Identification Of Attacks Research Articles

Detection and Identification of Cyber and Physical Attacks on Distribution Power Grids with PVs: An Online High-Dimensional Data-driven Approach.

Cyber and physical attacks threaten the security of distribution power grids. The emerging renewable energy sources such as photovoltaics (PVs) introduce new potential vulnerabilities. Based on the electric waveform data measured by waveform sensors in the distribution power networks, in this paper, we propose a novel high-dimensional data-driven cyber physical attack detection and identification approach (HCADI). Firstly, we analyze the cyber and physical attack impacts (including cyber attacks on the solar inverter causing unusual harmonics) on electric waveforms in distribution power grids. Then, we construct a high dimensional streaming data feature matrix based on signal analysis of multiple sensors in the network. Next, we propose a novel mechanism including leverage score based attack detection and binary matrix factorization based attack diagnosis. By leveraging the data structure and binary coding, our HCADI approach does not need the training stage for both detection and the root cause diagnosis, which is needed for machine learning/deep learning-based methods. To the best of our knowledge, it is the first attempt to use raw electrical waveform data to detect and identify the power electronics cyber/physical attacks in distribution power grids with PVs.

A Hidden Attack Sequences Detection Method Based on Dynamic Reward Deep Deterministic Policy Gradient

Attacker identification from network traffic is a common practice of cyberspace security management. However, network administrators cannot cover all security equipment due to the cyberspace management cost constraints, giving attackers the chance to escape from the surveillance of network security administrators by legitimate actions and to perform the attack in both physical domain and digital domain. Therefore, we proposed a hidden attack sequence detection method based on reinforcement learning to deal with the challenge through modeling the network administrators as an intelligent agent that learns their action policy from the interaction with the cyberspace environment. Following Deep Deterministic Policy Gradient (DDPG), the intelligent agent can not only discover the hidden attackers hiding in the legitimate action sequences but also reduce the cyberspace management cost. Furthermore, a dynamic reward DDPG method was proposed to improve defense performance, which set dynamic reward depending on the hidden attack sequences steps and agent’s check steps, compared to the fixed reward in common methods. Meanwhile, the method was verified in a simulated experimental cyberspace environment. Finally, the experimental results demonstrate that there are hidden attack sequences in cyberspace, and the proposed method can discover the hidden attack sequences. The dynamic reward DDPG shows superior performance in detecting hidden attackers, with a detection rate of 97.46%, which can improve the ability to discover hidden attackers and reduce the 6% cyberspace management cost compared to DDPG.

"Mitigation and Identification of Camouflage Attack Over Computer Vision Applications"

Computer vision technologies are now commonly used in real-time image and video recognition applications using deep neural networks. Scaling or Mitigation is the basic input pre-processing feature in these implementations. Image scaling methods are designed to maintain visual elements before and after scaling, and are widely utilized in a variety of visual and image processing applications. Content disguising attacks may be carried out by taking advantage of the picture scaling mechanism, which causes the machine's extracted content to be drastically different from the input before scaling. In this project the actual input image with dimension Am×n is resized to an attacked image dimension Om1×n1, which will mislead the classifier as the input is attacked image. To illustrate the threats from such camouflage attacks, some computer vision applications taken as targeted victims that includes multiple image classification applications based on popular deep learning frameworks like OpenCV, pillow. This attack is not detected while checking with the YOLOV4 demo. To defend against such attacks, in this project using Dhash i.e., difference hash concept. The hash the value of the actual image and the resized are same when using the Dhash. If the image is camouflaged the means the content is modified so the Dhash value of the image also changed if the image is not camouflaged the then the hash value of the actual image and resized images are same. By using the Dhash concept detecting the image is camouflaged or not.

Fog-Computing-Based Cyber–Physical System for Secure Food Traceability through the Twofish Algorithm

The Internet is an essential part of daily life with the expansion of businesses for maximizing profits. This technology has intensely altered the traditional shopping style in online shopping. Convenience, quick price comparison, saving traveling time, and avoiding crowds are the reasons behind the abrupt adoption of online shopping. However, in many situations, the product provided does not meet the quality, which is the primary concern of every customer. To ensure quality product provision, the whole food supply chain should be examined and managed properly. In food traceability systems, sensors are used to gather product information, which is forwarded to fog computing. However, the product information forwarded by the sensors may not be similar, as it can be modified by intruders/hackers. Moreover, consumers are interested in the product location, as well as its status, i.e., manufacturing date, expiry date, etc. Therefore, in this paper, data and account security techniques were introduced to efficiently secure product information through the Twofish algorithm and dual attestation for account verification. To improve the overall working, the proposed mechanism integrates fog computing with novel modules to efficiently monitor the product, along with increasing the efficiency of the whole working process. To validate the performance of the proposed system, a comparative simulation was performed with existing approaches in which Twofish showed notably better results in terms of encryption time, computational cost, and the identification of modification attacks.

Application of Artificial Intelligence to Network Forensics: Survey, Challenges and Future Directions

Network forensics focuses on the identification and investigation of internal and external network attacks, the reverse engineering of network protocols, and the uninstrumented investigation of networked devices. It lies at the intersection of digital forensics, incident response and network security. Network attacks exploit software and hardware vulnerabilities and communication protocols. The scope of a network forensic investigation can range from Internet-wide down to a single device’s network traffic. Network analysis tools (NATs) aid security professionals and law enforcement in the capturing, identification and analysis of network traffic. However, in most instances, the sheer volume of data to be analyzed is enormous and, despite some built-in NAT automation, the investigation of network traffic is often an arduous process. Furthermore, significant expert time remains wasted in the investigation of a high frequency of false positive alerting from automated systems. To address this globally impacting problem, artificial intelligence based approaches are becoming increasingly employed to automatically detect attacks and increase network traffic classification accuracy. This paper provides a comprehensive survey of the state-of-the-art in network forensics and the application of expert systems, machine learning, deep learning, and ensemble/hybrid approaches to a range of application areas in the field. These include network traffic analysis, intrusion detection systems, Internet-of-Things devices, cloud forensics, DNS tunneling, smart grid forensics, and vehicle forensics. In addition, the current challenges and future research directions for each of the aforementioned application areas is discussed.

Structural-Constrained Methods for the Identification of False Data Injection Attacks in Power Systems

Power system functionality is determined on the basis of the power system state estimation (PSSE). Thus, corruption of the PSSE may lead to severe consequences, such as financial losses, maintenance damage, and disruptions in electricity distribution. Classical bad data detection (BDD) methods, developed to ensure PSSE reliability, are unable to detect well-designed attacks, named unobservable false data injection (FDI) attacks. In this paper, we develop novel structural-constrained methods for the detection of unobservable FDI attacks, the identification of the attacked buses' locations, and PSSE under the presence of such attacks. The proposed methods are based on formulating structural, sparse constraints on both the attack and the system loads. First, we exploit these constraints in order to compose an appropriate model selection problem. Then, we develop the associated generalized information criterion (GIC) for this problem. However, for large networks, the GIC method's computational complexity grows exponentially with the network size. Thus, based on the proposed structural and sparse constraints, we develop two novel low-complexity methods for unobservable FDI attack identification: 1) a modification of the state-of-the-art orthogonal matching pursuit (OMP); and 2) a method that utilizes the graph Markovian property in power systems, i.e. the second-neighbor relationship between the power data at the system's buses. The methods' performance is evaluated on a IEEE-30 bus test case system.

Identification of Return-Oriented Programming Attacks Using RISC-V Instruction Trace Data

An increasing number of embedded systems include dedicated neural hardware. To benefit from this specialized hardware, deep learning techniques to discover malware on embedded systems are needed. This effort evaluated candidate machine learning detection techniques for distinguishing exploited from non-exploited RISC-V program behavior using execution traces. We first developed a dataset of execution traces containing Return Oriented Programming (ROP) exploitation on the RISC-V Instruction Set Architecture (ISA) and then developed several deep learning bidirectional Long Short-Term Memory (LSTM) models capable of distinguishing exploited traces from non-exploited traces, each using subsets of features from the execution traces. An objective of this effort was to evaluate which features (instruction addresses and immediate values) from an execution trace are application-specific, which features (opcodes and operands) are application-agnostic, and how these subsets of features affect model performance. Application-agnostic features allow a model to generalize its detection capability to detecting ROP in previously unseen applications. The model using opcode and operand sequences obtained 98.21% cross validation accuracy and 97.94% test accuracy. In contrast, a model using address values obtained 92.79% cross validation accuracy with 99.59% test set accuracy. This research also analyzed whether ROP exploitation significantly affects branch prediction; experimental evidence suggests that it does. Thus, branch prediction behavior could be a valuable feature in detecting ROP exploits.

A Highly Stealthy Adaptive Decay Attack Against Speaker Recognition

Speaker recognition based on deep learning is currently the most advanced and mainstream technology in the industry. Adversarial attacks, an emerging and powerful attack against neural network models, were first applied in the image domain and gradually expanded to other domains, also posing serious security problems for speaker recognition. Common gradient-based attack methods such as FGSM, PGD, and MI-FGSM can deceive speaker recognition models with high confidence, yet their carefully crafted adversarial examples suffer from poor stealthiness and are easily perceived by the human ear. To improve the stealthiness of the adversarial examples, this paper proposes a new attack method called the Adaptive Decay Attack (ADA), which is applied to three different scenarios in speaker recognition. The method takes the set number of iterations as the termination condition, automatically adjusts the size of the maximum perturbation according to whether the attack is successful or not, and then uses the decay methods in learning rates such as exponential decay and cosine annealing to continuously reduce the step size. The experimental results show that under the two speaker recognition models x-vector, and i-vector, the proposed attack method improves the stealthiness metrics such as SNR and PESQ by at least 30% and 39%, respectively, compared with the best PGD attack under speaker identification of untargeted attacks. For the speaker identification task with targeted attacks, the average improvement is at least 20% and 25% compared to PGD. For the speaker verification task, the improvement is at least 29.5% and 33.4% compared to PGD. In addition, we also use this attack method for adversarial training to enhance the robustness of the model. Experimental results show that ADA-based adversarial training takes 28.31% less time than PGD-based adversarial training, and its improved robustness is generally superior to PGD-based adversarial training. Specifically, the attack success rate of PGD and ADA methods decreased from 50.88% to 36.47% and 64.74% to 45.82%, respectively.

Identification of Sensor Replay Attacks and Physical Faults for Cyber-Physical Systems

This letter proposes a threat discrimination methodology for distinguishing between sensor replay attacks and sensor bias faults, based on the specially designed watermark integrated with adaptive estimation. For each threat type, a watermark is designed based on the changes that the threat imposes on the system. Threat discrimination conditions are rigorously investigated to characterize quantitatively the class of attacks and faults that can be discriminated by the proposed scheme. A simulation is presented to illustrate the effectiveness of our approach.

Automatic Botnet Attack Identification Based on Machine Learning

At present, the severe network security situation has put forward high requirements for network security defense technology. In order to automate botnet threat warning, this paper researches the types and characteristics of Botnet. Botnet has special characteristics in attributes such as packets, attack time interval, and packet size. In this paper, the attack data is annotated by means of string recognition and expert screening. The attack features are extracted from the labeled attack data, and then use K-means for cluster analysis. The clustering results show that the same attack data has its unique characteristics, and the automatic identification of network attacks is realized based on these characteristics. At the same time, based on the collection and attribute extraction of Botnet attack data, this paper uses RF, GBM, XGBOOST and other machine learning models to test the warning results, and automatically analyzes the attack by importing attack data. In the early warning analysis results, the accuracy rates of different models are obtained. Through the descriptive values of the three accuracy rates of Accuracy, Precision, and F1_Score, the early warning effect of each model can be comprehensively displayed. Among the five algorithms used in this paper, three have an accuracy rate of over 90%. The three models with the highest accuracy are used in the early warning model. The research shows that cyberattacks can be accurately predicted. When this technology is applied to the protection system, accurate early warning can be given before a network attack is launched.

A Stream Learning Approach for Real-Time Identification of False Data Injection Attacks in Cyber-Physical Power Systems

This paper presents a novel data-driven framework to aid in system state estimation when the power system is under unobservable false data injection attacks. The proposed framework dynamically detects and classifies false data injection attacks. Then, it retrieves the control signal using the acquired information. This process is accomplished in three main modules, with novel designs, for detection, classification, and control signal retrieval. The detection module monitors historical changes in phasor measurements and captures any deviation pattern caused by an attack on a complex plane. This approach can help to reveal characteristics of the attacks including the direction, magnitude, and ratio of the injected false data. Using this information, the signal retrieval module can easily recover the original control signal and remove the injected false data. Further information regarding the attack type can be obtained through the classifier module. The proposed ensemble learner is compatible with harsh learning conditions including the lack of labeled data, concept drift, concept evolution, recurring classes, and independence from external updates. The proposed novel classifier can dynamically learn from data and classify attacks under all these harsh learning conditions. The introduced framework is evaluated w.r.t. real-world data captured from the Central New York Power System. The obtained results indicate the efficacy and stability of the proposed framework.

Securing Consumer Internet of Things for Botnet Attacks: Deep Learning燗pproach

DDoS attacks in the Internet of Things (IoT) technology have increased significantly due to its spread adoption in different industrial domains. The purpose of the current research is to propose a novel technique for detecting botnet attacks in user-oriented IoT environments. Conspicuously, an attack identification technique inspired by Recurrent Neural networks and Bidirectional Long Short Term Memory (BLRNN) is presented using a unique Deep Learning (DL) technique. For text identification and translation of attack data segments into tokenized form, word embedding is employed. The performance analysis of the presented technique is performed in comparison to the state-of-the-art DL techniques. Specifically, Accuracy (98.4%), Specificity (98.7%), Sensitivity (99.0%), F-measure (99.0%) and Data loss (92.36%) of the presented BLRNN detection model are determined for identifying 4 attacks over Botnet (Mirai). The results show that, although adding cost to each epoch and increasing computation delay, the bidirectional strategy is more superior technique model over different data instances.

BCAuth: Physical Layer Enhanced Authentication and Attack Tracing for Backscatter Communications

Backscatter communication (BC) enables ultra-low-power communications and allows devices to harvest energy simultaneously. But its practical deployment faces severe security threats caused by its nature of openness and broadcast. Authenticating backscatter devices (BDs) is treated as the first line of defense. However, complex cryptographic approaches are not desirable due to the limited computation capability of BDs. Existing physical layer authentication schemes cannot effectively support BD mobility, multiple attacker identification and attacker location tracing in an integrated way. To tackle these problems, this paper proposes BCAuth, a multi-stage authentication and attack tracing scheme based on the physical spatial information of BDs to realize enhanced BD authentication security for both static and mobile BDs. After initial authentication based on BD identity with its position information registration, preemptive authentication and re-authentication are performed according to spatial correlation of backscattered signal source locations associated with the BD. By exploiting clustering-based analysis on spacial information, BCAuth is capable of determining the number of attackers and localizing their positions. In addition, we propose a reciprocal channel-based method for BD re-authentication with better authentication performance than the clustering-based method for mobile BDs when the BDs is able to measure received signal strength (RSS), which also enables mutual authentication. We theoretically analyze BCAuth security and conduct extensive numerical simulations with various settings to show its desirable performance.

Identifikasi Serangan Denial Of Service (Dos) Di Jaringan Dengan Algoritma Decision Tree C4.5

DoS and DDoS are attacks on computer networks that flood network traffic with continuous requests. For this reason, efforts to secure computer networks and preventive measures need to be carried out by installing firewalls, IDS / IPS devices. The IDS acts as an alarm to the admin that there is abnormal activity on the network, so that the admin can take immediate preventive action. In detecting attacks, IDS uses methods or algorithms to identify anomalies that occur in the network. The algorithm is expected to be able to classify between dangerous traffic and normal traffic. Data mining is suitable to be applied in the classification of network traffic because of the large size of the data and the various types of attacks. The C4.5 decision tree algorithm is expected to be able to be used in the traffic classification process with the aim of identifying DoS attacks. The results of the trial with dataset testing, C.45 yielded an accuracy of 90,68% in classifying traffic for the identification of DoS attacks, and yielded an accuracy of 74,99% in classifying all types of traffic. The Naïve Bayes algorithm is used as a comparison, the accuracy is 86,56% in classifying DoS attack identification traffic, and produces an accuracy of 69,50% in classifying all types of traffic. The C4.5 algorithm is superior in terms of accuracy but takes longer to build the model than the Naïve Bayes algorithm.

Feature Entropy Estimation (FEE) for Malicious IoT Traffic and Detection Using Machine Learning

Identification of anomaly and malicious traffic in the Internet of things (IoT) network is essential for IoT security. Tracking and blocking unwanted traffic flows in the IoT network is required to design a framework for the identification of attacks more accurately, quickly, and with less complexity. Many machine learning (ML) algorithms proved their efficiency to detect intrusion in IoT networks. But this ML algorithm suffers many misclassification problems due to inappropriate and irrelevant feature size. In this paper, an in-depth study is presented to address such issues. We have presented lightweight low-cost feature selection IoT intrusion detection techniques with low complexity and high accuracy due to their low computational time. A novel feature selection technique was proposed with the integration of rank-based chi-square, Pearson correlation, and score correlation to extract relevant features out of all available features from the dataset. Then, feature entropy estimation was applied to validate the relationship among all extracted features to identify malicious traffic in IoT networks. Finally, an extreme gradient ensemble boosting approach was used to classify the features in relevant attack types. The simulation is performed on three datasets, i.e., NSL-KDD, USNW-NB15, and CCIDS2017, and results are presented on different test sets. It was observed that on the NSL-KDD dataset, accuracy was approx. 97.48%. Similarly, the accuracy of USNW-NB15 and CCIDS2017 was approx. 99.96% and 99.93%, respectively. Along with that, state-of-the-art comparison is also presented with existing techniques.

Semantic web ecosystem based on CVE (NVD, CPE), CWE and CAPEC

CVE (NVD, CPE), CWE and CAPEC are databases in the Cybersecurity area sponsored and maintained by the US government. These are lists (databases) organized in taxonomies where it is appropriate. They contain information about known vulnerabilities, weaknesses and attacks. CVE (NVD, CPE), CWE and CAPEC are the corner stone in many cybersecurity tools.The usage of traditional database systems for the tasks in the cybersecurity require extended knowledge and skills in querying for identification of vulnerabilities, weaknesses and attacks. CVE (NVD, CPE), CWE and CAPEC contain hidden facts and relationships (knowledge) buried in the data. This knowledge can be effectively accessed by the Semantic web tools.The paper presents an approach for transition to the Semantic web of above-mentioned databases. The approach is presented in illustrative way. This means without duplication with information about the contents available for CVE (NVD, CPE), CWE and CAPEC.

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

DDoS (Distributed Denial of Service) attacks have now become a serious risk to the integrity and confidentiality of computer networks and systems, which are essential assets in today’s world. Detecting DDoS attacks is a difficult task that must be accomplished before any mitigation strategies can be used. The identification of DDoS attacks has already been successfully implemented using machine learning/deep learning (ML/DL). However, due to an inherent limitation of ML/DL frameworks—so-called optimal feature selection—complete accomplishment is likewise out of reach. This is a case in which a machine learning/deep learning-based system does not produce promising results for identifying DDoS attacks. At the moment, existing research on forecasting DDoS attacks has yielded a variety of unexpected predictions utilising machine learning (ML) classifiers and conventional approaches for feature encoding. These previous efforts also made use of deep neural networks to extract features without having to maintain the track of the sequence information. The current work suggests predicting DDoS attacks using a hybrid deep learning (DL) model, namely a CNN with BiLSTM (bidirectional long/short-term memory), in order to effectively anticipate DDoS attacks using benchmark data. By ranking and choosing features that scored the highest in the provided data set, only the most pertinent features were picked. Experiment findings demonstrate that the proposed CNN-BI-LSTM attained an accuracy of up to 94.52 percent using the data set CIC-DDoS2019 during training, testing, and validation.

GGNB: Graph-based Gaussian naive Bayes intrusion detection system for CAN bus

The national highway traffic safety administration (NHTSA) identified cybersecurity of the automobile systems are more critical than the security of other information systems. Researchers already demonstrated remote attacks on critical vehicular electronic control units (ECUs) using controller area network (CAN). Besides, existing intrusion detection systems (IDSs) often propose to tackle a specific type of attack, which may leave a system vulnerable to numerous other types of attacks. A generalizable IDS that can identify a wide range of attacks within the shortest possible time has more practical value than attack-specific IDSs, which is not a trivial task to accomplish. In this paper we propose a novel graph-based Gaussian naive Bayes (GGNB) intrusion detection algorithm by leveraging graph properties and PageRank-related features. The GGNB on the real rawCAN data set [1] yields 99.61%, 99.83%, 96.79%, and 96.20% detection accuracy for denial of service (DoS), fuzzy, spoofing, replay, mixed attacks, respectively. Also, using OpelAstra data set [2], the proposed methodology has 100%, 99.85%, 99.92%, 100%, 99.92%, 97.75% and 99.57% detection accuracy considering DoS, diagnostic, fuzzing CAN ID, fuzzing payload, replay, suspension, and mixed attacks, respectively. The GGNB-based methodology requires about 239× and 135× lower training and tests times, respectively, compared to the SVM classifier used in the same application. Using Xilinx Zybo Z7 field-programmable gate array (FPGA) board, the proposed GGNB requires 5.7×, 5.9×, 5.1×, and 3.6× fewer slices, LUTs, flip-flops, and DSP units, respectively, than conventional NN architecture.

Self-healing topology for DDoS attack identification & discovery protocol in software-defined networks

Software defined networking is an emerging network architecture that separates the control plane from the data plane of network devices and places the control plane on one or more control servers capable of managing the rules traffic forwarding of all communication devices under your domain. This article describes the architecture, different modules, and event sequences of the HyPASS for real-time protection from address-forged attacks with proactive host discovery and address validation. Such attacks cause the wastage of network bandwidth, processing power, and network resources available to the user. We performed the latency, throughput, and attack prevention tests using POX & RYU controllers on the Mininet network simulator with and without HyPASS. The system performance is analyzed for accuracy and efficiency in four different SDN scenarios categorized as fully OpenFlow enabled and Hybrid. The proposed system discovers all the live hosts in the network, updates Host Table at the handshaking between controller and OpenFlow switches. Experiments show that the system prevented all the address-forged attacks by validating the source address in different SDN environments. It achieves a 99.99% filtering accuracy level in a fully OpenFlow-enabled setup.

Analyzing the Impact of Cyber Security Related Attributes for Intrusion Detection Systems

Machine learning (ML) is one of the dominating technologies practiced in both the industrial and academic domains throughout the world. ML algorithms can examine the threats and respond to intrusions and security incidents swiftly in an instinctive way. It plays a critical function in providing a proactive security mechanism in the cybersecurity domain. Cybersecurity ensures the real time protection of information, information systems, and networks from intruders. Several security and privacy reports have cited that there has been a rapid increase in both the frequency and the number of cybersecurity breaches in the last decade. Information security has been compromised by intruders at an alarming rate. Anomaly detection, phishing page identification, software vulnerability diagnosis, malware identification, and denial of services attacks are the main cyber-security issues that demand effective solutions. Researchers and experts have been practicing different approaches to address the current cybersecurity issues and challenges. However, in this research endeavor, our objective is to make an idealness assessment of machine learning-based intrusion detection systems (IDS) under the hesitant fuzzy (HF) conditions, using a multi-criteria decision making (MCDM)-based analytical hierarchy process (AHP) and technique for order of preference by similarity to ideal-solutions (TOPSIS). Hesitant fuzzy sets are useful for addressing decision-making situations in which experts must overcome the reluctance to make a conclusion. The proposed research project would assist the machine learning practitioners and cybersecurity specialists in identifying, selecting, and prioritizing cybersecurity-related attributes for intrusion detection systems, and build more ideal and effective intrusion detection systems.