Cyber Attack Detection System Research Articles

Evasive attacks against autoencoder-based cyberattack detection systems in power systems

The digital transformation process of power systems towards smart grids is resulting in improved reliability, efficiency and situational awareness at the expense of increased cybersecurity vulnerabilities. Given the availability of large volumes of smart grid data, machine learning-based methods are considered an effective way to improve cybersecurity posture. Despite the unquestionable merits of machine learning approaches for cybersecurity enhancement, they represent a component of the cyberattack surface that is vulnerable, in particular, to adversarial attacks. In this paper, we examine the robustness of autoencoder-based cyberattack detection systems in smart grids to adversarial attacks. A novel iterative-based method is first proposed to craft adversarial attack samples. Then, it is demonstrated that an attacker with white-box access to the autoencoder-based cyberattack detection systems can successfully craft evasive samples using the proposed method. The results indicate that naive initial adversarial seeds cannot be employed to craft successful adversarial attacks shedding insight on the complexity of designing adversarial attacks against autoencoder-based cyberattack detection systems in smart grids.

Design Procedure for Real-Time Cyber–Physical Systems Tolerant to Cyberattacks

Modern industrial automation supported by Cyber–Physical Systems (CPSs) requires high flexibility, which is achieved through increased interconnection between modules. This interconnection introduces a layer of symmetry into the design and operation of CPSs, balancing the distribution of tasks and resources across the system and streamlining the flow of information. However, this adaptability also exposes control systems to security threats, particularly through novel communication links that are vulnerable to cyberattacks. Traditional strategies may have limitations in these applications. This research proposes a design approach for control applications supported by CPSs that incorporates cyberattack detection and tolerance strategies. Using a modular and adaptive approach, the system is partitioned into microservices for scalability and resilience, allowing structural symmetry to be maintained. Schedulability assessments ensure that critical timing constraints are met, improving overall system symmetry and performance. Advanced cyberattack detection and isolation systems generate alarms and facilitate rapid response with replicas of affected components. These replicas enable the system to recover from and tolerate cyberattacks, maintaining uninterrupted operation and preserving the balanced structure of the system. In conclusion, the proposed approach addresses the security challenges in CPS-based control applications and provides an integrated and robust approach to protect industrial automation systems from cyber threats. A case study conducted at a juice production facility in Colima, México, demonstrated how the architecture can be applied to complex processes such as pH control, from simulation to industrial implementation. The study highlighted a plug-and-play approach, starting with component definitions and relationships, and extending to technology integration, thereby reinforcing symmetry and efficiency within the system.

Predictive Analytics-Enabled Cyber Attack Detection

Cyber-attacks are becoming increasingly sophisticated and difficult to detect using traditional security measures. To address this challenge, we propose a predictive analytics- enabled cyber-attack detection system that utilizes machine learning algorithms to analyze network traffic and identify potential security threats in real time. Our system uses a combination of supervised and unsupervised learning techniques to identify patterns and anomalies in network data, and to generate anomaly and normal alert. The system is trained using historical data from known cyber-attacks and anomalies and we visualize the accuracy of various algorithms.

Black-box adversarial transferability: An empirical study in cybersecurity perspective

The rapid advancement of artificial intelligence within the realm of cybersecurity raises significant security concerns. The vulnerability of deep learning models in adversarial attacks is one of the major issues. In adversarial machine learning, malicious users try to fool the deep learning model by inserting adversarial perturbation inputs into the model during its training or testing phase. Subsequently, it reduces the model confidence score and results in incorrect classifications. The novel key contribution of the research is to empirically test the black-box adversarial transferability phenomena in cyber attack detection systems. It indicates that the adversarial perturbation input generated through the surrogate model has a similar impact on the target model in producing the incorrect classification. To empirically validate this phenomenon, surrogate and target models are used. The adversarial perturbation inputs are generated based on the surrogate-model for which the hacker has complete information. Based on these adversarial perturbation inputs, both surrogate and target models are evaluated during the inference phase. We have done extensive experimentation over the CICDDoS-2019 dataset, and the results are classified in terms of various performance metrics like accuracy, precision, recall and f1-score. The findings indicate that any deep learning model is highly susceptible to adversarial attacks, even if the attacker does not have access to the internal details of the target model. The results also indicate that white-box adversarial attacks have a severe impact compared to black-box adversarial attacks. There is a need to investigate and explore adversarial defence techniques to increase the robustness of the deep learning models against adversarial attacks.

Detection of cyber attacks on IoT based cyber physical systems

The integration of Internet of Things (IoT) devices in Cyber- Physical Systems (CPS) continues to proliferate, ensuring the security of these interconnected systems becomes paramount. In existing research work focuses on the development and implementation of a cyber attack detection system for IoT-based CPS, leveraging Support Vector Machine (SVM) models. The SVM model, known for its effectiveness in binary classification tasks, is trained on historical data to distinguish between normal and malicious behavior patterns exhibited by IoT devices within the CPS. The SVM model is trained to learn the normal behavior of the system, enabling it to identify deviations indicative of cyber attacks. Realworld experiments and simulations demonstrate the efficacy of the SVMbased detection system in identifying various types of cyber threats. However, this research also acknowledges certain limitations. The SVM model's performance may be impacted by the dynamic and evolving nature of cyber threats, as it relies heavily on historical data for training and detection accuracy issues. To address the limitations of present cyber threat detection model , in this research work proposed a novel deep learning based CNN Model. The proposed model improve cyber attacks detection and performance metrics. The proposed model outperforms with the comparison of previous model. The performance measured in terms of accuracy, precision, recall and f1-score.

A Bidirectional Differential Evolution Based Unknown Cyberattack Detection System

A Bidirectional Differential Evolution Based Unknown Cyberattack Detection System

A two-stage cyber attack detection and classification system for smart grids

As the adoption of Internet of Things (IoT) devices increases rapidly, industrial applications of IoT devices gain further popularity. Some of these applications, such as smart grids, are considered high-risk applications. In the past few years, smart grids became the target of many cyber attacks. In this paper, we present a two-stage system for the detection and classification of cyber attacks based on machine learning. The first stage of the proposed system focuses on detecting attacks efficiently and accurately. The second stage analyzes available data and predicts the specific attack class. The proposed system was tested using the DNP3 intrusion detection dataset, and delivered an F1 score of 0.9976 at the detection stage, and 0.9883 at the attack type classification stage.

Retracted: Computational Intelligence Approaches in Developing Cyberattack Detection System.

[This retracts the article DOI: 10.1155/2022/4705325.].

Intelligent AI-based Healthcare Cyber Security System using Multi-Source Transfer Learning Method

Cyber-security intelligence have made a great impact over healthcare industry where several researchers are developing new techniques to improve security for healthcare systems. Besides, Artificial Intelligence (AI) become the tremendous technology in recent decades to improve the existing methods to be more intelligent. In this paper, we proposed cyber attack detection system for healthcare sector with centralized and federated transfer learning mode. Edge of Things (EoT) framework is developed in connection with cloud and healthcare sectors to transmit the data efficiently and the proposed Centralized with Multi-Source Transfer Learning (CMTL) algorithm which is used for detection and classification of various threats such as information gathering, DoS/DDoS attacks, Malware attacks, Injection attacks, and Man in the Middle attacks. Performance of the proposed framework is evaluated using various datasets such as EMNIST, X-IIoTID, and Federated TON_IoT. Our framework outperforms with the analysis of execution time and obtains high level accuracy when compared with different algorithms.

Deep Transfer Learning: A Novel Collaborative Learning Model for Cyberattack Detection Systems in IoT Networks

Federated Learning (FL) has recently become an effective approach for cyberattack detection systems, especially in Internet-of-Things (IoT) networks. By distributing the learning process across IoT gateways, FL can improve learning efficiency, reduce communication overheads and enhance privacy for cyberattack detection systems. However, one of the biggest challenges for deploying FL in IoT networks is the unavailability of labeled data and dissimilarity of data features for training. In this paper, we propose a novel collaborative learning framework that leverages Transfer Learning (TL) to overcome these challenges. Particularly, we develop a novel collaborative learning approach that enables a target network with unlabeled data to effectively and quickly learn “knowledge” from a source network that possesses abundant labeled data. It is important that the state-of-the-art studies require the participated datasets of networks to have the same features, thus limiting the efficiency, flexibility as well as scalability of intrusion detection systems. However, our proposed framework can address these problems by exchanging the learning “knowledge” among various deep learning models, even when their datasets have different features. Extensive experiments on recent real-world cybersecurity datasets show that the proposed framework can improve more than 40% as compared to the state-of-the-art deep learning based approaches.

Enhanced Cyber Attack Detection Process for Internet of Health Things (IoHT) Devices Using Deep Neural Network

Internet of Health Things plays a vital role in day-to-day life by providing electronic healthcare services and has the capacity to increase the quality of patient care. Internet of Health Things (IoHT) devices and applications have been growing rapidly in recent years, becoming extensively vulnerable to cyber-attacks since the devices are small and heterogeneous. In addition, it is doubly significant when IoHT involves devices used in healthcare domain. Consequently, it is essential to develop a resilient cyber-attack detection system in the Internet of Health Things environment for mitigating the security risks and preventing Internet of Health Things devices from becoming exposed to cyber-attacks. Artificial intelligence plays a primary role in anomaly detection. In this paper, a deep neural network-based cyber-attack detection system is built by employing artificial intelligence on latest ECU-IoHT dataset to uncover cyber-attacks in Internet of Health Things environment. The proposed deep neural network system achieves average higher performance accuracy of 99.85%, an average area under receiver operator characteristic curve 0.99 and the false positive rate is 0.01. It is evident from the experimental result that the proposed system attains higher detection rate than the existing methods.

A Survey on Feature Selection Techniques Based on Filtering Methods for Cyber Attack Detection

Cyber attack detection technology plays a vital role today, since cyber attacks have been causing great harm and loss to organizations and individuals. Feature selection is a necessary step for many cyber-attack detection systems, because it can reduce training costs, improve detection performance, and make the detection system lightweight. Many techniques related to feature selection for cyber attack detection have been proposed, and each technique has advantages and disadvantages. Determining which technology should be selected is a challenging problem for many researchers and system developers, and although there have been several survey papers on feature selection techniques in the field of cyber security, most of them try to be all-encompassing and are too general, making it difficult for readers to grasp the concrete and comprehensive image of the methods. In this paper, we survey the filter-based feature selection technique in detail and comprehensively for the first time. The filter-based technique is one popular kind of feature selection technique and is widely used in both research and application. In addition to general descriptions of this kind of method, we also explain in detail search algorithms and relevance measures, which are two necessary technical elements commonly used in the filter-based technique.

МАТЕМАТИЧНА МОДЕЛЬ ВЗАЄМОВІДНОСИН СИСТЕМИ КЕРУВАННЯ ІНФОРМАЦІЙНОЮ БЕЗПЕКОЮ

An effective solution to the problems of analysis and synthesis of information security management systems can not be provided by simple ways of simply describing their behavior in different conditions - systems engineering solves problems that require quantitative evaluation of characteristics. Such data, obtained experimentally or by mathematical modeling, should reveal the properties of information security management systems. The main one is efficiency, which means the degree of compliance of the results of information protection to the goal. The latter, depending on the resources available, the knowledge of developers and other factors, can be achieved to one degree or another, and there are alternative ways to implement it. In a number of publications the authors propose the basics of the categorical apparatus of set theory, which allows to explain the relationship between sets of threats and sets of information protection system, which allows to build different mathematical models to analyze information exchange systems in critical application systems. At present, the creation of information security management systems is not possible without research and generalization of world experience in building information systems and their constituent subsystems, one of the key of which are information protection and intrusion prevention systems. Components of the process of attacking the mechanisms of protection and blocking or destruction of cyber threats themselves are components of the mathematical support of such systems. The basis of such models is the mathematical apparatus, which should ensure the adequacy of modeling of information security processes for any conditions of cyber threats. When defining the mathematical apparatus, it is necessary to clearly understand how certain sets of cyber threats are built, and how the sets of cyber threat sets, sets of security system elements and sets of cyber attack detection systems, which should control the correctness of the information security process. The article analyzes various options for building models of information security management system and creates a mathematical model that takes into account the internal relationships of different subsets of components of the information security system under the influence of cyber threats.

Utilizing Deep Learning to Identify Potentially Dangerous Routing Attacks in the IoT

Due to the rapid increase of cyber-security difficulties brought about by sophisticated assaults such as data injection attacks, replay attacks, etc., the design of cyber-attack detection and control systems has emerged as an essential subfield within cyber-physical systems (CPSs) during the past few years. The outcome of these attacks could be a system failure, malfunctioning, or other undesirable effects. Consequently, it may be necessary to implement the cyber defense system in preparation for impending CPSs to have an improved security system. The various cyber-attack detection schemes based on deep learning algorithms have been intended to detect and mitigate the cyber-attacks that can be launched against CPSs, smart grids, power systems, and other similar infrastructure. This article comprehensively reviews several different deep learning algorithms suggested for use in CPSs to accomplish cyber defense. In the beginning, several methods devised by earlier academics are analyzed in great detail. After that, a comparison study is performed to determine the shortcomings of each algorithm and offer a recommendation for how further improvements to CPSs might be made more effectively.

An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks

Wireless Sensor Networks (WSNs) are the key underlying technology of the Internet of Things (IoT); however, these networks are energy constrained. Security has become a major challenge with the significant increase in deployed sensors, necessitating effective detection and mitigation approaches. Machine learning (ML) is one of the most effective methods for building cyber-attack detection systems. This paper presents a lightweight ensemble-based ML approach, Weighted Score Selector (WSS), for detecting cyber-attacks in WSNs. The proposed approach is implemented using a blend of supervised ML classifiers, in which the most effective classifier is promoted dynamically for the detection process to gain higher detection performance quickly. We compared the performance of the proposed approach to three classical ensemble techniques: Boosting-based, Bagging-based, and Stacking-based. The performance comparison was conducted in terms of accuracy, probability of false alarm, probability of detection, probability of misdetection, model size, processing time, and average prediction time per sample. We applied two independent feature selection techniques. We utilized the simulation-based labeled dataset, WSN-DS, that comprises samples of four internal network-layer Denial of Service attack types: Grayhole, Blackhole, Flooding, and TDMA scheduling, in addition to normal traffic. The simulation revealed promising results for our proposed approach.

Information-extreme machine learning of a cyber attack detection system

The study aims to increase the functional efficiency of a machine learning cyber attack detection system. An information-extreme machine learning method of the cyberattack detection system with optimization of control tolerances for recognition features that reflect the traffic properties of the info-communication system has been developed. The method is developed within the framework of the functional approach to modeling of cognitive processes of natural intelligence at the formation and acceptance of classification decisions. This approach, in contrast to known methods of data mining, including neuron-like structures, allows giving the recognition system adaptability to arbitrary initial conditions of the learning matrix and flexibility in retraining the system by expanding the recognition classes alphabet. The method idea is to maximize the information capacity of the attack detection system in the machine learning process. A modified Kullback information measure is used as a criterion for optimizing machine learning parameters. According to the proposed categorical functional model, algorithmic software for attack detection system in the mode of machine learning with the depth of the second level has been developed and implemented. However, the depth level is determined by the number of machine learning parameters, which were optimized. The geometric parameters of the recognition hyperspherical containers classes and the control tolerances on the recognition features were considered as optimization parameters, which played the role of input data quantization levels in the transformation of the input Euclidean learning matrix of the type "object-property" into a working binary learning matrix given in the Hamming space. Admissible transformations of the working training matrix of the offered method allow adapting the input mathematical description of the attacks detection system to the maximum full probability of the correct classification decisions acceptance. Based on the results of information-extreme machine learning within the geometric approach, decisive rules are constructed as practically invariant to the multidimensionality of the recognition features space. The computer simulation results of information-extreme machine learning of the attack detection system to recognize four host traffic of different profiles confirm the developed method's efficiency.

A Self-Tuning Cyber-Attacks’ Location Identification Approach for Critical Infrastructures

The integration of the communications network and the Internet of Things in today’s critical infrastructures facilitates intelligent and online monitoring of these systems. However, although critical infrastructure’s digitalization brings tremendous advantages and opportunities for remote access and control, it significantly increases cyber-attack’s vulnerability. Therefore, efficient and proper detection and localization of cyber-attack are paramount for the critical infrastructure’s reliable and secure operation. This article proposes a deep learning-based cyber-attack detection and location identification system for critical infrastructures by constructing new representations and model the system behavior using multilayer autoencoders. The results show that the new representations capture the physical relationships among the measurements and have more discriminant power in distinguishing the location of the attack. Furthermore, the proposed method has outperformed conventional machine learning models under various cyber-attack scenarios using real-world data from the gas pipeline and water distribution supervisory control and data acquisition systems.

Developing Cybersecurity Systems Based on Machine Learning and Deep Learning Algorithms for Protecting Food Security Systems: Industrial Control Systems

Industrial control systems (ICSs) for critical infrastructure are extensively utilized to provide the fundamental functions of society and are frequently employed in critical infrastructure. Therefore, security of these systems from cyberattacks is essential. Over the years, several proposals have been made for various types of cyberattack detection systems, with each concept using a distinct set of processes and methodologies. However, there is a substantial void in the literature regarding approaches for detecting cyberattacks in ICSs. Identifying cyberattacks in ICSs is the primary aim of this proposed research. Anomaly detection in ICSs based on an artificial intelligence algorithm is presented. The methodology is intended to serve as a guideline for future research in this area. On the one hand, machine learning includes logistic regression, k-nearest neighbors (KNN), linear discriminant analysis (LDA), and decision tree (DT) algorithms, deep learning long short-term memory (LSTM), and the convolution neural network and long short-term memory (CNN-LSTM) network to detect ICS malicious attacks. The proposed algorithms were examined using real ICS datasets from the industrial partners Necon Automation and International Islamic University Malaysia (IIUM). There were three types of attacks: man-in-the-middle (mitm) attack, web-server access attack, and telnet attack, as well as normal. The proposed system was developed in two stages: binary classification and multiclass classification. The binary classification detected the malware as normal or attacks and the multiclass classification was used for detecting all individual attacks. The KNN and DT algorithms achieved superior accuracy (100%) in binary classification and multiclass classification. Moreover, a sensitivity analysis method was presented to predict the error between the target and prediction values. The sensitivity analysis results showed that the KNN and DT algorithms achieved R2 = 100% in both stages. The obtained results were compared with existing systems; the proposed algorithms outperformed existing systems.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

Purpose: Industrial Control Systems become more vulnerable to digital attacks by merging communication groups and the Internet of Things, which could have severe implications. An Intrusion Detection System is essential in IoT businesses for identifying and stopping assaults. To ensure data privacy and security in the face of digital attacks, legislation and large enterprises should develop network security policies today. As people-based full frameworks have become more vital in today's society, they've also become targets for hostile activities, compelling both industry and research to concentrate more on dealing with local area disruption recognition issues. Contraption reviewing techniques have shown to be effective tools for resolving in-network interruption location issues. Design/Methodology/Approach: This investigation yielded a very unique strategy for tackling hub moderation utilizing a Classification and Encryption method. The UNSW-NB15 dataset is acquired and divided into Data for preparation and testing from the start. The information is pre-handled and included are eliminated right away within the preparation time frame. The TWM Algorithm is then used to determine the relevant highlights from that moment onward. The BRELU-RESNET classifier then sorts the input into went after and non-went after categories. The compromised information is then saved in the security log record, and the typical data is encrypted using the ESHP-ECC computation. The shortest path distance is then calculated using Euclidean distance. Finally, the data is available. Finally, using the DSHP-ECC computation, the information is decrypted. If the information is available in the log document during testing, it is regarded as the sought-after data and is prevented from the transmission. If it is not present, then the process of digital assault recognition begins. Findings/Result: The research is based on the UNSW-NB 15 dataset, which shows that the proposed method achieves an unreasonable awareness level of 98.34 percent, particularity level of 77.54 percent, exactness level of 96.6 percent, Precision level of 97.96 percent, review level of 98.34 percent, F-proportion of 98.15 percent, False Positive Rate of 22.46 percent, False Negative Rate of 1.66 percent, and Matthew's connection coefficient of 77.38 Originality/Value: This experimental-based research article examines the malicious activities in the cyberspace using BRELU-RESNET approach and mitigated by using BAIT based approach mechanism. Paper Type: Research Analysis.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation