Mitigate Cyber Attacks Research Articles

Data integrity cyber-attack mitigation using linear quadratic regulator based load frequency control in hybrid power system

Abstract Hybrid power systems are the contemporary solution to meet the stiff climate change targets and also hold future for implementing distributed generation and microgrids. These systems have renewable sources as their key elements which in turn have high level of intermittency due to weather conditions and other reasons. At the same time, these hybrid power systems are also vulnerable to cyber threats owing to the intense adoption of various IoT Technologies (Internet of Things). Load frequency control (LFC) is a formidable task for the system operators under such scenario and robust control strategies are required to achieve the load frequency within tolerable limits. In this work Linear quadratic controller (LQR) has been proposed to address the challenges of hybrid power systems. Two area interconnected power systems are considered in this work with each one having different configuration with respect to source of power generation. Solar, wind, geo-thermal, electric vehicle charging infrastructure and pumped storage power plant are integrated together with conventional thermal power plant for showcasing the LQR based controller under data integrity cyber-attack scenario. The frequency response of the hybrid power system is demonstrated through MATLAB simulations.

Trust-Based Detection and Mitigation of Cyber Attacks in Distributed Cooperative Control of Islanded AC Microgrids

In this study, we address the challenge of detecting and mitigating cyber attacks in the distributed cooperative control of islanded AC microgrids, with a particular focus on detecting False Data Injection Attacks (FDIAs), a significant threat to the Smart Grid (SG). The SG integrates traditional power systems with communication networks, creating a complex system with numerous vulnerable links, making it a prime target for cyber attacks. These attacks can lead to the disclosure of private data, control network failures, and even blackouts. Unlike machine learning-based approaches that require extensive datasets and mathematical models dependent on accurate system modeling, our method is free from such dependencies. To enhance the microgrid’s resilience against these threats, we propose a resilient control algorithm by introducing a novel trustworthiness parameter into the traditional cooperative control algorithm. Our method evaluates the trustworthiness of distributed energy resources (DERs) based on their voltage measurements and exchanged information, using Kullback-Leibler (KL) divergence to dynamically adjust control actions. We validated our approach through simulations on both the IEEE-34 bus feeder system with eight DERs and a larger microgrid with twenty-two DERs. The results demonstrated a detection accuracy of around 100%, with millisecond range mitigation time, ensuring rapid system recovery. Additionally, our method improved system stability by up to almost 100% under attack scenarios, showcasing its effectiveness in promptly detecting attacks and maintaining system resilience. These findings highlight the potential of our approach to enhance the security and stability of microgrid systems in the face of cyber threats.

Malware containment with immediate response in IoT networks: An optimal control approach

The exponential growth of Internet of Things (IoT) devices has triggered a substantial increase in cyber-attacks targeting these systems. Recent statistics show a surge of over 100 percent in such attacks, underscoring the urgent need for robust cybersecurity measures. When a cyber-attack breaches an IoT network, it initiates the dissemination of malware across the network. However, to counteract this threat, an immediate installation of a new patch becomes imperative. The time frame for developing and deploying the patch can vary significantly, contingent upon the specifics of the cyber-attack. This paper aims to address the challenge of pre-emptively mitigating cyber-attacks prior to the installation of a new patch. The main novelties of our work include: (1) A well-designed node-level model known as Susceptible, Infected High, Infected Low, Recover First, and Recover Complete (SIHILRFRC). It categorizes the infected node states into infected high and infected low, according to the categorization of infection states for IoT devices, to accelerate containment strategies for malware propagation and improve mitigation of cyber-attacks targeting IoT networks by incorporating immediate response within a restricted environment. (2) Development of an optimal immediate response strategy (IRS) by modeling and analyzing the associated optimal control problem. This model aims to enhance the containment of malware propagation across IoT networks by swiftly responding to cyber threats. Finally, several numerical analyses were performed to fully illustrate the main findings. In addition, a dataset has been constructed for experimental purposes to simulate real-world scenarios within IoT networks, particularly in smart home environments.

The Crucial Significance of Cyber Threat Intelligence in Mitigating Cyber Attacks

The Crucial Significance of Cyber Threat Intelligence in Mitigating Cyber Attacks

Mobile forensics tools and techniques for digital crime investigation: a comprehensive review

<p>Extracting and analyzing data from smartphones, IoT devices, and drones is crucial for conducting digital crime investigations. Effective cyberattack mitigation necessitates the use of advanced Android mobile forensics techniques. The investigation necessitates proficiency in manual, logical, hex dump, chip-off, and microread methodologies. This paper provides a comprehensive overview of Android mobile forensics tools and techniques for digital crime investigation, as well as their use in gathering and analyzing evidence. Forensic software tools like Cellebrite UFED, Oxygen Forensic Detective, XRY by MSAB, Magnet AXIOM, SPF Pro by SalvationDATA, MOBILedit Forensic Express, and EnCase Forensic employ both physical and logical techniques to retrieve data from mobile devices. These advanced tools offer a structured approach to tackling digital crimes effectively. We compare dependability, speed, compatibility, data recovery accuracy, and reporting. Mobile-network forensics ensures data acquisition, decryption, and analysis success. Conclusions show that Android mobile forensics tools for digital crime investigations are diverse and have different capabilities. Mobile forensics software offers complete solutions, but new data storage and encryption methods require constant development. The continuous evolution of forensic software tools and a comprehensive tool classification system could further enhance digital crime investigation capabilities.</p>

A data-driven multi-perspective approach to cybersecurity knowledge discovery through topic modelling

Cybersecurity is crucial for protecting the privacy of digital systems, maintaining economic stability, and ensuring national security. This study presents a comprehensive approach to cybersecurity knowledge discovery through topic modelling, using a multi-perspective analysis of academic and industry sources. The datasets include 15,751 articles from the Web of Science (WoS) database and 5,831 articles from Security Magazine, spanning from 2011 to 2023. We employed BERTopic for topic modelling, UMAP for dimensionality reduction, and HDBSCAN clustering algorithm for grouping and analysing distinct article clusters to uncover latent topics, enhancing the understanding of the evolving cybersecurity landscape. This study found 12 micro-clusters and three macro-clusters, namely technology, smart city and education, from the WoS database and 12 more micro-clusters and four macro-clusters, including organization, public security, governance, and education, from magazines. This study reveals key cybersecurity research and practice trends, such as the increasing focus on malware, ransomware, and cyber-attack mitigation. Additionally, temporal analysis indicates a significant rise in cybersecurity interest around 2020, followed by a diversification of topics. The results highlight the importance of integrating diverse data sources to capture a holistic view of cybersecurity developments. Future work will aim to refine the clustering algorithms to further improve topic extraction and analysis and expand the datasets to include more diverse sources and perspectives. This approach helps discover current cybersecurity trends and provides a foundation for more targeted and effective cybersecurity strategies.

A COMPREHENSIVE REVIEW OF ARTIFICIAL INTELLIGENCE APPLICATIONS IN ENHANCING CYBERSECURITY THREAT DETECTION AND RESPONSE MECHANISMS

This literature review explores the transformative impact of artificial intelligence (AI) on enhancing cybersecurity measures across various domains. The study systematically examines the integration of AI in Intrusion Detection Systems (IDS), malware detection, phishing detection, threat intelligence, network security, and endpoint protection. Key findings reveal that AI-driven techniques significantly outperform traditional methods, particularly in real-time threat detection, accuracy, and adaptive response capabilities. Network-based IDS benefit from supervised and unsupervised learning algorithms, improving the identification of malicious network traffic and novel attack patterns. In malware detection, AI-enhanced static and dynamic analysis methods surpass signature-based approaches by detecting previously unknown malware and complex behaviors. Phishing detection has seen substantial improvements with AI applications in email filtering and URL analysis, reducing phishing incidents despite challenges like false positives. AI's role in threat intelligence is critical, automating data analysis to uncover hidden threats and employing predictive analytics to anticipate and mitigate cyber attacks. AI techniques in network security and endpoint protection enhance real-time monitoring and authentication processes, providing robust defenses against cyber intrusions. Despite these advancements, challenges such as handling high data volumes and the need for continuous learning to adapt to emerging threats remain. This review underscores the significant advancements, practical implementations, and ongoing challenges of leveraging AI in cybersecurity, highlighting its potential to fortify digital defenses and address the complexities of contemporary cyber threats.

Early detection and mitigation of cyber attacks with machine learning and artificial intelligence

Early detection and mitigation of cyber attacks with machine learning and artificial intelligence

CICIoV2024: Advancing realistic IDS approaches against DoS and spoofing attack in IoV CAN bus

Considering the complexity of network traffic in IoV operations, methods that can identify complex patterns become useful. Machine learning fosters several techniques to enhance the detection, prevention, and mitigation of cyberattacks. However, important features are not addressed in the current state-of-the-art security datasets for IoV. For example, in the case of intra-vehicle communications, it is critical to consider the interaction among multiple Electronic Control Units (ECUs). Also, mimicking a realistic IoV environment is not simple since establishing a test environment requires considerable financial investment. Hence, there is a need for a testbed composed of several real ECUs in an IoV environment comprising network traffic. Thereupon, the main goal of this research is to propose a realistic benchmark dataset to foster the development of new cybersecurity solutions for IoV operations. To accomplish this, five attacks were executed against the fully intact inner structure of a 2019 Ford car, complete with all ECUs. However, the vehicle was immobile and incapable of causing any potential harm or injuries. Hence, all attacks were carried out on the vehicle without endangering the car’s driver or passengers. These attacks are classified as spoofing and Denial-of-Service (Dos) and were carried out through the Controller Area Network (CAN) protocol. This effort establishes a baseline complementary to existing contributions and supports researchers in proposing new IoV solutions to strengthen overall security using different techniques (e.g., Machine Learning — ML). The CICIoV2024 dataset has been published on CIC’s dataset page.

Ensemble Learning-Based Browser Extension for Mitigating Cyber Attacks Carried out using Malicious Short URLs

As digitization continues to expand and cybercrimes become more prevalent, making it is crucial to prioritize the implementation of robust security measures. Malicious short URLs are frequently utilized as a vector for cyber-attacks on online forums and social media platforms. To address this issue, a plugin-based solution that uses ensemble learning to combine random forest, k-neighbors classifier, and logistic regression into a stacked model, was developed. The model was trained over the combination of three most popular kaggle datasets, with over 1081195 URLs. Additionally, gradient boosting was applied to further enhance the model's performance, resulting in a 92% accuracy in the detection. We developed the browser extension with Flask and JavaScript that identifies URLs as malicious or safe, for facilitation of the proposed solution. The work emphasizes the need for effective measures to mitigate cyber-attack risks, particularly those involving malicious short URLs.

Implications of GDPR and NIS2 for Cyber Threat Intelligence Exchange in Hospitals

The DYNAMO Horizon Europe Project aims to support critical sector (healthcare, energy production, marine transport) stakeholders in enhancing resilience and minimizing the effects of cyber-attacks. DYNAMO's objective is to use artificial intelligence to integrate cyber threat intelligence (CTI) and business continuity management (BCM) to support decision-making. The goal is joint preparation for EU cyber threats, necessitating timely global situational awareness and effective communication to address threats before they escalate. This paper focuses on the intelligence sharing and trust needs of the DYNAMO use cases while also meeting regulatory requirements. Analyzing DYNAMO’s internal materials and aligning them with authorities' requirements, particularly NIS2 and GDPR, reveals that healthcare organizations need to prepare for more effective data protection, incident response, and cyber-attack mitigation. While NIS2 doesn't specify technical requirements for healthcare, it offers a broader framework for organizations to make informed decisions about equipment suppliers and security applications. After the general review, this study examines a specific healthcare use case: a hospital infected by phishing, emphasizing that CTI exchanges may contain sensitive data falling under GDPR and NIS2 regulations. This includes technical details, health-related information, patient data, insurance details, and employee information. Concerning the AI-based approaches used, DYNAMO must handle this CTI exchange in compliance with the law. The case study compares the DYNAMO project's CTI exchange use case with GDPR and NIS2 requirements, highlighting challenges such as the difficulty in separating sensitive data under GDPR and differences in language and terms between the two regulations. Despite these challenges, the study discusses the impact of GDPR and NIS2 on CTI exchange in the healthcare sector, providing key implementation points and guidelines.

Kalman Filters Based Distributed Cyber-Attack Mitigation Layers for DC Microgrids

Kalman Filters Based Distributed Cyber-Attack Mitigation Layers for DC Microgrids

Review of AI and machine learning applications to predict and Thwart cyber-attacks in real-time

The contemporary cybersecurity landscape demands innovative solutions to combat the relentless evolution of cyber threats. Traditional approaches are facing unprecedented challenges, compelling a paradigm shift towards the integration of Artificial Intelligence (AI) and Machine Learning (ML). This paper meticulously explores the potential of AI and ML to fortify real-time cybersecurity, with a focus on the swift prediction and mitigation of cyber-attacks. Against the backdrop of an escalating threat landscape, this paper propels the inquiry into advanced technologies to fortify cybersecurity. The limitations of traditional methodologies underscore the urgency of investigating the efficacy of AI and ML in reinforcing defense mechanisms. This paper endeavors to comprehensively investigate the role of AI and ML in real-time cybersecurity. It places a distinct emphasis on their potential to predict and thwart cyber-attacks promptly. The exploration encompasses diverse dimensions, ranging from the intricacies of model complexity to crucial considerations in security, ethics, and emerging trends. Structured around a robust framework, the exploration encompasses comprehensive research directions. These include the imperative to enhance explainability, address vulnerabilities to adversarial attacks, foster collaboration between humans and AI, and develop quantum-resistant cryptographic solutions. The paper navigates through the intricate technical, organizational, and ethical dimensions inherent in the implementation of AI and ML in real-time cybersecurity. The findings of this exploration illuminate both the promises and challenges associated with the integration of AI and ML in cybersecurity. Ethical considerations, vulnerabilities to adversarial attacks, and the exigency for quantum-resistant cryptography emerge as critical areas necessitating nuanced attention and exploration. This paper envisions a future where the fusion of human expertise with the capabilities of AI and ML results in the creation of resilient and adaptive cybersecurity ecosystems. The delineated research directions serve not only as a comprehensive roadmap for ongoing innovation but also as a foundational guide to effectively integrate AI and ML in safeguarding our digital realm against the ever-evolving landscape of cyber threats.

Hybrid wrapper feature selection method based on genetic algorithm and extreme learning machine for intrusion detection

Intrusion detection systems play a critical role in the mitigation of cyber-attacks on the Internet of Things (IoT) environment. Due to the integration of many devices within the IoT environment, a huge amount of data is generated. The generated data sets in most cases consist of irrelevant and redundant features that affect the performance of the existing intrusion detection systems (IDS). The selection of optimal features plays a critical role in the enhancement of intrusion detection systems. This study proposes a sequential feature selection approach using an optimized extreme learning machine (ELM) with an SVM (support vector machine) classifier. The main challenge of ELM is the selection of the input parameters, which affect its performance. In this study, the genetic algorithm (GA) is used to optimize the weights of ELM to boost its performance. After the optimization, the algorithm is applied as an estimator in the sequential forward selection (wrapper technique) to select key features. The final obtained feature subset is applied for classification using SVM. The IoT_ToN network and UNSWNB15 datasets were used to test the model's performance. The performance of the model was compared with other existing state-of-the-art classifiers such as k-nearest neighbors, gradient boosting, random forest, and decision tree. The model had the best quality of the selected feature subset. The results indicate that the proposed model had a better intrusion detection performance with 99%, and 86% accuracy for IoT_ToN network dataset and UNSWNB15 datasets, respectively. The model can be used as a promising tool for enhancing the classification performance of IDS datasets.

Deep learning with blockchain based cyber security threat intelligence and situational awareness system for intrusion alert prediction

Network security situation assessment (NSSA) is imperative and active defense technology in the network security situation. By examining NSSA data, one can examine the threat of network security and examine the network attack phase and hence fully grasp the complete network security situation. With the quick design of 5 G, the cloud model and Internet of things (IoT), the network platform is increasingly complicated and resulting in diversity of network threats which discover the accuracy. Thus, a new blockchain based cyber-security threat intelligence (CTI) and situational awareness system is devised for intrusion alert prediction. A blockchain-based CTI model is considered where data acquired are allowed to linear normalization. Here, the cyber situational awareness engine is used for alert segregation, which is implemented with entropy weighting power k means algorithm wherein weights generated during alert segregation are updated using Adaptive Transit Search (ATS). Then, the feature selection is implemented using hybrid Soergel and Lorentzian. The selected features are fed to Deep Maxout Network (DMN) for performing intrusion alert prediction. Finally, the cyber attack mitigation is carried out by blacklisting based on predicted result. The modified DMN outperformed with highest F-measure of 95.2%, precision of 96.9% and recall of 94.7%.

Benchmarking the benchmark — Comparing synthetic and real-world Network IDS datasets

Network Intrusion Detection Systems (NIDSs) are an increasingly important tool for the prevention and mitigation of cyber attacks. Over the past years, a lot of research efforts have aimed at leveraging the increasingly powerful models of Machine Learning (ML) for this purpose. A number of labelled synthetic datasets have been generated and made publicly available by researchers, and they have become the benchmarks via which new ML-based NIDS classifiers are being evaluated. Recently published results show excellent classification performance with these datasets, increasingly approaching 100 percent performance across key evaluation metrics such as Accuracy, F1 score, AUC, etc. Unfortunately, we have not yet seen these excellent academic research results translated into practical NIDS systems with such near-perfect performance. This motivated our research presented in this paper, where we analyse the statistical properties of the benign traffic in three of the more recent and relevant NIDS datasets, (CIC_IDS, UNSW_NB15, TON_IOT), by converting them into a common flow format. As a comparison, we consider two datasets obtained from real-world production networks, one from a university network and one from a medium size Internet Service Provider (ISP). Our results show that the two real-world datasets are quite similar among themselves in regards to most of the considered statistical features. Equally, the three synthetic datasets are also relatively similar within their group. However, and most importantly, our results show a distinct difference of most of the considered statistical features between the three synthetic datasets and the two real-world datasets. Since ML relies on the basic assumption of training and test datasets being sampled from the same distribution, this raises the question of how well the performance results of ML-classifiers trained on the considered synthetic datasets can translate and generalise to real-world networks. We believe this is an interesting and relevant question which provides motivation for further research in this space.

The Crucial Significance of Cyber Threat Intelligence in Mitigating Cyber Attacks

The Crucial Significance of Cyber Threat Intelligence in Mitigating Cyber Attacks

Securing Network Resilience Leveraging Node Centrality for Cyberattack Mitigation and Robustness Enhancement

Securing Network Resilience Leveraging Node Centrality for Cyberattack Mitigation and Robustness Enhancement

A Kalman Filter-Based Distributed Cyber-Attack Mitigation Strategy for Distributed Generator Units in Meshed DC Microgrids

To ensure fast dynamics and the stability of multiple distributed generator units (DGUs) in DC microgrids, communication links among the controllers of DGUs are generally adopted. However, those communication channels are vulnerable to cyber-attacks. To alleviate this hassle, a Kalman Filter (KF)-based distributed cyber-attack mitigation strategy, which is highly involved in both primary and secondary control, is proposed in this paper. The KF, as a robust state estimator, is utilized to accurately estimate the authentic terminal voltages and currents of the DGUs. Based on the discrepancies between the estimated and measured parameters of the systems under cyber-attacks, the proposed control can adaptively compensate the attack signals via an adaptive proportional integral (API) controller and a fractional API (FAPI) controller in cyber-attack-mitigation layers. The main advantage of using the proposed control scheme compared to conventional schemes is the fast dynamic response. The simulation results verify this merit by comparing the adopted KF and comparing it with conventional artificial neural networks (ANN), while the experimental results validate that effectiveness of the proposed control and showcase the superiority of the FAPI control in terms of its perfect compensation for different types of cyber-attacks.

A Review of AI-Based Cyber-Attack Detection and Mitigation in Microgrids

In this paper, the application and future vision of Artificial Intelligence (AI)-based techniques in microgrids are presented from a cyber-security perspective of physical devices and communication networks. The vulnerabilities of microgrids are investigated under a variety of cyber-attacks targeting sensor measurements, control signals, and information sharing. With the inclusion of communication networks and smart metering devices, the attack surface has increased in microgrids, making them vulnerable to various cyber-attacks. The negative impact of such attacks may render the microgrids out-of-service, and the attacks may propagate throughout the network due to the absence of efficient mitigation approaches. AI-based techniques are being employed to tackle such data-driven cyber-attacks due to their exceptional pattern recognition and learning capabilities. AI-based methods for cyber-attack detection and mitigation that address the cyber-attacks in microgrids are summarized. A case study is presented showing the performance of AI-based cyber-attack mitigation in a distributed cooperative control-based AC microgrid. Finally, future potential research directions are provided that include the application of transfer learning and explainable AI techniques to increase the trust of AI-based models in the microgrid domain.