCP) as target to set up a covert channel. Once the threat channel is established, passive and active offensive methodologies are further exploited by implementing and testing them on a real industrial Internet of Things testbed. The experimental results highlight the potential damage of such specific threats and the easy extrapolation of the attacks to other types of channels in order to show the new risks for the Industry 4.0. Related to this, we discuss some countermeasures offering an overview of possible mitigation and defensive measures.

Optimization Algorithms for Catching Data Manipulators in Power System Estimation Loops

In this paper, we develop a set of algorithms that can detect the identities of malicious data manipulators in distributed optimization loops for estimating oscillation modes in large-power system models. The estimation is posed in terms of a consensus problem among multiple local estimators that jointly solve for the characteristic polynomial of the network model. If any of these local estimates is compromised by a malicious attacker, resulting in an incorrect value of the consensus variable, then the entire estimation loop can be destabilized. We present four iterative algorithms by which this instability can be quickly detected, and the identities of the compromised estimators can be revealed. The algorithms are solely based on the computed values of the estimates, and do not need any information about the model of the power system. Both large and covert attacks are considered. The results are illustrated using simulations of the IEEE 68-bus power system model.