Distributed Attack Detection Research Articles

Event-triggered resilient recovery learning control protocol for interconnected DC microgrids with distributed attack detection

The distributed control-based DC microgrid relies on communication networks for information exchange, rendering it susceptible to cyber-attacks and intrusions. Attack detection is crucial to ensure the safety of microgrids. However, it remains a challenge for existing detection methods to distinguish state changes caused by load changes or attacks. To address the issue, this paper proposes a distributed attack detection method that combines consistency and stationarity features to assist a resilient recovery strategy. Firstly, the layered architecture of an interconnected DC microgrid is introduced, and the impact of false data injection attacks on microgrids is analyzed. Then, the attack detection is decomposed into two phases, anomaly detection and attack identification. In the first phase, consistency and stationarity features are extracted to indicate whether the microgrid is abnormal. In the second phase, the correlation between voltage and current characteristics is analyzed to determine the attack types. Furthermore, an event-triggered resilient recovery learning control protocol is proposed, which estimates the normal states and reconstructs normal control inputs through two trained neural networks to ensure the operation safety of the DC microgrid. The experimental results validate the effectiveness of the proposed attack detection and resilient recovery strategy.

New Hybrid Distributed Attack Detection System for IoT

IoT is expressed as a network of physical objects with applications and various technologies that provide data connection and sharing with various devices and systems over the Internet. Security vulnerabilities in IoT devices are one of the biggest security issues in connecting devices to the internet and collecting and processing user data. These vulnerabilities can lead to increased attacks on IoT devices and malicious use of user data. In this article, we discuss these security problems that arise in IoT systems in detail in distributed systems technology. Distributed systems are increasingly used in the modern computing world. These systems are a structure where multiple independent computers communicate with each other for a common purpose. Distributed system technologies have become more common with the development of internet and cloud computing systems. However, the use of distributed systems has brought with it important security challenges such as security vulnerabilities, access controls and data integrity issues. Therefore, the security of distributed system technologies has been an important focus of work in this area. In this study, information about distributed system technologies and security for IoT is given. The all attack types were classified using ANN, developed RF and hybrid model. In RF, all feature vectors created from all datasets (bank and two financial datasets) were also analyzed separately and the classification performance was examined. In addition, a new RF algorithm based on weight values using the Gini algorithm has been proposed. With this algorithm, the traditional RF algorithm has been developed and the success rates have been increased. In addition, a hybrid method was created by classifying the datasets obtained by RF with ANN. With the hybrid method ANN and the enhanced RF method, its accuracy in detecting normal behaviors and attack types was calculated and the success of the methods was presented comparatively. In addition, the working times of the methods were determined.

Temporal convex combination‐based secure distributed estimation against cyberattacks and noisy input

AbstractThis paper proposes a new secure distributed estimation for cyber‐physical systems against adversarial attacks with noisy input. To mitigate the effect of attacks, a novel distributed attack detection based on a reliable reference estimation obtained by temporal convex combination is proposed. Furthermore, for more effective and robust performance, an adaptation rule to adjust convex combination weights is presented, in which the generalized correntropy method with nonlinear loss function and stochastic gradient descent are utilized. Besides, to eliminate input noise, a bias‐compensation method in local adaptation of the secure distributed estimation is proposed. Simulations show superior dynamic and real‐time adaptability of the proposed algorithm under complex attacking scenarios.

A Survey on Enterprise Network Security: Asset Behavioral Monitoring and Distributed Attack Detection

A Survey on Enterprise Network Security: Asset Behavioral Monitoring and Distributed Attack Detection

Resilient and constrained consensus against adversarial attacks: A distributed MPC framework

This paper proposes a distributed resilient consensus framework consisting of a distributed model predictive control (DMPC)-based consensus protocol and a new distributed attack detection mechanism, aiming to effectively handle the general linear constrained MAS under adversarial attacks. Based on the historical information from neighbors and a resilience set, we can evaluate the reliability of communication links via the attack detection mechanism. The proposed detection mechanism can significantly reduce the requirement on the network robustness compared with the well-known mean-subsequence-reduced (MSR) algorithms. The resilient consensus of general linear constrained MAS with F-locally adversarial attacks is achieved when the communication network is (F+1)-robust. Furthermore, the DMPC-based resilient consensus framework exhibits the following key feature: the constrained consensus performance is optimized by minimizing a set of control variables. We demonstrate that the recursive feasibility of the associated DMPC optimization problem and the resilient consensus convergence of the constrained MAS can be guaranteed. Finally, the effectiveness of the proposed framework is illustrated through simulation experiments.

Design of strictly stealthy attacks for nonlinear multiagent systems under distributed attack detection mechanism

This paper focuses on the problem of strictly stealthy attacks design against nonlinear multi-agent systems (MASs) with directed communication topology. First, a distributed attack detection mechanism with powerful detection capability is used to detect system anomalies and measure the concealment of attacks. Then, under different attack scenarios, the necessary and sufficient design conditions of strictly stealthy attacks which can bypass the distributed detection mechanism and lead to MASs insecurity are derived. Moreover, by combining the basic idea of blocking attacks and false data injection attacks (FDIAs), a strictly bounded stealthy attack scheme is proposed, which considers the energy constraint of attackers. Finally, simulation examples are carried out to show the effectiveness and superiority of the developed stealthy attack strategies.

Deep-Learning Based Detection for Cyber-Attacks in IoT Networks: A Distributed Attack Detection Framework

The widespread use of smart devices and the numerous security weaknesses of networks has dramatically increased the number of cyber-attacks in the internet of things (IoT). Detecting and classifying malicious traffic is key to ensure the security of those systems. This paper implements a distributed framework based on deep learning (DL) to prevent many different sources of vulnerability at once, all under the same protection system. Two different DL models are evaluated: feed forward neural network and long short-term memory. The models are evaluated with two different datasets (i.e.NSL-KDD and BoT-IoT) in terms of performance and identification of different kinds of attacks. The results demonstrate that the proposed distributed framework is effective in the detection of several types of cyber-attacks, achieving an accuracy up to 99.95% across the different setups.

Event-Triggered Distributed Attack Detection and Fault Diagnosis

This article investigates the security issue for multi-agent systems (MASs). Due to the effect of physical faults and cyber attacks, MASs are prone to anomalies. To meet these challenges, an observer-based distributed attack detection and fault diagnosis scheme is proposed. Firstly, in order to reduce unnecessary communication loss, an event-triggered mechanism is designed for each agent to determine whether to transmit the current measurement to its own state estimator and its neighbors. Then, based on the information received from neighbors, each agent designs a bank of attack detectors based on unknown input observer for the neighbors to detect whether there are attacks in the communication with the neighbor agents. In addition, for each agent, according to the local measurement and the estimated states of adjacent agents, a fault diagnoser based on Luenberger observer is designed, which can be combined with the attack detectors to make the distributed fault diagnosis for each agent. Finally, the effectiveness and scalability of the proposed scheme are verified by applying it to two smart grids with multiple generators.

Cyber Security Risk management with attack detection frameworks using multi connect variational auto-encoder with probabilistic Bayesian networks

This research proposes novel techniques in cyber security risk management and attack detection frameworks using deep learning architectures. Here the risk management of physical networks has been analysed using multi connect variational auto-encoder. Risk values were included in an ISMS (information security management system) as well a quantitative risk assessment was undertaken. According to the quantitative analysis, the proposed remedies could lower risk. Then the cyber attacks in the network were detected using probabilistic Bayesian networks. Performance of deep model is compared to that of a traditional ML method, and detection of distributed attacks is compared to that of a centralised system. According to tests, our distributed attack detection system beats centralised DL-based detection systems. For UNBS-NB-15 dataset, proposed MCVAE_PBNN achieved Accuracy of 96%, False Alarm Rate (FAR) of 71%, Sensitivity of 92%, Specificity of 82%, False positive rate (FPR) of 63%, AUC of 75% and KDD99 dataset proposed MCVAE_PBNN achieved Accuracy of 95%, False Alarm Rate (FAR) of 68%, Sensitivity of 92%, Specificity of 84%, False positive rate (FPR) of 61%, AUC of 78%.

Cross-Layer Distributed Attack Detection Model for the IoT

IoT is a huge network that contains many objects communicating with each other. It has a collection of sensitive data which is vulnerable to various threats at different layers. Due to the lack of infrastructure and the distributed control in IoT, there have been many security threats in all network layers. The security of IoT that is based on layered approaches has shortcomings such as the redundancy, inflexibility and inefficiently of security solutions. There are many harmful attacks in IoT network such as DoS and DDoS attacks which can compromise the IoT architecture in all layers. Consequently, cross layer approach is proposed as an effective and practical security defending mechanism. Cross-Layer Distributed Attack Detection model (CLDAD) is proposed to enhance security solution for IoT environment. CLDAD presents a general detection method of DDoS in sensing layer, network layer and application layer. CLDAD is based on big data analytics techniques which enable the detection process to be performed in distributed way, so the model can detect DDoS attacks in any layer on-the-fly and the model support the scalability of the IoT environment. CLDAD is tested based on three datasets, namely, artificial jamming attack dataset, BoT-IoT dataset, and BoT-IoT based HTTP. The results showed that the proposed model is efficient in detecting attacks in the three layers of the IoT and gives detection accuracy of 99.8% on average.

Fed_ADBN: An efficient intrusion detection framework based on client selection in AMI network

AbstractData transmission between smart meters and data center is facing network security threats in advanced metering infrastructure of smart grid. The traditional solution is to move the data to the data center to build a centralized attack detection model, or divide the collected data into several independent and identically distributed datasets to build a distributed attack detection model. However, the long‐distance transmission and the centralized storage of data not only increase the communication overhead and time overhead, but also increase the risk of being attacked, causing privacy disclosure during the process of building the model. In this paper, we propose an efficient intrusion detection framework Fed_ADBN based on federated attention deep belief network and client selection. Clients cooperate with the data center to jointly build a horizontal federated learning framework. Under the premise of protecting data security by keeping data on the clients, we design a client selection algorithm based on client computing power, communication quality and security risks, which can improve the operating efficiency of federated learning. We also deploy a deep belief neural network with attention mechanism in each client to accurately detect possible network attacks in AMI network in real time. Experimental results show that compared with state‐of‐the‐art methods, the proposed framework can not only maintain good detection accuracy but also protect privacy.

Resource-efficient and secure distributed state estimation over wireless sensor networks: a survey

Wireless sensor networks (WSNs) are extensively adopted for remote monitoring and tracking scenarios, such as battlefield surveillance, target detection and tracking, traffic condition detection, power system monitoring and health monitoring, thanks to their promising benefits in terms of flexibility, reliability and cost-effectiveness. However, some critical WSN applications, such as intelligent transportation and smart grid monitoring, have stringent requirements in terms of resource budget and security. This paper provides a survey of the trending resource-efficient and secure techniques currently used with distributed estimation algorithms over WSNs. Recent progresses on these two major research trends are reviewed, respectively, for WSN-based monitoring systems. More specifically, the first part of the survey covers the state-of-the-art in resource-efficient distributed state estimation. The main results along this line of research are classified into protocol-based scheduling, static event-triggered scheduling, dynamic event-triggered scheduling and stochastic event-triggered scheduling. Then, in the second part, the latest results on secure distributed state estimation are reviewed, where secure distributed state estimation under data integrity attacks and data available attacks, and distributed attack detection are examined, respectively. Finally, several challenging issues in the context of distributed state estimation are discussed for potential future research.

Distributed Detection and Mitigation of Biasing Attacks Over Multi-Agent Networks

This paper proposes a distributed attack detection and mitigation technique based on distributed estimation over a multi-agent network, where the agents take partial system measurements susceptible to (possible) biasing attacks. In particular, we assume that the system is not locally observable via the measurements in the direct neighborhood of any agent. First, for performance analysis in the attack-free case, we show that the proposed distributed estimation is unbiased with bounded mean-square deviation in steady-state. Then, we propose a residual-based strategy to locally detect possible attacks at agents. In contrast to the deterministic thresholds in the literature assuming an upper bound on the noise support, we define the thresholds on the residuals in a probabilistic sense. After detecting and isolating the attacked agent, a system-digraph-based mitigation strategy is proposed to replace the attacked measurement with a new observationally-equivalent one to recover potential observability loss. We adopt a graph-theoretic method to classify the agents based on their measurements, to distinguish between the agents recovering the system rank-deficiency and the ones recovering output-connectivity of the system digraph. The attack detection/mitigation strategy is specifically described for each type, which is of polynomial-order complexity for large-scale applications. Illustrative simulations support our theoretical results.

Attention based multi-agent intrusion detection systems using reinforcement learning

Designing an effective network intrusion system (IDS) is a challenging problem because of the emergence of a large number of novel attacks and heterogeneous network applications. The existing IDSs fail to adapt to the changing attack patterns and unseen attacks that lead to inaccurate detection of network vulnerabilities and system performance degradation. Therefore, there is a need to design robust, scalable, efficient, and adaptive IDS for networks. This paper presents a novel deep reinforcement learning-based IDS that employs Deep Q-Network logic in multiple distributed agents and uses attention mechanisms to efficiently detect and classify advanced network attacks. Our proposed multi-agent IDS is designed as a distributed attack detection platform where agents work in a coordinated manner to provide scalable, fault-tolerant, multi-view architecture guided security system. We have tested our model with extensive experimentation on two benchmark datasets: NSL-KDD and CICIDS2017. It shows improved performance in terms of higher accuracy, precision, recall, F1-Score, and low false-positive rate (FPR) in comparison to the state-of-the-art IDS works. On the other hand, many machine learning systems are found vulnerable to adversarial attacks. Thus, we evaluated our model’s robustness against a practical black-box adversarial attack and observed only a little degradation in performance. We integrated the concept of denoising autoencoder (DAE) with our model to further improve its robustness. Finally, we discuss the usability of our system in real-life applications against zero-day attack patterns.

Implementing optimized classifier for distributed attack detection and BAIT-based attack correction in IoT

Implementing optimized classifier for distributed attack detection and BAIT-based attack correction in IoT

A deep learning based secured energy management framework within a smart island

This study proposes a novel secured management method for renewable microgrids considering the policies required for diagnosing cyber-attacks happening in the communication networks, usually applied in the secondary control layer of microgrids (MGs). Due to the so long stochastic and bad information entering the systems in order to make malicious attacks, their location and time data links have the ability of straying of those acting in normal conditions that attempt to have an effect on the precise voltage regulation and current dividing via influencing sensors of current and voltage. The ability to extract high-level features due to the usage of fast fourier transform (FFT) and deep learning (DL) for attack detection in cyberspace has made them to be considered as a strong technique in the face of small mutations or new attacks. These self-educated and compaction abilities of DL architectures have been considered as basic techniques for hidden scheme detection from the training datum for this reason attacks have been distinguished from benign traffic. A novel method, deep learning and FFT, for cyber-security has been used in the following paper with the aim of enabling the attacks detection in DC smart MG. The deep model and traditional machine learning way are evaluated in terms of performance, and distributed attack detection has been compared to the centralized diagnosing procedure. The tests proved that the distributed attack detection system studied can be more advanced in comparison with centralized detection systems applying FFT in the role of the input index of the DL model. This suggested distributed method enables for scalable monitoring of a MG and has the ability of detecting the existence of cyber-attacks in the communications between distributed generation agents (DGAs) controlled via a control on the basis of consensus and isolating the communication link over that the attack has been injected. Any local attack detection needs restricted information about its neighbor’s dynamics. The most important factor of the proposed detection plan can be that has the ability of detecting cyber-attacks with great precision and distinguishing cyber-attack from load changes.in addition, this has been shown that the suggested model can be further useful in the detection of the attack.

Attack detection design for dc microgrid using eigenvalue assignment approach

DC microgrids (MGs) are complex systems connecting a number of renewable energy sources to different types of loads based on distributed networks. However, the strong reliance on communication networks makes DC MGs vulnerable to intentional cyber-attacks. In this paper, a distributed attack detection scheme is presented for the DC MG system by proposing an observer. The proposed detector is able to detect attacks with only local knowledge of the overall DC microgrid system. By eigenvalue assignment method, the designed residual is decoupled from both load and neighbor voltage changes. Furthermore, an optimization problem is provided to increase the attack detectability of the proposed observer. The presented method is easy to design with less computation complexity. The performances of the proposed scheme are validated by numerical simulations and experiments.

Distributed Attack Detection in a Water Treatment Plant: Method and Case Study

The rise in attempted and successful attacks on critical infrastructure, such as power grid and water treatment plants, has led to an urgent need for the creation and adoption of methods for detecting such attacks often launched either by insiders or state actors. This paper focuses on one such method that aims at the detection of attacks that compromise one or more actuators and sensors in a plant either through successful intrusion in the plant's communication network or directly through the plant computers. The method, labelled as Distributed Attack Detection (DAD), detects attacks in real-time by identifying anomalies in the behavior of the physical process in the plant. Anomalies are identified by using monitors that are implementations of invariants derived from the plant design. Each invariant must hold either throughout the plant operation, or when the plant is in a given state. The effectiveness of DAD was assessed experimentally on an operational water treatment plant named SWaT that is a near-replica of commercially available large treatment plants. The method used in DAD was found to be effective in detecting stealthy and coordinated attacks.

DADEM

Nowadays, Internet of Things (IoT) is considered as part our lives and it includes different aspects - from wearable devices to smart devices used in military applications. IoT connects a variety of devices and as such, the generated data is considered as ‘Big Data'. There has however been an increase in attacks in this era of IoT since IoT carries crucial information regarding banking, environmental, geographical, medical, and other aspects of the daily lives of humans. In this paper, a Distributed Attack Detection Model (DADEM) that combines two techniques - Deep Learning and Big Data analytics - is proposed. Sequential Deep Learning model is chosen as a classification engine for the distributed processing model after testing its classification accuracy against other classification algorithms like logistic regression, KNN, ID3 decision tree, CART, and SVM. Results showed that Sequential Deep Learning model outperforms the aforementioned ones. The classification accuracy of DADEM approaches 99.64% and 99.98% for the UNSW-NB15 and BoT-IoT datasets, respectively. Moreover, a plan is proposed for optimizing the proposed model to reduce the overhead of the overall system operation in a constrained environment like IoT.

Resilient Collaborative Distributed Energy Management System Framework for Cyber-Physical DC Microgrids

This article investigates the resilience of the consensus-based distributed economic dispatch (ED) in cyberphysical DC microgrid energy management system (EMS). A holistic framework, called resilient collaborative distributed EMS (R-CoDEMS), is proposed to model the system dynamics, adversaries, and the cybersecurity of the consensus-based distributed ED. Under the R-CoDEMS framework, a reputation-based distributed attack detection and mitigation algorithm is also proposed to improve the system’s resilience against typical non-colluding and colluding false data injection attacks. The effectiveness and scalability of the proposed R-CoDEMS countermeasure is evaluated on a typical microgrid system and large-scale networks via numerical simulations.