Class Of Cyber Attacks Research Articles

Comprehensive Review Next-Generation Intrusion Prevention System (NGIPS) Based Cyber Attacks Classification and Challenges Using Machine Learning Techniques

Comprehensive Review Next-Generation Intrusion Prevention System (NGIPS) Based Cyber Attacks Classification and Challenges Using Machine Learning Techniques

Overview of Cyber Attacks Classification and Detection in IoT using CNN-Deep Reinforcement Learning

Millions of digital devices total the Internet of Things (IoT), and this allows very easy interaction from users connecting the devices. IoT is one of the tech sectors that is expanding most rapidly, but it can also be very vulnerable to hazards. Infections and abnormal placement on the Internet of Things (IoT) framework is an increasing threat in the field of technology. In view of the growing IoT foundation usage across all industries, attacks and dangers on these systems have also grown proportional. Leveraging typical machine learning methods, cyber-attack detection plays a critical role in avoiding damage from cyberattacks on IoT devices. IoT Cyber Attacks are Not Detected by ANN Artificial Neural Networks Using Deep Learning Techniques CNN-DRL (Convolutional Neural Networks-Deep Reinforcement Learning) Hybrid Approach: Detects Attacks, including Distributed Denial of Service (DDoS), Zero-day, and Eavesdropping Attacks.

Integrated Genetic Algorithm and Deep Learning Approach for Effective Cyber-Attack Detection and Classification in Industrial Internet of Things (IIoT) Environments

AbstractCyber-attack detection within Industrial Internet of Things (IIoT) environments presents unique challenges due to the complex, resource-constrained, and real-time nature of these networks. Traditional detection techniques often struggle to adapt to the dynamic environment of IIoT. For instance, many existing methods rely on signature-based detection, which fails to identify evolving threats. Other approaches, such as anomaly-based detection, can generate a high rate of False Positives, leading to inefficiencies in threat management. To address these challenges, we propose a novel detection and classification model specifically tailored for IIoT environments. The proposed model integrates Genetic Algorithms (GA) and Deep Learning (DL) to enhance cyber-attack detection within IIoT environments. The GA component optimises feature selection from raw network data, ensuring the extraction of meaningful and relevant features. Leveraging these selected features, the DL component constructs a robust model capable of accurately detecting and classifying various cyber-attack patterns across IIoT devices. Through experimentation on real-world IIoT network traffic (UNSW-NB 15 dataset), the proposed approach demonstrates its efficacy in improving attack detection accuracy and adaptability. The integration of GA and DL offers a synergistic solution that addresses the complexities of IIoT cybersecurity, contributing to a more secure and resilient IIoT ecosystem. The integrated GA–DL classification model developed in this work achieved 98% precision, 96% accuracy, 94% recall, and 12% losses with only less than 50% of the features of the UNSW-NB 15 dataset. The reduction in features required for the identification and classification of cyber-attacks reduces the processing time by 50%.

Class imbalanced data handling with cyberattack classification using Hybrid Salp Swarm Algorithm with deep learning approach

Cyberattack classification involves applying deep learning (DL) and machine learning (ML) models to categorize digital threats based on their features and behaviors. These models examine system logs, network traffic, or other associated data patterns to discriminate between standard activities and malicious actions. Efficient cyberattack classification is vital for on-time threat detection and response, permitting cybersecurity specialists to categorize and reduce potential risks to a system. Handling class-imbalanced data in cyberattack classification using DL is critical for achieving exact and robust models. In cybersecurity databases, instances of normal behavior frequently significantly outnumber instances of cyberattacks, foremost due to biased methods that may complete poorly on minority classes. To address this issue approaches such as oversampling the lesser class, undersampling the popular class, or using more advanced systems can be used. These plans defend that the DL technique is more complex when determining cyberattacks, so it increases complete performance and adapts the effect of the imbalance class on the classification results. This study presents a novel Hybrid Salp Swarm Algorithm with a DL Approach for Cyberattack Classification (HSSADL-CAC) technique. The HSSADL-CAC method intends to resolve class imbalance data handling with an optimum DL model for the recognition of cyberattacks. At first, the HSSADL-CAC method experiences data normalization as a pre-processing stage. The HSSADL-CAC technique uses the ADASYN approach to handle class imbalance problems. In addition, the HSSADL-CAC technique applies an HSSA-based feature selection approach. The HSSADL-CAC technique detects cyberattacks using a deep extreme learning machine (DELM) model. Finally, the hyperparameter tuning of the ELM model takes place by utilizing the beluga whale optimization (BWO) model. The performance analysis of the HSSADL-CAC technique employs a benchmark database. The comprehensive comparison research indicates the superior performance of the HSSADL-CAC technique in the cyberattack detection procedure.

Res2Net-ERNN: deep learning based cyberattack classification in software defined network

Res2Net-ERNN: deep learning based cyberattack classification in software defined network

Network Intrusion Detection and Anomaly Classification

A software application known as an intrusion detection system (IDS) is utilized to monitor networks for any unauthorized or malicious activities that may violate security policies related to system confidentiality, integrity, and availability. Our thesis involved conducting extensive literature reviews on various types of IDS, anomaly detection methods, and machine learning algorithms that can be utilized for detection and classification. IDS are crucial for safeguarding advanced communication networks and were initially designed to identify specific patterns, signatures, and rule violations. In recent years, machine learning and deep learning approaches have been employed in the field of network intrusion detection, providing promising alternatives. Our proposed system involved identifying noisy features through causal intervention, preserving only those features that had a causality with cyberattacks. The ML algorithm was then utilized to make a preliminary classification to select the most relevant types of cyberattacks, ultimately leading to the detection of unique labeled cyberattacks through the counterfactual detection algorithm. Keywords—Intrusion Detection System (IDS), anomaly detection, machine learning algorithms, deep learning, causal intervention, cyberattack classification, and counterfactual detection.

A detailed study of resampling algorithms for cyberattack classification in engineering applications.

The evolution of engineering applications is highly relevant in the context of protecting industrial systems. As industries are increasingly interconnected, the need for robust cybersecurity measures becomes paramount. Engineering informatics not only provides tools for knowledge representation and extraction but also affords a comprehensive spectrum of developing sophisticated cybersecurity solutions. However, safeguarding industrial systems poses a unique challenge due to the inherent heterogeneity of data within these environments. Together with this problem, it's crucial to acknowledge that datasets that simulate real cyberattacks within these diverse environments exhibit a high imbalance, often skewed towards certain types of traffics. This study proposes a system for addressing class imbalance in cybersecurity. To do this, three oversampling (SMOTE, Borderline1-SMOTE, and ADASYN) and five undersampling (random undersampling, cluster centroids, NearMiss, repeated edited nearest neighbor, and Tomek Links) methods are tested. Particularly, these balancing algorithms are used to generate one-vs-rest binary models and to develop a two-stage classification system. By doing so, this study aims to enhance the efficacy of cybersecurity measures ensuring a more comprehensive understanding and defense against the diverse range of threats encountered in industrial environments. Experimental results demonstrates the effectiveness of proposed system for cyberattack detection and classification among nine widely known cyberattacks.

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

The cyber-physical system (CPS) plays a crucial role in supporting critical infrastructure like water treatment facilities, gas stations, air conditioning components, and smart grids, which are essential to society. However, these systems are facing a growing susceptibility to a wide range of emerging attacks. Cyber-attacks against CPS have the potential to cause disruptions in the accurate sensing and actuation processes, resulting in significant harm to physical entities and posing concerns for the overall safety of society. Unlike common security measures like firewalls and encryption, which often aren't enough to deal with the unique problems that CPS architectures present, deploying machine learning-based intrusion detection systems (IDS) that are specifically made for CPS has become an important way to make them safer. The application of machine learning algorithms has been suggested as a means of mitigating cyber-attacks on CPS. However, the limited availability of labelled data pertaining to emerging attack techniques poses a significant challenge to the accurate detection of such attacks. In the given scenario, transfer learning emerges as a promising methodology for the detection of cyber-attacks, as it involves the implicit modelling of the system. In this research, we propose a new lightweight transfer learning method via ResNet50-CNN1D for intrusion detection in CPS. The Adaptive Gradient (Adagrad) optimizer was applied in the proposed model to minimize the loss function through the adjustment of network weight. We tested how well the suggested ResNet50-1D-CNN model worked using the UNSW-NB15 dataset and a control system dataset called HAI. The HAI dataset was taken from the testbed and based on a planned physical attack scenario. By calculating the coefficient scores for the top ten (10) features in the HAI and UNSW-NB15 data, it was possible to determine the relevance of a feature. The rationale behind employing transfer learning was to mitigate the complexity associated with the classification of cyber-attacks and runtime. The utilization of transfer learning resulted in notable reductions in both the training and testing times required for the detection of attacks. On the HAI data, the results showed an accuracy of 97.32 %, recall of 98.41 %, F1-score of 96.32 %, and precision of 97.09 %. On the UNSW-NB15 data, the results showed an accuracy of 99.89 %, recall of 99.09 %, F1-score of 98.01 %, and precision of 98.70 %.

A comparative analysis of various machine learning methods for anomaly detection in cyber attacks on IoT networks

This study explores the growing challenges of cybersecurity in the context of rapidly adopted Internet of Things (IoT) technologies, which have become increasingly susceptible to cyber threats. The widespread utilisation of IoT systems intensifies the complex interactions between devices and amplifies the traffic of data, creating various opportunities for cyber adversaries. Consequently, detecting and mitigating cyberattacks targeting IoT systems has emerged as a critical imperative in the field of cybersecurity.The primary objective of this study is to employ various machine learning methods to detect cyber anomalies within IoT systems and subsequently compare the efficacy of these methods. Comparative analysis encompasses various machine learning techniques, including Support Vector Machine (SVM), Artificial Neural Network (ANN), Decision Tree (DT), Logistic Regression (LR), and k-Nearest Neighbours (k-NN). This technical evaluation aims to provide a nuanced perspective on the contributions of these methods to the classification of cyber attacks in IoT systems. Performance analysis of these methods serves as valuable information for cybersecurity experts, offering guidance in the development of robust protection strategies for the IoT ecosystem. As IoT security continues to gain prominence, the findings of this study are poised to contribute significantly to the refinement of cybersecurity practices and the fortification of IoT environments against potential threats. In this study, we use different machine learning methods to detect anomalies in cyber attacks on IoT systems and compare the performance of these methods. The result shows that the neural network performed better than the other models.

Cybercrimes: An Emerging Category of Offenses within the Frame of the International Criminal Court Jurisdiction

In our interconnected society, crime persists, demanding joint efforts by national and international authorities to detect, prevent, and prosecute criminal activities. Jurisprudential evolution mandates lawmakers to possess a comprehensive legal vision, adapting laws to changing social contexts and emerging criminal methods, especially in technology, including computer technology and Artificial Intelligence (AI). This article comments on the escalating vulnerability of sovereign states and their economies to cyber-attacks. The radical evolution of computer systems has led to new modes of aggression, targeting not only traditional legal assets but also individuals familiar with advanced technology. The emergence of "cyberwarfare" prompts inquiries into potential categorizations within international legal frameworks. Recent global conflicts highlight the potential classification of cyber-attacks on critical infrastructure as war crimes or acts of aggression, urging the International Criminal Court (ICC) to consider incorporating cybercrimes into its core interests. While normative references may lack in existing conventions, the Martens Clause emphasizes treating attacks using technology as equivalent to conventional means. Article 51 of the United Nations Charter implies that cyber weapons could be deemed equivalent to conventional weapons under international law. The article stresses the importance of education and advanced training for legal personnel skilled in identifying cybercrime perpetrators, challenging the ICC to recruit or train individuals with the necessary legal and technical expertise for effective cybersecurity responses. The article briefly explores challenges in conceptualizing and categorizing cybercrimes within existing legal frameworks. The intersection of law and technology necessitates harmonious collaboration between legal and technical experts, acknowledging the intricate web of cyberspace and the implications of cyber threats on global stability and security. In conclusion, the article advocates a fundamental shift in the approach to justice, recognizing the ICC's imperative evolution in addressing cybercrimes. Integrating cybercrimes into the ICC's purview aligns with international law principles, emphasizing the equivalence of cyber weapons to conventional arms. Collaboration between legal and technical experts is essential in navigating the complexities of cybercrimes, ensuring accountability, and upholding justice in the digital age. The article concludes by highlighting the proactive role of the ICC in shaping the future of global justice amid emerging cyber threats.

Кибератаки: некоторые подходы к системному анализу

The lack of a unified approach to understanding and responding to cyber attacks and incidents between information security software manufacturers, users and government agencies in charge of cybersecurity leads to the impossibility of interaction and joint counteraction. Various approaches to the classification of cyber attacks are considered. An attempt is made to systematize and analyze existing threats in the form of attacks on the network information infrastructure.

Central Medical Centre Healthcare Data Security with Lightweight Blockchain Model in IoT Sensor Environment

Data security involves implementing measures to protect digital information from unauthorized access, disclosure, alteration, or destruction, ensuring the confidentiality, integrity, and availability of sensitive data. Hence, this paper addresses the critical imperative of ensuring robust data security within the healthcare domain. With the proliferation of digital technologies and interconnected systems, safeguarding patient information has become paramount. The study comprehensively reviews existing strategies for data security in healthcare, including encryption, access controls, and secure authentication mechanisms. It delves into the unique challenges faced by healthcare organizations, such as the interoperability of systems, compliance with regulatory frameworks and the increasing sophistication of cyber threats. The paper emphasizes the significance of fostering a culture of cybersecurity awareness among healthcare professionals and implementing proactive measures to mitigate vulnerabilities. Future directions in healthcare data security, including the integration of emerging technologies like blockchain and artificial intelligence, are also explored. By providing a holistic overview of data security challenges and solutions in healthcare, this paper contributes to the ongoing efforts to fortify the confidentiality, integrity, and availability of sensitive patient data in the digital age. The effectiveness of two medical treatments (Treatment A and Treatment B) is assessed based on the responses of 20 participants, revealing subtle yet notable variations in efficacy. Additionally, the security scores of Healthcare Systems A and B are evaluated, demonstrating a marginal superiority of System B. A detailed classification of cyber attacks, ranging from phishing and malware infections to insider threats and zero-day exploits, sheds light on the diverse nature of cybersecurity challenges. The findings underscore the importance of a multifaceted approach to medical data security, emphasizing the need for robust treatments, secure healthcare systems, and targeted defense strategies against evolving cyber threats. This paper contributes valuable insights to the ongoing discourse on bolstering cybersecurity measures in healthcare to safeguard patient information and fortify the integrity of healthcare systems in an increasingly digital landscape.

Golden Jackal Optimization with a Deep Learning-Based Cybersecurity Solution in Industrial Internet of Things Systems

Recently, artificial intelligence (AI) has gained an abundance of attention in cybersecurity for Industry 4.0 and has shown immense benefits in a large number of applications. AI technologies have paved the way for multiscale security and privacy in cybersecurity, namely AI-based malicious intruder protection, AI-based intrusion detection, prediction, and classification, and so on. Moreover, AI-based techniques have a remarkable potential to address the challenges of cybersecurity that Industry 4.0 faces, which is otherwise called the IIoT. This manuscript concentrates on the design of the Golden Jackal Optimization with Deep Learning-based Cyberattack Detection and Classification (GJODL-CADC) method in the IIoT platform. The major objective of the GJODL-CADC system lies in the detection and classification of cyberattacks on the IoT platform. To obtain this, the GJODL-CADC algorithm presents a new GJO-based feature selection approach to improve classification accuracy. Next, the GJODL-CADC method makes use of a hybrid autoencoder-based deep belief network (AE-DBN) approach for cyberattack detection. The effectiveness of the AE-DBN approach can be improved through the design of the pelican optimization algorithm (POA), which in turn improves the detection rate. An extensive set of simulations were accomplished to demonstrate the superior outcomes of the GJODL-CADC technique. An extensive analysis highlighted the promising performance of the GJODL-CADC technique compared to existing techniques.

Optimal Deep-Learning-Based Cyberattack Detection in a Blockchain-Assisted IoT Environment

The Internet of Things (IoT) is the most extensively utilized technology nowadays that is simple and has the advantage of replacing the data with other devices by employing cloud or wireless networks. However, cyber-threats and cyber-attacks significantly affect smart applications on these IoT platforms. The effects of these intrusions lead to economic and physical damage. The conventional IoT security approaches are unable to handle the current security problems since the threats and attacks are continuously evolving. In this background, employing Artificial Intelligence (AI) knowledge, particularly Machine Learning (ML) and Deep Learning (DL) solutions, remains the key to delivering a dynamically improved and modern security system for next-generation IoT systems. Therefore, the current manuscript designs the Honey Badger Algorithm with an Optimal Hybrid Deep Belief Network (HBA-OHDBN) technique for cyberattack detection in a blockchain (BC)-assisted IoT environment. The purpose of the proposed HBA-OHDBN algorithm lies in its accurate recognition and classification of cyberattacks in the BC-assisted IoT platform. In the proposed HBA-OHDBN technique, feature selection using the HBA is implemented to choose an optimal set of features. For intrusion detection, the HBA-OHDBN technique applies the HDBN model. In order to adjust the hyperparameter values of the HDBN model, the Dung Beetle Optimization (DBO) algorithm is utilized. Moreover, BC technology is also applied to improve network security. The performance of the HBA-OHDBN algorithm was validated using the benchmark NSLKDD dataset. The extensive results indicate that the HBA-OHDBN model outperforms recent models, with a maximum accuracy of 99.21%.

Blockchain-Assisted Machine Learning with Hybrid Metaheuristics-Empowered Cyber Attack Detection and Classification Model

Cyber attack detection is the process of detecting and responding to malicious or unauthorized activities in networks, computer systems, and digital environments. The objective is to identify these attacks early, safeguard sensitive data, and minimize the potential damage. An intrusion detection system (IDS) is a cybersecurity tool mainly designed to monitor system activities or network traffic to detect and respond to malicious or suspicious behaviors that may indicate a cyber attack. IDSs that use machine learning (ML) and deep learning (DL) have played a pivotal role in helping organizations identify and respond to security risks in a prompt manner. ML and DL techniques can analyze large amounts of information and detect patterns that may indicate the presence of malicious or cyber attack activities. Therefore, this study focuses on the design of blockchain-assisted hybrid metaheuristics with a machine learning-based cyber attack detection and classification (BHMML-CADC) algorithm. The BHMML-CADC method focuses on the accurate recognition and classification of cyber attacks. Moreover, the BHMML-CADC technique applies Ethereum BC for attack detection. In addition, a hybrid enhanced glowworm swarm optimization (HEGSO) system is utilized for feature selection (FS). Moreover, cyber attacks can be identified with the design of a quasi-recurrent neural network (QRNN) model. Finally, hunter–prey optimization (HPO) algorithm is used for the optimal selection of the QRNN parameters. The experimental outcomes of the BHMML-CADC system were validated on the benchmark BoT-IoT dataset. The wide-ranging simulation analysis illustrates the superior performance of the BHMML-CADC method over other algorithms, with a maximum accuracy of 99.74%.

A two-stage cyber attack detection and classification system for smart grids

As the adoption of Internet of Things (IoT) devices increases rapidly, industrial applications of IoT devices gain further popularity. Some of these applications, such as smart grids, are considered high-risk applications. In the past few years, smart grids became the target of many cyber attacks. In this paper, we present a two-stage system for the detection and classification of cyber attacks based on machine learning. The first stage of the proposed system focuses on detecting attacks efficiently and accurately. The second stage analyzes available data and predicts the specific attack class. The proposed system was tested using the DNP3 intrusion detection dataset, and delivered an F1 score of 0.9976 at the detection stage, and 0.9883 at the attack type classification stage.

The Right of Legitimate Defense Against Cyberattacks in Public International Law

The emergence of this unusual occurrence necessitated the intervention of international law, which looked for to regulate it through the prohibition or discouragement of its employment through force, as expressed in Article 4/2 of the United Nations Charter, Additionally, international law aimed to govern the permissible usage of technology in the civil and military fields. This action was undertaken as a reaction to the recent increase in cyberattacks and the growing reliance in all fields This paper aims to analyse the legal criteria surrounding the classification of cyberattacks as acts of military aggression, specifically focusing on the circumstances requiring the use of the right to justified defence against governments and other powerful bodies.

Systematization of Cyber Threats in Maritime Transport

The paper proposes a classification of cyber-attacks at the present stage of maritime transport development. A classification system for ship blocks and port infrastructure has been developed. The vulnerabilities of the global navigation satellite system are analyzed; this system is the most important subcategory of maritime vehicles and may be a target for cyber-attacks. The paper shows that the rapid spread of cybercrime occurs due to the rapid development of new technologies and their integration into ship and port infrastructures. The main elements of the maritime transport infrastructure are considered: port infrastructure and ship infrastructure. IoT and Big Data can be examples of the spread of such systems. The ship's IT infrastructure, ship's electromechanical and electronic systems, communication systems, automatic identification systems, ship information system are considered. In the port infrastructure, port security systems, port equipment systems, port communication systems are analyzed. The main types of cyber-attacks to which the ship and port parts of the industry are exposed are considered. The signs of attacks on the Internet of things systems on ships and in ports are considered. The trend towards greater system integration cannot be reversed for economic reasons. Such integration makes it possible to reduce the size of the team, build autonomous ships, work in the smart ports system, and makes it possible to save various resources (time, human, fuel and organizational). The paper considers the practical directions and challenges facing the industry in terms of improving the security of maritime transport in cyberspace.

Embedded Signal Artificial Neural Network Based Intelligent Non-Dependent Feature Selection for Cyber Attack Classification in Signal-Based Networks

Embedded Signal Artificial Neural Network Based Intelligent Non-Dependent Feature Selection for Cyber Attack Classification in Signal-Based Networks

Towards adversarial realism and robust learning for IoT intrusion detection and classification

The internet of things (IoT) faces tremendous security challenges. Machine learning models can be used to tackle the growing number of cyber-attack variations targeting IoT systems, but the increasing threat posed by adversarial attacks restates the need for reliable defense strategies. This work describes the types of constraints required for a realistic adversarial cyber-attack example and proposes a methodology for a trustworthy adversarial robustness analysis with a realistic adversarial evasion attack vector. The proposed methodology was used to evaluate three supervised algorithms, random forest (RF), extreme gradient boosting (XGB), and light gradient boosting machine (LGBM), and one unsupervised algorithm, isolation forest (IFOR). Constrained adversarial examples were generated with the adaptative perturbation pattern method (A2PM), and evasion attacks were performed against models created with regular and adversarial training. Even though RF was the least affected in binary classification, XGB consistently achieved the highest accuracy in multi-class classification. The obtained results evidence the inherent susceptibility of tree-based algorithms and ensembles to adversarial evasion attacks and demonstrate the benefits of adversarial training and a security-by-design approach for a more robust IoT network intrusion detection and cyber-attack classification.