Cyber Intrusions Research Articles

Resiliency Metrics for Monitoring and Analysis of Cyber-Power Distribution System With IoTs

The electric grid operation is constantly threatened with natural disasters and cyber intrusions. The introduction of Internet of Things (IoTs) based distributed energy resources (DERs) in the distribution system provides opportunities for flexible services to enable efficient, reliable and resilient operation. At the same time, IoT based DERs comes with cyber vulnerabilities and requires cyber-power resiliency analysis of the IoT-integrated distribution system. This work focuses on developing metrics for monitoring resiliency of cyber-power distribution system, while maintaining consumers’ privacy. Here, resiliency refers to the system’s ability to keep providing energy to the critical load even with adverse events. In the developed cyber-power Distribution System Resiliency (DSR) metric, the IoT Trustability Score (ITS) considers the effects of IoTs using a neural network with federated learning. ITS and other factors impacting resiliency are integrated into a single metric using Fuzzy Multiple-Criteria Decision Making (F-MCDM) to compute Primary level Node Resiliency (PNR). Finally, DSR is computed by aggregating PNR of all primary nodes and attributes of distribution level network topology and vulnerabilities utilizing game-theoretic Data Envelopment Analysis (DEA) based optimization. The developed metrics will be valuable for i) monitoring the distribution system resiliency considering a holistic cyber-power model; ii) enabling data privacy by not utilizing the raw user data; and iii) enabling better decision-making to select the best possible mitigation strategies towards resilient distribution system. The developed ITS, PNR, and DSR metrics have been validated using multiple case studies for the IoTs-integrated IEEE 123 node distribution system with satisfactory results.

The review and oversight of transnational investigative cyber intrusion: an international convention?

The review and oversight of transnational investigative cyber intrusion: an international convention?

A novel cyber intrusion detection model based on improved hybrid sampling

The class imbalance of samples of network traffic will cause the poor classification performance of intrusion detection models based on machine learning. To solve this problem, this paper researches sampling algorithm and deep learning for intrusion detection in imbalanced network traffic. This paper proposes a deep recurrent neural network (delayed long short-term memory (DLSTM)) intrusion detection model based on the balanced samples. First, an improved hybrid sampling (IHS) method based on chaotic particle swarm optimization (CPSO) algorithm is proposed as the sampling algorithm to balance the imbalanced samples. Next, a DLSTM with long short-term memory (LSTM) function is proposed to realize high-precision classification of intrusion behaviours. Finally, the method is validated on the standard network traffic dataset. The experimental results show that the DLSTM intrusion detection model based on the IHS method outperforms other comparative models at accuracy. The model is available to the computer network information security defence system.

Fog-cloud based intrusion detection system using Recurrent Neural Networks and feature selection for IoT networks

Deep learning (DL) techniques are being widely researched for their effectiveness in detecting cyber intrusions against the Internet of Things (IoT). Time sensitive Critical Infrastructures (CIs) that rely on IoT require rapid detection of cyber intrusions close to the constrained devices in order to prevent service delays. Deep learning techniques perform better in detecting attacks compared to shallow machine learning algorithms and can be used for intrusion detection. However, communication overheads due to large volume of IoT data and computation requirements for deep learning models prevents effective application of deep learning models closer to the constrained devices. Existing IDS techniques are either based on shallow learning algorithms or not trained on relevant IoT datasets and furthermore not designed for distributed fog-cloud deployment. To counter these issues, we propose a novel fog-cloud based IoT intrusion detection framework which incorporates a distributed processing by splitting the dataset according to attack class and a feature selection step on time-series IoT data. This is followed by a deep learning Recurrent Neural Network (SimpleRNN and Bi-directional Long Short-Term Memory (LSTM)) for attack detection. The effectiveness of the proposed approach was evaluated using the high-dimensional BoT-IoT dataset which contains large volumes of realistic IoT attack traffic. Results show that feature selection methods significantly reduced the dataset size by 90% under the computation requirements without compromising on the attack detection ability. The models built on reduced dataset achieved higher recall rate compared to models trained on full feature set without loosing class differentiation ability. The SimpleRNN and Bi-LSTM models also did not suffer any underfitting or overfitting with the reduced feature space. The proposed deep learning based IoT intrusion detection framework is suitable for fog-cloud based deployment and can scale well even with large volumes of IoT data.

Forecasting Intrusion in Critical Power Systems Infrastructure Using Advanced Autoregressive Moving Average (AARMA) Based Intrusion Detection for Efficacious Alert System

Cyber intrusions into critical infrastructure inflict economic and physical damage. Extensive research is needed to identify and mitigate intrusions in power grid infrastructure. The modern solution is to use a data science time-series approach to identify the intrusion based on the electric grid data collected from the sensors. This paper addresses the new vision of the data science time-series modelling approach to integrate it with the existing power system security system. In this paper, the Advanced Autoregressive Moving Average (AARMA) model is designed to detect the possible intrusion of the given data set. An attack forecast is a model to predict possible cyber intrusions using real-time data input from sensors. By investigating the statistical properties of the sensors’ data set, intrusion detection is possible with a high accuracy of about 90%. Using AARMA, the operators have the benefit of an effective alert system to adjust their configuration and other resource allocation to tackle intrusions with low impact. MATLAB software is used to monitor the IEEE 9-bus and IEEE 33-bus test system against possible cyber-attacks using the proposed AARMA model.

A hybrid CNN+LSTM-based intrusion detection system for industrial IoT networks

The Internet of Things (IoT) ecosystem has proliferated based on the use of the internet and cloud-based technologies in the industrial area. IoT technology used in the industry has become a large-scale network based on the increasing amount of data and number of devices. Industrial IoT (IIoT) networks are intrinsically unprotected against cyber threats and intrusions. It is, therefore, significant to develop Intrusion Detection Systems (IDS) in order to ensure the security of the IIoT networks. Three different models were proposed to detect intrusions in the IIoT network by using deep learning architectures of Convolutional Neural Network (CNN), Long Short Term Memory (LSTM), and CNN + LSTM generated from a hybrid combination of these. In the study conducted by using the UNSW-NB15 and X-IIoTID datasets, normal and abnormal data were determined and compared with other studies in the literature following a binary and multi-class classification. The hybrid CNN + LSTM model attained the highest accuracy value for intrusion detection in both datasets among the proposed models. The proposed CNN + LSTM architecture attained an accuracy of 93.21% for binary classification and 92.9% for multi-class classification in the UNSW-NB15 dataset while the same model attained a detection accuracy of 99.84% for binary classification and 99.80% for multi-class classification in the X-IIoTID dataset. In addition, the accurate detection success of the implemented models regarding the types of attacks within the datasets was evaluated.

Access Control Application Prevention and Mitigation of Cyber Attacks

In the rapidly evolving landscape of cyber threats, safeguarding digital assets has become paramount for organizations worldwide. This paper presents a comprehensive analysis of access control applications as a frontline defense against cyber intrusions. We delve into the mechanics of contemporary access control systems, highlighting their role in preventing unauthorized access and ensuring data integrity. Drawing on real-world case studies, we demonstrate the efficacy of robust access control measures in thwarting cyber-attacks and mitigating their potential impacts. Further, we explore the challenges faced in implementing these systems, such as ensuring scalability, managing user privileges, and maintaining system resilience. Our findings underscore the indispensable nature of access control applications in today’s digital age. By offering actionable insights and best practices, this paper aims to guide organizations in fortifying their digital infrastructures against the ever-present threat of cyberattacks. To ensure the security of data, it’s essential to update automation processes periodically. This not only safeguards the transfer of information, ensuring its authenticity and confidentiality, but also prevents tampering or misinformation. Incorporating access control into the security strategy can address this concern. Access control restricts data access to designated individuals within the organization. However, there’s an inherent risk: permissions could inadvertently be granted to unintended parties. To mitigate this, we recommend several solutions, with multifactor authentication being a prominent option for future implementation.

Implementation of Risk-Aggregated Substation Testbed Using Generative Adversarial Networks

Capturing the anomalies of a cyber system in power control networks would promote operational awareness. Correlation of such events, e.g., intrusion attempts, traffic flow, and other signatures, together with control alarm events gives operators an in-depth understanding in order to make an informed decision. This paper proposes a threat inference framework to promote real-time vulnerability assessment associated with cyber intrusions on power communication networks. Wasserstein Generative Adversarial Networks (WGAN) is proposed to estimate the performance of the adversarial model. Additionally, a machine-learning framework is introduced to model the filtering process of the security devices, i.e., firewalls, isolation, and encryption devices, and the posterior fitting method is incorporated to establish an accurate probabilistic formulation. Finally, a testbed is established to coordinate system evaluation. Verification of the intrusion model is part of the implementation to quantify system risks based on the anomalies using (1) the open-source emulator, and (2) an externally imported system analyzer to characterize resulting impacts. The effectiveness and feasibility of the generative models are verified in a comparison study where the proper parameter settings could be obtained. The proposed framework is justified with extensive studies of substation networks using real-world settings.

Deep Learning-Based Intrusion Detection System for Internet of Vehicles

The growth of the Internet of Things (IoT) has resulted in several revolutionary applications, such as smart cities, cyber-physical systems, and the Internet of vehicles (IoV). Within the IoV infrastructure, vehicles are comprised of various electronic intelligent sensors or devices used to obtain data and communicate the necessary information with their surroundings. One of the major concerns about the implementation of these sensors or devices is data vulnerability; thus, it is necessary to present a solution that provides security, trust, and privacy to communicating entities and to secure vehicle data from malicious entities. In modern vehicles, the controller area network (CAN) is a fundamental scheme for controlling the interaction among different in-vehicle network sensors. However, not enough security features are present that support data encryption, authorization, and authentication mechanisms to secure the network from cyber or malicious intrusions such as denial of service and fuzzy attacks. An intrusion detection system is presented in this work based on the deep learning architecture to protect the CAN bus in vehicles. The VGG architecture is used and trained for different network intrusion patterns in order to detect malicious attacks. The experiments are performed using the CAN-intrusion-dataset. The experimental findings demonstrate that the presented deep learning system significantly reduces the false positive rate (FPR) compared to the conventional machine learning techniques. The overall accuracy of the system is 96% with FPR of 0.6%.

Federated Blockchain Model for Cyber Intrusion Analysis in Smart Grid Networks

Smart internet of things (IoT) devices are used to manage domestic and industrial energy needs using sustainable and renewable energy sources. Due to cyber infiltration and a lack of transparency, the traditional transaction process is inefficient, unsafe and expensive. Smart grid systems are now efficient, safe and transparent owing to the development of blockchain (BC) technology and its smart contract (SC) solution. In this study, federated learning extreme gradient boosting (FL-XGB) framework has been developed along with BC to learn the intrusion inside the smart energy system. FL is best suited for a decentralized BC-enabled system to adapt learning models for trustworthy and reliable transactions. Many features and attributes of the Third International Knowledge Discovery and Data mining Tools Competition (KDD Cup 1999) dataset have been used in this study to perform experimental analysis. The likelihood of intrusions in the network is mathematically stated. The participant nodes run the BC based FL-Smart Contract (SC) algorithms to detect network intrusions. FL provided aggregated learning results from the experiment that was 99% accurate in predicting network intrusion. The experimentally determined block storage gain and retrieval gain were 97.5% and 95.4% respectively. The intrusion in the smart grid network was evaluated, and the data indicated that there was 1.2% illegal access. Moreover, the learning system’s accuracy, retrieval and storage intrusions, legal access and transaction processing times were considered for comparison. The proposed system outperformed contemporary research-developed systems targeted for the same application. Therefore, this study provides a guaranteed intrusion learning system and secure transaction system for smart grids.

Rigorous Analysis of Data Orthogonalization for Self-Organizing Maps in Machine Learning Cyber Intrusion Detection for LoRa Sensors

In this article, a novel unsupervised machine learning (ML) algorithm is presented for the expeditious radio frequency (RF) fingerprinting of long range (LoRa)-modulated chirps. Identification based on the received signal strength indicator (RSSI) alone is unlikely to yield a robust means of authentication for critical infrastructure deployments. This is especially true for LoRa, a low-power and LoRa wireless Internet-of-Things (IoT) air-interface technology, where modulated chirps have constant envelope power and correlated in-phase/quadrature (I/Q) samples when the chirps are directly extracted. This makes traditional cyber intrusion detection techniques via a convolutional neural network (CNN) impractical. Moreover, we also prove that such correlation leads to an orthogonally inseparable dataset, due to which classification becomes intractable. Therefore, we propose an efficient way to produce self-organizing maps (SOMs) of LoRa transmitters (TXs) and a potential rogue node prior to CNN classification. This approach offers SOM orthogonalization, thus minimizing the mean square error (MSE) within the CNN using our specially constituted SOM engine for precisely profiling each LoRa TX. This method demonstrates cent-percent success in recognizing each LoRa TX as either being a legitimate device or a rogue.

Artificial intelligence to boost traceability systems for fraud prevention in the meat industry

Traceability was introduced about twenty years ago to face the worldwide spread of food safety crises. Traceability data flow associated with each lot of food products during any production and/or delivery phases can also be used to guarantee product authenticity. For this purpose, it is necessary to protect the data from cyber intrusions and, at the same time, to guarantee the integrity of the bond between the physical product and the data. Price grading related to quality perceivable or credence attributes attracts criminals to attempt item substitution fraud. Improved track and trace technologies supported by artificial intelligence (AI) could highly enhance systems’ capability to detect authenticity violations by product substitution. This paper proposes an innovative method based on AI, to reinforce traceability systems in detecting possible counterfeiting by product substitution. It is an item-based mass balance method that analyses the congruity of the traceability data flows not by using explicit (even stochastic) rules but by exploiting the learning capabilities of a neural network. The system can then detect suspect information in a traceability data flow, alerting a possible profit-driven crime. The AI-based method was applied to a pork slaughtering and meat cutting chain case study.

An Optimized Gradient Boost Decision Tree Using Enhanced African Buffalo Optimization Method for Cyber Security Intrusion Detection

The cyber security field has witnessed several intrusion detection systems (IDSs) that are critical to the detection of malicious activities in network traffic. In the last couple of years, much research has been conducted in this field; however, in the present circumstances, network attacks are increasing in both volume and diverseness. The objective of this research work is to introduce new IDSs based on a combination of Genetic Algorithms (GAs) and Optimized Gradient Boost Decision Trees (OGBDTs). To improve classification, enhanced African Buffalo Optimizations (EABOs) are used. Optimization Gradient Boost Decision Trees (OGBDT-IDS) include data exploration, preprocessing, standardization, and feature ratings/selection modules. In high-dimensional data, GAs are appropriate tools for selecting features. In machine learning techniques (MLTs), gradient-boosted decision trees (GBDTs) are used as a base learner, and the predictions are added to the set of trees. In this study, the experimental results demonstrate that the proposed methods improve cyber intrusion detection for unused and new cases. Based on performance evaluations, the proposed IDS (OGBDT) performs better than traditional MLTs. The performances are evaluated by comparing accuracy, precision, recall, and F-score using the UNBS-NB 15, KDD 99, and CICIDS2018 datasets. The proposed IDS has the highest attack detection rates, and can predict attacks in all datasets in the least amount of time.

Cyber-Attack and Reliability Monitoring of The Synchrophasor Smart Grid Network

The recent advancement of synchrophasor measurements technology in the conventional power grid can monitor and control the state variables of the network very accurately at a high sampling rate in real-time. The complete observability of system states can be achieved through the Phasor Measurement Unit (PMU). The inclusion of a zero injection bus (ZIB) optimized the total number of PMU requirements for complete observation of the synchrophasor network. The communication channels between measurement devices and control centers are highly vulnerable to cyber threats. Thus, an anomaly that occurs with PMU devices during a cyber-attack can affect the system’s reliability. Therefore, monitoring the reliability of the synchrophasor network has become essential for healthy power operation. Synchrophasor measurement technology can enhance wide-area surveillance and security functionality. However, the dependability of such technologies in the context of information network accessibility has yet to be investigated in a coherent model. Growing electric grid defence levels to mitigate the impact of cyber-attacks is essential. The cumulative effect of synchrophasor network observability and reliability is discussed in this paper by optimizing the number of PMUs deployed and the interruption load that occurs during an anomaly with PMU while taking ZIB into account.The backup PMU deployment modeling is also presented to secure the reliability and observability of the grid network during an anomaly occurs with PMU. The indices, Interrupted Load Probability Index (ILPI) and Expected Demand Not Supplied (EDNS), are used to evaluate the reliability of synchrophasor grid networks by integrating the state probability of PMU unavailability due to cyber intrusion.

Industrial IoT Intrusion Detection via Evolutionary Cost-Sensitive Learning and Fog Computing

Cyber attacks and intrusions have become the major obstacles to the adoption of the Industrial Internet of Things (IIoT) in critical industries. Imbalanced data distribution is a common problem in IIoT environments that negatively influence machine learning-based intrusion detection systems (IDSs). To address this issue, we introduce EvolCostDeep, a hybrid model of stacked autoencoders (SAE) and convolutional neural networks (CNNs) with a new cost-dependent loss function. The loss function aims to optimize the model’s parameters, where the costs are determined using an evolutionary algorithm. The combination of evolutionary algorithms and deep learning (DL) on Big data hinders the scalability of IIoT IDSs. In this regard, a fog computing-enabled framework, called DeepIDSFog, is designed at the data level, where the master node shares the EvolCostDeep model with worker nodes. In each fog worker node, the EvolCostDeep is parallelized through one task-level and two model-level mechanisms. After aggregating detection outputs from worker nodes to the master, the result is passed to the cloud platform for mitigating attacks. A series of experiments is conducted on the ToN-IoT and UNSW-NB15 data sets to evaluate the performance of EvolCostDeep and DeepIDSFog. The results show that our frameworks can effectively handle both class imbalance problem and scalability of big IIoT traffic data compared with the other models. The averaged values of the EvolCostDeep for recall, precision, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$F1$ </tex-math></inline-formula> -score on the data sets are of 93.3%, 97.6%, and 95.2%, respectively, which are higher than the compared methods. Also, the DeepIDSFog provides an average speedup of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$38.7\times $ </tex-math></inline-formula> over other comparing models.

A Review: Machine Learning Approaches for Zero-Day Attacks Recognition

Advancements and rapid technological developments in information age promoted computerization of day to day activities in all walks of life. As technology is growing rapidly, the cybercrime rate also increases both in number and complexity. Since a variety of attacks evolves regularly with complex patterns and varied signatures the task of securing cyberspace becomes more and more difficult and challenging. To minimize the impact of cybercrime through early detection of intrusions, network activity in terms of network traffic, is monitored in real-time thus accumulating huge data which is sometimes erroneous. Therefore, synergizing the concepts of cybersecurity and data analytics is essential to develop effective security algorithms for attack detection. Existing security measures like firewalls are no longer sufficient to deal with these emerging attacks. Because the firewall only checks the header of the data packet, it doesn't go through the details of the packet. Intrusion Detection Systems (IDSs) are the systems introduced as a second line of security after firewalls to handle cyber intrusions more efficiently. IDSs play a key role in protecting cyberspace by examining the entire details of the traffic packets to detect intrusions.

Risk-Based Contingency Screening Method Considering Cyber-Attacks on Substations

This letter proposes a probabilistic bi-level optimization model for system operators to identify important line contingencies that are initiated from substations. In contrast to classical contingency screening methods, the proposed model investigates the impacts of cyber intrusions against substations, which are rather different from the scenario where lines are on outages caused by natural disasters or physical attacks. Specifically, we consider the cyber-attacks that, to maximize the expected load loss, start from the substation cyberspace and then affect transmission lines to attain the desired outcomes. In addition, the correlation between substations and associated lines that are subjected to cyber-attack is also modeled to simulate the behavior of an intelligent attacker. The numerical results on THE standard IEEE RTS 24-bus and IEEE 118-bus systems validate the effectiveness of the proposed model.

MultiRHM: Defeating multi-staged enterprise intrusion attacks through multi-dimensional and multi-parameter host identity anonymization

Advanced and persistent multi-staged intrusion attacks are usually conducted by elite well-resourced cyber threat actors with the goal of bypassing the defense-in-depth and zoning policies of enterprise networks and accessing critical internal assets which are embedded deep in the target network (Hutchins et al., 2011; Wilkens et al., 2021). Starting from an externally reachable host, these attacks compromise a chain of network hosts until they reach their targets. Each compromised host could provide attackers access to new systems and network zones, thus enabling them to intrude deeper into the network. While conventional detection-based mechanisms are necessary to defeat such attacks, they are not enough as they can be evaded by stealthy or zero-day attack techniques.To complement these conventional approaches, in our previous works (Jafarian et al., 2015b; 2016; 2014a), we have proposed several proactive defense techniques based on the paradigms of cyber agility and cyber deception to defeat various types of cyber intrusions through disrupting their reconnaissance. While each of these techniques can individually defeat a specific type of reconnaissance, none is individually enough to defeat different types of reconnaissance on which multi-staged intrusions rely.In this paper, we first show that defeating multi-staged intrusion attacks requires a synergistic fusion of a group of coordinated strategies for (1) disrupting both external and internal reconnaissance, (2) defeating both active (e.g., port-scanning) and passive (e.g., sniffing) reconnaissance, as well as (3) disrupting collaborative reconnaissance and information reuse as attackers laterally move inside the internal network. Then, building on our previous approaches, we present a novel proactive technique, called MultiRHM, that anonymizes different identifying attributes of network hosts (IP address, MAC address, domain name responses to rDNS queries, and fingerprints) over different dimensions (time and space) to obfuscate identities of network hosts against all aforementioned types of reconnaissance. We present the necessary architectures, protocols, and algorithms for the deployment of MultiRHM in an enterprise network. Through both theoretical analysis and simulation, we show that MultiRHM is highly effective in defeating multi-staged intrusion attacks.

Statistical machine learning defensive mechanism against cyber intrusion in smart grid cyber-physical network

Cyber-Physical Systems are becoming more susceptible to cyber intrusion, compromising the critical infrastructure of the smart grid. This emerging concern requires the urgent help of researchers to find a practical and better approach to secure an intelligent power grid against cyber-attack. This research article proposes a "Statistical Machine Learning Defensive Mechanism (SML-DM)" for Smart Grid Cyber-Physical Networks (SGCPN) against cyber intrusion by using a Gaussian mixture model merged with wireless sensor data. Using SML-DM, two new indices are proposed to evaluate the performance of the defensive mechanism. The first index, Data Prediction Error (DPE), calculates actual and predicted data errors during a cyber-attack. The second index, Sensor Reliability Score (SRS), is used to assess the reliability status of wireless sensors. MATLAB software was used to validate this research, and data was taken from the National Renewable Energy Laboratory (NREL). Using the proposed defence mechanism, it is found that the data integrity and reliability of the sensors can increase by up to 90%.

Threats and Opportunities with AI-based Cyber Security Intrusion Detection: A Review

Internet usage has increased quickly, particularly in the previous decade. With the widespread use of the internet, cybercrime is growing at an alarming rate in our daily lives. However, with the growth of artificial intelligence (AI), businesses are concentrating more on preventing cybercrime. AI is becoming an essential component of every business, affecting individuals worldwide. Cybercrime is one of the most prominent domains where AI has begun demonstrating valuable inputs. As a result, AI is being deployed as the first line of defense in most firms' systems. Because AI can detect new assaults faster than humans, it is the best alternative for constructing better protection against cybercrime. AI technologies also offer more significant potential in the development of such technology. This paper discusses recent cyber intrusions and how the AI-enabled industry is preparing to defend itself in the long run.