Disruption Attacks Research Articles

Defesa cibernética na guerra russo-ucraniana: um mapeamento dos ataques cibernéticos às infraestruturas críticas da Ucrânia

What cyberattacks did Ukraine’s critical infrastructure experience between February 2022 and February 2023 during the Russo-Ukrainian war? In recent months, Ukraine has experienced a significant increase in cyberattacks on its critical infrastructure. Therefore, the purpose of this study is to analyze the cyberattacks suffered by Ukraine’s critical infrastructure within the selected cutout. A mixed method research approach was used, operationalized through descriptive statistics, documentary analysis, and a systematic literature review. Based on the analyzed data from the CyberPeace Institute, the sector most affected was public administration (66), with the Disruption attack category being the most utilized (139). The types of cyberattacks were also evaluated, with the DDoS type being the most common (135). The collective (124), especially the People’s CyberArmy (48), was the most common in the actor category. In conclusion, we can say that attacks on critical infrastructure are a matter of national defense, which requires a revision of legislation on this issue and ensuring that the responsible bodies are prepared for future challenges.

Detection and mitigation of vehicle platooning disruption attacks

In response to the escalating challenges posed by traffic bottlenecks, accidents, and intersection delays, the deployment of platooning mechanisms emerges as an imperative remedy. This investigation revolves around a pivotal scenario wherein a closely-knit platoon of cooperative vehicles approaches an intersection. Orchestrated by a lead vehicle, this convoy navigates the traffic light to expedite the journey of its followers towards their respective destinations. However, given that the size of the platoon can be increased, it will become difficult for the leader to manage it smoothly. Therefore, dividing the platoon into small groups led by co-leaders who deal directly with the leader is considered an ideal solution to speed up and facilitate the process of maintaining platoon stability. In this paper, we propose a Cooperative Adaptive Platooning Control Algorithm (CAPCA) for the hybrid communication topology in platooning. In fact, CAPCA aims to achieve stability in the platoon by distributing tasks in a parallel manner to mini-platoons. Moreover, inherent complexities arise as select members within the platoon strive to undermine its stability. Within this context, the research addresses the intricacies of Vehicle Platooning Disruption (VPD) attacks, a menacing phenomenon characterized by deliberate efforts to destabilize or seize control of a platoon. These attacks manifest through tactics such as false data injection (FDI) and replaying of control messages. In response, a robust and multifaceted countermeasure is conceptualized. The Vehicle Platooning Disruption Attacks Detection Protocol (VPD-ADP) takes center stage as a foundational component. By identifying instability within the platoon's dynamics model, VPD-ADP lays the essential groundwork for mitigating the repercussions of FDI and replay attacks. Employing advanced stochastic time series analysis, the impact of VPD attacks is scrutinized via anomalies in the Cartesian coordinates of vehicles deviations from the trajectory anticipated by the platoon. Moreover, the study introduces the Reputation-based Reliable Mitigation Protocol (RRMP), a pioneering approach that leverages collaborative data gleaned from neighboring vehicles. RRMP is devised to assess the veracity of received messages and gauge their reliability in real-time. Through extensive simulations and experiments, the proposed approach's effectiveness in fortifying the resilience of vehicle platooning systems against an array of disruption attacks is convincingly demonstrated.

Controller Hardware-in-the-Loop Testbed of a Distributed Consensus Multi-Agent System Control under Deception and Disruption Cyber-Attacks

The impact of communication disturbances on microgrids (MGs) needs robust and scalable Information Communication Technology (ICT) infrastructure for efficient MG control. This work builds on advances in the Internet of Things (IoT) to provide a practical platform for testing the impact of various cyber-attacks on a distributed control scheme for a Multi-Agent System (MAS). This paper presents a Controller Hardware-in-the-Loop (CHIL) testbed to investigate the impact of various cyber-attacks and communication disruptions on MGs. A distributed consensus secondary control scheme for a MAS within an MG cyber-physical system (CPS) is proposed. The proposed cyber-physical testbed integrates a real-time islanded AC microgrid on RT-Lab, secondary controllers implemented on single-board computers, and an attacker agent on another single-board computer. Communication occurs via a UDP/IP network between OPAL-RT and controller agents, as well as between the agents. Through meticulous experimentation, the efficacy of the proposed control strategy using the developed platform is validated. Various attacks were modeled and launched including deception attacks on sensors, actuators, and their combinations, as well as disruption attacks. The ramifications of both deception and disruption cyber-attacks on system performance are analyzed.

Gradient-guided hierarchical feature attack for object detector

Deep neural networks (DNNs) are vulnerable to adversarial attacks, which can cause security risks in computer information systems. Feature disruption attacks, as a typical form of adversarial attack, optimize adversarial examples by disrupting the intermediate features extracted by DNN. The existing feature disruption attacks have limitations when it comes to objects of different scales within resolution features, favoring low-resolution feature maps and low-scoring objects. The imbalance above affects their effectiveness in object detection tasks. Gradient-guided Hierarchical Feature Attack (GHFA) is proposed to solve these problems, which disrupts detector-extracted features using gradient-guided feature weighting. GHFA incorporates receptive field scaling and gradient scaling to balance the focus among feature maps and enhance attack performance. The evaluation of GHFA on 9 object detectors demonstrates its superior transferability compared with the 6 comparative methods, surpassing the second-ranked method by 2.4%. Furthermore, the real-world applicability of GHFA is validated available by testing it on a commercial online object detection platform.

Exploring Machine Learning Methods for IoT Network Intrusion Detection Systems

An ad hoc network is a transient network that is self-organizing and does not require any infrastructure. Therefore, the majority of its applications are in the field of military work and disaster assistance. Because of wireless connectivity and the ability to organize itself, ad hoc networks are becoming more common. Susceptible to a greater number of breaches or assaults than the conventional system. Blackhole assault is a significant routing disruption attack that a rogue node promotes itself as being capable of. as a step along the way to the final destination. In this research, we simulated a black hole using computer models. Assault in a setting with ad hoc networking, as well as data collection of important features for the purpose of classifying aggressive behaviour. Then, several different approaches to machine learning have been developed. utilized for the classification of information regarding benign and harmful packets. It seems to imply. a novel method for the selection of certain features, the gathering of crucial information, and the intrusion detection in an ad hoc network with the application of machine learning algorithms.

Novel deep learning approach for DDoS attack using elephant heard optimization algorithm along with a fuzzy classifier for rules learning

The research aims to provide network security so that it can be protected from several attacks, especially DoS (Denial-of-Service) or DDoS (Distributed Denial-of-Service) attacks that could at some point render the server inoperable. Security is one of the main obstacles. There are a lot of network risks and attacks available today. One of the most common and disruptive attacks is a DDoS attack. In this study, upgraded deep learning Elephant Herd Optimization with random forest classifier is employed for early DDos attack detection. The DDoS dataset’s number of characteristics is decreased by the proposed IDN-EHO method for classifying data learning that works with a lot of data. In the feature extraction stage, deep neural networks (DNN) approach is used, and the classified data packages are compared to return the DDoS attack traffic characteristics with a significant percentage. In the classification stage, the proposed deep learning Elephant Herd Optimization with random forest classifier used to classify the data learning which deal with a huge amount of data and minimise the number of features of the DDoS dataset. During the detection step, when the extracted features are used as input features, the attack detection model is trained using the improved deep learning Elephant Herd Optimization. The proposed framework has the potential to be a promising method for identifying unidentified DDoS attacks, according to experiments. 99% recall, precision, and accuracy can be attained using the suggested strategy, according on the findings of the experiments.

Potential cyber threats of adversarial attacks on autonomous driving models

Autonomous Vehicles (CAVs) are currently seen as a viable alternative to traditional vehicles. However, CAVs will face serious cyber threats because many components of the driving system are based on machine learning models and are vulnerable to adversary attacks. We have reviewed the scientific literature and highlighted the main types of disruptive attacks on autonomous driving models that pose potential threats to CAVs. In this paper, we have compiled a dataset with traffic sign images obtained from public sources. We made experiments in which we distorted the original images and used them to train deep neural network-based classification models. The experiments demonstrated a possible threat to traffic sign recognition by autonomous vehicles. This work can give researchers and engineers a better understanding of the current state and trends in CAV security for their future use.

Ambient Intelligence for Securing Intelligent Vehicular Networks: Edge-Enabled Intrusion and Anomaly Detection Strategies

The Internet of Things (IoT) is increasingly being deployed in smart city applications such as vehicular networks. The presence of a large number of communicating vehicles greatly increases the number and types of possible anomalies in the network. These anomalies could range from faulty vehicular data being broadcast by the vehicles to more catastrophic attacks such as disruptive attacks and Denial of Service (DoS) attacks to name a few. This calls for a need to develop robust security schemes such as intrusion detection and anomaly detection schemes. With a humongous growth in the amount of vehicular traffic data expected, artificial intelligence (AI)-based detection strategies need to be developed to address this burgeoning demand. In this article, we propose three AI-based intrusion detection strategies for vehicular network applications, leading to an effective Ambient Intelligence based vehicular network paradigm. The detection tasks are run on local edge servers deployed at the network edge. By showing the prediction results on an experimental testbed emulating the edge servers, we show the feasibility of deploying the proposed strategies in the vehicular network scenario.

Redundancy Planning for Cost Efficient Resilience to Cyber Attacks

We investigate the extent to which redundancy (including with diversity) can help mitigate the impact of cyber attacks that aim to reduce system performance. Using analytical techniques, we estimate impacts, in terms of monetary costs, of penalties from breaching Service Level Agreements (SLAs), and find optimal resource allocations to minimize the overall costs arising from attacks. Our approach combines attack impact analysis, based on performance modeling using queueing networks, with an attack model based on attack graphs. We evaluate our approach using a case study of a website, and show how resource redundancy and diversity can improve the resilience of a system by reducing the likelihood of a fully disruptive attack. We find that the cost-effectiveness of redundancy depends on the SLA terms, the probability of attack detection, the time to recover, and the cost of maintenance. In our case study, redundancy with diversity achieved a saving of up to around 50 percent in expected attack costs relative to no redundancy. The overall benefit over time depends on how the saving during attacks compares to the added maintenance costs due to redundancy.

Synchronizing DDoS defense at network edge with P4, SDN, and Blockchain

Botnet-originated DDoS attacks continue to plague the internet and disrupt services for legitimate users. While various proposals have been presented in the last two decades, the botnet still has advantages over the defenders, because botnets have orchestrated processes to launch disruptive attacks. On the other hand, the defenders use manual methods, siloed tools, and lack orchestration among different organizations. These unorchestrated efforts slow down the attack response and extend the lifespan of botnet attacks. This article presents shieldSDN and shieldCHAIN, an inter-organization collaborative defense framework using P4, SDN , and Blockchain , which extends our earlier research on microVNF, a solution of Edge security for SIP-enabled IoT devices with P4. Besides mitigating DDoS attacks, microVNF also produces attack fingerprints called Indicator of Compromise (IOC) records. ShieldSDN and shieldCHAIN distribute these IOCs to other organizations so that they can create their own packet filters . Effectively, shieldSDN and shieldCHAIN synchronize packet filters for different organizations to mitigate against the same botnet strain. Four experiments were performed successfully to validate the functionalities of shieldSDN and shieldCHAIN. The scope for the first experiment was intra-company, while the second, third, and fourth experiments were inter-company. In the first experiment, shieldSDN extracted IOCs from the source switch and installed these as packet filters on other switches within the same organization (in the U.S.). In the second experiment, the shieldCHAIN in the publishing organization (in the U.S.) shared IOCs by posting them to the Blockchain. In the third experiment, the shieldCHAIN in the subscriber organizations (in Singapore & the U.K.) retrieved these IOCs from Blockchain. Finally, in the last experiment, the shieldCHAIN in the subscriber organizations installed the retrieved IOCs as packet filters; that are identical to those in the originating organization. To the best of our knowledge, this is the first framework that uses the P4 switch, SDN controller, and Blockchain together for this use case. As SDN and Blockchain gain acceptance, this framework empowers community members to collaborate and defend against botnet DDoS attacks.

Stealthy attacks and attack-resilient interval observers

Industrial control systems have been frequent targets of cyber attacks during the last decade. Adversaries can hinder the safe operation of these systems by tampering with their sensors and actuators, while ensuring that the monitoring systems are not able to detect such attacks in time. This paper presents methods to design and overcome stealthy attacks on linear time-invariant control systems that estimate their state using an interval observer, in the presence of unknown but bounded noise and perturbations. We analyze scenarios in which a malicious agent compromises the sensors and/or the actuators of the system with additive attack signals to steer the state estimate outside of the bounds provided by the interval observer. We first show that maximally disruptive attack sequences that remain undetected by a linear monitor can be computed recursively via linear programming. We then design an attack-resilient interval observer for the system’s state, identifying sufficient conditions on the sensor data for such an observer to be realizable. We propose a computational method to determine optimal observer gains using semi-definite programming and compute bounds for the unknown attack signal as well. In numerical simulations, we illustrate and compare the ability of such interval observers to still provide accurate estimates when under attack.

Resilient Consensus-Based AC Optimal Power Flow Against Data Integrity Attacks Using PLC

This paper investigates the resilience of consensus-based AC optimal power flow (OPF) for distribution networks against the data integrity attacks (DIA). The distribution network is first decomposed into several autonomous microgrids to achieve consensus-based AC OPF through the alternating direction multiplier method (ADMM). Then the vulnerability of consensus-based AC OPF is analyzed by showing how the dispatch results can be easily altered by attackers through falsifying the information (active power, reactive power, and voltage) shared between neighboring microgrids. Two different attack scenarios, viz., economic-driven attacks and disruptive attacks, are studied to show the malicious influence of cyber attacks on consensus-based AC OPF. A detection and mitigation strategy based on the existing power line communication (PLC) infrastructure is then described, where the critical information is not only shared in the cyber layer, but also through the power lines. Game-theoretic analysis is provided to demonstrate the effectiveness of the proposed mitigation strategy. Furthermore, to validate the authenticity of the information through PLC, a physical encryption method based on the Lorenz system is proposed. The effectiveness of the proposed attack-resilient mechanism is verified using the IEEE 123-bus test system.

Maintaining legitimacy: an institutional cooptative analysis of a green technology innovation scheme crisis

ABSTRACT Most institutions adopt deliberate methods of intervention for managing their legitimacy, particularly under conditions of a crisis. Maintaining legitimacy is therefore significant in institutional research, and the question of how social actors defend and protect their institution in the face of legitimacy judgement attacks is empirically significant. This study explores a green technology innovation scheme that engulfed a whole governance system, leading to a financial crisis, deterioration in public confidence, and the collapse of a devolved government. It identifies three types of legitimacy attacks that evolve throughout the crisis, and cooptation strategies institutions can apply to shore up and maintain dimensions of their legitimacy. The institutional analysis of the scheme crisis identifies that legitimacy attacks occur when an institution: (i) morally falters; (ii) relationally disconnects; (iii) instrumentally disregards. The findings, moreover, uniquely identify three institutional cooptation strategies, which can halt and avert threats in the face of such legitimacy attacks. These cooptation strategies include: (i) warranting transparency; (ii) streamlining communality; (iii) accepting responsibility. This demonstrates the inhabited nature of institutions and how they can regain legitimacy in the face of disruptive attacks.

Defeat Magic with Magic: A Novel Ransomware Attack Method to Dynamically Generate Malicious Payloads Based on PLC Control Logic

The Industrial Control System (ICS) is a public facility that provides services to lots of users; thus, its security has always been a critical factor in measuring its availability. Recently, a new type of attack on ICS has occurred frequently, which realizes the extortion of users by invading the information domain and destroying the physical domain. However, due to the diversity and unavailability of an ICS control logic, the targets of such attacks are usually limited to PCs and servers, leaving more disruptive attack methods unexplored. To contribute more possible attack methods to strengthen the immunity of ICS, in this paper, we propose a novel ransomware attack method named Industrial Control System Automatic Ransomware Constructor (ICS-ARC). Compared to existing ICS ransomware, ICS-ARC can automatically generate an International Electrotechnical Commission (IEC) compliant payload to compromise the Programmable Logic Controller (PLC) without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. To evaluate the attack capability of ICS-ARC, we built a tap water treatment system as the simulation experiment target for verification. The experimental results determine that ICS-ARC can automatically generate malicious code without the control logic and complete the attack against target PLCs. In addition, to assist the related research on future attacks and defenses, we present the statistical results and corresponding analysis of PLC based on Shodan.

Trust and Mobility-Based Protocol for Secure Routing in Internet of Things.

In the Internet of Things (IoT), the de facto Routing Protocol for Low Power and Lossy Networks (RPL) is susceptible to several disruptive attacks based on its functionalities and features. Among various RPL security solutions, a trust-based security is easy to adapt for resource-constrained IoT environments. In the existing trust-based security for RPL routing attacks, nodes’ mobility is not considered or limited to only the sender nodes. Similarly, these trust-based protocols are not evaluated for mobile IoT environments, particularly regarding RPL attacks. Hence, a trust and mobility-based secure routing protocol is proposed, termed as SMTrust, by critically analysing the trust metrics involving the mobility-based metrics in IoT. SMTrust intends to provide security against RPL Rank and Blackhole attacks. The proposed protocol is evaluated in three different scenarios, including static and mobile nodes in an IoT network. SMTrust is compared with the default RPL objective function, Minimum Rank with Hysteresis Objective Function (MRHOF), SecTrust, DCTM, and MRTS. The evaluation results indicate that the proposed protocol outperforms with respect to packet loss rate, throughput, and topology stability. Moreover, SMTrust is validated using routing protocol requirements analysis to ensure that it fulfils the consistency, optimality, and loop-freeness.

CAMA: Class activation mapping disruptive attack for deep neural networks

The emergence of adversarial examples has aroused widespread attention to the safety of deep learning. Most recent research focuses on how to obtain adversarial examples which make networks’ predictions wrong, and rarely observe the changes in feature embedding space from the perspective of interpretability. In addition, researchers have proposed various attack algorithms for a single task, but there are few general methods that can perform multiple tasks at the same time, such as image classification, object detection, and face recognition. To resolve these issues, we propose a new attack algorithm CAMA for deep neural networks (DNNs). CAMA perturbs each feature extraction layer through adaptive feature measurement function, thereby disrupting the predicted class activation mapping of DNNs. Experiments show that CAMA is good at creating white-box adversarial examples on classification networks and has the highest attack success rate. To solve the problem of the disappearance of aggression caused by image transformation, we propose spread-spectrum compression CAMA, which achieve a better attack success rate under various defensive measures. In addition, we successfully attack face recognition networks and object detection networks using CAMA, and achieve excellent performance. It verifies that our algorithm is a general attack algorithm for attacking different tasks.

Distributed Resilient Mitigation Strategy for False Data Injection Attack in Cyber-Physical Microgrids

The stable and reliable operation of microgrids requires the immediate communication and accurate measuring data of cyber systems. The cyber security of smart grids consists of detection and mitigation, where the latter mainly refers to resisting the attack and recovering the physical operation state through various means after cyber attacks. With the flexible electrical topology and the distributed control strategy based on the public communication network and end-to-end neighbor communication, the application and effect of cyber security technologies (firewall and encryption) in traditional cyber systems are limited. However, due to the fact that the cyber system and power system are coupled in microgrid cooperative control, countermeasures are added to the control to enhance the cyber security of microgrids, which has drawn more attention. Therefore, considering the control failure and even system results from the false data inject attack (FDIA) on the cooperative control of microgrids, this study investigates the synchronous mitigation framework based on local detection where the reactive power cooperative control targets of microgrids with and without FDIA are compatible by the resilient control method. The credibility is utilized to measure the reliability of local and neighbor data in the proposed method. The consensus communication coupling gain is weighted corrected by an adaptive update strategy of credibility to delete the attack signal. Moreover, the proposed method directly improves the conventional distributed secondary controller that reduces the complexity of controller design. Simulations investigate the effectiveness of the proposed distributed resilient mitigation strategy under conditions of deception and disruption attacks.

Machine Learning Enabled Techniques for Protecting Wireless Sensor Networks by Estimating Attack Prevalence and Device Deployment Strategy for 5G Networks

A number of disadvantages of traditional networks may be attributed to the close relationship that exists between the control plane and the data plane inside proprietary hardware designs, as described above. The problem of security is one of the most difficult to deal with. There are a plethora of network hazards and attacks that might be encountered these days. DDoS attacks are one of the most popular and disruptive attacks on the internet today, and they affect a wide range of organisations. Despite a large number of traditional mitigation solutions now available, the frequency, volume, and intensity of distributed denial-of-service (DDoS) attacks continue to rise. According to the findings of this paper, a new network paradigm is necessary to satisfy the requirements of today’s complex security concerns. It was necessary to develop a software-defined network (SDN) in order to meet the real-time needs of the massive network that was expanding at an exponential rate. Many advantages of SDN exist, including simplicity of administration, scalability, and agility, but one of the most critical is security, which is one of the most important considerations when implementing SDN. SDS may be seen as a paradigm in which the implementation of new security regulations in the computer environment is performed via the use of protected software, which is described further below. The goal is to provide a flexible and extensible architecture for DDoS detection and prevention that is both flexible and extendable; the suggested clustering approach, which is based on the Open Day Light (ODL) Controller, is employed to carry out the experimental findings. In this section, we emphasise DDoS penetration techniques from a range of tools, and we evaluate the vulnerability against various tactics. It is necessary to use a Mininet emulation tool to construct a detection and prevention system against distributed denial of service (DDoS) attacks in order to achieve success. There is a range of other simulation tools that are utilised in conjunction with this research in order to bring it to a conclusion. Integration of industry standards such as SNORT and Flow has been accomplished in a variety of situations and parameter settings. During the creation of a framework capable of detecting and mitigating DDoS attacks at an early stage in both the control and application levels, the implementation of this framework has been shown to be crucial in the development of a framework.

Cascading verification initiated by switching attacks through compromised digital relays

Attackers are able to enumerate all devices and computers within a compromised substation network. Digital relays deployed in the substation are the devices with IP addresses that can be discovered in the process of trial-and-error search. This paper is concerned with studies of cyberattacks manipulating digital relays to disruptively disconnect the associated breakers. The plausible enumeration of such disruptive attack for each relay in a substation is verified with the dynamic simulation studies with the special protection system for frequency, voltage, and rotor angle stability. A pertinent approach with smaller scale contingency analysis results is proposed to reduce the enormous computation burden. The devised enumeration reduction method is evaluated using IEEE test cases. The proposed method provides an extensive enumeration strategy that can be used by utility engineers to identify the pivotal relays in the system and can be further strengthened with security protection.

Navigation Data Anomaly Analysis and Detection

Several disruptive attacks against companies in the maritime industry have led experts to consider the increased risk imposed by cyber threats as a major obstacle to undergoing digitization. The industry is heading toward increased automation and connectivity, leading to reduced human involvement in the different navigational functions and increased reliance on sensor data and software for more autonomous modes of operations. To meet the objectives of increased automation under the threat of cyber attacks, the different software modules that are expected to be involved in different navigational functions need to be prepared to detect such attacks utilizing suitable detection techniques. Therefore, we propose a systematic approach for analyzing the navigational NMEA messages carrying the data of the different sensors, their possible anomalies, malicious causes of such anomalies as well as the appropriate detection algorithms. The proposed approach is evaluated through two use cases, traditional Integrated Navigation System (INS) and Autonomous Passenger Ship (APS). The results reflect the utility of specification and frequency-based detection in detecting the identified anomalies with high confidence. Furthermore, the analysis is found to facilitate the communication of threats through indicating the possible impact of the identified anomalies against the navigational operations. Moreover, we have developed a testing environment that facilitates conducting the analysis. The environment includes a developed tool, NMEA-Manipulator that enables the invocation of the identified anomalies through a group of cyber attacks on sensor data. Our work paves the way for future work in the analysis of NMEA anomalies toward the development of an NMEA intrusion detection system.