Data Manipulation Attacks Research Articles

Quantum Transfer Learning with Adversarial Robustness for Classification of High‐Resolution Image Datasets

AbstractThe application of quantum machine learning to large‐scale high‐resolution image datasets is not yet possible due to the limited number of qubits and relatively high level of noise in the current generation of quantum devices. In this work, this challenge is addressed by proposing a quantum transfer learning (QTL) architecture that integrates quantum variational circuits with a classical machine learning network pre‐trained on ImageNet dataset. Through a systematic set of simulations over a variety of image datasets such as Ants & Bees, CIFAR‐10, and Road Sign Detection, the superior performance of the QTL approach over classical and quantum machine learning without involving transfer learning is demonstrated. Furthermore, the adversarial robustness of QTL architecture with and without adversarial training is evaluated, confirming that our QTL method is adversarially robust against data manipulation attacks and outperforms classical methods.

A real-time network based anomaly detection in industrial control systems

Data manipulation attacks targeting network traffic of SCADA systems may compromise the reliability of an Industrial Control system (ICS). This can mislead the control center about the real-time operating conditions of the ICS and can alter commands sent to the field equipment. Deep Learning techniques appear as a suitable solution for detecting such complicated attacks. This paper proposes a Network based Anomaly Detection System (NADS) to detect data manipulation attacks with a focus on Modbus/TCP-based SCADA systems. The proposed NADS is a sequence to sequence auto encoder which uses the long short term memory units with embedding layer, teacher forcing technique and attention mechanism. The model has been trained and tested using the SWaT dataset, which corresponds to a scaled-down water treatment plant. The model detected 23 of 36 attacks and outperformed two other existing NADS with an improvement of 0.22 for simple attacks and obtained a recall value of 0.86 on attack 36 compared to the other NADS which obtained 0.74.

Modified Matrix Completion-Based Detection of Stealthy Data Manipulation Attacks in Low Observable Distribution Systems

A composite detection technique against stealthy data manipulations is developed in this paper for distribution networks that are low observable. Attack detection strategies typically rely on state estimation which becomes challenging when limited measurements are available. In this paper, a modified matrix completion approach provides estimates of the system state and its error variances for the locations in the network where measurements are unavailable. Using the error statistics and their corresponding state estimates, bad data detection can be carried out using the chi-squared test. The proposed approach employs a moving target defence strategy (MTD) where the network parameters are perturbed through distributed flexible AC transmission system (D-FACTS) devices such that stealthy data manipulation attacks can be exposed in the form of bad data. Thus, the bad data detection approach developed in this paper can detect stealthy attacks using the MTD strategy. This technique is implemented on 37-bus and 123-bus three-phase unbalanced distribution networks to demonstrate the attack detection accuracy even for a low observable system.

Cyber-Secure Global Energy Equalization in DC Microgrid Clusters Under Data Manipulation Attacks

Cyber physical microgrids (MGs) are vulnerable to data manipulation attacks which can lead to significant imbalance in the MG. For instance, data manipulations by cyber adversaries may cause to higher loading of batteries with low state-of-charge. This will lead to degradation of the cycle-life of batteries unless timely intervention is done for malware detection. Therefore, a cyber-secure global energy equalisation of battery energy storage systems in multiple interconnected direct current (DC) MG clusters is proposed in this article for efficient utilisation of batteries. Cyber security is achieved in the framework through the proposed multi-level detection and mitigation paradigm aided by event generators. Firstly, it is the maiden attempt to propose and design a secure global energy equalisation framework for MG clusters. Secondly, the proposed event generators enable segregated defensive actions for leader and follower nodes in the network. This is unlike previously reported works wherein the defense mechanism has been generalised for every node. Further, the results indicate that the proposed event generators help in maintaining continuity of power to critical loads in the system. Extensive time-domain simulations are performed in MATLAB/Simulink under various practical scenarios of ad- versarial intrusions. Controller hardware-in-loop tests employing real-time digital simulator (RTDS) and field programmable gate array (FPGA) based WAVECT Controller are also performed for real-time validation of the proposed technique. Finally, for testing scalability of the algorithm, it is extended to 20 DC-DC converters.

Deep Learning-Based PMU Cyber Security Scheme Against Data Manipulation Attacks With WADC Application

In this paper, a new deep learning-based cyber-security scheme is proposed to detect PMU data manipulation attacks and to recover the corrupted measurements. The scheme consists of two deep learning models, an attack detection model, and a data recovery model. The first model can detect attack existence, and also determine which PMUs are attacked. The second model is used to reconstruct the manipulated signals and send them to the wide-area monitoring and control (WAMC) system. Unlike many approaches presented in the literature, the proposed models are capable of understanding the behavior of the system in both steady-state and transient operation, and therefore distinguishing between the normal and corrupted measurements. The state-of-art deep learning techniques are used to train and test these models. Furthermore, the effectiveness of the proposed cyber-security scheme is demonstrated for a wide-area damping control application. The obtained results show superior performance when the proposed model is evaluated using the IEEE 39-bus system and the 68-bus system. The security scheme succeeds to detect cyber-attacks with very high accuracy and recover the manipulated signals with a small reconstruction error.

Cybersecurity Vulnerabilities for Off-Board Commercial Vehicle Diagnostics

<div class="section abstract"><div class="htmlview paragraph">The lack of inherent security controls makes traditional Controller Area Network (CAN) buses vulnerable to Machine-In-The-Middle (MitM) cybersecurity attacks. Conventional vehicular MitM attacks involve tampering with the hardware to directly manipulate CAN bus traffic. We show, however, that MitM attacks can be realized without direct tampering of any CAN hardware. Our demonstration leverages how diagnostic applications based on RP1210 are vulnerable to Machine-In-The-Middle attacks. Test results show SAE J1939 communications, including single frame and multi-framed broadcast and on-request messages, are susceptible to data manipulation attacks where a shim DLL is used as a Machine-In-The-Middle. The demonstration shows these attacks can manipulate data that may mislead vehicle operators into taking the wrong actions. A solution is proposed to mitigate these attacks by utilizing machine authentication codes or authenticated encryption with pre-shared keys between the communicating parties. Various tradeoffs, such as communication overhead encryption time and J1939 protocol compliance, are presented while implementing the mitigation strategy. One of our key findings is that the data flowing through RP1210-based diagnostic systems are vulnerable to MitM attacks launched from the host diagnostics computer. Security models should include controls to detect and mitigate these data flows. An example of a cryptographic security control to mitigate the risk of an MitM attack was implemented and demonstrated by using the SAE J1939 DM18 message. This approach, however, utilizes over twice the bandwidth as normal communications. Sensitive data should utilize such a security control.</div></div>

On specification-based cyber-attack detection in smart grids

The transformation of power grids into intelligent cyber-physical systems brings numerous benefits, but also significantly increases the surface for cyber-attacks, demanding appropriate countermeasures. However, the development, validation, and testing of data-driven countermeasures against cyber-attacks, such as machine learning-based detection approaches, lack important data from real-world cyber incidents. Unlike attack data from real-world cyber incidents, infrastructure knowledge and standards are accessible through expert and domain knowledge. Our proposed approach uses domain knowledge to define the behavior of a smart grid under non-attack conditions and detect attack patterns and anomalies. Using a graph-based specification formalism, we combine cross-domain knowledge that enables the generation of whitelisting rules not only for statically defined protocol fields but also for communication flows and technical operation boundaries. Finally, we evaluate our specification-based intrusion detection system against various attack scenarios and assess detection quality and performance. In particular, we investigate a data manipulation attack in a future-orientated use case of an IEC 60870-based SCADA system that controls distributed energy resources in the distribution grid. Our approach can detect severe data manipulation attacks with high accuracy in a timely and reliable manner.

Adaptive Resilient Secondary Control for Microgrids With Communication Faults.

In this article, we consider the resilience problem in the presence of communication faults encountered in distributed secondary voltage and frequency control of an islanded alternating current microgrid. Such faults include the partial failure of communication links and some classes of data manipulation attacks. This practical and important yet challenging issue has been taken into limited consideration by existing approaches, which commonly assume that the measurement or communication between the distributed generations (DGs) is ideal or satisfies some restrictive assumptions. To achieve communication resilience, a novel adaptive observer is first proposed for each individual DG to estimate the desired reference voltage and frequency under unknown communication faults. Then, to guarantee the stability of the closed-loop system, voltage and frequency restoration, and accurate power sharing regardless of unknown communication faults, sufficient conditions are derived. Some simulation results are presented to verify the effectiveness of the proposed secondary control approach.

Electromagnetic Transients-Based Detection of Data Manipulation Attacks in Three Phase Radial Distribution Networks

Electromagnetic Transients-Based Detection of Data Manipulation Attacks in Three Phase Radial Distribution Networks

An Improved PMU Data Manipulation Attack Model

The importance of Phasor Manipulation Unit (PMU) in the smart grid makes it a target for attackers who can create PMU Data Manipulation Attacks (PDMA) by adding a small constant to change the magnitude and angle of the voltage and current captured by the PMU. To prevent the attack result from being detected by PDMA detection based on the properties of equivalent impedance, this paper proposes a collaborative step attack. In this attack, the equivalent impedance’s value on the end of the transmission line is equal whether before or after been attack, which is taken as the constraint condition. The objective function of it is to minimize the number of the elements which is not 0 in attack vector but this number is not 0. Turn a vector construction problem into an optimization problem by building objective functions and constraints and then we use the Alternating Direction Method of Multipliers (ADMM) and Convex Relaxation (CR) to solve. The experiment verifies the feasibility of using the CR-ADMM algorithm to construct attack vectors from two aspects of attack vector construction time and vector sparsity. Further, it uses the constructed attack vectors to carry out attacks on PMU. The experimental results show that the measurement value of PMU will change after the attack, but the equivalent impedance value at both ends of the transmission line remains the same. The attack vector successfully bypasses the PDMA detection method based on the property of equivalent impedance and the attack model constructed based on this method was more covert than the original model.

A Detection Mechanism for PMU Data Manipulation Attacks by Using Sliced Recurrent Convolutional Attention Module

Background: Phasor Measurement Unit (PMU) Data Manipulation Attacks (PDMA) can change the state estimates of power systems and cause significant damage to the smart grid. So it is vital to research a method to detect it. Objective: In this paper, we propose a detection mechanism and model for PDMA. Methods: Firstly, the distribution's characteristics of Phasor Data Concentrator (PDC) and PMU are analyzed, and we use these characteristics to detect a PDMA detection mechanism that could help us reduce the number of detection samples. Secondly, we use the Sliced Recurrent Neural Network (SRNN) to extract the time series data's temporal characteristics of PMU data. Thirdly, based on the temporal characteristics, the Convolutional Neural Networks (CNN) and Attention mechanisms are used to extract the spatial features of these data. Finally, we sent the spatial features to the Fully Layer and used the softmax function to classify. Results: The proposed SRCAM in this paper has two advantages. One is that it implements the parallel computation on data by using the segmentation concept of SRNN, which reduces the computation time. The other is that using the Attention mechanism on CNN can make the spatial features more prominent. At the end of the paper, we do many comparative experiments between SRCAM and other models, such as some algorithms of Machine learning and soft computing. We take IEEE node data as experimental data and TensorFlow as an experimental platform. Experimental results show that the SRCAM model has an excellent performance of the detection of PDMA with high precision and accuracy. Conclusion: The superiority of SRCAM is theoretically and experimentally proved in this paper. As we expected, SRCAM showed great results in the application of PDMA detection.

Wavelet probability distribution mapping for detection and correction of dynamic data injection attacks in WAMS

The dependency of synchrophasor technology on shared/dedicated communication networks for data transfer and the lack of security specifications in C37.118 standard makes phasor measurements susceptible to data manipulation attacks. More critically, a false data injection attack could influence both accuracy of state estimates and the evaluation of system dynamics. Typically, false data sequences are modeled as multi-constraint non-linear optimization with random, step, or ramp type distribution. However, a carefully designed attack that mimics the dynamic response of a natural disturbance can hugely impact trends-based applications of synchrophasor-based disturbance monitoring and mode metering. This work designs a multi-channel/multi-sample dynamic injection attack in phasor trends to closely mimic natural disturbances aiming at trends-based applications. Also, the work proposes an un-supervised wavelet probability mapping method for the detection and correction of dynamic false data sequences. The proposed method identifies the attack sequences from disturbances using relative wavelet energy measure and replaces the corrupted sub-sequences with coherent un-corrupted trends using a kernel density estimation-based mode mapping method. The efficacy of the proposed method is validated for simulated injection cases in IEEE-118 bus system using DigSILENT/PowerFactory and real phasor data for the Eastern region of the India grid. The results show that the proposed method exhibits high detection accuracy and low correction error for different categories of dynamic false data cases under real system conditions.

Resilience Against Data Manipulation in Distributed Synchrophasor-Based Mode Estimation

Generators are critical components of electrical grids and have to operate synchronously. Unfortunately, faults in power grids can cause significant electro-mechanical oscillations. A number of methods to estimate these electro-mechanical oscillation modes have been proposed in the literature. With the advent of synchrophasors which enable real-time measurements over a wide-area, and in keeping with a trend towards more distributed monitoring and control applications (e.g., WAMPAC), measurement-based methods to estimate oscillation modes in a distributed manner have been proposed. Like other power system applications these distributed mode estimation approaches also face the prospect of false data injection attacks. In this paper, we introduce a mechanism, inspired by byzantine fault tolerance, for making distributed alternating direction of multipliers method of mode estimation resilient against data manipulation attacks. We evaluate our approach using IEEE 68-bus and 145-bus test systems under different attack scenarios and show that in all the scenarios considered our approach allows distributed mode estimation to converge well.

Cyberattacks identification in IEC 61850 based substation using proximal support vector machine

Maintaining the reliable, efficient, secure and multifunctional IEC 61850 based substation is an extremely challenging task, especially in the ever-evolving cyberattacks domain. This challenge is also exacerbated with expending the modern power system (MPS) to meet the demand along with growing availability of hacking tools in the hacker community. Few of the most serious threats in the substation automation system (SAS) are DoS (Denial of Services), MS (Message Suppression) and DM (Data Manipulation) attacks, where DoS is due to flood bogus frames. In MS, hacker inject the GOOSE sequence (sqNum) and GOOSE status (stNum) number. In the DM attacks, attacker modify current measurements reported by the merging units, inject modified boolean value of circuit breaker and replay a previously valid message. In this paper, an intelligent cyberattacks identification approach in IEC 61850 based SAS using PSVM (proximal support vector machine) is proposed. The performance of the proposed approach is demonstrated using experimental dataset of recorded signatures. The obtained results of the demonstrated study shows the effectiveness and high level of acceptability for real side implementation to protect the SAS from the cyberattacks in different scenarios.

Detection and Mitigation of Data Manipulation Attacks in AC Microgrids

This paper presents a resilient control framework for distributed frequency and voltage control of AC microgrids under data manipulation attacks. In order for each distributed energy resource (DER) to detect any misbehavior on its neighboring DERs, an attack detection mechanism is first presented using a Kullback-Liebler (KL) divergence-based criterion. An attack mitigation technique is then proposed that utilizes the calculated KL divergence factors to determine trust values indicating the trustworthiness of the received information. Moreover, DERs continuously generate a self-belief factor and communicate it with their neighbors to inform them of the validity level of their own outgoing information. DERs incorporate their neighbors' self-belief and their own trust values in their control protocols to slow down and mitigate attacks. It is shown that the proposed cyber-secure control effectively distinguishes data manipulation attacks from legitimate events. The performance of proposed secure frequency and voltage control techniques is verified through the simulation of microgrid tests system implemented on IEEE 34-bus test feeder with six DERs.

Online Identification and Data Recovery for PMU Data Manipulation Attack

Some of the modern smart grid infrastructures, phasor measurement units (PMUs) for instance, are vulnerable to cyberattacks due to their ever-increasing dependence on information and communications technologies. In general, existing solutions to cyberattacks focus on creating redundancy and/or enhancing security levels of sensing and communication networks. These solutions require intensive offline efforts and therefore are economically expensive. Further, they are generally inefficient when dealing with dynamic attacks. This paper proposes a novel density-based spatial clustering approach for online detection, classification, and data recovery for data manipulation attacks to PMU measurements. The proposed method is purely data-driven and is applicable to simultaneous multi-measurement attacks without requiring additional hardware in the existing infrastructure. The proposed approach is also independent of the conventional state estimation. Comprehensive case studies demonstrate the effectiveness of the proposed method.

Robust Fuzzy Extractors and Helper Data Manipulation Attacks Revisited: Theory versus Practice

Fuzzy extractors have been proposed in 2004 by Dodis et al. as a secure way to generate cryptographic keys from noisy sources. In recent years, fuzzy extractors have become an important building block in hardware security due to their use in secure key generation based on Physical Unclonable Functions (PUFs). Fuzzy extractors are provably secure against passive attackers. A year later Boyen et al. introduced robust fuzzy extractors which are also provably secure against active attackers, i.e., attackers that can manipulate the helper data. In this paper we show that the original provable secure robust fuzzy extractor construction by Boyen et al. actually does not fulfill the error-correction requirements for practical PUF applications. The fuzzy extractors proposed for PUF-based key generation on the other hand that fulfill the error-correction requirements cannot be extended to such robust fuzzy extractors, due to a strict bound $t$t on the number of correctable errors. While it is therefore tempting to simply ignore this strict bound, we present novel helper data manipulation attacks on fuzzy extractors that also work if a “robust fuzzy extractor-like” construction without this strict bound is used. Hence, this paper can be seen as a call for action to revisit this seemingly solved problem of building robust fuzzy extractors. The new focus should be on building more efficient solutions in terms of error-correction capability, even if this might come at the costs of a proof in a weaker security model.

Attacking Data Transforming Learners at Training Time

While machine learning systems are known to be vulnerable to data-manipulation attacks at both training and deployment time, little is known about how to adapt attacks when the defender transforms data prior to model estimation. We consider the setting where the defender Bob first transforms the data then learns a model from the result; Alice, the attacker, perturbs Bob’s input data prior to him transforming it. We develop a general-purpose “plug and play” framework for gradient-based attacks based on matrix differentials, focusing on ordinary least-squares linear regression. This allows learning algorithms and data transformations to be paired and composed arbitrarily: attacks can be adapted through the use of the chain rule—analogous to backpropagation on neural network parameters—to compositional learning maps. Bestresponse attacks can be computed through matrix multiplications from a library of attack matrices for transformations and learners. Our treatment of linear regression extends state-ofthe-art attacks at training time, by permitting the attacker to affect both features and targets optimally and simultaneously. We explore several transformations broadly used across machine learning with a driving motivation for our work being autogressive modeling. There, Bob transforms a univariate time series into a matrix of observations and vector of target values which can then be fed into standard learners. Under this learning reduction, a perturbation from Alice to a single value of the time series affects features of several data points along with target values.

Distributed Framework for Detecting PMU Data Manipulation Attacks With Deep Autoencoders

Phasor measurement unit (PMU) data manipulation attacks (PDMAs) may blind the control centers to the real-time operating conditions of power systems. Detecting these attacks accurately is essential to ensure the normal operation of power system monitoring and control. Using long-term accumulated historical PMU measurements to train a machine learning model to detect PDMAs has shown promising results. In this paper, deep-autoencoder-based anomaly measurers are deployed throughout the power system to build a distributed PDMA detection framework. The architecture of a deep autoencoder and its training process are introduced. How to convert the historical PMU measurements into data samples for learning is also elaborated upon. Once trained, an anomaly measurer can assess the PDMA existence possibility of the new PMU measurements. By integrating the results of different anomaly measurers, the proposed distributed PDMA detection framework can detect PDMAs in the whole power system. The effectiveness and detection performance of the framework are discussed through experiments.

The study of promising secure information systems based on signal modeling

The aim of the study is to increase the effectiveness of information security management through the use of 5G networks. The transition to the fifth-generation network does not solve the existing problems of information security and leads to the emergence of new threats. The main objective of each modulation method of signals is to ensure high bandwidth, proper transmission quality in a noisy communication channel, using the minimum amount of energy. One of the most effective indicators of increasing the level of information security in wireless networks is quadrature modulation, which is used in such networks as: LTE, WiMAX, McWill, DVB-T (T2), Wi-Fi and other radio access networks [1].One of the promising directions for the development of 5G networks is the use of higher frequency ranges, such as the range of millimeter waves (from 30 to 300 GHz) [2, 3]. A feature of the millimeter wave range is that they provide much wider spectral bands, making it possible to significantly increase the bandwidth in the channels. Thus, when studying prospective protected information systems based on the use of 5G network technology, it is advisable to use a simulation of the signals of the channel-level interaction of subscribers, which allows you to evaluate the basic security parameters at the physical level.Materials and research methods. Fifth generation networks will simultaneously look like any previous generation of mobile networks, and at the same time they will differ significantly from them – and there are a number of explanations that become more obvious if you think about how these changes affect the principles of user and equipment safety networks of the fifth generation.Widespread in the field of digital information transmission, including 5G networks, has received combinational modulation, called quadrature amplitude modulation.Multiposition signals have the greatest spectral efficiency, of which four-position phase modulation and sixteen-position quadrature amplitude modulation are most often used.The quadrature amplitude modulation is a kind of multi-position amplitude-phase modulation, in addition to the phase, the amplitude of the signal for a given type of modulation will also carry information. This leads to the fact that for a given frequency band the amount of transmitted information increases.A brief overview of the existing modulation approaches is presented OFDM (english. Orthogonal frequency-division multiplexing) [4, 5] systems and methods for forming solutions of signal modulation problems for building such systems/Results. Currently, OFDM technology is widely used in modern wireless Internet systems. High data transfer rates in OFDM systems are achieved using parallel information transfer over a large number of orthogonal frequency subchannels (subcarriers) [6].The method of synthesizing signal-code constructions with orthogonal frequency multiplexing provides for different scenarios for the use of semi-square modulation depending on the requirements for interception protection, as well as balancing between spectral and energy efficiency. This method can be used in two cases: with alternative and consistent transmission of signals. In the case of alternative transmission, only one of the four subcarriers is used during one channel interval. For efficient use of bandwidth, the proposed method involves the use of the spectrum of three other subcarriers for data transmission in D2D channels (this creates a connection between two user devices that are in close proximity), which allows you to further avoid interference between fixed channels and D2D communication channels.Findings. At present, 5G networks can be considered as one of the necessary components of the digital transformation and digital economy, while the main task in ensuring security in cellular communications is protection against eavesdropping. However, in the future world of smartphones and the Internet of things, in environments with a large number of mechanisms, the probability of listening is likely to fade into the background. Instead, you have to think about such things as data manipulation attacks, which, for example, can be used to command the mechanisms to perform certain actions (for example, open the door or take control of an unmanned vehicle). Mobile network operators, like consumer electronics manufacturers, will be able to offer “security as a service,” with the result that application providers will be able to apply additional levels of security over existing secure cellular network channels when transferring certain types of data. [7] Due to the better spectral density, the proposed signal conditioning method makes it possible to use prototypes of window functions with the best spatial localization properties without violating the orthogonality condition of the signal bases, and accordingly does not require the use of cyclic prefixes when generating the OFDM signal.