Defense Scheme Research Articles

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants may upload arbitrary local updates to the central server to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematic comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg . We first survey existing Byzantine attack strategies and Byzantine-robust aggregation schemes that aim to defend against Byzantine attacks. We also propose a new scheme, ClippedClustering , to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our results show that these aggregation schemes sustain relatively high accuracy in some cases but are ineffective in others. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and IID local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. We conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets.

A novel Distributed Denial of Service attack defense scheme for Software-Defined Networking using Packet-In message and frequency domain analysis

Software-Defined Networking (SDN) enhances network management by improving adaptability, flexibility, and scalability. However, its centralized controller is vulnerable to Distributed Denial of Service (DDoS) attacks that can disrupt network availability. This study introduces a novel real-time DDoS detection scheme integrated into the SDN controller. The scheme uses a two-step process to analyze Packet-In messages in both time and frequency domains. A time-series is generated by sampling the number of Packet-In messages at specific time intervals, which is compared against a predefined threshold. If exceeded, frequency domain analysis is applied to extract features, which are then used by Machine Learning (ML) algorithms to identify DDoS attacks. The scheme achieves 99.85% accuracy in distinguishing normal traffic from attack traffic, demonstrating its effectiveness in safeguarding SDN environments from DDoS threats.

Fake Base Station Detection and Link Routing Defense

Fake base stations comprise a critical security issue in mobile networking. A fake base station exploits vulnerabilities in the broadcast message announcing a base station’s presence, which is called SIB1 in 4G LTE and 5G NR, to get user equipment to connect to the fake base station. Once connected, the fake base station can deprive the user of connectivity and access to the Internet/cloud. We discovered that a fake base station can disable the victim user equipment’s connectivity for an indefinite period of time, which we validated using our threat prototype against current 4G/5G practices. We designed and built a defense scheme which detects and blacklists a fake base station and then, informed by the detection, avoids it through link routing for connectivity availability. For detection and blacklisting, our scheme uses the real-time information of both the time duration and the number of request transmissions, the features of which are directly impacted by the fake base station’s threat and which have not been studied in previous research. Upon detection, our scheme takes an active measure called link routing, which is a novel concept in mobile/4G/5G networking, where the user equipment routes the connectivity request to another base station. To defend against a Sybil-capable fake base station, we use a history–reputation-based link routing scheme for routing and base station selection. We implemented both the base station and the user on software-defined radios using open-source 5G software (srsRAN v23.10 and Open5GS v2.6.6) for validation. We varied the base station implementation to simulate legitimate vs. faulty but legitimate vs. fake and malicious base stations, where a faulty base station notifies the user of the connectivity disruption and releases the session, while a fake base station continues to hold the session. We empirically analyzed the detection and identification thresholds, which vary with the fake base station’s power and the channel condition. By strategically selecting the threshold parameters, our scheme provides zero errors, including zero false positives, to avoid blacklisting a temporarily faulty base station that cannot provide connectivity at the time. Furthermore, our link routing scheme enables the base station to switch in order to restore the connectivity availability and limit the threat impact. We also discuss future directions to facilitate and encourage R&D in securing telecommunications and base station security.

Resilient Cruise Control of Heterogeneous Platoons Against Byzantine Attacks: Theory and Experiment.

This article studies the problem of the resilient cruise control in heterogeneous vehicle platoons against f -local Byzantine attacks (BAs). Agents under BAs become traitors of the swarm, who try to mislead its neighbors while adopting wrong inputs. Thus, BAs are extremely challenging to be suppressed. This study introduces a novel hierarchical protocol characterized by a virtual twin layer (TL), motivated by the rationale of digital twin. This protocol separates the defense scheme against f -local BAs into two parts: one defense scheme against Byzantine edge attacks (BEAs) via the TL and another scheme against Byzantine node attacks (BNAs) via the cyber-physical layer (CPL). The TL employs a trusted-edge strategy, enhancing the network resilience by incorporating a minimal fraction of the key edges. It is rigorously proven that a TL topology meeting strong (2f+1) -robustness is sufficient for achieving distributed resilient estimation against BEAs. On the CPL, a series of decentralized chattering-free controllers is proposed, guaranteeing the resilient cruise tracking of heterogeneous platoons against exponentially unbounded BNAs. Besides, these controllers can achieve uniformly ultimately bounded convergence. The theoretical results' effectiveness and practicality are validated through a numerical simulation example and an unmanned ground vehicle experiment involving heterogeneous platoons against f -local BAs.

FloodKnight: an intelligent DDoS defense scheme to combat attacks near attack entry points

FloodKnight: an intelligent DDoS defense scheme to combat attacks near attack entry points

Synchronizing real-time and high-precision LDoS defense of learning model-based in AIoT with programmable data plane, SDN

The availability of SD-AIoT is currently under complicated and serious cyber threats, especially Low-rate Denial-of-Service attacks. However, traditional defense schemes for such attacks with characteristics of high concealability and periodicity suffer from serious challenges with high detection difficulty, low accuracy of detection models, and inefficiency of mitigation approaches. In this paper, one novel cooperative defense scheme against hybrid LDoS attacks is proposed, which consists of a timely-response hardware-based Renyi Entropy edge checkpoint intent detection algorithm, the high-precision detection mechanism based on a hybrid deep learning model, and a Markov-chain-based differential rate-limiting mitigation strategy. The detection algorithm deployed at the edge checkpoint activates a hybrid CNN-RF-based deep learning model after filtering the intent information of the flows to detect which are malicious LDoS flows with high accuracy, where the multi-stage detection scheme not only extracts and learns the hidden features of the flow data, but also has better representation capabilities. Enhanced dynamic threshold-based whitelisting automatically adapts to the real-time state of the network environment to improve mitigation flexibility. Markov chain-based differential rate-limiting mitigation strategy reduces the packet loss error rate to mitigate network attacks promptly and ensures the continuation of network services. The results of several comparative experiments show that the proposed scheme detects LDoS attacks more accurately and mitigates them more effectively than traditional schemes.

Battery Energy Storage System (BESS) as a voltage control at substation based on the defense scheme mechanism

Battery Energy Storage System (BESS) as a voltage control at substation based on the defense scheme mechanism

State estimation for linear discrete-time systems with binary-valued quantized innovations against data tampering attacks

In today’s information era, cyber–physical systems (CPS) have been widely used in many industrial and infrastructure fields, and the study of security problems of CPS has become a crucial issue. For linear discrete-time systems, this paper investigates the state estimation problem based on the quantized innovations and transmission data tampering scenarios. From the attacker’s view, by designing the tampering matrix and combining the property of the error function, the optimal attack strategy in the sense of maximizing the prediction error covariance matrix is given. From the defender’s view, the optimal defense scheme based on multiplicative compensation is given in the case of a known attack strategy. Moreover, in the case of unknown attack strategies, a joint estimation algorithm is designed to give the optimal defense scheme subject to error constraints. In this paper, state estimators in recursive form are given for all above cases, and the algorithms are proved to be consistent. The theoretical results obtained are verified by simulations.

Privacy preserving and secure robust federated learning: A survey

SummaryFederated learning (FL) has emerged as a promising solution to address the challenges posed by data silos and the need for global data fusion. It offers a distributed machine learning framework with privacy‐preserving features, allowing model training without the need to collect user data. However, FL also presents significant security and privacy threats that hinder its widespread adoption. The requirements of privacy and security in FL are inherently conflicting. Privacy necessitates the concealment of individual client updates, while security requires the disclosure of client updates to detect anomalies. While most existing research focused on the privacy and security aspects of FL, very few studies have addressed the compatibility of these two demands. In this work, we aim to bridge this gap by proposing a comprehensive defense scheme that ensures privacy, security, and compatibility in FL. We categorize the existing literature into two key directions: privacy defense and security defense. Privacy defense includes methods based on additive masks, differential privacy, homomorphic encryption, and trusted execution environment, whereas security defense encompasses distance‐, performance‐, clustering‐, and similarity‐based anomaly detection techniques and statistical information‐based anomaly update bypassing techniques when the server is trusted and privacy‐compatible anomaly update detection techniques when the server is not trusted. In addition, this article presents decentralized FL solutions based on blockchain. For each direction, we discuss specific technical solutions, their advantages, and disadvantages. By evaluating various defense methods, we identify the most suitable approach to address the primary challenge of “achieving a secure and robust FL system against malicious adversaries while protecting users' privacy.” We then propose a theoretical reference framework for end‐to‐end protection of privacy and security in FL for the key problem, which summarizes the attack surface of FL systems from the client to the server under the security model where the client and server are malicious. Leveraging the strengths and characteristics of existing schemes, our proposed framework integrates multiple techniques to strike a balance between privacy, usability, and efficiency. This framework serves as a valuable reference and provides insights for future work in the field. Finally, we also provide recommendations for future research directions in this field.

NLPSweep: A comprehensive defense scheme for mitigating NLP backdoor attacks

Natural language processing (NLP) backdoor attacks have become a hidden threat to modern NLP applications. Most of the existing defense methods defend against specific types of backdoor attacks, and they generally fail to defend against invisible backdoors with syntactically correct triggers. This paper proposes NLPSweep, a comprehensive defense scheme that can defend against five common types of backdoor attacks, namely, character, word, sentence, homograph, and learnable textual attacks. Specifically, we propose a framework that can discover an effective defense solution without prior knowledge of the attacks. The defense solution is optimized from the framework and can defend against various attacks while ensuring high accuracy. Finally, we verify the effectiveness of NLPSweep on two pretrained models (BERT and XLNET) on three classic datasets (SST-2, IMDB, and OLID) and compare it with five state-of-the-art defense methods, namely, ONION, Pred, RAP, Fine-pruning, and STRIP. The experimental results demonstrate that NLPSweep has an average model accuracy (ACC) greater than 0.922 and that the average attack success rate (ASR) is only 0.202, outperforming the compared methods. Furthermore, NLPSweep is tested on the real-world Yelp dataset and it can effectively defend against backdoor attacks with the ASR less than 0.07 and the ACC greater than 0.973.1

Post Operational Optimization of Adaptive Overload Shedding Protection in the Bali Island Sub-system using the ADS Simulation

The Bali electrical network sub system is supported by the Java-Bali power transfer assisted by the Bali power generation. Most of these power plants are not economical, so the Java-Bali power transfer is prioritized. If an island operation occurs, the Bali sub system loses most of the power that supports its load. This loss of power can result in a black out. The Bali sub system must perform overload shedding equal to the loss of Java-Bali power transfer. However, because the magnitude of the Java-Bali power transfer is very dynamic, the amount of Over Load Shedding (OLS) is difficult to predict, so an optimization system is required that can calculate the amount of OLS according to the Java-Bali power transfer at any time. The optimization system can also determine OLS targets before Faults occur based on the Priority Scale. To ensure that the Optimization System has worked properly, an Adaptive Defense Scheme (ADS) simulation was created. In this simulation, the optimization system will be tested using the ADS simulation series. In this simulation, the optimization system will be tested using the ADS simulation series. This system is simulated so that it can work OLS target off contact. This system will be tested for the suitability of the load selection with the amount of Java-Bali power transfer. The load selection is compared with manual calculations using the same method to ensure the optimization system calculations are appropriate. Comparison between the selection of targets for the optimization system with calculations, and working contacts is made by making a suitability matrix. From the tests carried out, it was obtained that OLS System Optimization System target size was calculated with a maximum deviation of 5.5%, a minimum deviation of 0.037%, and an average deviation of 1.03%. The system is also capable of selecting targets with 100% accuracy and can also perform MTDS digital output according to 100% accuracy, that the operational system efficiency can be achieved very significantly.

Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN

The availability of SD-IoT is now under complex and serious cyber threats, especially distributed denial-of-service attacks. However, traditional defense schemes suffer from coarse-grained centralized sampling approaches, low accuracy of detection models, and inefficient mitigation methods. In this paper, a novel DDoS defense scheme is proposed, which consists of a high-accuracy detection mechanism based on a Graph Convolutional Neural Network learning model and a mitigation mechanism based on fast traffic migration. In the detection stage, a fine-grained INT sampling approach is utilized to obtain multidimensional network topology and status information. The Graph Convolutional Neural Network learning model detects switches containing DDoS attack traffic with high accuracy because the detection model not only extracts and utilizes multiple temporal and spatial features of the collected information, but also has a better learning and representation capability. In the mitigation stage, the enhanced whitelist with dynamic threshold-based values is automatically adapted to the real-time state of the network environment for enhanced mitigation flexibility. The fast programmable segment rerouting strategy can block attack traffic in time and ensure the continuity of network services. The results of several comparison experiments show that the proposed scheme can detect DDoS attacks more accurately and mitigate them more effectively than traditional schemes.

Securing Autonomous Vehicles Visual Perception: Adversarial Patch Attack and Defense Schemes With Experimental Validations

Securing Autonomous Vehicles Visual Perception: Adversarial Patch Attack and Defense Schemes With Experimental Validations

AN-GCN: An Anonymous Graph Convolutional Network Against Edge-Perturbing Attacks.

Recent studies have revealed the vulnerability of graph convolutional networks (GCNs) to edge-perturbing attacks, such as maliciously inserting or deleting graph edges. However, theoretical proof of such vulnerability remains a big challenge, and effective defense schemes are still open issues. In this article, we first generalize the formulation of edge-perturbing attacks and strictly prove the vulnerability of GCNs to such attacks in node classification tasks. Following this, an anonymous GCN, named AN-GCN, is proposed to defend against edge-perturbing attacks. In particular, we present a node localization theorem to demonstrate how GCNs locate nodes during their training phase. In addition, we design a staggered Gaussian noise-based node position generator and a spectral graph convolution-based discriminator (in detecting the generated node positions). Furthermore, we provide an optimization method for the designed generator and discriminator. It is demonstrated that the AN-GCN is secure against edge-perturbing attacks in node classification tasks, as AN-GCN is developed to classify nodes without the edge information (making it impossible for attackers to perturb edges anymore). Extensive evaluations verify the effectiveness of the general edge-perturbing attack (G-EPA) model in manipulating the classification results of the target nodes. More importantly, the proposed AN-GCN can achieve 82.7% in node classification accuracy without the edge-reading permission, which outperforms the state-of-the-art GCN.

Secure Consensus Control of Multiagent Systems Under DoS Attacks: A Switching-Scheme-Based Active Defense Method.

This article studies the secure consensus control problem of multiagent systems (MASs) with a nonzero input leader subject to denial-of-service (DoS) attacks. The introduction of backup topologies makes it possible for MASs to actively defend against DoS attacks. Subsequently, a novel active defense method consisting of two types of state observers, an adaptive topology switching mechanism, and switching controllers is proposed, which can ensure the leader-follower bound consensus even if DoS attacks hinder the interaction between agents. Within such a defense framework, the switching mechanism, driven by the predefined performance index and designed monitoring function, can automatically search for a healthy communication graph among backup topologies. Concurrently, the observer-based switching control strategy will be modified to match the corresponding topology, in which the universal observer and controller parameters in different topologies are obtained by solving linear matrix inequalities. It should be highlighted that the developed defense scheme not only removes the limitations of existing results on the duration and frequency of DoS attacks but also ensures the same upper bound of consensus error before and after DoS attacks. Finally, several simulation examples for different systems illustrate the efficiency and superiority of the theoretical results.

CMTD:A fast Moving Target Defense Scheme based on CFL Authentication

CMTD:A fast Moving Target Defense Scheme based on CFL Authentication

Resilient Optimal Defensive Strategy of Micro-Grids System via Distributed Deep Reinforcement Learning Approach Against FDI Attack.

The ever-increasing false data injection (FDI) attack on the demand side brings great challenges to the energy management of interconnected microgrids. To address those aspects, this article proposes a resilient optimal defensive strategy with the distributed deep reinforcement learning (DRL) approach. To evaluate the FDI attack on demand response (DR), an online evaluation approach with the recursive least-square (RLS) method is proposed to evaluate the extent of supply security or voltage stability of the microgrids system is affected by the FDI attack. On the basis of evaluated security confidence, a distributed actor network learning approach is proposed to deduce optimal network weight, which can generate an optimal defensive scheme to ensure the economic and security issue of the microgrids system. From the methodology's view, it can also enhance the autonomy of each microgrid as well as accelerate DRL efficiency. According to those simulation results, it can reveal that the proposed method can evaluate FDI attack impact well and an improved distributed DRL approach can be a viable and promising way for the optimal defense of microgrids against the FDI attack on the demand side.

Active Interdiction Defence Scheme Against False Data-Injection Attacks: A Stackelberg Game Perspective.

The security issue is of the fundamental importance for cyber-physical systems (CPSs) due to the vulnerability to cyber attacks. In this article, an active interdiction defence scheme is proposed as an extra safeguard against the strategic false data-injection (FDI) attacker. To tackle the coupling between the decision-making processes of the FDI attacker and the active interdiction defence scheme, a framework of dynamic Stackelberg game is formulated to characterize the hierarchical interaction due to their asymmetric information structures. Subsequently, the Stackelberg strategies of both players are constructed. Furthermore, a sufficient condition is derived to guarantee asymptotic stability of the closed-loop system with the FDI attack and the active interdiction defence scheme. Finally, two simulation examples are provided to illustrate the correctness and effectiveness of the proposed active interdiction defence scheme.

DeepDIST: A Black-Box Anti-Collusion Framework for Secure Distribution of Deep Models

Due to enormous computing and storage overhead for well-trained Deep Neural Network (DNN) models, protecting the intellectual property of model owners is a pressing need. As the commercialization of deep models is becoming increasingly popular, the pre-trained models delivered to users may suffer from being illegally copied, redistributed, or abused. In this paper, we propose DeepDIST, the first end-to-end secure DNNs distribution framework in a black-box scenario. Specifically, our framework adopts a dual-level fingerprint (FP) mechanism to provide reliable ownership verification, and proposes two equivalent transformations that can resist collusion attacks, plus a newly designed similarity loss term to improve the security of the transformations. Unlike the existing passive defense schemes that detect colluding participants, we introduce an active defense strategy, namely damaging the performance of the model after the malicious collusion. The extensive experimental results show that DeepDIST can maintain the accuracy of the host DNN after embedding fingerprint conducted for true traitor tracing, and is robust against several popular model modifications. Furthermore, the anti-collusion effect is evaluated on two typical classification tasks (10-class and 100-class), and the proposed DeepDIST can drop the prediction accuracy of the collusion model to 10% and 1% (random guess), respectively.

FLPM: A property modification scheme for data protection in federated learning

Federated learning (FL) is a critical technology for implementing time-critical computing systems in the Internet of Things (IoT). It allows for continuous updates to machine learning (ML) models across IoT devices. However, the vulnerability of ML models and the complexity of IoT pose significant threats to device data security and privacy, affecting the robustness of time-critical computing systems constructed through FL. Recent research on FL data protection has made progress, but challenges remain in balancing privacy protection with model availability. For example, cryptography-based defense schemes increase time overhead in time-critical computing systems, while differential privacy negatively impacts system performance. This paper proposes the FL properties modification scheme (FLPM) for data preprocessing to resist property inference attacks and data poisoning attacks. FLPM modifies training data properties using algorithms for property separation, selection, and control based on continuous latent variables. While this sacrifices a small amount of classification accuracy, it significantly improves data protection capabilities. Detailed experimental results demonstrate that FLPM successfully separates and controls image property vectors. In the FL classification task, the property modification data achieve a precision of 94.44%. This scheme effectively prevents property inference attacks and data poisoning attacks. FLPM can reduce the AUC score for property inference attacks from 0.94 to 0.56 and reduce the success rate of data poisoning attacks to 5.13%, 7.07%, and 4.60%.