Integrity Attacks Research Articles

AroMa : Evaluating Deep Learning Systems for Stealthy Integrity Attacks on Multi-tenant Accelerators

Multi-tenant applications have been proliferating in recent years, supported by the emergence of computing-as-service paradigms. Unfortunately, multi-tenancy induces new security vulnerabilities due to spatial or temporal co-location of applications with possibly malicious intent. In this article, we consider a special class of stealthy integrity attacks on multi-tenant deep learning accelerators. One interesting conclusion is that it is possible to perform targeted integrity attacks on kernel weights of deep learning systems such that it remains functional but mis-labels specific categories of input data through standard RowHammer attacks by only changing 0.0009% of the total weights. We develop an automated framework, AroMa , to evaluate the impact of multi-tenancy on security of deep learning accelerators against integrity attacks on memory systems. We present extensive evaluations on AroMa to demonstrate its effectiveness.

A Blockchain-Based Data-Driven Fault-Tolerant Control System for Smart Factories in Industry 4.0

Modern technologies and data-driven approaches have enabled fault-tolerant controllers in Industry 4.0 smart factories to detect, identify, and mitigate anomalies in real-time with a high level of accuracy. However, this has also presented new challenges and requirements for cybersecurity, data analytics, and computational complexity for Data-Driven Fault-Tolerant Controllers (DD-FTC) in smart factories. To address these issues, a Blockchain-Based Data-Driven Fault-Tolerant Control (BB-DD-FTC) framework for smart factories is proposed in this paper. Blockchain ensures the integrity of data logs via its immutable ledger and decentralized architecture. Moreover, the blockchain smart contract functionality, embedded with a Data-Driven Intrusion Detection System (DD-IDS), and reconfiguration conditions, realizes DD-FTC and undertakes the mitigation response in case of cyber-attacks. The DD-IDS mechanism utilizes the principal component analysis technique and observer models, trained via neural networks, to detect an attack and identify the compromised component. The Tennessee Eastman (TE) industrial benchmark process is considered a case study to investigate the performance of the proposed framework. Two kinds of integrity attacks are applied to the sensors of the TE process with simulation results demonstrating the effectiveness of the method in mitigating the adversarial effect of the applied attacks on the overall system performance. As feedback delays can negatively impact performance, a detailed delay analysis is performed using network calculus. The security advantages and limitations of the proposed method are finally highlighted in the performed security analysis. The results are encouraging for the wider adoption of the control-over-the-blockchain concept.

Evaluating the Privacy and Utility of Time-Series Data Perturbation Algorithms

Data collected from sensor-rich systems may reveal user-related patterns that represent private information. Sensitive patterns from time-series data can be protected using diverse perturbation methods; however, choosing the method that provides the desired privacy and utility level is challenging. This paper proposes a new procedure for evaluating the utility and privacy of perturbation techniques and an algorithm for comparing perturbation methods. The contribution is significant for those involved in protecting time-series data collected from various sensors as the approach is sensor-type-independent, algorithm-independent, and data-independent. The analysis of the impact of data integrity attacks on the perturbed data follows the methodology. Experimental results obtained using actual data collected from a VW Passat vehicle via the OBD-II port demonstrate the applicability of the approach to measuring the utility and privacy of perturbation algorithms. Moreover, important benefits have been identified: the proposed approach measures both privacy and utility, various distortion and perturbation methods can be compared (no matter how different), and an evaluation of the impact of data integrity attacks on perturbed data is possible.

Reachability Analysis Plus Satisfiability Modulo Theories: An Adversary-Proof Control Method for Connected and Autonomous Vehicles

Connected and autonomous vehicles (CAVs) are expected to operate with safety guarantee in presence of adversaries from the Internet of Vehicles. This article proposes a control method named reachability analysis plus satisfiability modulo theories (RA-SMT) for CAVs against integrity attacks caused by bounded adversary. This method enables vehicles to possess the reach-avoid specification and strict control safety ensurance even in the worst case scenario. The introduction of state-feedback control decomposes the original complex problem into more manageable reachability analysis and adversary-free control strategy optimization. Precisely, zonotope sets are employed for reachability analysis, and the control strategy is optimally solved and verified simultaneously via SMT. This method is applicable to complex traffic scenarios with the help of SMT, which can describe various constraints flexibly and conveniently. Simulation results reveal the effectiveness and safety of the proposed method in the classical car-following scenario against bounded adversary under various conditions. Particularly, RA-SMT exhibits significantly improved control performance (around 16%) and computation efficiency (around 63%) compared with existing methods. Finally, the RA-SMT is implemented on an autonomous driving platform to validate its practicability.

Critical Data Visualization to Enhance Protection Schemes for State Estimation

Intelligent electrical power grids, widely referred to as smart grids (SGs), rely on digital technology resources, especially communication and measurement devices, becoming a cyber-physical energy system. Massive data flow between grid elements makes smart grids more vulnerable to cyber-attacks. Power system state estimation (SE)—an essential function of energy management systems—is one of these data integrity attacks’ targets. Integrity validation routines can fail when insufficient redundancy levels are reached, and spurious data occur. These levels are associated with critical data, i.e., those whose unavailability makes the grid unobservable. Data redundancy is a metric that gives a precarious indication that SE can run. Alternatively, it is more appropriate to quantify this function strength concerning its results’ reliability, which can be achieved by criticality analysis (CA). This paper proposes a novel approach to visualize the results of an extensive CA through representative graphs; they facilitate understanding the usefulness of CA. Critical sets of measurements are generalized, and several metrics are proposed to reveal measuring system vulnerabilities, assisting the design of protection schemes to resist cyber-attacks. Simulations attained on the IEEE-30bus system evince significant improvements in the interpretation/use of CA.

Data Integrity Attack Detection Using Ensemble-Based Learning for Cyber–Physical Power Systems

The modern power system has evolved into a cyber-physical system with the integration of PMUs, smart meters, substation automation, and wide-area monitoring and control systems. This increases attack surface area and cybersecurity issues, but we can also use these technologies to prevent such scenarios. This paper provides a novel technique to generate and detect data integrity attacks in smart grids. It also gives an optimization algorithm for generating FDIA against state estimation algorithms present at the control center. The formulation for generating AC state estimation attack with full information and limited information along with DC state estimation attacks is given. It further proposes a combining technique for the voting based ensemble learning technique (MVCC) to detect FDIA in smartgrids. The model is then tested on an IEEE 24 bus system and 39 bus new England system by generating false data injection attacks and detecting them. The detection strategy is compared with most of the existing state of the art Machine learning algorithms, ensemble algorithms and conventional weighted least square algorithm and is found to have a better performance.

Zonotopic resilient state estimation for unmanned surface vehicles subject to integrity attacks

This work concerns the problem of resilient state estimation for unmanned surface vehicle systems subject to integrity attacks under peak-bounded perturbations. A novel resilient remote state estimation method is proposed based on zonotopic reachability analysis. The compromised sensors are identified based on the so-called predicted output set and zonotope support strip. Then, a resilient state reachable set is obtained by using the sensor data from the remaining benign measurements. For enhancing the performance of estimation, segment minimization is introduced to optimize the obtained state reachable set. Simulation results are provided to testify the effectiveness of the proposed method.

Reinforcing Data Integrity in Renewable Hybrid AC-DC Microgrids from Social-Economic Perspectives

The microgrid (MG) is a complicated cyber-physical system that operates based on interactions between physical processes and computational components, which make it vulnerable to varied cyber-attacks. In this article, the impact of data integrity attack (DIA) has been considered, as one of the most dangerous cyber threats to MGs, on the steady-state operation of hybrid microgrids (HMGs). Additionally, a novel method based on the sequential hypothesis testing approach is proposed to detect DIA on the renewable energy sources’ metering infrastructure and improve the data security within the HMGs. The proposed method generates a binary sample, which is used to compute a test statistic that is further used against two thresholds to decide among three alternatives. The performance of the suggested method is examined using an IEEE standard test system. The results illustrated the acceptable performance of the proposed methodology in detection of DIAs. In addition, to evaluate the effect of DIA on the operation of the HMGs, DIAs with different severities are launched on the measured power generation of renewable energy resources like wind turbines. The results showed that a successful DIA on renewable units can severely affect the operation of electric grids and cause serious damage.

Observable placement of phasor measurement units for defense against data integrity attacks in real time power markets

Integrity data (DI) attacks are considered malicious cyber threats to the economic performance of power markets in current power systems. A cyber attacker could mislead the system operator by implementing a DI attack, through the deviation of measured information, and causes non-optimal power distribution and erroneous participation in the electricity market (EM). This paper proposes a placement scheme of phasor measurement units (PMUs) to defend against these attacks, so that network observability is guaranteed; the possibility of detecting DI attacks by the operator is increased; and the effect of electricity price fluctuations caused by these attacks is prevented. For this purpose, we introduce two possible indices to determine the degree of attack detectability and the magnitude of system congestion variation. Accordingly, the two-objective placement model of PMUs is upgraded, in which the minimum number of PMUs and their placement must be specified to improve the proposed indices so as to minimize the possibility of financial misconduct taking place in the real time market. Using IEEE standard systems, the effectiveness of this PMU placement-based defense scheme has been confirmed.

Letter Detecting the One-Shot Dummy Attack on the Power Industrial Control Processes With an Unsupervised Data-Driven Approach

Dear Editor, Dummy attack (DA), a deep stealthy but impactful data integrity attack on power industrial control processes, is recently recognized as hiding the corrupted measurements in normal measurements. In this letter, targeting a more practical case, we aim to detect the one-shot DA, with the purpose of revealing the DA once it is launched. Specifically, we first formulate an optimization problem to generate one-shot DAs. Then, an unsupervised data-driven approach based on a modified local outlier factor (MLOF) is proposed to detect them. To improve the detection performance, the measurements are preprocessed with the gamma transformation and the power patterns are extracted from historical data and integrated into the MLOF algorithm. Finally, extensive experiments are conducted to evaluate the performance of the proposed approach with real-world load data.

Blockchain-Driven Intelligent Scheme for IoT-Based Public Safety System beyond 5G Networks.

Mobile applications have rapidly grown over the past few decades to offer futuristic applications, such as autonomous vehicles, smart farming, and smart city. Such applications require ubiquitous, real-time, and secure communications to deliver services quickly. Toward this aim, sixth-generation (6G) wireless technology offers superior performance with high reliability, enhanced transmission rate, and low latency. However, managing the resources of the aforementioned applications is highly complex in the precarious network. An adversary can perform various network-related attacks (i.e., data injection or modification) to jeopardize the regular operation of the smart applications. Therefore, incorporating blockchain technology in the smart application can be a prominent solution to tackle security, reliability, and data-sharing privacy concerns. Motivated by the same, we presented a case study on public safety applications that utilizes the essential characteristics of artificial intelligence (AI), blockchain, and a 6G network to handle data integrity attacks on the crime data. The case study is assessed using various performance parameters by considering blockchain scalability, packet drop ratio, and training accuracy. Lastly, we explored different research challenges of adopting blockchain in the 6G wireless network.

A detection model of scaling attacks considering consumption pattern diversity in AMI

As an important branch of the Internet of Things, the smart grid has become a crucial field of modern information technology. It realizes the two-way information flow and power flow by integrating the advanced metering infrastructure (AMI) and distributed energy resources, which greatly improves users’ participation. However, owing to smart meters, the most critical components of AMI, are deployed in an open network environment, AMI is a potential target for data integrity attacks. Among various attack types, the scaling attack is the most typical one, because it can be used as a general expression for most of other ones. By launching a scaling attack, adversaries can randomly reduce hourly reported values in smart meters, thereby causing economic losses. A number of research efforts have been devoted to detecting data integrity attacks. Nonetheless, most of the existing investigations focus on all attack types, and little attention has been paid to a detection strategy specially designed for scaling attacks. Our contribution addresses this issue in this paper and hence, developing a detection model of scaling attacks considering consumption pattern diversity (SA2CPD), to ensure that scaling attacks can be effectively detected when users have multiple consumption patterns. To be specific, we leverage Kmeans to distinguish different consumption patterns, and then the consumption intervals can be extracted to binarize the data. We divide time periods in every day into two categories based on the binarization values, and use one of them with the greatest information gain to construct a decision tree for judgment. Both theoretical and simulation results based on the GEFCom2012 dataset show that our SA2CPD model has a higher F1 score than the decision tree model without considering consumption pattern diversity, the KNN model and the Naive Bayes model.

Deep Learning-Based Malicious Smart Contract and Intrusion Detection System for IoT Environment

The Internet of Things (IoT) is a key enabler technology that recently received significant attention from the scientific community across the globe. It helps transform everyone’s life by connecting physical and virtual devices with each other to offer staggering benefits, such as automation and control, higher productivity, real-time information access, and improved efficiency. However, IoT devices and their accumulated data are susceptible to various security threats and vulnerabilities, such as data integrity, denial-of-service, interception, and information disclosure attacks. In recent years, the IoT with blockchain technology has seen rapid growth, where smart contracts play an essential role in validating IoT data. However, these smart contracts can be vulnerable and degrade the performance of IoT applications. Hence, besides offering indispensable features to ease human lives, there is also a need to confront IoT environment security attacks, especially data integrity attacks. Toward this aim, this paper proposed an artificial intelligence-based system model with a dual objective. It first detects the malicious user trying to compromise the IoT environment using a binary classification problem. Further, blockchain technology is utilized to offer tamper-proof storage to store non-malicious IoT data. However, a malicious user can exploit the blockchain-based smart contract to deteriorate the performance IoT environment. For that, this paper utilizes deep learning algorithms to classify malicious and non-malicious smart contracts. The proposed system model offers an end-to-end security pipeline through which the IoT data are disseminated to the recipient. Lastly, the proposed system model is evaluated by considering different assessment measures that comprise the training accuracy, training loss, classification measures (precision, recall, and F1 score), and receiver operating characteristic (ROC) curve.

Distributed filtering algorithm based on local outlier factor under data integrity attacks

Network security is becoming a prominent issue for the development of information technology, and intelligent network attacks pose great challenges to system security due to its strong concealment. The existence of these attacks threatens the operation process of the complicated control system. Motivated by such a security problem, we study the secure distributed filtering algorithm under a kind of complex data integrity attack which can attack in two forms. We design a detection mechanism based on local outlier factor to distinguish the rightness of exchanged data, which determines whether to fuse the estimates by comparing the local density (LD) of the estimation of each sensor. Such a detection mechanism does not need the sensor to transmit redundant data information, thus greatly saving calculation cost and improving transmission efficiency. Meanwhile, we optimize the distributed filtering algorithm and obtain a suboptimal estimation gain. Finally, we demonstrate a numerical example to verify the availability of the filtering algorithm, and explore the influence of detector parameters on the performance of the estimation system.

Security and Integrity Attacks in Named Data Networking: A Survey

The notion of Information-Centric Networking (ICN) specifies a new communication model that emphasis on the content exchanged rather than the devices connected. ICN architectures like Content Centric Network (CCN) and Named Data Networking (NDN) have been proposed to shift from host-centric based to content-centric based communication along and provide benefits to users in addressing the challenges of traditional IP networks. It differs from host-centric standard Internet Protocol (IP) networking in of naming, routing, forwarding, and caching characteristics. Naming features used in NDN use global unique names provided by content-based security and encryption. It ensures content integrity and authenticity as part of its design. In this paper, we survey on security aspects of NDN/CCN, discussing three integrity attacks such as replay attacks, Man-in-The-Middle (MiTM) attacks, and Content Poisoning Attack (CPA) with countermeasure against them. In addition, we highlight an open challenge and offer future research directions in the context of security.

Watermarking-Based Protection Strategy Against Stealthy Integrity Attack on Distributed State Estimation

This article studies the security of distributed state estimation under data integrity attacks. Each sensor is equipped with a Kullback–Leibler (K–L) divergence detector to diagnose the authenticity of the received data. A necessary and sufficient condition for the insecurity of the distributed estimator is derived, in which the stealthy attack can evade the detector and degrade the estimation performance. Furthermore, an algorithm is proposed to generate stealthy attack sequences. To overcome the vulnerability, a data transmission strategy based on watermarking is proposed. The effect of the watermarking parameters on the attack in different scenarios is subsequently analyzed. It is proved that the K–L divergence detector can effectively distinguish the stealthy attack with the help of the proposed strategy, thereby ensuring the security of the distributed state estimator. Compared with traditional encryption mechanisms, the proposed strategy neither increases the computational complexity nor sacrifices the estimation performance in the absence of attacks. A simulation example is presented to demonstrate the effectiveness of the developed approach.

Digital twin application for attach detection and mitigation of PV-based smart systems using fast and accurate hybrid machine learning algorithm

Microgrids (MG) is originally designed to make Smart Grids more energy-efficient and reliable. The MG represents a complex cyber-physical system whose functioning is driven by the interaction of physical actions and computational elements, making it vulnerable to many forms of malicious cyber-attack. This study considers the effect of data integrity attack (DIA) on the performance of hybrid MGs, an important cyber threat to microgrids (MGs). Further, this paper develops a new process using sequential hypothesis testing (SHT) for detecting DIA on renewable energy resources and improving the security of information in hybrid MGs. By using a binary sample generated from the suggested approach, an analysis statistic is computed and afterward compared to 2 thresholds for deciding between the 3 options. On the measured energy production of renewable energy sources such as wind turbines, DIAs of various severity levels have been conducted for assessing the impact of DIAs on hybrid MG security. A standard IEEE test system has been used to evaluate the efficiency of the suggested process.

Mitigating Software Integrity Attacks With Trusted Computing in a Time Distribution Network

Time Distribution Networks (TDNs) evolve as new technologies occur to ensure more accurate, reliable, and secure timing information. These networks typically exploit several distributed time servers, organized in a master-slave architecture, that communicate via dedicated timing protocols. From the security perspective, timing data must be protected since its modification or filtering can lead to grave consequences in different time-based contexts, such as health, energy, finance, or transportation. Thus, adequate countermeasures must be employed in all the stages and systems handling timing data from its calculation until it reaches the final users. We consider a TDN offering highly accurate (nanosecond level) time synchronization through specific time unit devices that exploit terrestrial atomic or rubidium clocks and Global Navigation Satellite Systems (GNSS) receivers. Such devices are appealing targets for attackers, who might exploit various attack vectors to compromise their functionality. We individuate three possible software integrity attacks against time devices, and we propose a solution to counter them by exploiting the cryptographic Trusted Platform Module (TPM), defined and supported by the Trusted Computing Group. We used remote attestation software for cloud environments, namely the Keylime framework, to verify (periodically) the software daemons running on the time devices (or their configuration) from a trusted node. Experiments performed on a dedicated testbed set up in the ROOT project with customized time unit devices from Seven Solutions (currently Orolia Spain) allow us to demonstrate that exploiting TPMs and remote attestation in the TDNs is not only helpful but is fundamental for discovering some attacks that would remain otherwise undetected. Our work helps thus TDN operators build more robust, accurate, and secure time synchronization services.

Detection-Performance Tradeoff for Watermarking in Industrial Control Systems

The watermarking method, which adds unique watermarks to data, has been widely used for integrity attack detection in industrial control systems (ICSs). Existing literature generally designs watermarking mechanisms without considering the existence of noises, which cannot be trivially applied to realistic ICS scenarios in the presence of strong noise interference. On one hand, the low-intensity watermarking will be ineffective under the strong noise environment; while on the other hand, the oversized watermarking can possibly degrade the control performance or even destabilize the system. Therefore, the intensity of watermarks plays a fundamental role in balancing the tradeoff between detection effectiveness and control performance, which, to the best of our knowledge, has never been thoroughly analyzed yet. To this end, in this paper, we for the first time propose an optimal watermarking design method for ICSs considering the detection-performance tradeoff. To begin with, we shift the watermark container from data points to segments and update the detection metrics to reduce the noise impact. Then, we formulate an optimization problem to determine the strength of watermarks to balance the detection-performance tradeoff. Meanwhile, the detection effectiveness and control performance metrics are analytically modeled and theoretically analyzed considering the discrepancy between added watermarks and noises, signal quality, detection latency, as well as estimation of detection metrics. Finally, extensive numerical simulations and systematical experiments based on a practical Ethanol Distillation ICS are conducted to validate the theoretical analysis and demonstrate the outperformance of our proposed watermarking method in comparison with related works.

An Online Approach to Covert Attack Detection and Identification in Power Systems

The development of information technology and digital control systems has posed an inevitable trend of interconnectivity and wirelessness of data communications in power systems. As a result, the cybersecurity of power systems has been raising concerns over the past decades. Yet the complexity of power systems and their conventional designs with local and wide area network communications has posed increasing vulnerability to cyberattacks. Among the types of cyberattacks, data integrity attacks can be more harmful to power systems, especially power transmission systems, through malicious manipulation of measurement and control data to cause damage to the physical system. As the sophistication of cyberattacks increases, certain cyberattacks can successfully bypass traditional intrusion detection systems, which calls for better design of detection schemes. On the other hand, in a large-scale network, attack identification for a power system is as important as attack detection. In this paper, we develop an online approach based on the Sparse Group Lasso to detect and identify the location of a typical type of data integrity attack named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">covert attacks</i> on power transmission systems. We provide the theoretical foundation of the proposed method with a simplified linear system model and extend the method to nonlinear systems. We validate the performance of our method on both linear and nonlinear system settings with a comprehensive numerical study.