Detection Of Replay Attacks Research Articles

Enhancing Unmanned Marine Vehicle Security: A Periodic Watermark-Based Detection of Replay Attacks

This paper explores a periodic watermark-based replay attack detection method for Unmanned Marine Vehicles modeled in the framework of the Takagi–Sugeno fuzzy system. The precise detection of replay attacks is crucial for ensuring the security of Unmanned Marine Vehicles; however, traditional timestamp-based or encoded measurement-dependent detection approaches often sacrifice system performance to achieve higher detection rates. To reduce the potential performance degradation, a periodic watermark-based detection scheme is developed, in which a compensation signal together with a periodic Gaussian watermark signal is integrated into the actuator. By compensation calculations conducted with all compensatory signals in each period, the position corresponding to a minimum value of the detection function can be derived. Then, the time that the attacks occurred can be ensured with the aid of the comparison between this position with the watermark signal in the same period. An application on a UMV is shown to demonstrate the effectiveness of the presented scheme in detecting replay attacks while minimizing control costs.

A New Lightweight Cryptographic Cipher for Detection and Prevention of Replay Attacks in Wireless Sensor Networks

A New Lightweight Cryptographic Cipher for Detection and Prevention of Replay Attacks in Wireless Sensor Networks

Replay Attack Detection Using Integrated Glottal Excitation Based Group Delay Function and Cepstral Features

The automatic speaker verification system is susceptible to replay attacks. Recent literature has focused on score-level integration of multiple features, phase information-based features, high frequency-based features, and glottal excitation for the detection of replay attacks. This work presents glottal excitation-based all-pole group delay function (GAPGDF) features for replay attack detection. The essence of a group delay function based on the all-pole model is to exploit information from the speech signal phase spectrum in an effective manner. Further, the performance of integrated high-frequency-based CQCC features with cepstral features, subband spectral centroid-based features (SCFC and SCMC), APGDF, and LPC-based features is evaluated on the ASVspoof 2017 version 2.0 database. On the development set, an EER of 3.08% is achieved, and on the evaluation set, an EER of 9.86% is achieved. The proposed GAPGDF features provide an EER of 10.5% on the evaluation set. Finally, integrated GAPGDF and GCQCC features provide an EER of 8.80% on the evaluation set. The computation time required for the ASV systems based on various integrated features is compared to ensure symmetry between the integrated features and the classifier.

A Data-Driven Framework for Verified Detection of Replay Attacks on Industrial Control Systems

A Data-Driven Framework for Verified Detection of Replay Attacks on Industrial Control Systems

Joint Watermarking-Based Replay Attack Detection for Industrial Process Operation Optimization Cyber-Physical Systems

This paper addresses the replay attack detection issue for a class of industrial process operation optimization (IPOO) cyber-physical systems (CPSs). In contrast to conventional CPSs with a single loop structure, the IPOO CPSs employ a dual-layer network environment consisting of a wireless network for the setpoint optimization loop and a CAN bus for the device control loop. Consequently, the issue of attack detection is more complicated for the IPOO CPSs, and this motivates our current research. First, a unified model of the IPOO CPS is built, with PI controller controlling the physical plants and LQG controller managing setpoint optimization. Then, a novel joint watermarking detection mechanism is established with the PI controller watermarking, LQG controller watermarking, and a watermarking compensator. The proposed watermarking compensator with an augmented Kalman filter is utilized to efficiently eliminate false alarms brought on by information interactions of the coupled cyber-layers, enabling the accurate detection and location of replay attacks. Furthermore, a linear relationship is established between watermarking parameters and system performance loss. Finally, simulations with a quadruple water tank system are conducted to verify the effectiveness of the proposed algorithm.

Sequential Detection of Replay Attacks

One of the most studied forms of attacks on the cyber-physical systems is the replay attack. The statistical similarities of the replayed signal and the true observations make the replay attack difficult to detect. In this article, we address the problem of replay attack detection by adding watermarking to the control inputs and then perform resilient detection using cumulative sum (CUSUM) test on the joint statistics of the innovation signal and the watermarking signal, whereas existing work considers only the marginal distribution of the innovation signal. We derive the expression of the Kullback–Liebler divergence (KLD) between the two joint distributions before and after the replay attack, which is, asymptotically, inversely proportional to the detection delay. We perform a structural analysis of the derived KLD expression and suggest a technique to improve the KLD for the systems with relative degree greater than one. A scheme to find the optimal watermarking signal variance for a fixed increase in the control cost to maximize the KLD under the CUSUM test is presented. We provide various numerical simulation results to support our theory. The proposed method is also compared with a state-of-the-art method based on the Neyman–Pearson detector, illustrating the smaller detection delay of the proposed sequential detector.

A practical physical watermarking approach to detect replay attacks in a CPS

Cyber Physical Systems (CPSs) are considered as an integration of computing, networking, and physical processes. In such systems physical processes are monitored and controlled by the combination of computation, communication, and control technologies. Examples of CPSs include process control systems, medical devices, robots, and critical infrastructures such as water treatment plants, water distribution systems, and power grid. Often, these systems are vulnerable to attacks as the cyber components such as Supervisory Control and Data Acquisition (SCADA) workstations, Human Machine Interface (HMI), and Programmable Logic Controllers (PLCs) are potential targets for attackers. Replay attacks are easy to perform on such systems and can potentially lead to significant damages to the system. Therefore, timely detection of replay attacks is important to mitigate the attack consequences. In this work, we propose a practical watermarking technique to detect the attacks. Experiments are performed on a real WAter DIstribution system (WADI) to explore how to tackle the replay attacks using watermarking signal.

A Novel Privacy Preserving Scheme for Smart Grid-Based Home Area Networks.

Despite the benefits of smart grids, concerns about security and privacy arise when a large number of heterogeneous devices communicate via a public network. A novel privacy-preserving method for smart grid-based home area networks (HAN) is proposed in this research. To aggregate data from diverse household appliances, the proposed approach uses homomorphic Paillier encryption, Chinese remainder theorem, and one-way hash function. The privacy in Internet of things (IoT)-enabled smart homes is one of the major concerns of the research community. In the proposed scheme, the sink node not only aggregates the data but also enables the early detection of false data injection and replay attacks. According to the security analysis, the proposed approach offers adequate security. The smart grid distributes power and facilitates a two-way communications channel that leads to transparency and developing trust.

Optimal Finite-time Watermark Signal Design for Replay Attack Detection using Zonotopes

This paper analyzes the injection of finite sequences as a physical watermarking method for the detection of sensor replay attacks under an unknown but zonotopically bounded uncertainty description. A temporal mismatch between the watermark sequences that are injected during the record and replay phases of the attack is achieved by splitting the input space into a pre-established number of sets. These sets are designed offline by solving an optimization problem whose solution guarantees that, in each set, there exists a finite sequence that ensures attack detection for all possible recorded watermarks belonging to any of the remaining sets. Additionally, several approaches for reducing the complexity of the optimization problem are discussed. The results are validated in simulation using a four-tanks system

An Event-Triggered Watermarking Strategy for Detection of Replay Attacks

The problem of detecting replay attacks in linear time-invariant discrete-time systems is considered in this paper. In the same spirit of watermarking techniques that apply a distinctive signature to the plant\’s signals, we propose an event-triggered control scheme, that is purposely designed to generate a unique sequence of switching intervals, by computing an appropriate input value to be held constant while the communication is not triggered. We provide a detailed undetectability characterization in the time domain and design a controller that achieves the desired behavior. Our proposed method results in a control scheme that makes it hard for an attacker to satisfy undetectability conditions, and, as a result, a standard observer-based residual generator can be employed to reveal replay attacks. We finally validate the method using a numerical example.

Detection of replay attacks to GNSS based on partial correlations and authentication data unpredictability

Intentional interference, and in particular GNSS spoofing, is currently one of the most significant concerns of the Positioning, Navigation and Timing (PNT) community. With the adoption of Open Service Navigation Message Authentication (OSNMA) in Galileo, the E1B signal component will continuously broadcast unpredictable cryptographic data. This allows GNSS receivers not only to ensure the authenticity of data origin but also to detect replay spoofing attacks for receivers already tracking real signals with relatively good visibility conditions. Since the spoofer needs to estimate the unpredictable bits introduced by OSNMA with almost zero delay in order to perform a Security Code Estimation and Replay (SCER) attack, the spoofer unavoidably introduces a slight distortion into the signal, which can be the basis of a spoofing detector. In this work, we propose five detectors based on partial correlations of GNSS signals obtained over predictable and unpredictable parts of the signals. We evaluate them in a wide set of test cases, including different types of receiver and spoofing conditions. The results show that one of the detectors is consistently superior to the others, and it is able to detect SCER attacks with a high probability even in favorable conditions for the spoofer. Finally, we discuss some practical considerations for implementing the proposed detector in receivers, in particular when the Galileo OSNMA message structure is used.

On Joint Optimization of Automatic Speaker Verification and Anti-Spoofing in the Embedding Space

Biometric systems are exposed to spoofing attacks which may compromise their security, and voice biometrics based on automatic speaker verification (ASV), is no exception. To increase the robustness against such attacks, anti-spoofing systems have been proposed for the detection of replay, synthesis and voice conversion-based attacks. However, most proposed anti-spoofing techniques are loosely integrated with the ASV system. In this work, we develop a new integration neural network which jointly processes the embeddings extracted from ASV and anti-spoofing systems in order to detect both zero-effort impostors and spoofing attacks. Moreover, we propose a new loss function based on the minimization of the area under the expected (AUE) performance and spoofability curve (EPSC), which allows us to optimize the integration neural network on the desired operating range in which the biometric system is expected to work. To evaluate our proposals, experiments were carried out on the recent ASVspoof 2019 corpus, including both logical access (LA) and physical access (PA) scenarios. The experimental results show that our proposal clearly outperforms some well-known techniques based on the integration at the score- and embedding-level. Specifically, our proposal achieves up to 23.62% and 22.03% relative equal error rate (EER) improvement over the best performing baseline in the LA and PA scenarios, respectively, as well as relative gains of 27.62% and 29.15% on the AUE metric.

A Switching Multiplicative Watermarking Scheme for Detection of Stealthy Cyber-Attacks

This article addresses the detection of stealthy attacks on sensor measurements. Inspired in authentication schemes with weak cryptographic guarantees, we propose a watermarking approach to validate the data and its source. In particular, we propose a multiplicative scheme, where the sensor outputs are watermarked by a bank of filters, then transmitted through the possibly unsecured communication network. The original measurement data are finally reconstructed by a watermark remover. To allow the detection of replay attacks, the watermarking filters are devised as hybrid switching systems, whose parameters are assumed to be unknown to the adversary. Design rules are provided, guaranteeing that the nominal closed-loop performance is not deteriorated by the watermarking scheme and ensuring robust stability with mismatched filter parameters. Moreover, we design a switching protocol with no communication overhead to allow the watermarking filters to synchronously update their parameters. The detectability properties of cyber-attacks are analyzed, and the results are illustrated through numerical examples for replay and data injection attacks.

A data‐based private learning framework for enhanced security against replay attacks in cyber‐physical systems

SummaryThis article develops a data‐based and private learning framework of the detection and mitigation against replay attacks for cyber‐physical systems. Optimal watermarking signals are added to assist in the detection of potential replay attacks. In order to improve the confidentiality of the output data, we first add a level of differential privacy. We then use a data‐based technique to learn the best defending strategy in the presence of worst case disturbances, stochastic noise, and replay attacks. A data‐based Neyman‐Pearson detector design is also proposed to identify replay attacks. Finally, simulation results show the efficacy of the proposed approach along with a comparison of our data‐based technique to a model‐based one.

A New Replay Attack Against Automatic Speaker Verification Systems

With the increasing popularity of automatic speaker verification (ASV), the reliability of ASV systems has also gained importance. ASV is vulnerable to various spoofing attacks, especially replay attacks. Thus, recent public competitions and studies based on spoofing attack detection for ASV have mainly focused on the detection of replay attacks. Generally, replayed speech includes the attributes of one playback and two recording devices: the playback device, the recording device used by the attacker, and the recording device embedded in any system to verify input utterances. Therefore, the main attributes differentiating a replayed speech from the genuine speech are the attributes of the playback and the recording devices used by the attacker. In this paper, we propose a novel replay attack and its defense through observation of the general speech-spoofing process. The proposed attack includes only the attribute of one recording device embedded in an ASV system; genuine speech passes through the recording device only once, and the replayed speech produced for the proposed attack passes through the same recording device twice. Because the proposed attack is feasible, it can be considered a new task for replay countermeasures in the training process in order to develop a robust ASV protection system. The experimental results show that this novel replay attack cannot be detected by several of the existing state-of-the-art replay attack detection systems. Furthermore, the new attack can be detected by the same systems successfully if they are retrained with an appropriate dataset designed for the new task.

Efficient Intrusion Detection With Bloom Filtering in Controller Area Networks

Due to its cost efficiency, the controller area network (CAN) is still the most wide-spread in-vehicle bus, and the numerous reported attacks demonstrate the urgency in designing new security solutions for CAN. In this paper, we propose an intrusion detection mechanism that takes advantage of Bloom filtering to test frame periodicity based on message identifiers and parts of the data-field which facilitates detection of potential replay or modification attacks. This proves to be an effective approach since most of the traffic from in-vehicle buses is cyclic in nature and the format of the data-field is fixed due to rigid signal allocation. Bloom filters provide an efficient time-memory tradeoff which is beneficial for the constrained resources of automotive grade controllers. We test the correctness of our approach and obtain good results on an industry-standard CANoe-based simulation for a J1939 commercial-vehicle bus and also on CAN with flexible data-rate traces obtained from a real-world high-end vehicle. The proposed filtering mechanism is straightforward to adapt for any other time-triggered in-vehicle bus, e.g., FlexRay, since it is built on time-driven characteristics.

Detection of replay attacks in cyber-physical systems using a frequency-based signature

This paper proposes a frequency-based approach for the detection of replay attacks affecting cyber-physical systems (CPS). In particular, the method employs a sinusoidal signal with a time-varying frequency (authentication signal) into the closed-loop system and checks whether the time profile of the frequency components in the output signal are compatible with the authentication signal or not. In order to carry out this target, the couplings between inputs and outputs are eliminated using a dynamic decoupling technique based on vector fitting. In this way, a signature introduced on a specific input channel will affect only the output that is selected to be associated with that input, which is a property that can be exploited to determine which channels are being affected. A bank of band-pass filters is used to generate signals whose energies can be compared to reconstruct an estimation of the time-varying frequency profile. By matching the known frequency profile with its estimation, the detector can provide the information about whether a replay attack is being carried out or not. The design of the signal generator and the detector are thoroughly discussed, and an example based on a quadruple-tank process is used to show the application and effectiveness of the proposed method.

Distributed watermarking for secure control of microgrids under replay attacks

Abstract The problem of replay attacks in the communication network between Distributed Generation Units (DGUs) of a DC microgrid is examined. The DGUs are regulated through a hierarchical control architecture, and are networked to achieve secondary control objectives. Following analysis of the detectability of replay attacks by a distributed monitoring scheme previously proposed, the need for a watermarking signal is identified. Hence, conditions are given on the watermark in order to guarantee detection of replay attacks, and such a signal is designed. Simulations are then presented to demonstrate the effectiveness of the technique.

Frequency-based detection of replay attacks: application to a multiple tank system

This paper presents a frequency-based method for detecting replay attacks and its application to a multiple tank system. This method introduces a sinusoidal signal with a time-varying frequency (authentication signature) into the closed-loop system and checks whether the output signal is compatible with the signature or not. The effectiveness of the method is illustrated through simulation scenarios using a 9-tank system under different situations.

Detection and Isolation of Replay Attacks through Sensor Watermarking

This paper addresses the detection and isolation of replay attacks on sensor measurements. As opposed to previously proposed additive watermarking, we propose a multiplicative watermarking scheme, where each sensor’s output is separately watermarked by being fed to a SISO watermark generator. Additionally, a set of equalizing filters is placed at the controller’s side, which reconstructs the original output signals from the received watermarked data. We show that the proposed scheme has several advantages over existing approaches: it has no detrimental effects on the closed-loop performance in the absence of attacks; it can be designed in a modular fashion, independently of the design of the controller and anomaly detector; it facilitates the detection of replay attacks and the isolation of the time at which the replayed data was recorded. These properties are discussed in detail and the results are illustrated through a numerical example.