Intelligent Attacks Research Articles

An efficient intelligent intrusion detection system using fuzzy logic based on the Particle Swarm Optimization algorithm: A case study

This paper presents an intelligent intrusion detection system using fuzzy logic based on particle swarm optimization algorithm. The main goal of this research is to survey the convergence capability of the particle swarm optimization algorithm using fuzzy logic in intelligent intrusion detection of a designable system. In order to simulate intelligent attacks on a system, KDD99 data are used. Based on the findings, the Particle Swarm Optimization (PSO) algorithm is highly capable of detecting an intelligent attack on a system. In this study, we considered 1800 times attack, in which the PSO algorithm was capable of repelling attacks in 7.24 seconds and converged. The best convergence occurred at stage 775, and then all attacks were eliminated from the system. Results showed that the stability and convergence of the system improved after each attack. Also, the number of attacks increased to 2500 times to investigate unpredictable intrusions and converge accrued at the attack 771st. Finally, the results obtained by the PSO algorithms were compared to the results obtained by the Genetic Algorithm (GA) and Simulated Annealing (SA) algorithm. The findings indicate that the PSO algorithm is highly capable of detecting intelligent intrusions into a system. It is also suggested to employ this algorithm in cloud computing systems because of its high capability of repelling smart attacks.

A Security Analysis Model for IoT-ecosystem Using Machine Learning-(ML) Approach

Introduction: The attacks on IoT systems are increasing as the devices and communication networks are progressively integrated. If no attacks are found in IoT for a long time, it will affect the availability of services that can result in data leaks and can create a significant impact on the associated costs and quality of services. Therefore, the attacks and security vulnerability in the IoT ecosystem must be detected to provide robust security and defensive mechanisms for real-time applications. Method: This paper proposes an analytical design of an intelligent attack detection framework using multiple machine learning techniques to provide cost-effective and efficient security analysis services in the IoT ecosystem. Result: The performance validation of the proposed framework is carried out by multiple performance indicators. Conclusion: The simulation outcome exhibits the effectiveness of the proposed system in terms of accuracy and F1-score for the detection of various types of attacking scenarios.

An Intelligent Attack Detection Framework for the Internet of Autonomous Vehicles with Imbalanced Car Hacking Data

The modern Internet of Autonomous Vehicles (IoVs) has enabled the development of autonomous vehicles that can interact with each other and their surroundings, facilitating real-time data exchange and communication between vehicles, infrastructure, and the external environment. The lack of security procedures in vehicular networks and Controller Area Network (CAN) protocol leaves vehicles exposed to intrusions. One common attack type is the message injection attack, which inserts fake messages into original Electronic Control Units (ECUs) to trick them or create failures. Therefore, this paper tackles the pressing issue of cyber-attack detection in modern IoV systems, where the increasing connectivity of vehicles to the external world and each other creates a vast attack surface. The vulnerability of in-vehicle networks, particularly the CAN protocol, makes them susceptible to attacks such as message injection, which can have severe consequences. To address this, we propose an intelligent Intrusion detection system (IDS) to detect a wide range of threats utilizing machine learning techniques. However, a significant challenge lies in the inherent imbalance of car-hacking datasets, which can lead to misclassification of attack types. To overcome this, we employ various imbalanced pre-processing techniques, including NearMiss, Random over-sampling (ROS), and TomLinks, to pre-process and handle imbalanced data. Then, various Machine Learning (ML) techniques, including Logistic Regression (LR), Linear Discriminant Analysis (LDA), Naive Bayes (NB), and K-Nearest Neighbors (k-NN), are employed in detecting and predicting attack types on balanced data. We evaluate the performance and efficacy of these techniques using a comprehensive set of evaluation metrics, including accuracy, precision, F1_Score, and recall. This demonstrates how well the suggested IDS detects cyberattacks in external and intra-vehicle vehicular networks using unbalanced data on vehicle hacking. Using k-NN with various resampling techniques, the results show that the proposed system achieves 100% detection rates in testing on the Car-Hacking dataset in comparison with existing work, demonstrating the effectiveness of our approach in protecting modern vehicle systems from advanced threats.

Improving the controllability robustness of complex temporal networks against intelligent attacks

Abstract The main goal of controllability network methods on complex temporal networks is to control all nodes with the minimum number of control nodes. Real-world complex temporal networks are faced with many errors and attacks that cause the network structure to be changed in some way so that the controllability processes are disturbed and after that, the controllability robustness of the network decreases. One of the most important attacks on complex temporal networks is intelligent attacks. In this paper, the types of intelligent attacks and their destructive effects on the controllability of complex temporal networks have been investigated. In order to increase the controllability robustness of the network against intelligent attacks, a novel graph model and strategies have been proposed on complex dynamic graph by adding new control nodes or adding new links to the network so that the network is protected against intelligent attacks. The results of simulation and comparing them with conventional methods demonstrate that the proposed node addition strategy has performed better than other methods and the improvement rate in terms of execution time is 60%. On the other hand, the proposed immunization strategy by adding links has kept the network controllable with a smaller number of links (38%) and less execution time (52%) compared to other methods.

Optimized Cross-Path Attacks via Adversarial Reconnaissance

While softwarization and virtualization technologies make modern communication networks appear easier to manage, they also introduce highly complex interactions within the networks that can cause unexpected security threats. In this work, we study a particular security threat due to the sharing of links between high-security paths and low-security paths, which enables a new type of DoS attacks, called cross-path attacks, that indirectly attack a set of targeted high-security paths (target paths) by congesting the shared links through a set of attacker-controlled low-security paths (attack paths). While the feasibility of such attacks has been recently demonstrated in the context of SDN, their potential performance impact has not been characterized. To this end, we develop an approach for designing an optimized cross-path attack under a constrained total attack rate, consisting of (i) novel reconnaissance algorithms that can provide consistent estimates of the locations and parameters of the shared links via network tomography, and (ii) efficient optimization methods to design the optimal allocation of attack rate over the attack paths to maximally degrade the performance of the target paths. The proposed attack has achieved a significantly larger performance impact than its non-optimized counterparts in extensive evaluations based on multiple network settings, signaling the importance of addressing such intelligent attacks in network design. For more detail, see the full paper [4].

Turing-like Experiment in a Cyber Defense Game

During the past decade, researchers of behavioral cyber security have created cognitive agents that are able to learn and make decisions in dynamic environments in ways that assimilate human decision processes. However, many of these efforts have been limited to simple detection tasks and represent basic cognitive functions rather than a whole set of cognitive capabilities required in dynamic cyber defense scenarios. Our current work aims at advancing the development of cognitive agents that learn and make defense-dynamic decisions during cyber attacks by intelligent attack agents. We also aim to evaluate the capability of these cognitive models in ``Turing-like'' experiments, comparing the decisions and performance of these agents against human cyber defenders. In this paper, we present an initial demonstration of a cognitive model of the defender that relies on a cognitive theory of dynamic decision-making, Instance-Based Learning Theory (IBLT); we also demonstrate the execution of the same defense task by human defenders. We rely on OpenAI Gym and CybORG and adapt an existing CAGE scenario to generate a simulation experiment using an IBL defender. We also offer a new Interactive Defense Game (IDG), where \textit{human} defenders can perform the same CAGE scenario simulated with the IBL model. Our results suggest that the IBL model makes decisions against two intelligent attack agents that are similar to those observed in a subsequent human experiment. We conclude with a description of the cognitive foundations required to build autonomous intelligent cyber defense agents that can collaborate with humans in autonomous cyber defense teams.

Representation-Learning-Based CNN for Intelligent Attack Localization and Recovery of Cyber-Physical Power Systems.

Enabled by the advances in communication networks, computational units, and control systems, cyber-physical power systems (CPPSs) are anticipated to be complex and smart systems in which a large amount of data are generated, exchanged, and processed for various purposes. Due to these strong interactions, CPPSs will introduce new security vulnerabilities. To ensure secure operation and control of CPPSs, it is essential to detect the locations of the attacked measurements and remove the state bias caused by malicious cyber-attacks such as false data inject attack, jamming attack, denial of service attack, or hybrid attack. Accordingly, this article makes the first contribution concerning the representation-learning-based convolutional neural network (RL-CNN) for intelligent attack localization and system recovery of CPPSs. In the proposed method, the cyber-attacks' locational detection problem is formulated as a multilabel classification problem for CPPSs. An RL-CNN is originally adopted as the multilabel classifier to explore and exploit the implicit information of measurements. By comparing with previous multilabel classifiers, the RL-CNN improves the performance of attack localization for complex CPPSs. Then, to automatically filter out the cyber-attacks for system recovery, a mean-squared estimator is used to handle the difficulty in state estimation with the removal of contaminated measurements. In this scheme, prior knowledge of the system state is obtained based on the outputs of the stochastic power flow or historical measurements. The extensive simulation results in three IEEE bus systems show that the proposed method is able to provide high accuracy for attack localization and perform automatic attack filtering for system recovery under various cyber-attacks.

Attack detection and mitigation using Intelligent attack graph model for Forensic in IoT Networks

Attack detection and mitigation using Intelligent attack graph model for Forensic in IoT Networks

Temporal ECDSA: A timestamp and signature mask enabled ECDSA algorithm for IoT client node authentication

Internet of Things (IoT) networks are vulnerable to various security threats, especially in client authentication. The current authentication methods require significant resources and are vulnerable to specific attacks. The Non-Interactive Zero Knowledge Proof (NIZKP) concept suits IoT device authentication. Elliptic Curve Digital Signature (ECDSA) is a popular algorithm for IoT device authentication based on elliptic curve cryptography (ECC) and NIZKP. However, an intelligent attacker who captures the ECDSA signatures generated by the same random number can recover the private key. This paper proposes a timestamp based approach to prevent signature reuse and fake signature generation in the ECDSA algorithm. The signature proof is generated differently at each occurrence to prevent the generation of valid signatures from leaked private keys. The proposed approach eliminates the expensive modular inversion operations in signature generation and verification phases, enhancing execution efficiency. The analysis results indicate that the proposed Temporal ECDSA algorithm effectively prevents most attacks on client authentication in IoT networks. Various metrics, including computational complexity and security measures, were used to evaluate the effectiveness of the proposed approach, demonstrating that it outperforms most ECDSA variants.

Countering ARP spoofing attacks in software-defined networks using a game-theoretic approach

The Address Resolution Protocol (ARP) spoofing is a form of attack typically used by attackers to cause a denial of service or man-in-the-middle attacks. This attack comes from ARP weaknesses and aims to compromise victims' ARP caches by sending ARP packets containing fake IP-MAC pairs. To overcome ARP spoofing attacks, several approaches leverage the advantages of software-defined networking (SDN) to detect malicious users in the network. To achieve their goal, the SDN controller consecutively checks the characteristics of each ARP packet to ensure its correctness. However, this verification method can lead to latency and congestion at the controller level or render the system unusable for large-scale networks. To address this drawback, we propose a game-theoretic approach to provide an optimal verification method that considers the intelligent attackers' decision-making process during an ARP cache poisoning attempt. This approach is a zero-sum game between the attacker who wants to poison the victims' ARP caches and the defender who must avoid this poisoning. The game model results in mixed-strategy Nash equilibria that identify optimal verification methods to prevent control plane latency and congestion during attacker detection. The results show that an intelligent attacker will refrain from poisoning ARP caches with a high-impact strategy because the defender frequently checks such a strategy. In addition, the attacker's penalty value can deter both rational and irrational attackers from poisoning ARP caches. Simulations in the Mininet simulator have shown that the proposed approach can significantly mitigate control plane latency and congestion during the attacker's characteristic checking.

Optimized Cross-Path Attacks via Adversarial Reconnaissance

While softwarization and virtualization technologies make modern communication networks appear easier to manage, they also introduce highly complex interactions within the networks that can cause unexpected security threats. In this work, we study a particular security threat due to the sharing of links between high-security paths and low-security paths, which enables a new type of DoS attacks, called cross-path attacks, that indirectly attack a set of targeted high-security paths (target paths) by congesting the shared links through a set of attacker-controlled low-security paths (attack paths). While the feasibility of such attacks has been recently demonstrated in the context of SDN, their potential performance impact has not been characterized. To this end, we develop an approach for designing an optimized cross-path attack under a constrained total attack rate, consisting of (i) novel reconnaissance algorithms that can provide consistent estimates of the locations and parameters of the shared links via network tomography, and (ii) efficient optimization methods to design the optimal allocation of attack rate over the attack paths to maximally degrade the performance of the target paths. The proposed attack has achieved a significantly larger performance impact than its non-optimized counterparts in extensive evaluations based on multiple network settings, signaling the importance of addressing such intelligent attacks in network design.

Data-Driven Practical Cooperative Output Regulation Under Actuator Faults and DoS Attacks.

This article addresses the resilient practical cooperative output regulation problem (RPCORP) for multiagent systems subjected to both denial-of-service (DoS) attacks and actuator faults. Fundamentally different from the existing solutions to RPCORPs, the system parameters considered in this article are unknown to each agent, and a novel data-driven control approach is introduced to handle such an issue. The solution starts with developing resilient distributed observers for each follower in the presence of DoS attacks. Then, a resilient communication mechanism and a time-varying sampling period are introduced to, respectively, ensure the neighbor state is available as soon as attacks disappear and to avoid targeted attacks launched by intelligent attackers. Furthermore, a model-based fault-tolerant and resilient controller is designed based on the Lyapunov approach and the output regulation theory. In order to remove the reliance on system parameters, we leverage a new data-driven algorithm to learn controller parameters via the collected data. Rigorous analysis shows that the closed-loop system can resiliently achieve practical cooperative output regulation. Finally, a simulation example is given to illustrate the effectiveness of the achieved results.

GDE model: A variable intrusion detection model for few-shot attack

With the formation and popularity of the Internet of Things(IoT), the difficulty of protecting IoT infrastructure and smart devices from a few-shot of ever-changing malicious attacks has increased significantly. Traditional intrusion detection models in static mode cannot defend against intelligent attacks that change in real time and are good at reconnaissance, and it is difficult to achieve effective detection of few-shot attacks. Therefore, to solve the above problems, this paper proposes a variable few-shot intrusion detection model GDE Model for IoT, which contains a data processing module consisting of an improved Gramian Angular Fields(GAF), a data augmentation module consisting of an improved Denoising Diffusion Probabilistic Models(DDPM), and an image classification module consisting of a variable network ETNet V2 obtained from a neural architecture search based on efficient net v2. The one-dimensional network traffic data collected from a real network environment is converted into two-dimensional images and fed into the above model for learning and training, so as to construct a variable intrusion detection model that combines accuracy and inference speed. To evaluate the work of this paper, different categories of evaluation metrics were selected and experiments were conducted on each module and the overall model separately. The experimental results show that the proposed intrusion detection model achieves variable functionality with an accuracy of up to 99.20% for few-shot detection and an average inference time as low as 23ms, which can be used not only for IoT but also for different network environments and attack types.

Reference Broadcast-Based Secure Time Synchronization for Industrial Wireless Sensor Networks

Security is an important factor that cannot be neglected in the design of time synchronization algorithms since industrial wireless sensor networks are prone to attacks against physical nodes and communication links. The Sybil attack is an intelligent attack with a high destructive capacity in pretending multiple identities and broadcasting illegitimate messages to destroy the network operation. Existing secure time synchronization algorithms mostly focus on distributed protocols; however, they pay less attention to Sybil attacks and centralized network time synchronization. In this paper, we propose a novel reference broadcast-based secure time synchronization (RSTS) for industrial wireless sensor networks with a time source against Sybil attacks. Different from previous protocols, in converging the network structure and the clock status, RSTS employs a public neighbor forwarding mechanism based on reference broadcast to filter the illegal time information automatically. Instead of establishing a table with timestamps of packet transmission and receipt, the least square linear regression is utilized to estimate the compensation relative to the source node with the recorded time and calculated time difference in receiving packets. The simulation results demonstrate that RSTS is resilient to Sybil attacks as well as message manipulation attacks in comparison with existing algorithms.

Robust Mitigation Strategy Against Dummy Data Attacks in Power Systems

An intelligent attacker can carefully design stealthy false data by hiding them among normal ones to escape detection. Such attack is referred to as dummy data attacks (DDAs), whose stealth is further improved in this paper, which can induce line overloads and even cascading failures in a power system. Thus, in this paper, we propose a robust mitigation strategy model to mitigate DDAs risk by preventing the attacker from constructing high-stealth attack scenarios. The robust mitigation strategy secures line flow levels and trades off the economy and the security of power systems. A novel decomposition algorithm is developed to solve the proposed model which can guarantee the solution optimality in a finite number of iterations. Simulation results on the IEEE 118-bus and Chinese 132-bus systems demonstrate the effectiveness of the proposed approach.

A multi-dimensional trust model for misbehavior detection in vehicular ad hoc networks

Communication security is one of the focus issues of vehicular ad hoc networks (VANETs). Trust model is commonly used to identify malicious attackers or filter false messages in the network, which effectively guarantees secure communication between vehicles. Constrained by the distributed network architecture of VANETs, trust evaluation results may be biased due to uneven data distribution and lack of reference. By colluding with the partners, malicious vehicle launches imbalance attack and zigzag attack to bypass the detection of the trust model. To address these new intelligent attacks, we propose a multi-dimensional trust model (MDT) in this paper, which makes a combined evaluation of different trust attributes from vehicles. In MDT, data collection and trust calculation are deployed in vehicles and trust authority (TA), respectively. Since the model dynamically adjusts the corresponding weight coefficient according to the data fluctuations of each trust indicator by adopting entropy weight method and filters anomalous evaluation results by using the median absolute deviation (MAD) algorithm, it can effectively deal with complex and variable intelligent attacks. The legitimate identity of a vehicle will be revoked from the network by TA once its trust value is less than the threshold. We have conducted extensive experimental studies to evaluate the performance of MDT. The experimental results show that the MDT model can accurately and effectively calculate the global trust of vehicles and detect malicious attacks in the network under different scenarios and tests.

Defending the Defender: Adversarial Learning Based Defending Strategy for Learning Based Security Methods in Cyber-Physical Systems (CPS)

Cyber-Physical Systems (CPS) are prone to many security exploitations due to a greater attack surface being introduced by their cyber component by the nature of their remote accessibility or non-isolated capability. Security exploitations, on the other hand, rise in complexities, aiming for more powerful attacks and evasion from detections. The real-world applicability of CPS thus poses a question mark due to security infringements. Researchers have been developing new and robust techniques to enhance the security of these systems. Many techniques and security aspects are being considered to build robust security systems; these include attack prevention, attack detection, and attack mitigation as security development techniques with consideration of confidentiality, integrity, and availability as some of the important security aspects. In this paper, we have proposed machine learning-based intelligent attack detection strategies which have evolved as a result of failures in traditional signature-based techniques to detect zero-day attacks and attacks of a complex nature. Many researchers have evaluated the feasibility of learning models in the security domain and pointed out their capability to detect known as well as unknown attacks (zero-day attacks). However, these learning models are also vulnerable to adversarial attacks like poisoning attacks, evasion attacks, and exploration attacks. To make use of a robust-cum-intelligent security mechanism, we have proposed an adversarial learning-based defense strategy for the security of CPS to ensure CPS security and invoke resilience against adversarial attacks. We have evaluated the proposed strategy through the implementation of Random Forest (RF), Artificial Neural Network (ANN), and Long Short-Term Memory (LSTM) on the ToN_IoT Network dataset and an adversarial dataset generated through the Generative Adversarial Network (GAN) model.

Recommender Systems in Cybersecurity

With the growth of CyberTerrorism, enterprises worldwide have been struggling to stop intruders from obtaining private data. Despite the efforts made by Cybersecurity experts, the shortage of skillful security teams and the usage of intelligent attacks have slowed down the enhancement of defense mechanisms. Furthermore, the pandemic in 2020 forced organizations to work in remote environments with poor security, leading to increased cyberattacks. One possible solution for these problems is the implementation of Recommender Systems to assist Cybersecurity human operators. Our goal is to survey the application of Recommender Systems in Cybersecurity architectures. These decision-support tools deal with information overload through filtering and prioritization methods, allowing businesses to increase revenue, achieve better user satisfaction, and make faster and more efficient decisions in various domains (e-commerce, healthcare, finance, and other fields). Several reports demonstrate the potential of using these recommendation structures to enhance the detection and prevention of cyberattacks and aid Cybersecurity experts in treating client incidents. This survey discusses several studies where Recommender Systems are implemented in Cybersecurity with encouraging results. One promising direction explored by the community is using Recommender Systems as attack predictors and navigation assistance tools. As contributions, we show the recent efforts in this area and summarize them in a table. Furthermore, we provide an in-depth analysis of potential research lines. For example, the inclusion of Recommender Systems in security information event management systems and security orchestration, automation, and response applications could decrease their complexity and information overload.

Concurrent Receding Horizon Control and Estimation Against Stealthy Attacks

In this work, we consider a game-theoretic framework for cyber-physical systems, where a defender develops a mitigation strategy against an intelligent attacker who exploits the system's uncertainty to remain undetected. The goal of the defender is to optimize a performance cost constructed specifically to account for robustness against stealthy attacks, so that the system is regulated. Conversely, the goal of the attacker is to disrupt the system's performance by leveraging its significant information advantage against the defender. Both players implement their policies in a moving horizon fashion, according to the principles of receding horizon control. However, because the defender has no access to the full state of the system, it concurrently employs receding horizon estimation to overcome this limitation. A rigorous theoretical analysis shows that such a concurrent policy can guarantee closed-loop boundedness, despite the stealthy attacks and the information disadvantage. Simulations verify and clarify these findings.

DDoS Attack Detection Using Enhanced Neural Network Algorithm in Software-Defined Networks

With the uncommon advancement of technology and networking, the world today is totally relying on it. The most obvious drawback of this technical progress resulted in several possible dangers. A Distributed Denial of Service (DDoS) attack is one in which a large number of compromised systems work together to prevent service from being provided to the targeted system. Consequently, to protect network servers, attack detection systems must be very effective. The proposed architecture has Software Defined Networks (SDN) which comprise controllers and SFlow agents. According to the article, the anomaly detection of statistical traffic, which is performed on both normal and pathological anomaly traces in the packet header, as well as traffic volume detection, is based on the suggested work provided in this study. The k-means clustering technique is used by the statistical anomaly detection system and the attack alert aggregation system. Low-level attack detection systems are used to generate cluster dissimilar warnings, which are then investigated further. Clusters generate meta-alerts based on the information they have gathered. After that, the report of meta-alerts is sent to the security specialists. The online alert aggregation technique, which is also known as the probabilistic model, is used to identify new assaults on a system. The k-means clustering method is used to improve the quality of the traffic data streams. The Enhanced Neural Network Algorithm (ENNA) is being used to advance the intelligent attack detection system, which is currently under development. It is utilized in open-day controllers to identify attacks with a 99.7% accuracy by using Mininet and the Python simulation tool (ODL). In future work, it is possible to evaluate how the suggested detection method would be used in the event of subnet attacks and its mitigation.