Existing Detection Schemes Research Articles

Sybil Attacks Detection and Traceability Mechanism Based on Beacon Packets in Connected Automobile Vehicles.

Connected Automobile Vehicles (CAVs) enable cooperative driving and traffic management by sharing traffic information between them and other vehicles and infrastructures. However, malicious vehicles create Sybil vehicles by forging multiple identities and sharing false location information with CAVs, misleading their decisions and behaviors. The existing work on defending against Sybil attacks has almost exclusively focused on detecting Sybil vehicles, ignoring the traceability of malicious vehicles. As a result, they cannot fundamentally alleviate Sybil attacks. In this work, we focus on tracking the attack source of malicious vehicles by using a novel detection mechanism that relies on vehicle broadcast beacon packets. Firstly, the roadside units (RSUs) randomly instruct vehicles to perform customized key broadcasting and listening within communication range. This allows the vehicle to prove its physical presence by broadcasting. Then, RSU analyzes the beacon packets listened to by the vehicle and constructs a neighbor graph between the vehicles based on the customized particular fields in the beacon packets. Finally, the vehicle's credibility is determined by calculating the edge success probability of vehicles in the neighbor graph, ultimately achieving the detection of Sybil vehicles and tracing malicious vehicles. The experimental results demonstrate that our scheme achieves the real-time detection and tracking of Sybil vehicles, with precision and recall rates of 98.53% and 95.93%, respectively, solving the challenge of existing detection schemes failing to combat Sybil attacks from the root.

Matrix Profile data mining for BGP anomaly detection

The Border Gateway Protocol (BGP), acting as the communication protocol that binds the Internet, remains vulnerable despite Internet security advancements. This is not surprising, as the Internet was not designed to be resilient to cyber-attacks, therefore the detection of anomalous activity was not of prime importance to the Internet creators. Detection of BGP anomalies can potentially provide network operators with an early warning system to focus on protecting networks, systems, and infrastructure from significant impact, improve security posture and resilience, while ultimately contributing to a secure global Internet environment. In this paper, we present a novel technique for the detection of BGP anomalies in different events. This research uses publicly available datasets of BGP messages collected from the repositories, Route Views and Réseaux IP Européens (RIPE). Our contribution is the application of a time series data mining approach, Matrix Profile (MP), to detect BGP anomalies in all categories of BGP events. Advantages of the MP detection technique compared to extant approaches include that it is domain agnostic, is assumption-free, requires few parameters, does not require training data, and is scalable and storage efficient. The single hyper-parameter analyzed in MP shows it is robust to change. Our results indicate the MP detection scheme is competitive against existing detection schemes. A novel BGP anomaly detection scheme is also proposed for further research and validation.

DeepMark: A Scalable and Robust Framework for DeepFake Video Detection

With the rapid growth of DeepFake video techniques, it becomes increasingly challenging to identify them visually, posing a huge threat to our society. Unfortunately, existing detection schemes are limited to exploiting the artifacts left by DeepFake manipulations, so they struggle to keep pace with the ever-improving DeepFake models. In this work, we propose DeepMark, a scalable and robust framework for detecting DeepFakes. It imprints essential visual features of a video into DeepMark Meta (DMM) and uses it to detect DeepFake manipulations by comparing the extracted visual features with the ground truth in DMM. Therefore, DeepMark is future-proof, because a DeepFake video must aim to alter some visual feature, no matter how “natural” it looks. Furthermore, DMM also contains a signature for verifying the integrity of the above features. And an essential link to the features as well as their signature is attached with error correction codes and embedded in the video watermark. To improve the efficiency of DMM creation, we also present a threshold-based feature selection scheme and a deduced face detection scheme. Experimental results demonstrate the effectiveness and efficiency of DeepMark on DeepFake video detection under various datasets and parameter settings.

PPFGED: Federated learning for graphic element detection with privacy preservation in multi-source substation drawings

In digital recognition of substation drawings, a significant challenge is how to accurately detect complex graphic elements in each drawing. Existing detection schemes often operate in isolation, with data dispersed across multiple sources, which impedes the development of high-accuracy models. A straightforward solution of consolidating drawings from different substations for training does not satisfy the stringent security requirements of substations. To address these challenges, we propose a novel graphic element detection framework based on federated learning for multi-source substation drawings. Our framework involves a server provider, multiple power companies, and distributed substations, and it employs a universal model generation scheme that protects data privacy. Local substations utilize the designed universal graphic element extraction scheme to categorize drawings and extract smaller elements, achieving enhanced accuracy. Subsequently, we design a privacy-enhanced diffusion model for substations to protect elements before uploading them. Power companies then train local model and apply a designed dimension-compressed local differential privacy scheme to the model parameters to protect the training process. To deter server provider from maliciously exploiting model, a game theory-based optimization solution is designed between server provider and power companies. Finally, experiments conducted using substation drawings provided by multiple cooperating units demonstrate that our framework can accurately perform drawing classification and graphic element extraction, and while obtaining the strongest privacy guarantees and low time cost, it achieves an intelligent system for graphic element detection with an accuracy of 88.14% across different regional substations.

Blockwise Joint Detection of Physical Cell Identity and Carrier Frequency Offset for Narrowband IoT Applications

This paper presents a novel formulation for detecting the secondary synchronization signal in a narrowband Internet of Things communication system. The proposed approach is supported by a noncoherent algorithm that eliminates the need for channel information. A robust joint synchronization scheme is developed by decoupling the estimations of the physical cell identity and the carrier frequency offset. We derive the detection probability of the proposed physical cell identity detector and the mean squared error of the carrier frequency offset estimator, demonstrating their accuracy through simulation results. The performance of the proposed detection scheme is compared with that of existing detection schemes in terms of both estimation accuracy and computational complexity. Experimental results confirm that the proposed synchronization method exhibits superior performance while maintaining relatively lower complexity compared with benchmark methods.

A reliable fault detection algorithm for distribution network with DG resources

The natural disaster though may have less probability, but their impact can be extreme. For instance, windstorms can result in not only single instantaneous impact, but on multiple locations in the power grid. In such situations, detection of faults in active distribution networks (ADNs), having integration of different types of distributed generation (DG) resources, further escalates the challenging task for existing conventional techniques. The reliability of existing detection schemes is further compromised in case of high impedance faults (HIFs). This paper presents a unified approach for reliable detection of both low-impedance and high-impedance faults, while maintaining the discrimination against non-fault events. In the proposed detection algorithm, the fault detection index is calculated using a newer version of empirical mode decomposition (EMD), i.e., improved complete ensemble EMD with adaptive noise (ICEEMDAN). The performance is demonstrated for detection of multiple faults occurrence at different locations in the ADN. It is shown that with selection of uniform threshold value for all the relays in the network, only the dedicated primary and back-up relays operate reliably at the time of fault conditions. The scheme exhibits accurate, fast and reliable operation as compared to available works in the literature.

MDFD: A multi-source data fusion detection framework for Sybil attack detection in VANETs

Sybil attacks in Vehicular Ad-Hoc Networks (VANETs) conduct malicious behavior by falsifying and faking messages between vehicles. It poses a significant threat to the safety of vehicle movement. Meanwhile, because Sybil attacks often hide the real identity of the attacker with the help of a legitimate pseudonym, making it very difficult to detect them. Most existing detection schemes use a single data source, which is not enough to describe the specific characteristics of the attack behavior accurately, while their detection performance is also affected by real scenario factors such as traffic flow and attacker density. Therefore, we propose a multi-source data fusion detection framework for Sybil attacks based on the study of the behavior characteristics of Sybil attacks and the impact of the attacks on the traffic flow state. We get basic safety messages data, map data and sensor data and then obtain multi-dimensional data fusion features from four aspects: spatio-temporal location relationship, traffic flow state change, vehicle behavior characteristics and sensor data verification, and finally use machine learning classification model to complete the detection of attack behavior. Experimental results show that our proposed attack detection framework is able to locate the specific road section where the attack occurred in a realistic and complex traffic scenario containing different road types without using trusted vehicles as observation nodes, and has good generalization capability. the average detection accuracy of the MDFD framework for four types of compound attacks is as high as 97.69%.

Detection method to eliminate Sybil attacks in Vehicular Ad-hoc Networks

A Sybil attack is caused by a malicious vehicle node stealing fake identities and continuously generating fake vehicles on the road to create the illusion of congestion, which endangers normal vehicles on the road. Because Sybil vehicle nodes have trajectories and motion states similar to those of normal vehicles, they are more difficult to detect in high-density traffic environments. The real-time authentication of vehicles is impossible in the existing traffic environment; thus, malicious vehicle nodes with a high degree of stealth can continuously attack and are difficult to stop. In this paper, we propose a Sybil attack detection method based on basic security message (BSM) packets, which exploits the characteristic that BSM packets have a unique sending source and uses the spatiotemporal relationship of dynamic vehicle location changes to detect and trace Sybil attacks. A weighted integration strategy is proposed for increasing the detection precision without machine-learning model prediction. Experimental results indicated that the proposed method can detect Sybil attacks in real time and is not affected by the attack density or traffic density. Moreover, it can detect Sybil nodes and trace malicious nodes simultaneously, with precisions of ¿98% and ¿94%, respectively, resolving the difficulties of existing detection schemes.

Detection of Improved Collusive Interest Flooding Attacks Using BO-GBM Fusion Algorithm in NDN

In Named Data Networking (NDN), Collusive Interest Flooding Attacks (CIFA) is a new type of Distributed Denial of Service (DDoS) attacks, which can effectively affect the performance of NDN by sending malicious Interests intermittently. Since the concealment of CIFA is strong, the existing detection methods for Interest Flooding Attacks (IFA) are difficult to find the malicious Interests in the NDN network. However, the subsequent attack strength of CIFA is weaker than that of IFA, resulting in the attack range of CIFA is much smaller than that of IFA in large network topologies. In order to launch the most serious attack with the least cost, the attack model of CIFA has been improved by our previous work, namely Improved Collusive Interest Flooding Attacks (I-CIFA). To better take the countermeasures against I-CIFA, this paper studies the adverse effects of I-CIFA in NDN and proposes a detection mechanism for I-CIFA. Foremost, we extract the corresponding network traffic and analyze the impact of I-CIFA on malicious routing nodes in different locations of the network. Furthermore, the detection mechanism based on BO-GBM fusion algorithm is proposed to detect I-CIFA through classifying the network traffic. Finally, several specific performance metrics are adopted to evaluate the practicability of BO-GBM fusion algorithm in detecting I-CIFA. The results show that BO-GBM fusion algorithm has better detection performance than other existing detection schemes, with the detection rate of 98.69%, false alarm rate of 1.36% and missing alarm rate of 1.43%.

A mathematical analysis of M-MIMO using ML based signal detection algorithms

The advanced radio communication is being rapidly deploying in the world. Multiple Inputs and Multiple Outputs (MIMO) is limited to 8 Antennas at the base station already utilized in fourth generation(4G). Massive-MIMO (M-MIMO) has been gaining and anormal popularities for its characteristics and utilisation in 5G. The throughput of the system is significantly increased by utilizing maximum number of antennas at the BS. However, the detection of the original signal is considered a complex task in massive MIMO. Hence, in this article we introduce a novel QRM-MLD method with an aim to enhance the throughput with a low intricacy. Further we compared a proposed Machine learning (ML) based QRM-MLD with existing detection scheme the experimental result revealed that the QRM-MLD acquired a gain of 2DB as compound with conventional QRM-MLD.

Complexity-Efficient Coherent Physical Cell Identity Detection Method for Cellular IoT Systems

Narrowband Internet of Things (NB-IoT) is one of the low-power wide-area network technologies that aim to support enormous connection, deep coverage, low power consumption, and low cost. Therefore, low cost of implementation and maintenance is one of the key challenges of NB-IoT terminals. This paper presents a low-complexity formulation for narrowband secondary synchronization signal (NSSS) detection in the NB-IoT system, supported by a coherent algorithm that requires a priori knowledge of the channel. By exploiting a symmetric conjugate feature of the NSSS sequence, a joint physical cell ID and radio frame number detection method with low complexity is proposed for coherent detection. The probability of erroneous detection of the presented NSSS detection method is computed, and the analytical model is verified by means of simulation. Numerical experiments will demonstrate that the proposed detection scheme remarkably reduces the computational complexity with almost the same detection ability compared to the existing detection scheme.

A comprehensive fuzzy-based scheme for online detection of operational and topological changes

<span>Operational modes and topological changes affect power flow in the power systems. As a result, a broad spectrum of protection issues may happen in the power system. So, both the operational and topological changes should be detected fast to prevent blackouts. On the other hand, the existing detection schemes are complex in analyzing and implementation. Therefore, there is a need for an online scheme to identify the network's topology and operation mode simultaneously without complex computations and additional communication infrastructures. To this end, a comprehensive scheme is proposed in which the changes are detected by analyzing the power flow obtained from the network. For this purpose, line outage contingencies and operation modes are defined in rules to be used in a fuzzy inference system (FIS) as a decision-making tool. The proposed scheme can be implemented on existing lines as a communication infrastructure and determines the network’s status in an online manner. Also, in comparison to the existing schemes, the proposed scheme reduces the complexity and the computational burden. The proposed scheme is implemented on IEEE 8-bus system and the results proved its efficiency.</span>

Temporal Correlation Enhanced Sparse Activity Detection in MIMO Enabled Grant-Free NOMA

Exploiting the sparse user activity induced by sporadic transmission, compressed sensing (CS) has been widely applied in multiple-input multiple-output (MIMO) enabled non-orthogonal multiple access (NOMA) for efficient multiuser detection. However, most of the existing detection schemes in MIMO enabled NOMA systems focus mainly on the spatial structure in user activity induced by multiantenna reception, while the temporal correlation in user activity has rarely been incorporated for further performance improvement. To address this issue, we propose a novel Multiuser Detection framework in MIMO enabled NOMA (MDMN), which explicitly integrates the temporal correlation in user activity into the detection process to improve the user detection accuracy. Specifically, we first formulate multiuser detection with multiantenna reception in MDMN as a block CS problem, by exploiting the spatial correlation in user activity. Furthermore, through incorporating the temporal correlation in active user sets into block CS, an adaptive CS algorithm based on subspace pursuit is developed for MDMN, named spatial-temporal correlation enhanced adaptive subspace pursuit (STASP). In particular, STASP does not require any prior knowledge of the user sparsity, as the cross validation designed in STASP can properly terminate the algorithm. The superior performance of the proposed MDMN framework and the corresponding algorithms is corroborated by extensive simulation results.

Network-on-Chip hardware Trojan detection platform based on machine learning

The extensive use of the Network-on-Chip (NoC) architecture makes it vulnerable to malicious attacks by hardware Trojans, especially Denial of Service (DoS) attack. To address this issue, this paper proposes a general NoC hardware Trojan detection platform based on machine learning. The platform establishes a security detection module including traffic feature tracking unit, feature registration unit, change point detection unit, and random forest detection unit, to accomplish the traffic-related hardware Trojan detection. The live-lock and fault routing Trojans are inserted in the proposed platform, then the simulation results verify the effectiveness of platform function and show its superiority to other existing detection schemes.

WEB DDoS Attack Detection Method Based on Semisupervised Learning

Since the services on the Internet are becoming increasingly abundant, all walks of life are inextricably linked with the Internet. Simultaneously, the Internet’s WEB attacks have never stopped. Relative to other common WEB attacks, WEB DDoS (distributed denial of service) will cause serious damage to the availability of the target network or system resources in a short period of time. At present, most researches are centered around machine learning-related DDoS attack detection algorithms. According to previous studies, unsupervised methods generally have a high false positive rate, while supervisory methods cannot handle large amount of network traffic data, and the performance is often limited by noise and irrelevant data. Therefore, this paper proposes a semisupervised learning detection model combining spectral clustering and random forest to detect the DDoS attack of the WEB application layer and compares it with other existing detection schemes to verify the semisupervised learning model proposed in this paper. While ensuring a low false positive rate, there is a certain improvement in the detection rate, which is more suitable for the WEB application layer DDoS attack detection.

Extraction of the characteristics of vortex beams with a partial receiving aperture at arbitrary locations

Orbital angular momentum (OAM) has aroused widespread interest in communication systems because it improves spectrum efficiency. However, for the free-space link, OAM-based communications encounter problems of OAM beam divergence and misalignment, which reduces the channel quality. To address these two challenges, we propose an algorithm to detect the OAM beams based on the dynamic mode decomposition (DMD). Only the partial receiving aperture is used to address the challenge caused by the beam divergence, and the output DMD spectrum exactly sorts the OAM indices of superposed modes. Besides, when there is a misalignment, the DMD spectrum is utilized as a feedback indicator to search for the lateral displacement of the mode axis. With the differential evolution, the axis of OAM beams can be located. Compared with existing detection schemes, our work enables the separation of mixed OAM modes with less received information, and the perfect alignment is dispensable as a priori. This decentralized partial aperture receiving scheme could serve as a practical and effective detection technique for OAM-based communication systems.

A correlation-based approach to detecting wireless physical covert channels

With the rapid development of wireless communication technology, the openness of wireless communication makes it more likely to be threated by radio interception or even maliciously use. As a widely used way to exfiltrate information, the wireless covert channel brings a great threat to communication security. Compared with the wireless covert channel on the upper layer, the wireless covert channel based on the physical layer (WCC-P) has better concealment and greater capacity. However, due to the high variation in the wireless communication channel, detecting WCC-P is a challenging task. Existing detection schemes are ineffective at detecting most of WCC-P schemes. In this paper, we propose a new correlation-based scheme to detect WCC-P communication signal. The proposed detection scheme is based on the correlation coefficient of the constellation error vectors (CEV) for multiple antennas. The difference in the correlation coefficient of a detection process provides a critical clue for WCC-P signal detection. Exploiting this observation, we investigate the use of the correlation coefficient in detecting WCC-P communication signal. Simulations show that the proposed scheme can effectively detect WCC-P signal. When the signal-to-noise ratio (SNR) reaches 5 dB, the detection accuracy can reach more than 90%.

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.

Dynamic Threshold Based Throughput Enhancement in Cognitive Radio Network Using Hidden Markov Model with State Prediction

The enhancement of throughput is one of the key issues in the cognitive radio network. In this paper, a channel status prediction scheme based on hidden Markov model is proposed for enhancing the throughput of cognitive radio network. Unlike the conventional scheme which relies on channel sensing alone, the proposed scheme provides an additional advantage of being able to predict the primary user’s state along with channel sensing, thus increasing spectrum utilization and system throughput. For achieving enhanced reliability in spectrum sensing process of the network, a dynamic threshold based energy detection technique considering noise uncertainty and target detection probabilities is proposed. Comparative analyses of the performance of the dynamic threshold based energy detection technique with that of existing fixed and dynamic threshold based detection schemes are presented. The analyses reveal that the proposed detection scheme performs better than the existing detection schemes with regard to probability of detection and probability of false alarm. It is shown that the hidden Markov model-based prediction scheme makes the cognitive radio network more efficient in terms of throughput than existing schemes.

Molecular Fingerprint Detection Using Portable Water‐Compatible Electronic Tunneling Spectroscopy Device

AbstractReal‐time and label‐free recognition of molecules is highly desired in numerous fields; however, most existing detection schemes require specific functionalization of the device suited for the molecule to be detected and is often complicated by nonselective adsorption. Current detection methodologies that deliver detailed molecular‐level information typically require elaborate analytical instrumentation to overcome these limitations, rendering those costly, not scalable, and nonportable techniques. Herein, a detection scheme is presented that rely on measurement of the tunneling currents through molecules under ambient conditions by employing a robust, scalable, portable, and water‐compatible device. High aspect ratio semiconductor–metal hybrid nanosystems, which feature a metal tip (Au) that functions as a nanoelectrode, are utilized to create self‐formed nanojunctions. Analyte molecules intercalate between the nanoscopic gold tip and a counter electrode, resulting in distinctive tunneling currents. Characteristic dI/dV fingerprint traces, unique to the density of states of the molecular species embedded in the liquid medium, are detectable. Resetting is demonstrated by desorption of adsorbed molecules by applying a reset voltage bias. This study paves the way toward low‐cost, on‐site, and real‐time information‐rich molecular detectors.