Defensive Approach Research Articles

Enhancing Cybersecurity in Energy IT Infrastructure Through a Layered Defense Approach to Major Malware Threats

This study examines the cybersecurity vulnerabilities of energy IT infrastructure in the context of rapid digital transformation and network expansion. While these advancements have improved efficiency, they have also increased susceptibility to cyber threats, particularly from malware such as Industroyer, Triton, NotPetya, and BlackEnergy3. By analyzing these malware threats, this research identifies key weaknesses in energy systems and highlights the need for enhanced anomaly detection, network segmentation, and system integrity checks. To address these vulnerabilities, this study proposes a layered security architecture in which each layer—physical, control, network, application, and security—provides independent protection while integrating into a unified defense strategy. This research emphasizes the necessity of combining technical-, organizational-, and policy-based responses to bolster cybersecurity across all levels of energy infrastructure. Key recommendations include immediate vulnerability patching, improved international cooperation, stronger legal frameworks, enhanced cybersecurity education, and the establishment of a unified command structure. This study provides practical insights and strategies for strengthening the cybersecurity of energy systems through a comprehensive, integrated approach.

The ethical inadequacy of uninformed surrogate consent: advancing respect for persons in clinical research.

In clinical research, decision-making capacity is often equated with unspecified conceptions of autonomy, and autonomy is often equated with personhood. On this view, the loss of decision-making capacity is seen as a loss of autonomy, and the loss of autonomy subsumes a loss of personhood. An ethical concern arises at the intersection of those philosophical considerations with the legal considerations in informed consent. Because persons with inadequate decision-making capacity cannot provide legally effective consent, enrollment in research can occur only if a surrogate gives permission on the person's behalf. Federal regulations and resulting institutional policies allow permission from surrogates empowered under state law to consent to medical treatment procedures, typically in a hierarchy of legislatively prioritized relationships lacking regard for what the surrogate actually knows about the current research-related values and preferences of the potential subject. As a result, the research enterprise often countenances reliance on surrogates who have no relational or informational basis for an enrollment decision that aligns with the values and preferences of the subject. Arguing from the perspective that losing decision-making capacity does not alter the moral status of persons, and that respect for persons rather than respect for autonomy is the central ethical obligation, I assess the ethical implications of allowing persons with no knowledge of the values and preferences of the potential subject to make enrollment decisions, concluding that reliance on uninformed surrogates is not an ethically defensible approach to enrolling subjects in clinical research.

Strengthening urban deer management with structured decision making

Urban deer management (UDM) decision‐makers face social, ecological, regulatory, and economic pressures when creating an agreeable deer management plan for stakeholders. Historically, decision making techniques (e.g. consensus‐based analyses) have not effectively balanced UDM elements leading to short‐lived management progress. Structured decision making (SDM) is a formal, values‐based approach to identifying an optimal management solution. Although SDM has been applied to other wildlife management decisions, it has not been applied in UDM. We provide the first case‐study of SDM‐based UDM and streamline the process for wildlife managers. We focused on one suburban and one semi‐rural community near Atlanta, Georgia, USA. We established a problem statement to capture what decision‐makers must address in UDM programs and reviewed the primary literature and UDM plans from five states to establish four fundamental objectives. We then utilized a support–effectiveness analysis to identify acceptable UDM alternatives and gathered expert insights to calculate the consequences of alternatives on objectives. Finally, we asked each community's decision‐makers to weigh objectives against each other. Using this framework, education was the most optimal UDM technique to implement in the suburban community, and sharpshooting was the most optimal UDM technique to implement in the semi‐rural community. This paper positions SDM as a transparent, defensible, inclusive, and adaptive approach to UDM. Furthermore, our SDM framework provides managers with the means and justification to create an optimal plan of action for communities in need of UDM.

A Passive Defensive Tactic in Target‐Attacker‐Defenders Game Against Fast Attacker

ABSTRACTThe target‐attacker‐defenders game (TADs) is an important topic in multi‐agent systems, concerning group cooperation and decision‐making. To effectively counter fast attackers, this study introduces a passive defensive approach, where a group of defenders position themselves around a formation point, rather than intercept the attacker actively. An evaluation model is developed to determine the optimal formation point, and a comprehensive analysis of the model is conducted, demonstrating that the formation point changes at a slower rate than the attacker, allowing the defenders to effectively track the attacker's movements. To enhance the global search capabilities, a backbone exchange mechanism is integrated into the original pigeon‐inspired optimization (PIO) algorithm. Finally, a series of comparative experiments are conducted, providing a comprehensive assessment of the defense strategy and the improved algorithm. The simulation results indicate the defenders can block the attacker with a slower speed following the proposed strategy, while the UAVs using the comparison method fail to follow the attacker, and the attacker escape the encirclement of defenders. The results prove the effectiveness of the proposed passive method in the article.

Deep-Reinforcement-Learning-Based Self-Evolving Moving Target Defense Approach Against Unknown Attacks

Deep-Reinforcement-Learning-Based Self-Evolving Moving Target Defense Approach Against Unknown Attacks

A divide-and-conquer reconstruction method for defending against adversarial example attacks

In recent years, defending against adversarial examples has gained significant importance, leading to a growing body of research in this area. Among these studies, pre-processing defense approaches have emerged as a prominent research direction. However, existing adversarial example pre-processing techniques often employ a single pre-processing model to counter different types of adversarial attacks. Such a strategy may miss the nuances between different types of attacks, limiting the comprehensiveness and effectiveness of the defense strategy. To address this issue, we propose a divide-and-conquer reconstruction pre-processing algorithm via multi-classification and multi-network training to more effectively defend against different types of mainstream adversarial attacks. The premise and challenge of the divide-and-conquer reconstruction defense is to distinguish between multiple types of adversarial attacks. Our method designs an adversarial attack classification module that exploits the high-frequency information differences between different types of adversarial examples for their multi-classification, which can hardly be achieved by existing adversarial example detection methods. In addition, we construct a divide-and-conquer reconstruction module that utilizes different trained image reconstruction models for each type of adversarial attack, ensuring optimal defense effectiveness. Extensive experiments show that our proposed divide-and-conquer defense algorithm exhibits superior performance compared to state-of-the-art pre-processing methods.

Optimal strategies design of active target defense differential game

In this paper, the optimal strategies are investigated for the differential game of active target defense. Specifically, we describe a pursuitevasion game with three agents (namely, an attacker, a target and a defender). For the three agents engagement scenario, two different differential game guidance laws–pure pursuit (PP) and proportional navigation (PN)–are presented for defender. Firstly, the relative motion kinematic models of the three agents are established. We subsequently derive the coupled Hamilton-Jacobi (HJ) equations to design the optimal control strategies for the three agents. Through the construction of actor-critic neural networks, optimal solutions are obtained. Then, the stability of the three-agent system is ensured, and the convergence to the Nash equilibrium equations is demonstrated. Finally, we simulate the optimal strategies employed by the attacker and the defender-target team, thereby highlighting the contrasting outcomes and superiority of different defensive approaches.

Break-Pad: effective padding machines for tor with break burst padding

AbstractWebsite Fingerprinting (WF) attacks enable a local eavesdropper to use metadata of packet flow, such as size, timing, and direction, to infer the websites a user is visiting. This can damage the user privacy provided by anonymity systems such as Tor. Tor has implemented the WF defense called Circuit Padding Framework, which provides an interface for developers to implement their own defenses. However, these defenses in the framework were overcome by the Deep Fingerprinting (DF) attack. In this paper, we propose a novel defense approach called break burst padding (Break-Pad), which injects a random number of padding packets into an incoming burst once the number of consecutive incoming packets exceeds a set number. We integrated Break-Pad into the existing Circuit Padding Framework. In addition, we have implemented two padding machines named August and October in the new framework and conducted experiments to evaluate these machines. In the open-world setting, our results show that August, with 29% bandwidth overhead, reduces Tik-Tok’s TPR by 14.48% and DF’s TPR by 22%. October outperforms the best padding machine, RBB. With 36% bandwidth overhead, it drops Tik-Tok’s TPR to 74.24% and DF’s TPR to 65.36%. In the one-page setting, October further reduces the bandwidth overhead by 11% while achieving similar performance to RBB. In the information leak analysis, for the burst sequence feature of the traffic, October leaks at 2.453 bits, while the best comparable padding machine Interspace leaks at 2.629 bits.

A multiscale approach for network intrusion detection based on variance–covariance subspace distance and EQL v2

As an important network defense approach, network intrusion detection is mainly used to identify anomaly traffic behavior. However, dominant network intrusion detection approaches are now struggling to identify the complex and variable means of attack, leading to high false alarm rate. Additionally, the feature redundancy and class imbalance problem in the intrusion detection dataset also constrain the performance of detection methods. This paper proposes a multiscale intrusion detection approach based on variance–covariance subspace distance and Equalization Loss v2 (EQL v2). Firstly, the variance–covariance subspace distance is used for feature selection on the preprocessed dataset to determine a set of representative feature subsets that can effectively approximate the original feature space. Secondly, the loss function, EQL v2, is adopted to balance the positive and negative gradients, addressing the class imbalance problem. Finally, a pyramid depthwise separable convolution model is proposed to capture the multiscale information of the traffic, and the convolutional layer in the depthwise convolution is replaced with self-supervised predictive convolutional attention block to compensate for the performance loss caused by the parameter reduction. Extensive experiments demonstrated that the proposed approach exhibits better performance on the three datasets of NSL-KDD, UNSW_NB15, and CIC-IDS-2017, with accuracy rates of 99.19%, 97.81%, and 99.83%, respectively, effectively improve the intrusion detection performance.

Astro-Politics: US-India Strategic Cooperation in Space and its Implications for China (2000-2024)

The Article aims to investigate the strategic purpose of space as a new battlefield among the great powers of the 21st century. The US sees China as its great adversary in space hence its cooperation with India for strategic purposes to engage China which is posing a national security threat to China. Similarly, increasing Indian space capabilities is also misbalancing the pendulum of power in South Asia. The offensive and defensive approaches from the broader framework of Neo-Realism have been employed to interpret the whole power competition. Qualitative research methodology grounded in post-positivism has been employed. Data would be gathered through the help of primary & secondary sources and document study would also be utilized for data analysis. The findings of the study are expected to show that an arms race in space can cause space warfare among major global powers.

Collaborative IoT learning with secure peer-to-peer federated approach

Federated Learning (FL) has emerged as a powerful model for training collaborative machine learning (ML) models while maintaining the privacy of participants’ data. However, traditional FL methods can exhibit limitations such as increased communication overhead, vulnerability to poisoning attacks, and reliance on a central server, which can impede their practicality in certain IoT applications. In such cases, the necessity of a central server to oversee the learning process may be infeasible, particularly in situations with limited connectivity and energy management. To address these challenges, peer-to-peer FL (P2PFL) offers an alternative approach, providing greater adaptability by enabling participants to collaboratively train their own models alongside their peers. This paper introduces an original framework that combines P2PFL and Homomorphic Encryption (HE), enabling secure computations on encrypted data. Furthermore, a defense approach against poisoning attacks based on cosine similarity is introduced These techniques enable users to collectively learn while preserving data privacy and accounting for ideal energy optimization. The proposed approach has demonstrated superior performance metrics in terms of accuracy, F-scores, and loss when compared to other similar approaches. Furthermore, it offers robust privacy and security measures, leading to an enhanced security level, with improvements ranging from 5.5% to 14.6%. Moreover, we demonstrate that the proposed approach effectively reduces the communication overhead. The proposed approach resulted in impressive reductions in communication overhead ranging from 63.8% to 79.6%. The implementation of these security models was cumbersome, but we have made the code publicly available for your reference 11https://github.com/Artifitialleap-MBZUAI/Collaborative-Learning-with-Secure-Peer-to-Peer-Federated-Approach..

Comparison of deep learning algorithms for site detection of false data injection attacks in smart grids

False Data Injection Attacks (FDIA) pose a significant threat to the stability of smart grids. Traditional Bad Data Detection (BDD) algorithms, deployed to remove low-quality data, can easily be bypassed by these attacks which require minimal knowledge about the parameters of the power bus systems. This makes it essential to develop defence approaches that are generic and scalable to all types of power systems. Deep learning algorithms provide state-of-the-art detection for FDIA while requiring no knowledge about system parameters. However, there are very few works in the literature that evaluate these models for FDIA detection at the level of an individual node in the power system. In this paper, we compare several recent deep learning-based model that proven their high performance and accuracy in detecting the exact location of the attack node, which are convolutional neural networks (CNN), Long Short-Term Memory (LSTM), attention-based bidirectional LSTM, and hybrid models. We, then, compare their performance with baseline multi-layer perceptron (MLP)., All the models are evaluated on IEEE-14 and IEEE-118 bus systems in terms of row accuracy (RACC), computational time, and memory space required for training the deep learning model. Each model was further investigated through a manual grid search to determine the optimal architecture of the deep learning model, including the number of layers and neurons in each layer. Based on the results, CNN model exhibited consistently high performance in very short training time. LSTM achieved the second highest accuracy; however, it had required an averagely higher training time. The attention-based LSTM model achieved a high accuracy of 94.53 during hyperparameter tuning, while the CNN model achieved a moderately lower accuracy with only one-fourth of the training time. Finally, the performance of each model was quantified on different variants of the dataset—which varied in their l2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$${\ ext{l}}_{2}$$\\end{document}-norm. Based on the results, LSTM, CNN obtained the highest accuracy followed by CNN-LSTM and lastly MLP.

Hardening Active Directory Graphs via Evolutionary Diversity Optimization based Policies

Active Directory (AD) is the default security management system for Windows domain networks. An AD environment can be described as a cyber-attack graph, with nodes representing computers, accounts, etc., and edges indicating existing accesses or known exploits that enable attackers to move from one node to another. This paper explores a Stackelberg game model between one attacker and one defender on an AD attack graph. The attacker’s goal is to maximize their chances of successfully reaching the destination before getting detected. The defender’s aim is to block a constant number of edges to minimize the attacker’s chance of success. The paper shows that the problem is #P-hard and, therefore, intractable to solve exactly. To defend the AD graph from cyber attackers, this paper proposes two defensive approaches. In the first approach, we convert the attacker’s problem to an exponential sized Dynamic Program that is approximated by a Neural Network (NN). Once trained, the NN serves as an efficient fitness function for defender’s Evolutionary Diversity Optimization based defensive policy. The diversity emphasis on the defender’s solution provides a diverse set of training samples, improving the training accuracy of our NN for modeling the attacker. In the second approach, we propose a RL based policy to solve the attacker’s problem and Critic network assisted Evolutionary Diversity Optimization based defensive policy to solve defender’s problem. Experimental results on synthetic AD graphs show that the proposed defensive policies are scalable, highly effective, approximate attacker’s problem accurately, and generate good defensive plans.

Adversarial Attacks in Machine Learning: Key Insights and Defense Approaches

There is a considerable threat present in genres such as machine learning due to adversarial attacks which include purposely feeding the system with data that will alter the decision region. These attacks are committed to presenting different data to machine learning models in a way that the model would be wrong in its classification or prediction. The field of study is still relatively young and has to develop strong bodies of scientific research that would eliminate the gaps in the current knowledge. This paper provides the literature review of adversarial attacks and defenses based on the highly cited articles and conference published in the Scopus database. Through the classification and assessment of 128 systematic articles: 80 original papers and 48 review papers till May 15, 2024, this study categorizes and reviews the literature from different domains, such as Graph Neural Networks, Deep Learning Models for IoT Systems, and others. The review posits findings on identified metrics, citation analysis, and contributions from these studies while suggesting the area’s further research and development for adversarial robustness’ and protection mechanisms. The identified objective of this work is to present the basic background of adversarial attacks and defenses, and the need for maintaining the adaptability of machine learning platforms. In this context, the objective is to contribute to building efficient and sustainable protection mechanisms for AI applications in various industries

Mitigating Adversarial Reconnaissance in IoT Anomaly Detection Systems: A Moving Target Defense Approach based on Reinforcement Learning

The machine learning (ML) community has extensively studied adversarial threats on learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. On the other hand, investigating the use of moving target defense (MTD) mechanisms in Internet of Things (IoT) networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite their computational deficiencies. In this paper, we propose a game-theoretic model of MTD to render the configuration and deployment of anomaly-based IDS more dynamic through diversification of feature training in order to minimize successful reconnaissance on ML-based IDS. We then solve the MTD problem using a reinforcement learning method to generate the optimal shifting policy within the network without a prior network transition model. The state-of-the-art ToN-IoT dataset is investigated for feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS is compared to a conventional IDS by analyzing the accuracy curve for varying attacker success rates. Our approach has proven effective in increasing the resilience of the IDS against adversarial learning.

A pool-based electricity retail markets integrating renewable energy sources and electric vehicles in the presence of demand response program and conditional value at risk to enhance energy security

In restructured power systems, energy security has become a critical concern, driven by changes in laws and regulations and underscored by a defensive approach implemented by the independent system operator. This alignment highlights a strong interdependence between energy security, energy supply, and the economic aspects of energy management. The paper explores how consumers energy supply in restructured systems can be managed through Demand-Side Management (DSM) and Demand Response (DR) programs, considering economic efficiency and risk in scenarios that include Renewable Energy Sources (RES), suitable storage systems, and electric vehicles (EVs). An energy security index is introduced to evaluate the impact of DR programs on both electrical and thermal energy, considering the economic risks involved. A hybrid pool-based electricity retail market approach is utilized to optimize energy security, supply, and consumption. The significant roles of RES, storage systems, and EVs are highlighted in this context. Economic and environmental optimization is achieved using the Conditional Value at Risk (CVaR) method, facilitating strategic decision-making under varied risk conditions. The energy supply security is further analyzed in the presence of electricity market retailers, exploring different pricing strategies. A Mixed-Integer Programming (MIP) model, implemented in GAMS software with the CONOPT solver, is used to examine pricing methods such as Time-of-Use (TOU) and real-time pricing. Findings reveal that DR programs lead to substantial increases in retailer profit and energy supply security value, with real-time pricing showing a significant 23.5 % increase in energy supply security value and a 24.5 % increase in retailer profit compared to fixed tariff pricing.

Mitigating adversarial threats in deep CT image diagnosis models via a dual-stage inference-time defense

Artificial intelligence (AI), particularly deep learning (DL) and machine learning (ML) have revolutionized disease diagnosis using complex medical images such as X-rays and CT scans, significantly improving accuracy in identifying various medical conditions. However, concerns arise regarding the trustworthiness of these models due to their vulnerability to adversarial attacks, potentially leading to inaccurate predictions. In response, we propose an innovative pipeline defensive approach that integrates denoising techniques like Total Variation Minimization (TVM) and Non-local (NL) means, followed by a fuzzy logic-based image transformer called Fuzzy Image Transformations (FIT). Deployed during the inferencing phase as a preprocessing module, this strategy aims to fortify DL medical diagnosis models, addressing adversarial vulnerabilities and ensuring their reliability in critical healthcare applications. Our focus is narrowed down to COVID-19 diagnosis, where we initially developed a model for accurately classifying lung CT images, covering both normal and COVID-19 pneumonia cases. Our experimental procedures, employing the Stratified K-Fold cross-validation method with K=5, systematically evaluate the model’s susceptibility to benchmark adversarial attacks such as the Fast Gradient Sign Method (FGSM), revealing a significant drop in aggregate average metrics across all folds under adversarial conditions. Specifically, precision (P), recall (R), accuracy (A), and F1-score (F) metrics decrease from 95.86 %, 96.16 %, 95.85 %, and 96.00–12.54 %, 13.13 %, 12.63 %, and 12.83 %, respectively. Notably, our proposed pipeline defense approach demonstrates substantial efficacy in enhancing diagnostic models, with average P, R, A, and F metrics improving impressively to 92.65 %, 92.39 %, 92.65 %, and 92.51 %, respectively, when applied to the same adversarial images. These promising results underscore the potential of our proposed pipeline defense techniques to enhance the resilience and reliability of AI-based diagnostic systems.

An exploratory data analysis of malware/ransomware cyberattacks: insights from an extensive cyber loss dataset

ABSTRACT This study comprehensively assesses ransomware/malware risks using the Advisen cyber loss dataset. It classifies malware types by frequency and financial impact, revealing that low-frequency attacks can cause significant economic damage. Some malware types incur extensive losses despite their rarity. The analysis highlights cybersecurity technologies like AI-based tools and Zero Trust Architecture (ZTA) for combating attacks. Large organizations and small businesses can adopt these defensive approaches across various industries. The study underscores the need for robust cybersecurity measures to prevent or mitigate future attacks, offering valuable insights into malware and ransomware patterns and trends, stressing adherence to frameworks, policies, and regulations.

A generic approach for network defense strategies generation based on evolutionary game theory

The generation of optimal defense strategies in dynamic adversarial environments is crucial for cybersecurity. Recently, defense approaches based on evolutionary game theory have gained significant achievements. However, they would fail when facing complex networks and sophisticated attack strategies, due to the fatal drawbacks of defense strategy generation considering atomic attacks only. To relieve this issue, a generic approach for generating defense strategies using evolutionary game theory is proposed in this paper. Initially, a novel payoff quantification method for network attack-defense games based on attack graphs is designed. Innovatively, two factors concerning the decision-maker's degree of irrationality (DI) and the level of environmental security (LES) are introduced into the replicator dynamics equation to model the impacts on equilibrium solutions. Noting that Active Directory (AD) domain service is one of the most used and representative information security management system in Windows domains, from which attack graphs and paths can be plainly extracted and analyzed. Therefore, it is necessary and imperative to anchor AD to unfold the theoretical analyses and experiments validation based on a real environment. Case studies on a real-world AD network demonstrate that the proposed approach is effective and can generate stable and efficient defense strategies.

Aflatoxins in Peanut (Arachis hypogaea): Prevalence, Global Health Concern, and Management from an Innovative Nanotechnology Approach: A Mechanistic Repertoire and Future Direction.

Arachis hypogaea is the most significant oilseed nutritious legume crop in agricultural trade across the world. It is recognized as a valued crop for its contributions to nourishing food, as a cooking oil, and for meeting the protein needs of people who are unable to afford animal protein. Currently, its production, marketability, and consumption are hindered because of Aspergillus species infection that consequently contaminates the kernels with aflatoxins. Regarding health concerns, humans and animals are affected by acute and chronic aflatoxin toxicity and millions of people are at high risk of chronic levels. Most methods used to store peanuts are traditional and serve effectively for short-term storage. Now the question for long-term storage has been raised, and this promptly finds potential approaches to the issue. It is imperative to reduce the aflatoxin levels in peanuts to a permissible level by introducing detoxifying innovations. Most of the detoxification reports mention physical, chemical, and biological techniques. However, many current approaches are impractical because of time consumption, loss of nutritional quality, or weak detoxifying efficiency. Therefore, it is crucial to investigate practical, economical, and green methods to control Aspergillus flavus that address current global food security problems. Herein, a green and economically revolutionary way is a nanotechnology that has demonstrated its potential to connect farmers to markets, elevate international marketability, improve human and animal health conditions, and enhance food quality and safety by the management of fungal diseases. Due to the antimicrobial potential of nanoparticles, they act as nanofungicides and have an incredible role in the control of aflatoxins. Nanoparticles have ultrasmall sizes and therefore penetrate the fungal body and invade the pathogen machinery, leading to fungal cell death by ROS production, mutation in DNA, disruption of organelles, and membrane leakage. This is the first mechanistic overview that unveils a comprehensive insight into aflatoxin contamination in peanuts, its prevalence, health effects, and management in addition to nanotechnological interventions that serve as a triple defense approach to detoxify aflatoxins. The optimum use of nanofungicides ensures food safety and the development of goals, especially "zero hunger".