DoS Attacks Research Articles

An intelligent system to detect slow denial of service attacks in software-defined networks

<span lang="EN-US">Slow denial of service attack (DoS) is a tricky issue in software-defined network (SDN) as it uses less bandwidth to attack a server. In this paper, a slow-rate DoS attack called Slowloris is detected and mitigated on Apache2 and Nginx servers using a methodology called an intelligent system for slow DoS detection using machine learning (ISSDM) in SDN. Data generation module of ISSDM generates dataset with response time, the number of connections, timeout, and pattern match as features. Data are generated in a real environment using Apache2, Nginx server, Zodiac FX OpenFlow switch and Ryu controller. Monte Carlo simulation is used to estimate threshold values for attack classification. Further, ISSDM performs header inspection using regular expressions to mark flows as legitimate or attacked during data generation. The proposed feature selection module of ISSDM, called blended statistical and information gain (BSIG), selects those features that contribute best to classification. These features are used for classification by various machine learning and deep learning models. Results are compared with feature selection methods like Chi-square, T-test, and information gain.</span>

Hybrid Dynamic Event-Triggered Control for Networked Control Systems Subject to Asynchronous DoS Attacks

Hybrid Dynamic Event-Triggered Control for Networked Control Systems Subject to Asynchronous DoS Attacks

DHCP DoS and starvation attacks on SDN controllers and their mitigation

Software Defined Networking (SDN) technology offers possibilities to improve network administration through a separate central controller for network switching devices. However, security in SDN is a critical issue and SDN faces new challenges due to shared protocols, inherits flaws from traditional networks and control flexibility. Dynamic Host Configuration Protocol (DHCP) is a crucial protocol for SDN, but DHCP itself poses a security risk to SDN. In our study we performed security analysis for DHCP attacks on RYU, OpenDaylight and Floodlight, three popular SDN controllers. Our research demonstrates that they are vulnerable to starvation attacks and denial of service attacks by flooding DHCP discovery messages, slowing down networks and overloading controllers. In order to address these problems, we looked at state-of-the-art DHCP security approaches and evaluated their performance on these SDN controllers. We proposed and implemented a DHCP security algorithm on the RYU controller based on our analysis. Our solution utilize flexibility of SDN controller to identify discovery flood packets and verify authentic hosts to mitigate effects of DHCP attacks. Furthermore, the proposed solution transfers the authentic flows to switch for reduction in controller load. We demonstrate that without significant computational load the suggested method successfully rejects malicious DHCP packets, restores the IP address pool, and mitigates the harmful network consequences of DHCP-related attacks. The proposed solution improves the throughput by 3.6 times, transferred data by 66.8%, CPU usage by 93.9% and packet loss by 95% compared to the conventional RYU controller.

Dynamic event-triggered predictive control for DoS attacks-based discrete-time networked linear systems

This paper studies a novel method of the dynamic event-triggered mechanisms and the predictive control scheme for discrete-time networked linear systems subject to network delays and DoS attacks in both sensor-to-controller ([Formula: see text]) and controller-to-actuator ([Formula: see text]) channels. First, by assuming maximum allowable duration of DoS attacks, predictive control scheme is used to proactively offset the adverse impacts of communication constraints. Second, to further save communication resources, dynamic event-triggered mechanisms are configured on sensor and controller sides, respectively. Next, sufficient condition is derived for discrete-time networked linear systems under predictive control and dynamic event-triggered mechanisms, which guarantees the resulting closed-loop system’s asymptotical stability. Finally, a simulation example is used to confirm the availability and applicability of the proposed method.

On-Demand Anonymous Access and Roaming Authentication Protocols for 6G Satellite-Ground Integrated Networks.

Satellite-ground integrated networks (SGIN) are in line with 6th generation wireless network technology (6G) requirements. However, security and privacy issues are challenging with heterogeneous networks. Specifically, although 5G authentication and key agreement (AKA) protects terminal anonymity, privacy preserving authentication protocols are still important in satellite networks. Meanwhile, 6G will have a large number of nodes with low energy consumption. The balance between security and performance needs to be investigated. Furthermore, 6G networks will likely belong to different operators. How to optimize the repeated authentication during roaming between different networks is also a key issue. To address these challenges, on-demand anonymous access and novel roaming authentication protocols are presented in this paper. Ordinary nodes implement unlinkable authentication by adopting a bilinear pairing-based short group signature algorithm. When low-energy nodes achieve fast authentication by utilizing the proposed lightweight batch authentication protocol, which can protect malicious nodes from DoS attacks. An efficient cross-domain roaming authentication protocol, which allows terminals to quickly connect to different operator networks, is designed to reduce the authentication delay. The security of our scheme is verified through formal and informal security analysis. Finally, the performance analysis results show that our scheme is feasible.

Outlier Detection Mechanism for Ensuring Availability in Wireless Mobile Networks Anomaly Detection

Finding things that are significantly different from, incomparable with, and inconsistent with the majority of data in many domains is the focus of the important research problem of anomaly detection. A noteworthy research problem has recently been illuminated by the explosion of data that has been gathered. This offers brand-new opportunities as well as difficulties for anomaly detection research. The analysis and monitoring of data connected to network traffic, weblogs, medical domains, financial transactions, transportation domains, and many more are just a few of the areas in which anomaly detection is useful. An important part of assessing the effectiveness of mobile ad hoc networks (MANET) is anomaly detection. Due to difficulties in the associated protocols, MANET has become a popular study topic in recent years. No matter where they are geographically located, users can connect to a dynamic infrastructure using MANETs. Small, powerful, and affordable devices enable MANETs to self-organize and expand quickly. By an outlier detection approach, the proposed work provides cryptographic property and availability for an RFID-WSN integrated network with node counts ranging from 500 to 5000. The detection ratio and anomaly scores are used to measure the system's resistance to outliers. The suggested method uses anomaly scores to identify outliers and provide defence against DoS attacks. The suggested method uses anomaly scores to identify outliers and provide protection from DoS attacks. The proposed method has been shown to detect intruders in a matter of milliseconds without interfering with authorised users' privileges. Throughput is improved by at least 6.8% using the suggested protocol, while Packet Delivery Ratio (PDR) is improved by at least 9.2% and by as much as 21.5%.

Analysing Cyber Threats: A Comprehensive Literature Review on Data-Driven Approaches

This literature review paper aims to examine and analyze the existing research on prediction models for different types of cyber-attacks. Four key research papers have been selected as the base for this review: "A Prediction Model of DoS Attack's Distribution Discrete Probability," "Apriori Viterbi Model for Prior Detection of Socio-Technical Attacks," "Cyber Attacks Prediction Model Based on Bayesian Network," and "Applying Data Science to Cybersecurity Network Attacks & Events.” An overview of the value of prediction models in cybersecurity and their function in reducing potential threats come first in the review. The methodology section outlines the search strategy used to identify relevant literature and the selection criteria for the base papers. The subsequent sections provide an overview of the field, highlighting the historical development and key theories or frameworks related to cyber-attack prediction. The themes or subtopics identified in the literature are discussed, focusing on the discrete probability distribution model of DoS attacks, the Apriori Viterbi model for detecting socio-technical attacks, the Bayesian network-based prediction model, and the application of data science in analyzing network attacks and events. The review critically evaluates the selected papers, analyzing their methodologies, findings, and limitations. It identifies gaps, controversies, and conflicting findings in the literature, paving the way for further research in the field. The synthesis and interpretation section integrates the findings from the different studies, compares various perspectives, and discusses the implications and significance of the literature for cyber-attack prediction. In conclusion, this literature review paper provides a comprehensive analysis of prediction models for cyber-attacks, based on the selected base papers. It highlights the strengths and weaknesses of existing approaches, identifies research gaps, and offers recommendations for future studies. This review contributes to the advancement of knowledge in the field of cybersecurity and aids in the development of more effective prediction models to combat evolving cyber threats.

Optimal DoS attack strategy for cyber-physical systems: A Stackelberg game-theoretical approach

In this paper, the optimal DoS attack on cyber-physical systems is studied in Stackelberg game framework, which is manifested by energy allocation on communication channels. To give a realistic picture of DoS attack on a normal user launched by several hackers, a Stackelberg game between one defender and multiple attackers is considered. Compared with the existing literature, which mainly focus on equilibrium in static games, the dynamic process of the Stackelberg game is also reflected in this paper, which demonstrates the intelligence of attackers switching channels to allocate aggressive energy. In the solution of Stackelberg equilibrium, self-adaptive Particle Swarm Optimization (PSO) algorithm is utilized to cope with the nonlinearity of the reward function. Besides, for the purpose of better performance of both sides in choosing channels to allocate energy, an online computation algorithm is proposed. Finally, numerical examples are equipped to illustrate the theoretical results proved in this work.

Distributed event-based H∞ consensus filtering for 2-D T-S fuzzy systems over sensor networks subject to DoS attacks

This paper concentrates on the H∞ consensus filtering issue of a kind of nonlinear two-dimensional (2-D) systems over sensor networks, which are described by the Takagi-Sugeno fuzzy model. With consideration of the limited communication bandwidth and the malicious network attack behavior, a distributed event-triggered mechanism is considered for the sensor network under DoS attacks. Different from the implicit assumption of many previous results that detail information of the non-periodic DoS attacks is available, a switching-like distributed event-triggered mechanism is introduced under the 2-D framework, which could schedule the triggering strategy flexibly in the attack silent or active regions. By means of the switching system analysis method and the discontinuous Lyapunov functions, this paper aims to develop a proper distributed attack-resilient H∞ consensus filter based on the information from the local sensor and its neighbors. A set of sufficient conditions are presented so that the estimation error system can reach exponential stability and meet an expected H∞ performance. Finally, a numerical example is given to demonstrate feasibility of the filter designing method.

A DDoS Attack Detection Using Deep Learning - A Review

In this review article, the distributed denial of service (DDoS) assaults are the main topic since they offer a substantial danger to systems linked to the internet and can cause large losses in terms of money, bandwidth and downtime. In this review paper discuss the detection approaches, which are used in traditional methods for identifying and mitigating these assaults, have a limited capacity to identify fresh and changing attack patterns. In this review paper, we provide a deep learning-based DDoS assault detection method. Also discuss the different methods presented by different researchers in the last decade for detection of DoS attack in network.

Secure P2P Nonfragile Sampled-Data Controller Design for Nonlinear Networked System under Sensor Saturation and DoS Attack

Secure P2P Nonfragile Sampled-Data Controller Design for Nonlinear Networked System under Sensor Saturation and DoS Attack

Foreseeing Outbreak Investigation by Means of Machine Learning

Abstract: The deliberate breach of a security strategy is what intrusion exposure is. In order to look for any malicious actions or extortions, invasion discovery systems monitornetwork traffic passing across numerous types of computer systems and deliver warnings when it perceives any hazards. Systems for identifying extortions should be able to recognize every injurious software and occurrence in the linkage. All forms of occurrences,comprising intrusion, file less malware, botnets, and malware, are changing the threat environment. In order to identify harmful events by investigating the program's negotiating pattern, a learning recognition system is essential. In this situation, we have form the structure to stipulate the type of attack that machine learning has accepted. Malicious action exposure can be alienated into two classes: signature grounded discovery and misuse discovery. For both types of revealing, an IDS mustgather the essential data, assess it, and then associate it to outbreak signs retained in big databanks. In our paper, we advised a technique for generating nominal IDS employing either the stacking procedure or the decision tree procedure. According to the outcomes, the recommended method achieves more precisely and professionally than other approaches like logistic regression and random forest. The accurateness rate values for the results formed by the proposed technique are 99.36%. Outbreak analyzer method uses four dissimilar procedures to assess numerous kinds of protocols constraints and endorse users. After that, it stacks approaches with and without characters choice to assess the accuracy and choose the best algorithm to recognize which types of outbreaks such as, port scans, brute force attacks, benign, DoS, botattacks, infiltration, and web attacks.

Distributed Finite-Time Cooperative Economic Dispatch Strategy for Smart Grid under DOS Attack

This paper proposes an energy management strategy that can resist DOS attacks for solving the Economic Dispatch Problem (EDP) of the smart grid. We use the concept of energy agent, which acts as a hub for the smart grid, and each EA is an integrated energy unit that converts, stores, and utilizes its local energy resources. This approach takes into account the coupling relationship between energy agents (EA) and utilizes the Lyapunov function technique to achieve finite-time solutions for optimization problems. We incorporate strategies to resist DOS attacks when analyzing finite-time convergence using the Lyapunov technique. Based on this, a finite convergence time related to DOS attack time is derived. The integral sliding mode control strategy is adopted and the Lyapunov method is used to analyze it, so that the algorithm can resist DOS attacks and resist external disturbances. Through theoretical analysis, it is shown that the strategy is capable of converging to the global optimal solution in finite time even if it is attacked by DOS. We conducted case studies of six-EA and ten-EA systems to verify the effectiveness of this strategy. The proposed strategy has potential for deployment in distributed energy management systems that require resilience against DOS attacks.

Distributed adaptive event‐triggered fault‐tolerant cooperative control of multiple UAVs and UGVs under DoS attacks

AbstractHere, the issue of distributed adaptive event‐triggered fault‐tolerant cooperative control (FTCC) is studied for multiple unmanned aerial vehicles (UAVs) and unmanned ground vehicles (UGVs) in the presence of actuator faults under denial‐of‐service attacks. To save the limited communication network resources, the distributed adaptive event‐triggered FTCC scheme is investigated for the multiple UAVs and UGVs which does not require continuous information relating to its neighbours. It is proven that the tracking errors are uniformly ultimately bounded by utilizing the Lyapunov function approach. Furthermore, the Zeno behaviour is excluded with the proposed scheme. Finally, simulation studies are provided to demonstrate the efficiency of the proposed scheme.

Secure cloud file sharing scheme using blockchain and attribute-based encryption

This paper presents a novel collaboration scheme for secure cloud file sharing using blockchain and attribute-based encryption(ABE). Blockchain enables us to implement access control as a smart contract between data owner and users. Each data owner creates its own smart contract where in a data user can request to access a specific file by registering a transaction. In response transaction, the data owner sends the required credential to the user thereby enabling her/him to decrypt the intended file on the cloud storage. This scheme is decentralized, fault tolerant and secured against DoS attacks. The cipher-key, which is used for file encryption, is embedded into a set of coefficients of a polynomial so-called access polynomial. It is attached to the encrypted file on the cloud storage as a metadata. The data user can restore the cipher-key by means of the credential receiving in response transaction and access polynomial. The data owner uses ABE scheme in response transaction to impose her/him access policy to the file as well as preserving user anonymity. This scheme supports fast revocation of the user access by means of updating the access polynomial coefficients and without any communication overhead to non-revoked users. Through formal verification, we show that the scheme is secure in terms of secrecy of credential information and authentication of participants. Finally, the evaluation results show that our scheme is scalable with acceptable performance up to 20,000 users.

EdgeAuth: An intelligent token‐based collaborative authentication scheme

AbstractEdge computing is regarded as an extension of cloud computing that brings computing and storage resources to the network edge. For some Industrial Internet of Things (IIoT) applications such as supply‐chain supervision and collaboration, Internet of Vehicles, real‐time video analysis and so forth, users should be authenticated before visiting the geographically distributed edge servers. Limited by the considerable latency between the cloud and edge servers, and the limited capacity of edge servers, it is infeasible to copy the authentication method from cloud servers when users are authenticated in edge servers. In view of this challenge, this paper proposes a novel token‐based authentication scheme, named EdgeAuth, that enables fast edge user authentication through collaboration among cloud servers and edge servers. Under the EdgeAuth scheme, edge servers can rapidly verify the credentials of users who have been authenticated by the cloud server. EdgeAuth can also protect users from a series of authentication attacks, for example, the replay attack, DoS attack and man‐in‐the‐middle attack. The results of experiments conducted on a simulated edge computing environment validate the usefulness of EdgeAuth through a comparison in latency and throughput against two baseline schemes.

Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions

Peer-to-peer (P2P) networks are distributed systems with a communication model in which no central authority governs the behavior of individual peers. These networks currently account for a considerable percentage of all bandwidth worldwide. However, this communication model also has a clear disadvantage: it has a multitude of vulnerabilities and security threats. The nature of the P2P philosophy itself means that there is no centralized server responsible for uploading, storing, and verifying the authenticity of the shared files and packets. A direct consequence of this is that P2P networks are a good choice for hackers for the spread of malicious software or malware in general since there is no mechanism to control what content is shared. In this paper, we present a mathematical model for P2P networks to study the effect of two different attacks on these systems, namely, malware and denial of service. To analyze the behavior of the cyber attacks and identify important weaknesses, we develop different Markov chains that reflect the main dynamics of the system and the attacks. Specifically, our model considers the case in which a certain number of nodes are infected with a cyber worm that is spread throughout the network as the file is shared among peers. This allows observation of the final number of infected peers when an initial number (we evaluate the system for from 1 to 14 initial nodes) of malicious nodes infect the system. For the DoS attack, our model considers the portion of peers that are unable to communicate and the average attack duration to study the performance degradation of such an attack. A two-pronged approach was used to study the impact of the attacks on P2P networks; the first focused only on the P2P network, and the second focused on the attacks and the network.

Resilient Event-/Self-Triggering Leader-Following Consensus Control of Multiagent Systems Against DoS Attacks

This paper focuses on the problem of resilient leader-following consensus for multi-agent systems (MAS) against denial-of-service (DoS) attacks. Two update strategies based on event/self-triggering are proposed for the control protocols to handle the leader-following consensus in unreliable shared networks. We first propose a dynamic event-triggered communication (DETC) scheme to mitigate unnecessary information transfer through energy-limited and vulnerable networks. Continuous communication between agents can be avoided. DoS attacks are supposed to be aperiodic and asynchronous at different edges. The concept of valid DoS attack interval is introduced, and the frequency and duration of attacks are analyzed. The leader-following consensus can be achieved when there exist DoS attacks using the dynamic event-based control strategy. Then to avoid continuous event detection and save computation resources, a self-triggered communication (STC) function is developed. The next triggering moment is predetermined with the latest received state information. And the Zeno behavior is eliminated for the feasibility of the event/self-triggering scheme. Finally, a simulation is provided to verify the effectiveness of the proposed update strategies and control protocols.

Threats Detection in IoT Network

The recent growth in Internet of Things (IoT) deployment has increased the rapidness of integration and extended the reach of the internet from computers, tablets, and phones to countless devices in our physical world. This growth makes our life more convenient and industries more efficient. However, at the same time, it brought numerous challenges in terms of security and expanded the area of cyber-attacks, especially the DoS and DDoS attacks. Moreover, since many IoT devices run custom or outdated operating systems, and most do not have enough resources to run typical intrusion detection systems, it was necessary to search for alternative solutions. Therefore, many researchers have joined the race to develop new lightweight intrusion detection methods. In this study, we have investigated the detection of different DoS attacks on the IoT network using machine learning techniques. The studied attacks are TCP Syn-Flood Attack, UDP Flood Attack, HTTP Slowloris GET Attack, Apache Range Header DoS, and Port Scan attack. We have proposed a new dataset, namely HEIoT21, which was generated in a real smart home environment using a collective of IoT devices and non-IoT devices connected to a wireless network. The proposed dataset included normal and anomaly data, and using the CiCflowmeter application, we extracted 82 network features from the proposed dataset. The dataset was labeled and categorized into binary-class and multi-class. Our dataset underwent multiple feature selection methods to keep only enough features to produce a good detection accuracy; for that, we have used Anova F-value Feature Selection, Random Forest importance feature selection, and Sequential Forward Feature Selection. The feature selection techniques produced three new sub-datasets, which were evaluated using multiple machine learning algorithms like Logistic Regression (LR), J48 Decision Tree (DT), Naïve Bayes, and Artificial Neural Network (ANN). A comparison study was conducted on the result obtained from applying the different machine learning algorithms on the derived sub-datasets, which led to the finding that the most suitable feature selection technique for the proposed dataset was Anova F-value and the best-fit machine learning algorithm for the proposed dataset was The Decision Tree which produced an accuracy result of 99.92% for binary classification and 99.94% for multi-class classification. 
 In the end, our study was compared with other studies in the field of IoT intrusion detection, and we found that the result obtained through this study was higher than most others. Therefore, the proposed dataset could be of great use to those who want to work on the analysis and detection of the existing network security threats. Also, this study can be considered a cornerstone for a proper lightweight intrusion detection system, where the datasets can be expanded to include other types of attacks, new detection rules can be added, and an alert mechanism can be integrated to become a complete detection system.

The digital harms of smart home devices: A systematic literature review

The connection of home electronic devices to the internet allows remote control of physical devices and involves the collection of large volumes of data. With the increase in the uptake of Internet-of-Things home devices, it becomes critical to understand the digital harms of smart homes. We present a systematic literature review on the security and privacy harms of smart homes. PRISMA methodology is used to systematically review 63 studies published between January 2011 and October 2021; and a review of known cases is undertaken to illustrate the literature review findings with real-world scenarios. Published literature identifies that smart homes may pose threats to confidentiality (unwanted release of information), authentication (sensing information being falsified) and unauthorised access to system controls. Most existing studies focus on privacy intrusions as a prevalent form of harm against smart homes. Other types of harms that are less common in the literature include hacking, malware and DoS attacks. Digital harms, and data associated with these harms, may vary extensively across smart devices. Most studies propose technical measures to mitigate digital harms, while fewer consider social prevention mechanisms. We also identify salient gaps in research, and argue that these should be addressed in future crossdisciplinary research initiatives.