Intelligent Attacks Research Articles

HDRS: A Hybrid Reputation System With Dynamic Update Interval for Detecting Malicious Vehicles in VANETs

The reputation-based scheme is a promising solution to prevent malicious behaviors in Vehicular Ad-hoc Networks (VANETs). However, traditional centralized reputation schemes are not suited for distributed networks, while decentralized reputation schemes are vulnerable to malicious vehicles spreading false messages. Most of these schemes assume that the behavior of vehicles can be accurately measured as reputation from the communication, ignoring that malicious vehicles may behave intelligently to avoid being detected. In this paper, we propose a hybrid reputation system (HDRS) which allows vehicles and roadside units (RSU) to complete reputation evaluations separately and provide references to each other. HDRS utilizes a reliability evaluation module to filter out unreliable calculation results and reference records. Furthermore, HDRS includes a dynamic adjustment mechanism for the reputation update interval, employing Analytic Hierarchy Process (AHP) and reliability evaluation results to resist intelligent attacks. Simulation results illustrate that HDRS can maintain a high detection rate and low false-positive rate for detecting malicious vehicles in different environments. Compared with existing schemes, HDRS increases the detection rates of collusion and intelligent attacks by 30% and 16%, respectively.

When Can the Defender Effectively Deceive Attackers in Security Games?

This paper studies defender patrol deception in general Stackelberg security games (SSGs), where a defender attempts to alter the attacker's perception of the defender's patrolling intensity so as to influence the attacker's decision making. We are interested in understanding the complexity and effectiveness of optimal defender deception under different attacker behavior models. Specifically, we consider three different attacker strategies of response (to the defender's deception) with increasing sophistication, and design efficient polynomial-time algorithms to compute the equilibrium for each. Moreover, we prove formal separation for the effectiveness of patrol deception when facing an attacker of increasing sophistication, until it becomes even harmful to the defender when facing the most intelligent attacker we consider. Our results shed light on when and how deception should be used in SSGs. We conduct extensive experiments to illustrate our theoretical results in various game settings.

An intelligent proactive defense against the client‐side DNS cache poisoning attack via self‐checking deep reinforcement learning

A new class of poisoning attacks has recently emerged targeting the client-side Domain Name System (DNS) cache. It allows users to visit fake websites unconsciously, thereby revealing their information, such as passwords. However, the current DNS defense architecture does not include DNS clients. Although relative encryption solutions can mitigate this attack, they require the cooperation of multiple parties, and the deployment speed is slow. Therefore, we propose an intelligent-driven proactive defense strategy. First, we model the offensive and defensive process as a stochastic game based on moving target defense. Second, we adopt and optimize Proximal Policy Optimization (PPO), a deep reinforcement learning method, to solve problems caused by uncertain attack strategies and unknown state transition probability. Third, we design a self-checking component in PPO to solve the uncertainty of action space caused by game state constraints based on our previous work. Thus the convergence speed and stability of PPO are improved. Finally, to the best of our knowledge, we are the first to game with intelligent attackers besides three conventional ones. Our strategy does not require any modifications to the DNS architecture. Through an extensive experimental campaign, the prototype system is proved to be effective against multiple attack modes. Its success rate is 98.5% approximately, and network round-trip time is about 55 ms. Even for random attackers, our method can achieve the theoretical maximum defensive success rate.

Stochastic Denial-of-Service Attack Allocation in Leader-Following Multiagent Systems

In this article, an intelligent attacker is considered, which aims to prevent leader-following multiagent systems from achieving consensus. The attacker randomly injects denial-of-service (DoS) attacks to some communication channels in the network, which make the corresponding attacked edges disconnected. The minimum number of communication channels needed to be jammed by the attacker to guarantee the system fails to achieve the consensus is provided based on the Max-Flow Min-Cut lemma and an algorithm to generate the minimum attacked edges is proposed. Furthermore, a lower bound and an upper bound of the attack probability to destroy the consensusability of the system are provided, respectively. Finally, numerical simulations are given to illustrate the results.

Knowledge graph and behavior portrait of intelligent attack against path planning

The broad application of artificial intelligence (AI) shows more and more vulnerabilities. Adversaries have more opportunities to attack AI systems. For example, unmanned vehicles may be interfered with by adversaries in path planning, resulting in unmanned vehicles being unable to move according to the planned route, and even serious safety problems. On the other side, the portrait technology can extract highly refined characteristics of different attack strategies, so that unmanned vehicles can defend themselves based on the characteristics of each attack. Existing research lacks intelligent attack research on path planning in the field of unmanned vehicles, and lacks portraits of attack behaviors in this scenario. This paper combines multiagent reinforcement learning technology, time-series segmentation clustering technology, and knowledge graph technology to study the portrait technology of adversary intelligent attack behavior in the field of unmanned vehicle path planning. First, the simulation results of unmanned vehicle path planning are obtained, and the steps of adversary attack behavior are extracted by using Toeplitz inverse covariance-based clustering time-series segmentation cluster technology. Second, the knowledge graph is used to save the attack strategy, so as to form the attack behavior portrait of unmanned vehicle path planning. The test on the Neo4j platform shows that our method is universal, can effectively describe the attack steps for unmanned vehicle path planning, and provides the basis for attack detection to establish the defense system of unmanned vehicles.

A Survey on Dynamic Corrective Control of Asynchronous Sequential Machines

As a feedback control methodology exclusively targeting asynchronous sequential machines (ASMs), corrective control has been rapidly developing for the past two decades. This paper presents a comprehensive survey on the theory and application of dynamic corrective control in which the controller also has the form of an ASM. First, basic notions and principles of dynamic corrective control, including models of ASMs and configurations of closed-loop systems, are reviewed. Next, assorted dynamic corrective control schemes are presented aiming at solving specific control problems of ASMs, such as model matching and fault-tolerant control. Variations of control aspects are classified according to modeling formalisms of controlled ASMs—input/state, input/output, and composite ASMs—and involved fault characteristics, such as transient, permanent, and intermittent faults and intelligent attacks. Representative results on the application of fault-tolerant corrective control to real-world engineering systems are also provided with an emphasis on space-borne digital systems. Finally, some challenging topics for future studies on corrective control are discussed.

A Novel Four-Level Approach for Improving Power System Resilience Against Intentional Attacks

This study proposes a new four-level model to enhance power system resilience against human attacks. The model considers human attacks, such as intelligent attackers and power system planners, as defenders. The attackers want to maximize the impacts of actions, while the defender tries to avoid imposed costs and damages due to budget limitations. To this end, a new four-level model defense-defense-attack-defense (DDAD) is proposed, in which a new defense layer is added to the common three-level model defense-attack-defense (DAD). Looking at the model more closely, new power plants and substations are added to the power system to improve its resilience, while the most important power plants and substations are determined. Subsequently, the conventional three-level model was applied. In this research, the defender and attacker have some strategies with their own costs for every power system component, such as power plants and substations, and their own interactions. The power system model includes the load, power plant and substation, and substation priority, which are defined as a combination of the value of the load and network topology. The proposed model was applied to the IEEE-30 bus test system, and the results indicated the effectiveness of the proposed method.

Intelligent Attack Analysis for IRS Communications with Incomplete Information

Intelligent Reflection Surface (IRS) will be widely used in future communication system construction to reduce construction costs and improve coverage. However, IRS systems are generally equipped with controllers to receive wireless signal instructions, this increases the vulnerability of future communications. In this paper, we present an attack tactic to provide a way of thinking for the future defense deployment. At the beginning, the hacker cannot know the whole communication system, then it continuously attacks the IRS system, monitor the communication system, and sequentially learns new information about the system in each attacking round in order to attack more effectively in the next round. A two-layer optimal mathematical model is presented to describe the BS and the hacker’s decision. And the two-layer optimization which is difficult to solve is transformed into a single layer linear optimization by using equivalent transformation and dual transformation. A series of mathematical experiments are used to test different scenarios applicable to different monitoring style, and verify that the tactic proposed in this paper can effectively interfere with the system.

Flow Table Security in SDN: Adversarial Reconnaissance and Intelligent Attacks

The performance-driven design of SDN architectures leaves many security vulnerabilities, a notable one being the communication bottleneck between the controller and the switches. Functioning as a cache between the controller and the switches, the flow table mitigates this bottleneck by caching flow rules received from the controller at each switch, but is very limited in size due to the high cost and power consumption of the underlying storage medium. It thus presents an easy target for attacks. Observing that many existing defenses are based on simplistic attack models, we develop a model of intelligent attacks that exploit specific cache-like behaviors of the flow table to infer its internal configuration and state, and then design attack parameters accordingly. Our evaluations show that such attacks can accurately expose the internal parameters of the target flow table and cause measurable damage with the minimum effort.

A Multiphase Dynamic Deployment Mechanism of Virtualized Honeypots Based on Intelligent Attack Path Prediction

As an important deception defense method, a honeypot can be used to enhance the network’s active defense capability effectively. However, the existing rigid deployment method makes it difficult to deal with the uncertain strategic attack behaviors of the attackers. To solve such a problem, we propose a multiphase dynamic deployment mechanism of virtualized honeypots (MD2VH) based on the intelligent attack path prediction method. MD2VH depicts the attack and defense characteristics of both attackers and defenders through the Bayesian state attack graph, establishes a multiphase dynamic deployment optimization model of the virtualized honeypots based on the extended Markov’s decision-making process, and generates the deployment strategies dynamically by combining the online and offline reinforcement learning methods. Besides, we also implement a prototype system based on software-defined network and virtualization container, so as to evaluate the effectiveness of MD2VH. Experiments results show that the capture rate of MD2VH is maintained at about 90% in the case of both simple topology and complex topology. Compared with the simple intelligent deployment strategy, such a metric is increased by 20% to 60%, and the result is more stable under different types of the attacker’s strategy.

Measurement-driven blind topology estimation for sparse data injection attack in energy system

Smart grid cyber-security has come to the forefront of national security priorities due to the emergence of new cyber threats such as the False Data Injection (FDI) attack. This specific type of attack modifies smart grid measurements to produce wrong system states during the state estimation which is a critical operational functionality. While most of the existing works assume that power grid topology or the Jacobian matrix (that represents measurement and state relationship) is known to the attacker, this work shows that an intelligent attacker can construct a data-driven sparse FDI attack which does not require prior knowledge of system Jacobian or grid topology. In this paper, we show how the power grid topology, which is an important information for sparse attack construction, can be revealed using only measurement signals. The blind topology estimation is formulated as a constrained optimisation problem. The alternating direction method of multipliers (ADMM) is then employed with a novel initialization process for solving this complex problem. The comparative evaluation using graph-theoretic measures indicates that the power grid topology can be revealed with very high accuracy using such an approach. For example, average eigenvalue centrality measures and degree centrality measures show that the estimated topology is around 95.82% and 94.99% accurate compared to the actual topology for the IEEE-14 bus system and 86.47% and 96.34%, respectively for IEEE-30 bus system. Finally, based on the estimated topology we determine the critical set of measurements, which are then utilised for sparse attack construction. We show that only 7.40% and 3.57% sensors are required to construct the sparsest stealthy attacks for the IEEE 14 bus and the 30 bus system, respectively. The findings of this research conclude that an intelligent attacker can construct a very sparse ‘stealthy’ attack, that can degrade the operational performance significantly, by manipulating a few sensor devices only without any prior system knowledge or information.

Dynamic game-based defensive primary frequency control system considering intelligent attackers

Due to cyber security vulnerabilities of electrical cyber physical systems, cyber attacks against frequency-active power controllers become an emerging problem. Cyber attack-tolerant frequency control strategies are thus presented to reduce abnormal frequency excursions. These strategies mainly treat attackers as ‘dumb’ agents. However, attackers in some situations are more like ‘intelligent’ agents with initiative, who can actively and purposefully respond by considering actions of defenders. In this paper, this actively confrontational interaction is modeled by a dynamic game. We propose two types of game scenarios in the primary frequency control system. Improved Nash equilibrium-based defending strategies are studied using reinforcement learning algorithms. By testing the proposed dynamic game-based strategies on the benchmark system, the validity is verified. The proposed analytical procedure concerning dynamic games can also be extended to the study of other industrial control applications.

Ready for emerging threats to recommender systems? A graph convolution-based generative shilling attack

To explore the robustness of recommender systems, researchers have proposed various shilling attack models and analyzed their adverse effects. Primitive attacks are highly feasible but less effective due to simplistic handcrafted rules, while upgraded attacks are more powerful but costly and difficult to deploy because they require more knowledge from recommendations. In this paper, we explore a novel shilling attack called Graph cOnvolution-based generative shilling ATtack (GOAT) to balance the attacks’ feasibility and effectiveness. GOAT adopts the primitive attacks’ paradigm that assigns items for fake users by sampling and the upgraded attacks’ paradigm that generates fake ratings by a deep learning-based model. It deploys a generative adversarial network (GAN) that learns the real rating distribution to generate fake ratings. Additionally, the generator combines a tailored graph convolution structure that leverages the correlations between co-rated items to smoothen the fake ratings and enhance their authenticity. The extensive experiments on two public datasets evaluate GOAT’s performance from multiple perspectives. Our study of the GOAT demonstrates technical feasibility for building a more powerful and intelligent attack model with a much-reduced cost, enables analysis the threat of such an attack and guides for investigating necessary prevention measures.

Bi-Level Poisoning Attack Model and Countermeasure for Appliance Consumption Data of Smart Homes

Accurate building energy prediction is useful in various applications starting from building energy automation and management to optimal storage control. However, vulnerabilities should be considered when designing building energy prediction models, as intelligent attackers can deliberately influence the model performance using sophisticated attack models. These may consequently degrade the prediction accuracy, which may affect the efficiency and performance of the building energy management systems. In this paper, we investigate the impact of bi-level poisoning attacks on regression models of energy usage obtained from household appliances. Furthermore, an effective countermeasure against the poisoning attacks on the prediction model is proposed in this paper. Attacks and defenses are evaluated on a benchmark dataset. Experimental results show that an intelligent cyber-attacker can poison the prediction model to manipulate the decision. However, our proposed solution successfully ensures defense against such poisoning attacks effectively compared to other benchmark techniques.

RBP: a website fingerprinting obfuscation method against intelligent fingerprinting attacks

Edge computing has developed rapidly in recent years due to its advantages of low bandwidth overhead and low delay, but it also brings challenges in data security and privacy. Website fingerprinting (WF) is a passive traffic analysis attack that threatens website privacy which poses a great threat to user’s privacy and web security. It collects network packets generated while a user accesses website, and then uses a series of techniques to discover patterns of network packets to infer the type of website user accesses. Many anonymous networks such as Tor can meet the need of hide identity from users in network activities, but they are also threatened by WF attacks. In this paper, we propose a website fingerprinting obfuscation method against intelligent fingerprinting attacks, called Random Bidirectional Padding (RBP). It is a novel website fingerprinting defense technology based on time sampling and random bidirectional packets padding, which can covert the real packets distribution to destroy the Inter-Arrival Time (IAT) features in the traffic sequence and increase the difference between the datasets with random bidirectional virtual packets padding. We evaluate the defense against state-of-the-art website fingerprinting attacks in real scenarios, and show its effectiveness.

Intelligent Attack Detection Modelin lotusing Optimal Feature Selectionincorporated withOptimized DeepLearningArchitecture

Attacks and problem recognition within the Internet of Things (IoT) foundation is an increasing worry in the environment of IoT.Within the expanded utilization of IoT framework in each space, dangers and assaults in these foundations are additionally developing comparably. Some attacks like node tampering, malicious code injection, malicious node injection, DoS Attacks, Malicious scripts such assaults and inconsistencies which can cause an IoT framework failure. In this study deep learning architecture models were compared to attacks and anamolies on the IoT frameworks that could be predicted.Themainphases ofthe proposedanomalyorattackdetection model are Feature Extractionand Detection. Infeatureextractionprocess,the attributesinthe datasetisconsideredasfeatures,which arelike SystemID,SystemAddress,SystemType,SystemLocation,DestinationService Address,DestinationServiceType,DestinationLocation,Accessed NodeAddress,Accessed Node Type, Operation, Value, Timestamp, and Normality. Since thenumbersoffeatureare high,which increasesthe lengthofthefeature vector, optimalfeatureselectionprocesswillbedevelopedtoextractthe mostsignificantfeatures withuni.queinformation.Finally,theoptimizedDBN(Deep Belief Network)categorizesthedataintonormalas wellasattacks,anddetectseachcategoryofattacks.

An intelligent cryptographic key management model for secure communications in distributed industrial intelligent systems

For secure communication in a distributed cooperation, generally, the data are encrypted and decrypted using a symmetric key. The process of creating, distributing, storing, deploying, and finally revoking the cryptographic keys is called key management. On the basis of the structure, usability, and complexity of the cyber-physical systems, each one of the current key management practices is suitable for a specific range of applications. However, these schemes have some drawbacks in common, such as complicated key generation and distribution process, using key storage, attacks, and traffic load. This paper proposes a key management model for establishing secure communications in the distributed industrial intelligent systems. The model is attack resistant, has high usability in real-world applications, and transforms the current customary key management workflow to enhance security and reduce weaknesses. Its main features include reduced process, intelligent attack resistance, producing dynamic keys with no additional cost, and eliminating key storage and revocation calls.

Recurrent autonomous autoencoder for intelligent DDoS attack mitigation within the ISP domain.

The continuous advancement of DDoS attack technology and an increasing number of IoT devices connected on 5G networks escalate the level of difficulty for DDoS mitigation. A growing number of researchers have started to utilise Deep Learning algorithms to improve the performance of DDoS mitigation systems. Real DDoS attack data has no labels, and hence, we present an intelligent attack mitigation (IAM) system, which takes an ensemble approach by employing Recurrent Autonomous Autoencoders (RAA) as basic learners with a majority voting scheme. The RAA is a target-driven, distributionenabled, and imbalanced clustering algorithm, which is designed to work with the ISP’s blackholing mechanism for DDoS flood attack mitigation. It can dynamically select features, decide a reference target (RT), and determine an optimal threshold to classify network traffic. A novel Comparison-Max Random Walk algorithm is used to determine the RT, which is used as an instrument to direct the model to classify the data so that the predicted positives are close or equal to the RT. We also propose Estimated Evaluation Metrics (EEM) to evaluate the performance of unsupervised models. The IAM system is tested with UDP flood, TCP flood, ICMP flood, multi-vector and a real UDP flood attack data. Additionally, to check the scalability of the IAM system, we tested it on every subdivided data set for distributed computing. The average Recall on all data sets was above 98%.

Protecting the Internet of Vehicles Against Advanced Persistent Threats: A Bayesian Stackelberg Game

Connected vehicles are essential for the deployment of intelligent transportation services. However, the high level of connectivity in today's Internet of vehicles (IoV) and the extreme reliance on the data collected from the smart transportation infrastructure widen the space of security vulnerabilities, making the IoV a potential target for cyberattacks. This article investigates novel sophisticated ways to exploit the IoV and launch intelligent attacks on road traffic services by creating persistent impact and reducing detection chances. This article models the processes of attack and defense as a cybersecurity Stackelberg game leading to optimal mixed strategies for both the attackers and the IoV defense system, where the latter optimally deploys the available security resources within the transportation infrastructure to minimize the impact of attacks and improve their detection. The game is of Bayesian type and considers several types of data corruption attacks that occur according to a probability distribution that we determine based on a rigorous risk assessment approach. The results show that our game model and solution allow us to reduce the impact of advanced persistent threats compared to a uniform defense design that is indifferent to attackers' strategies and types. The solution could be integrated into the design of IoV intrusion detection systems to increase their robustness.

Assessing the risk reducing effect of measures against intelligent attacks: review and discussion of some common approaches

Assessing the risk reducing effect of measures against intelligent attacks: review and discussion of some common approaches