Cyber Attack Detection Research Articles

Artificial Intelligence Predictions in Cyber Security: Analysis and Early Detection of Cyber Attacks

Artificial Intelligence Predictions in Cyber Security: Analysis and Early Detection of Cyber Attacks

CICIoV2024: Advancing realistic IDS approaches against DoS and spoofing attack in IoV CAN bus

Considering the complexity of network traffic in IoV operations, methods that can identify complex patterns become useful. Machine learning fosters several techniques to enhance the detection, prevention, and mitigation of cyberattacks. However, important features are not addressed in the current state-of-the-art security datasets for IoV. For example, in the case of intra-vehicle communications, it is critical to consider the interaction among multiple Electronic Control Units (ECUs). Also, mimicking a realistic IoV environment is not simple since establishing a test environment requires considerable financial investment. Hence, there is a need for a testbed composed of several real ECUs in an IoV environment comprising network traffic. Thereupon, the main goal of this research is to propose a realistic benchmark dataset to foster the development of new cybersecurity solutions for IoV operations. To accomplish this, five attacks were executed against the fully intact inner structure of a 2019 Ford car, complete with all ECUs. However, the vehicle was immobile and incapable of causing any potential harm or injuries. Hence, all attacks were carried out on the vehicle without endangering the car’s driver or passengers. These attacks are classified as spoofing and Denial-of-Service (Dos) and were carried out through the Controller Area Network (CAN) protocol. This effort establishes a baseline complementary to existing contributions and supports researchers in proposing new IoV solutions to strengthen overall security using different techniques (e.g., Machine Learning — ML). The CICIoV2024 dataset has been published on CIC’s dataset page.

Wavy-attention network for real-time cyber-attack detection in a small modular pressurized water reactor digital control system

Global interest in advanced reactors has been reignited by recent investments in small modular reactors and micro-reactor design. The use of digital devices is essential for meeting the size and modularity requirements of small modular reactor controls. By fully digitizing the small modular reactor control systems, critical information can be obtained to optimize control, reduce costs, and extend the reactor’s lifetime. However, the potential for cyber-attacks on digital devices leaves digital control systems vulnerable. To address this risk, this study presents a novel wavy-attention network for sensor attack detection in nuclear plants. The wavy-attention network comprises stacks of batch-normalized, dilated, one-dimensional convolution neural networks, and sequential self-attention modules, superior to conventional single-layer networks on sequence classification tasks. To evaluate the proposed wavy-attention network architecture, the International Atomic Energy Agency’s Asherah Nuclear Simulator and a false data injection toolbox found in the literature, both implemented in MATLAB/SIMULINK, are utilized. This approach leverages changes in process measurements to identify and classify cyber-attacks on priority signals using the proposed wavy-attention network. Three false data injection attacks are simulated on the simulator’s pressure, temperature, and level sensors to obtain representative process measurements. The wavy-attention network is trained and validated with normal and compromised process variables obtained from the simulator. The performance of the wavy-attention network to discriminate between the reactor states using the test set shows 99% accuracy, as opposed to other baseline models such as vanilla convolution neural networks, long short-term memory networks, and bi-directional long short-term memory networks with 90%, 77%, and 91% accuracy, respectively. An ablation study is also conducted to test the contribution of each component of the proposed architecture. The theoretical framework of the proposed wavy-attention network and its implementation for nuclear reactor digital sensor attack detection are discussed in this paper.

Defend Predict: Forecasting Innovations in Cyber Attack Detection

Defend Predict: Forecasting Innovations in Cyber Attack Detection

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

In the dynamic landscape of cyberspace, organizations face a myriad of coordinated advanced threats that challenge the traditional defense paradigm. Cyber Threat Intelligence (CTI) plays a crucial role, providing in-depth insights into adversary groups and enhancing the detection and neutralization of complex cyber attacks. However, attributing attacks poses significant challenges due to over-reliance on malware samples or network detection data alone, which falls short of comprehensively profiling attackers. This paper proposes an IPv4-based threat attribution model, IPAttributor, that improves attack characterization by merging a real-world network behavior dataset comprising 39,707 intrusion entries with commercial threat intelligence from three distinct sources, offering a more nuanced context. A total of 30 features were utilized from the enriched dataset for each IP to create a feature matrix to assess the similarities and linkage of associated IPs, and a dynamic weighted threat segmentation algorithm was employed to discern attacker communities. The experiments affirm the efficacy of our method in pinpointing attackers sharing a common origin, achieving the highest accuracy of 88.89%. Our study advances the relatively underexplored line of work of cyber attacker attribution, with a specific interest in IP-based attribution strategies, thereby enhancing the overall understanding of the attacker’s group regarding their capabilities and intentions.

CYBER SECURITY ATTACK DETECTION MODEL USING SEMI-SUPERVISED LEARNING

The increasing digitalization of our society has brought about numerous benefits, enabling seamless communication, convenient transactions, and efficient operations. However, with this growing reliance on interconnected systems and information technology, the risk of cyber-attacks has also surged. Cyber threats, such as data breaches, ransomware, and sophisticated malware, have become more prevalent, threatening the confidentiality, integrity, and availability of critical data and services. Organizations across industries face the daunting challenge of defending against a wide array of cyber-attacks that continue to evolve in complexity and stealth. In response to this ever-changing cyber threat landscape, Cyber Security Risk Management (CSRM) and attack detection have become critical components of any comprehensive cybersecurity strategy. The ability to identify and mitigate cyber risks and swiftly detect malicious activities is paramount for safeguarding sensitive information, preserving business continuity, and maintaining the trust of customers and stakeholders. A novel approach to Cyber Security Risk Management through an Attack Detection Model that utilizes Semi-Supervised Learning Auto-Encoders in conjunction with Probabilistic Bayesian Networks. The study compares the performance of Multi Connect Variational Auto-Encoder (MC-VAE), Probabilistic Bayesian Networks (PBN), and a combined model of MC-VAE and PBN. The study employs the NUSW-NB15_GT dataset for training and evaluation purposes. Notably, the Semi-Supervised Learning with Probabilistic Bayesian Networks (SSL-PBN) model demonstrates exceptional results, achieving a precision rate of 94% and a recall rate of 90%. The F1 score of 0.9191 highlights the SSL-PBN model's efficacy in achieving a balanced trade-off between precision and recall, critical for minimizing false positives and false negatives...

Cyberattack Analysis, Detection and Prevention using Machine Learning

Abstract: In today's linked world, with the increase of cyberattacks, it is critical to have strong detection and prevention systems. This study presents an advanced approach utilizing both machine learning and deep learning algorithms for cyberattack detection and prevention. The UNSW-NB15 dataset, renowned for its comprehensive representation of diverse cyber threats, serves as the foundation for experimentation and evaluation. Several algorithms such as Random Forest, Naïve Bayes, boosting algorithms, Artificial neural networks, Support vector machine are employed where the comparative analysis focuses on evaluating the efficiency of each algorithm in terms of recall, precision, and accuracy metrics. This study enhances the development of cybersecurity defense tactics by offering valuable perspectives on the efficacy of different machine learning methods in predicting cyberattacks. Experimental findings indicate that the boosting algorithm strategy is capable of identifying and preventing cyber threats with an accuracy rate of 94%.

Predictive Analytics-Enabled Cyber Attack Detection

Cyber-attacks are becoming increasingly sophisticated and difficult to detect using traditional security measures. To address this challenge, we propose a predictive analytics- enabled cyber-attack detection system that utilizes machine learning algorithms to analyze network traffic and identify potential security threats in real time. Our system uses a combination of supervised and unsupervised learning techniques to identify patterns and anomalies in network data, and to generate anomaly and normal alert. The system is trained using historical data from known cyber-attacks and anomalies and we visualize the accuracy of various algorithms.

Computer-aided urban energy systems cyber attach detection and mitigation: Intelligence hybrid machine learning technique for security enhancement of smart cities

This paper introduces a sophisticated computer-aided system for enhancing the security of smart cities through urban cyber attack detection and mitigation. The proposed system employs a comprehensive mathematical framework that models the dynamics of cyber attacks, detection, and mitigation, capturing the intricate relationships within a smart city environment. Leveraging a hybrid approach combining Transfer Learning and Meta-Learning, the system adapts to evolving threats and tasks, showcasing superior performance in comparison to standalone methods. Simulation results demonstrate the system’s robustness, with low False Positive and False Negative Rates, high System Security, and effective Mitigation Strategies. This research contributes a state-of-the-art solution for securing smart cities, leveraging intelligent hybrid machine learning techniques.

Cyber security attack recognition on cloud computing networks based on graph convolutional neural network and graphsage models

In this paper, the modeling of the network attacks of cloud computing through Graph Neural Networks is considered. Based on structural features and relationships between neighboring nodes and the edges of the cloud ecosystem a cyberattack detection method is proposed. A simulation dataset is created on the CSE-CIC-IDS2018 dataset to train and test the proposed graph neural network based models. In a comparative analysis of the suggested method with the existing one superior results are obtained from the model constructed on the GraphSAGE algorithm. Thus in the recognition of dataset samples, the model obtained a value of 0.97739 according to the accuracy metric. The values obtained by the algorithm on precision, recall, and F1-score metrics were also higher compared to the Graph Convolutional Neural Network model.

An unsupervised adversarial autoencoder for cyber attack detection in power distribution grids

Detection of cyber attacks in smart power distribution grids with unbalanced configurations poses challenges due to the inherent nonlinear nature of these uncertain and stochastic systems. It originates from the intermittent characteristics of the distributed energy resources (DERs) generation and load variations. Moreover, the unknown behavior of cyber attacks, especially false data injection attacks (FDIAs) in the distribution grids with complex temporal correlations and the limited amount of labeled data increases the vulnerability of the grids and imposes a high risk in the secure and reliable operation of the grids. To address these challenges, this paper proposes an unsupervised adversarial autoencoder (AAE) model to detect FDIAs in unbalanced power distribution grids integrated with DERs, i.e., PV systems and wind generation. The proposed method utilizes long short-term memory (LSTM) in the structure of the autoencoder to capture the temporal dependencies in the time-series measurements and leverages the power of generative adversarial networks (GANs) for better reconstruction of the input data. The advantage of the proposed data-driven model is that it can detect anomalous points for the system operation without reliance on abstract models or mathematical representations and data labels. To evaluate the efficacy of the approach, it is tested on IEEE 13-bus and 123-bus systems with historical meteorological data (wind speed, ambient temperature, and solar irradiance) as well as historical real-world load data under three types of data falsification functions. The comparison of the detection results of the proposed model with other data-driven methods verifies its superior performance in detecting cyber attacks in unbalanced power distribution grids.

Proactive Analysis and Detection of Cyber-attacks using Deep Learning Techniques

Objectives: This study objective is to create a proactive forensic framework with a classification model to identify the malicious content to avoid cyber-attacks. Methods: In this proposed work, a novel framework is introduced to analyze and detect network attacks before it happens. It monitors the network packet flow, captures the packets, analyzes the packet flow proactively, and detects cyber-attacks using different machine learning algorithms and Deep Convolution Neural network (CNN) technique. The KDD dataset is used in this experiment with 30% for testing and 80% for training. Findings: The simulation results show that the detection percentage of the proposed framework reaches a maximum of 95.92% in different scenarios. It is approximately 10% higher than the existing proactive frameworks for example Gawand’s model, Ahmetoglu’s model and many more. Novelty and applications: The proposed framework is a proactive model which detects the cyber-attack in prior to avoid cyber-attacks. The deep CNN model highly efficient for detecting cyber-attack. Keywords: Proactive Forensic Framework, Deep CNN, Classification Algorithms, Cyber attack detection, Intrusion Detection System

Black-box adversarial transferability: An empirical study in cybersecurity perspective

The rapid advancement of artificial intelligence within the realm of cybersecurity raises significant security concerns. The vulnerability of deep learning models in adversarial attacks is one of the major issues. In adversarial machine learning, malicious users try to fool the deep learning model by inserting adversarial perturbation inputs into the model during its training or testing phase. Subsequently, it reduces the model confidence score and results in incorrect classifications. The novel key contribution of the research is to empirically test the black-box adversarial transferability phenomena in cyber attack detection systems. It indicates that the adversarial perturbation input generated through the surrogate model has a similar impact on the target model in producing the incorrect classification. To empirically validate this phenomenon, surrogate and target models are used. The adversarial perturbation inputs are generated based on the surrogate-model for which the hacker has complete information. Based on these adversarial perturbation inputs, both surrogate and target models are evaluated during the inference phase. We have done extensive experimentation over the CICDDoS-2019 dataset, and the results are classified in terms of various performance metrics like accuracy, precision, recall and f1-score. The findings indicate that any deep learning model is highly susceptible to adversarial attacks, even if the attacker does not have access to the internal details of the target model. The results also indicate that white-box adversarial attacks have a severe impact compared to black-box adversarial attacks. There is a need to investigate and explore adversarial defence techniques to increase the robustness of the deep learning models against adversarial attacks.

A detailed study of resampling algorithms for cyberattack classification in engineering applications.

The evolution of engineering applications is highly relevant in the context of protecting industrial systems. As industries are increasingly interconnected, the need for robust cybersecurity measures becomes paramount. Engineering informatics not only provides tools for knowledge representation and extraction but also affords a comprehensive spectrum of developing sophisticated cybersecurity solutions. However, safeguarding industrial systems poses a unique challenge due to the inherent heterogeneity of data within these environments. Together with this problem, it's crucial to acknowledge that datasets that simulate real cyberattacks within these diverse environments exhibit a high imbalance, often skewed towards certain types of traffics. This study proposes a system for addressing class imbalance in cybersecurity. To do this, three oversampling (SMOTE, Borderline1-SMOTE, and ADASYN) and five undersampling (random undersampling, cluster centroids, NearMiss, repeated edited nearest neighbor, and Tomek Links) methods are tested. Particularly, these balancing algorithms are used to generate one-vs-rest binary models and to develop a two-stage classification system. By doing so, this study aims to enhance the efficacy of cybersecurity measures ensuring a more comprehensive understanding and defense against the diverse range of threats encountered in industrial environments. Experimental results demonstrates the effectiveness of proposed system for cyberattack detection and classification among nine widely known cyberattacks.

Detection of Cyber Attacks and Network Attacks using Machine Learning Algorithms

With the escalating sophistication of cyber threats and the increasing complexity of network infrastructures, traditional rule-based intrusion detection systems (IDS) are proving inadequate in safeguarding against modern cyber attacks. Consequently, the integration of machine learning (ML) algorithms has emerged as a promising approach to fortify network security by enabling proactive detection and mitigation of cyber threats. This review paper comprehensively explores the application of ML algorithms in detecting various forms of cyber-attacks and network intrusions. The review begins by outlining the fundamental concepts of cyber attacks and network intrusions, providing context for the subsequent discussion on ML-based detection methodologies. It surveys the landscape of ML algorithms employed in cybersecurity, ranging from classical techniques like Support Vector Machines (SVM) and Random Forests to more advanced methods such as deep learning and ensemble models. Furthermore, the paper explains the diverse datasets utilized for training and evaluating ML-based intrusion detection systems, highlighting their significance in ensuring robust and generalizable models. Additionally, it examines the challenges and limitations associated with ML-driven detection, including issues of data scarcity, adversarial attacks, and model interpretability

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

The cyber-physical system (CPS) plays a crucial role in supporting critical infrastructure like water treatment facilities, gas stations, air conditioning components, and smart grids, which are essential to society. However, these systems are facing a growing susceptibility to a wide range of emerging attacks. Cyber-attacks against CPS have the potential to cause disruptions in the accurate sensing and actuation processes, resulting in significant harm to physical entities and posing concerns for the overall safety of society. Unlike common security measures like firewalls and encryption, which often aren't enough to deal with the unique problems that CPS architectures present, deploying machine learning-based intrusion detection systems (IDS) that are specifically made for CPS has become an important way to make them safer. The application of machine learning algorithms has been suggested as a means of mitigating cyber-attacks on CPS. However, the limited availability of labelled data pertaining to emerging attack techniques poses a significant challenge to the accurate detection of such attacks. In the given scenario, transfer learning emerges as a promising methodology for the detection of cyber-attacks, as it involves the implicit modelling of the system. In this research, we propose a new lightweight transfer learning method via ResNet50-CNN1D for intrusion detection in CPS. The Adaptive Gradient (Adagrad) optimizer was applied in the proposed model to minimize the loss function through the adjustment of network weight. We tested how well the suggested ResNet50-1D-CNN model worked using the UNSW-NB15 dataset and a control system dataset called HAI. The HAI dataset was taken from the testbed and based on a planned physical attack scenario. By calculating the coefficient scores for the top ten (10) features in the HAI and UNSW-NB15 data, it was possible to determine the relevance of a feature. The rationale behind employing transfer learning was to mitigate the complexity associated with the classification of cyber-attacks and runtime. The utilization of transfer learning resulted in notable reductions in both the training and testing times required for the detection of attacks. On the HAI data, the results showed an accuracy of 97.32 %, recall of 98.41 %, F1-score of 96.32 %, and precision of 97.09 %. On the UNSW-NB15 data, the results showed an accuracy of 99.89 %, recall of 99.09 %, F1-score of 98.01 %, and precision of 98.70 %.

Digital Twin-Based Cyber-Attack Detection Framework for Cyber-Physical Manufacturing Systems

Smart manufacturing (SM) systems utilize run-time data to improve productivity via intelligent decision-making and analysis mechanisms on both machine and system levels. The increased adoption of cyber-physical systems in SM leads to the comprehensive framework of cyber-physical manufacturing systems (CPMS) where data-enabled decision-making mechanisms are coupled with cyber-physical resources on the plant floor. Due to their cyber-physical nature, CPMS are susceptible to cyber-attacks that may cause harm to the manufacturing system, products, or even the human workers involved in this context. Therefore, detecting cyber-attacks efficiently and timely is a crucial step toward implementing and securing high-performance CPMS in practice. This paper addresses two key challenges to CPMS cyber-attack detection. The first challenge is distinguishing expected anomalies in the system from cyber-attacks. The second challenge is the identification of cyber-attacks during the transient response of CPMS due to closed-loop controllers. Digital twin (DT) technology emerges as a promising solution for providing additional insights into the physical process (twin) by leveraging run-time data, models, and analytics. In this work, we propose a DT framework for detecting cyber-attacks in CPMS during controlled transient behavior as well as expected anomalies of the physical process. We present a DT framework and provide details on structuring the architecture to support cyber-attack detection. Additionally, we present an experimental case study on off-the-shelf 3D printers to detect cyber-attacks utilizing the proposed DT framework to illustrate the effectiveness of our proposed approach. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —This work is motivated by developing a general-purpose and extensible digital twin-enabled cyber-attack detection framework for manufacturing systems. Existing works in the field consider specialized attack scenarios and models that may not be extensible in practical manufacturing scenarios. We utilize digital twin (DT) technology as a key enabler to develop a systematic and extensible framework where we identify the abnormality of a resource and detect if the abnormality is due to an attack or an expected anomaly. We provide several remarks on how our proposed framework can extend existing industrial control systems (ICS) and can accommodate further extensions. The presented DTs utilize data-driven machine learning models, physics-based models, and subject matter expert knowledge to perform detection and differentiation tasks in the context of expected anomalies and model-based controllers that control the manufacturing process between multiple setpoints. We utilize a model predictive controller on an off-the-shelf 3D printer to run the process, and stage anomalies and cyber-attacks that are successfully detected by the proposed framework.

Machine learning based Cyber Attack detection on Internet Traffic

Cyber attacks on the internet have become increasingly sophisticated and frequent, posing significant challenges to cybersecurity. Traditional rule-based methods for detecting these attacks often struggle to keep pace with the evolving tactics of malicious actors. In this context, machine learning (ML) techniques have emerged as a promising approach for cyber attack detection due to their ability to analyze large volumes of data and identify patterns indicative of malicious behavior. The proposed framework for utilizing machine learning in cyber attack detection on the internet. The framework integrates various ML algorithms, including supervised, unsupervised, and reinforcement learning techniques, to enhance the detection capabilities against different types of cyber threats. Moreover, the framework incorporates feature engineering and selection methods to optimize the performance of ML models in identifying malicious activities.

Detecting Cyber-attacks in the Industrial Internet of Things using a Hybrid Deep Random Neural Network

Critical infrastructure now faces greater vulnerabilities and a higher risk of cyberattacks as a result of the (IIoT) quick expansion. The security and dependability of industrial systems must be ensured by identifying and thwarting these threats. In this paper, we use a hybrid approach of deep learning and RNN called hybrid deep random neural network (HDRNN) to offer a novel method of identifying cyber-attacks in the IIoT.The proposed HDRNN model combines the benefits of random neural networks with deep learning to improve the detection of IIoT cyberattacks. The deep learning component makes use of deep neural networks' capacity to extract intricate features from unstructured data, while the random neural network component offers robustness and adaptability to manage changing attack patterns.Realistic threats and benchmark datasets such as UNSW-NB15and DS2OS are used in experimental evaluations. High accuracy, precision, and recall rates are attained by the model, which successfully detects a variety of assaults including infiltration, data manipulation, and denial of service.The suggested HDRNN model offers a promising approach for improving the security of IIoT systems by precisely identifying cyber-attacks in real-time. The model's hybrid nature enables enhanced detection capabilities, adaptability to changing attack patterns, and a reduction in false positives, enabling efficient threat mitigation and protecting crucial infrastructure in the IIoT context.

A Packet Scripting Model for Real-Time Detection of Cyber Attacks

A Packet Scripting Model for Real-Time Detection of Cyber Attacks