Malicious Packets Research Articles

Exploiting Dispersive Power Gain and Delay Spread for Sybil Detection in Industrial WSNs: A Multi-Kernel Approach

Industrial wireless sensor networks (IWSNs) promote innovations in the industry such as structural status mapping, instrument fault diagnosing, and oriented automation system associating. However, due to the shared nature of the wireless propagation environment, the emerging sensor nodes (SNs) with wireless properties are vulnerable to external malicious attacks. The security threats, especially Sybil attacks, impose great difficulties in fulfilling quality requirements of industrial applications. What is more complicated is that the harsh industrial environment brings about new challenges which can degrade the accuracy of detecting Sybil threats. In this paper, we focus on how to detect the malicious packets transmitted from Sybil attackers without adding extra authentication overhead into the transmission frame. We develop a multi-Kernel-based expectation maximization (MKEM) scheme to detect Sybil attacks in IWSNs. Instead of directly investigating the radio resource of SNs, we produce channel-vectors which are extracted from the power gain and delay spread of the channel impulse response obtained from the received packets to represent each SN. Specifically, a kernel-oriented method is designed to discriminate the malicious packets from benign ones without establishing a pre-defined database of channel features of all SNs. Meanwhile, we allocate different kernel weights to the proposed kernels and combine them to improve the discrimination ability of the scheme. Moreover, a kernel parameter optimization method is developed to regulate each kernel weight and parameter to reduce the effects of transmission impairments in IWSNs. To avoid poor detection accuracy when the number of Sybil attackers increases, we use the gap statistical analysis method to verify and EM method to summarize the detection results. The simulation results show that the proposed MKEM scheme can achieve high accuracy on detecting malicious packets transmitted from Sybil attackers from benign ones, and tolerate the effects of transmission impairments in the industrial environment. Moreover, the MKEM scheme can guarantee the detection accuracy even if the number of Sybil attackers increases.

An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses.

In this paper, we provide an overview of recent research efforts on networked control systems under denial-of-service attacks. Our goal is to discuss the utility of different attack modeling and analysis techniques proposed in the literature for addressing feedback control, state estimation, and multi-agent consensus problems in the face of jamming attacks in wireless channels and malicious packet drops in multi-hop networks. We discuss several modeling approaches that are employed for capturing the uncertainty in denial-of-service attack strategies. We give an outlook on deterministic constraint-based modeling ideas, game-theoretic and optimization-based techniques and probabilistic modeling approaches. A special emphasis is placed on tail-probability based failure models, which have been recently used for describing jamming attacks that affect signal to interference-plus-noise ratios of wireless channels as well as transmission failures on multi-hop networks due to packet-dropping attacks and non-malicious issues. We explain the use of attack models in the security analysis of networked systems. In addition to the modeling and analysis problems, a discussion is provided also on the recent developments concerning the design of attack-resilient control and communication protocols.

A Novel Data Mining Approach for Analysis and Pattern Recognition of Active Fingerprinting Components

Active fingerprinting is an effective penetration testing technique to know about vulnerability of hosts against security threats and network as a whole. Sometimes firewalls may block fingerprinting packets, hence making the probes infeasible. Measured Round Trip Time (RTTm) is a benign number that can be obtained from communication based on legitimate non malicious packets. In this paper, RTTm has been used along with other timers namely Smoothened Round-trip Time (SRTT), Round-trip Time Variance (RTTVar), Retransmission Time Out (RTO) and Scantime for pattern recognition and association analysis with the aid of cross-correlations. Experimental relationship among these timers are derived to back-up existing theoretical knowledge. A novel method to estimate IP-ID Sequence classes and network-traffic intensity based on these timers has been proposed. Results show that the model can be used to accurately derive (about 100% accuracy) active fingerprinting components IP-ID sequences and link traffic estimation. Analytical results obtained by this study can help in designing high-performance realistic networks and dynamic congestion control techniques.

Intrusion Detection System based on the SDN Network, Bloom Filter and Machine Learning

The scale and frequency of sophisticated attacks through denial of distributed service (DDoS) are still growing. The urgency is required because with the new emerging paradigms of the Internet of Things (IoT) and Cloud Computing, billions of unsecured connected objects will be available. This document deals with the detection, and correction of DDoS attacks based on real-time behavioral analysis of traffic. This method is based on Software Defined Network (SDN) technologies, Bloom filter and automatic behaviour learning. Indeed, distributed denial of service attacks (DDoS) are difficult to detect in real time. In particular, it concerns the distinction between legitimate and illegitimate packages. Our approach outlines a supervised classification method based on Machine Learning that identifies malicious and normal packets. Thus, we design and implement Defined (IDS) with a great precision. The results of the evaluation suggest that our proposal is timely and detects several abnormal DDoS-based cyber-attack behaviours.

QoS Aware Routing Protocol Through Cross-layer Approach in Asynchronous Duty-Cycled WSNs

The growing usage of wireless sensor networks (WSNs) in different scenarios makes the Quality-of-Service (QoS) a paramount issue in WSN-based applications. We are especially interested in the QoS aware of asynchronous duty-cycled WSNs in the light of designing routing protocol, whereby waiting for latency and malicious packet dropping are critical to the network performance. We first propose an optimized detection mechanism for malicious packet dropping attack. Then, based on sleep latency and queue length, a method for congestion degree measurement is proposed under asynchronous duty-cycled low power listening (LPL) modes. Last but not least, we introduce related QoS aware metrics for the design of QoS aware routing protocol, which can enhance the QoS performance in throughput, delay, and packet losses (TDL). Experimental results demonstrate that the QoS performance of our TDL-based routing protocol is better than those of the CTP-Watchdog protocol and the CTP-Optimized protocol, especially in terms of higher-throughput, lower-delay, and less-loss rate. By optimized threshold, the detection accuracy of our detection mechanism is improved much more than that of the traditional watchdog technology. Furthermore, we evaluate that the preferred optimization factor can help to make a tradeoff between the false negative rate and the false positive rate. Our TDL-based routing protocol is implemented under the component-based architecture by a cross-layer approach, which provides a practicable solution for the design of QoS-aware routing protocol in asynchronous duty-cycled WSNs.

Detection of malicious packet dropping attacks in RPL-based internet of things

Detection of malicious packet dropping attacks in RPL-based internet of things

An Efficient Forensics Architecture in Software-Defined Networking-IoT Using Blockchain Technology

A Potential solution for solving forensic is the use of blockchain in software-defined networking (SDN). The blockchain is a distributed peer-to-peer network that can be utilized on SDN-based Internet of Things (IoT) environments for security provisioning. Hence, to meet some challenges in digital forensics such as data integrity, evidence deletion or alteration, blockchain is used. However, some problems such as poor attack detection and slow processing existed in previous works. To address these issues, an efficient forensics architecture is proposed in SDN-IoT that establishes the Chain of Custody (CoC) in blockchain technology. The proposed SDN-based IoT architecture is initiated with flow table rules on switches for the three different traffics Voice over Internet Protocol (VoIP), File Transfer Protocol (FTP), and Hyper Text Transfer Protocol (HTTP). In this work, overloaded switches migrate the packets to nearby switches to balance the packet flow. The packets disobeying flow rules will be discarded by switches. The blockchain-based distributed controller in this forensic architecture is designed to use the Linear Homomorphic Signature (LHS) algorithm for validating users. Each controller is fed with a classifier that uses the Neuro Multi-fuzzy to classify malicious packets based on packet features. The logs of events are used and stored on the blockchain in the proposed SDN-IoT architecture. We evaluated the performance of our forensic architecture and compared it to the existing model using various performance measures. Our evaluation results demonstrate performance improvement by reducing delay, response time and processing time, increasing throughput, accuracy, and security parameters.

Detection of malicious packet dropping attacks in RPL-based internet of things

The routing protocol for low-power and lossy networks (RPL) is an IPv6-based routing protocol optimised for internet of things (IoT) environments. However, it is susceptible to malicious packet dropping attacks. If a node with a lower rank that is closer to the root node attempts a malicious packet dropping, it may disrupt basic data transmission or even the entire IoT application service. In this paper, we present a novel detection method for malicious packet dropping attacks against RPL-based networks. The proposed method is based on the anomaly intrusion detection system and detects malicious packet dropping in the presence of normal packet losses. We evaluate the performance of the method on Contiki's network simulator, Cooja. The evaluation results show that the method has good performance in detecting malicious packet dropping attacks. In every case, the successful detection rate is greater than 94% and the false alarm rate is less than 3%.

Detection of selective forwarding attacks based on adaptive learning automata and communication quality in wireless sensor networks

Wireless sensor networks face threats of selective forwarding attacks which are simple to implement but difficult to detect. It is difficult to distinguish between malicious packet dropping and the normal packet loss on unstable wireless channels. For this situation, a selective forwarding attack detection method is proposed based on adaptive learning automata and communication quality; the method can eliminate the impact of normal packet loss on selective forwarding attack detection and can detect ordinary selective forwarding attack and special cases of selective forwarding attack. The current and comprehensive communication quality of nodes are employed to reflect the short- and long-term forwarding behaviors of nodes, and the normal packet loss caused by unstable channels and medium-access-control layer collisions is considered. The adaptive reward and penalty parameters of a detection learning automata are determined by the comprehensive communication quality of the node and the voting of its neighbors to reward normal nodes or punish malicious ones. Simulation results indicate the effectiveness of the proposed method in detecting ordinary selective forwarding attacks, black-hole attacks, on-off attacks, and energy exhaustion attacks. In addition, the communication overhead of the method is lower than that of other methods.

Anomaly Payload Signature Generation System Based on Efficient Tokenization Methodology

Signature-based intrusion detection systems are widely used as an efficient network security control. Unfortunately, security experts manually craft attack signatures after capturing and analyzing the exploit code. Therefore, those systems are only able to detect known attacks. In this paper, we propose a new automated and content-based signature generation system that generates anomaly profiles to detect new and previously unknown attacks and worms. The proposed system, denoted SCANS, uses a natural tokenization method that speeds up the signature generation process by producing a fewer number of substrings. In this system, we propose a new stop character technique that will help to overcome signatures’ substrings granularity limitations of the old stop word techniques. In addition, SCANS introduces an improved normalized binary detection model specifically tailored for attacks detection. Experimental testing using DARPA IDS dataset shows a 95% malicious packets detection rate for port 23, with specificity of 88.4% and 94.6% for ports 21 and 25, respectively.

DoS vulnerabilities and mitigation strategies in software-defined networks

Software defined networking (SDN) significantly simplifies the management of network resources and the deployment of networking applications by decoupling the control logic from forwarding devices, as well as using a logically centralized control. While SDN brings huge success, the characteristics of SDN architecture also raise new security concerns. The software control agents on the switches, the bandwidth between switches, and the controller have limited processing capacity. These resources can be exhausted by SDN-aimed DoS attacks easily. In this paper, we investigate the DoS attack methods and mitigation strategies in SDN. We launch DoS attacks by injecting malicious packets with random source addresses. We find that these packets can overload the software control agents, the secure channel, and the controller. To defend against such attacks, we present DosDefender, an extension module for SDN controller to filter the malicious packets from the data plane in an online manner. We implement a prototype of DosDefender in the floodlight controller and evaluate the effectiveness of the defense mechanism. The results show that DosDefender can mitigate the DoS attacks and protect the software control agents, secure channel and controller resources simultaneously.

Anomaly intrusion detection method for vehicular networks based on survival analysis

In recent years, alongside with the convergence of In-vehicle network (IVN) and wireless communication technology, vehicle communication technology has been steadily progressing. Furthermore, communication with various external networks—such as cloud, vehicle-to-vehicle (V2V), and vehicle-to-infrastructure (V2I) communication networks—further reinforces the connectivity between the inside and outside of a vehicle. On the contrary, this means that the functions of existing vehicles using computer-assisted mechanical mechanisms can be manipulated and controlled by a malicious packet attack. Therefore, diversified and advanced architectures of vehicle systems can significantly increase the accessibility of the system to hackers and the possibility of an attack. This paper proposes an intrusion detection method for vehicular networks based on the survival analysis model. Our main aims were to identify malicious CAN messages and accurately detect the normality and abnormality of a vehicle network without semantic knowledge of the CAN ID function. To this end, normal and abnormal driving data were extracted from three different types of vehicles and we evaluated the performance of our proposed method by measuring the accuracy and the time complexity of anomaly detection by considering three attack scenarios and the periodic characteristics of CAN IDs. Based on the results, we concluded that a CAN ID with a long cycle affects the detection accuracy and the number of CAN IDs affects the detection speed. The difference in the detection accuracy between applying all CAN IDs and CAN IDs with a short cycle is not considerable with some differences observed in the detection accuracy depending on the chunk size and the specific attack type. High detection accuracy and low computational cost will be the essential factors for real-time processing of IVN security. Taken together, the results of the present study contribute to the current understanding of how to correctly manage vehicle communications for vehicle security and driver safety.

Optimizing Error Rate in Intrusion Detection System Using Artificial Neural Network Algorithm

The illegal hackers penetrate the servers and networks of corporate and financial institutions to gain money and extract vital information. The hacking varies from one computing system to many system. They gain access by sending malicious packets in the network through virus, worms, Trojan horses etc. The hackers scan a network through various tools and collect information of network and host. Hence it is very much essential to detect the attacks as they enter into a network. The methods available for intrusion detection are Naive Bayes, Decision tree, Support Vector Machine, K-Nearest Neighbor, Artificial Neural Networks. A neural network consists of processing units in complex manner and able to store information and make it functional for use. It acts like human brain and takes knowledge from the environment through training and learning process. Many algorithms are available for learning process This work carry out research on analysis of malicious packets and predicting the error rate in detection of injured packets through artificial neural network algorithms.

Path Reconstruction and Effective Routing with Advanced Congestion Diversity in Wireless Adhoc Networks

Link error and malicious packet dropping are two sources for packet losses in multi-hop wireless ad hoc network. In this paper, while observing a sequence of packet losses in the network, we are interested in determining whether the losses are caused by link errors only, or by the combined effect of link errors and malicious drop. We are especially interested in the insider-attack case, whereby malicious nodes that are part of the route exploit their knowledge of the communication context to selectively drop a small amount of packets critical to the network performance. Because the packet dropping rate in this case is comparable to the channel error rate, conventional algorithms that are based on detecting the packet loss rate cannot achieve satisfactory detection accuracy. To improve the detection accuracy, we propose to exploit the correlations between lost packets. Furthermore, to ensure truthful calculation of these correlations, we develop a homomorphic linear authenticator (HLA) based public auditing architecture that allows the detector to verify the truthfulness of the packet loss information reported by nodes. This construction is privacy preserving, collusion proof, and incurs low communication and storage overheads. To reduce the computation overhead of the baseline scheme, a packet-block based mechanism is also proposed, which allows one to trade detection accuracy for lower computation complexity. Through extensive simulations, we verify that the proposed mechanisms achieve significantly better detection accuracy than conventional methods such as a maximum-likelihood based detection.

Intelligent Intrusion Detection System Through Combined and Optimized Machine Learning

In this paper, an existing rule-based intrusion detection system (IDS) is made more intelligent through the application of machine learning. Snort was chosen as it is an open source software and though it was performing well, it showed false positives (FPs). To find the best performing machine learning algorithms (MLAs) to use with Snort so as to improve its detection, we tested some algorithms on three available datasets. Support vector machine (SVM) was chosen along with fuzzy logic and decision tree based on their accuracy. Combined versions of algorithms through ensemble SVM along with other variants were tried on the generated traffic of normal and malicious packets at 10[Formula: see text]Gbps. Optimized versions of the SVM along with firefly and ant colony optimization (ACO) were also tried, and the accuracy improved remarkably. Thus, the application of combined and optimized MLAs to Snort at 10[Formula: see text]Gbps worked quite well.

Design and analysis of hybrid single packet IP traceback scheme

Although cybercrime and cyber threats are increasing significantly, yet prevention and security of the critical infrastructure are still far from perfect. The internet has no protection against malicious packet modifications. Attackers exploit such vulnerabilities to forge the source IP addresses while instigating an attack. Consequently, investigating cybercrime is becoming extremely difficult. The best antidote would be to weed out the problem at its root by identifying the source of the attack. The objective of this study is to propose an IP traceback scheme that can identify the origin of an attack with a single packet with minimum computational and storage overhead while ensuring a high degree of accuracy. Compared to the state-of-the-art single packet IP traceback technique, the proposed scheme entails lesser computation overhead. According to CAIDA topology dataset, it requires only 320 kB of storage on each router. Storage requirement is several thousand times lesser than the pioneer single packet traceback scheme and 6.25 times lesser than the state-of-the-art traceback scheme. It has the better endurance to the change in topology compared with the state-of-the-art schemes. It identifies the attack node with high accuracy and minimal false positive. The obtained result has been validated to demonstrate its statistical significance.

HONEYDOS: a hybrid approach using data mining and honeypot to counter denial of service attack and malicious packets

Honeypots and data mining are the major methods used as a safeguard of assets or for classifying the data. Each technique has positives and disadvantages of its own and is best applied in a particular position. Hybrid approach uses aspects of both techniques to upgrade performance and shortcomings. In this paper, we propose a hybrid approach based on Honeypot and Data Mining based Support Vector Machine technique, implemented in the dot net framework for preventing Denial of Service Attack. The proposed approach, HoneyDos tested in three interfaces. This paper presents an empirical comparison of the hybrid approach to the earlier methods used for preventing Denial of Service attack and draw useful conclusions upon their performance.

Event-Based Fault Detection Filtering for Complex Networked Jump Systems

This paper is concerned with the fault detection filtering for complex systems over communication networks subject to nonhomogeneous Markovian parameters. A residual signal is generated that gives a satisfactory estimation of the fault, and an event-triggered scheme is proposed to determine whether the networks should be updated at the trigger instants decided by the event-threshold. Moreover, a random process is employed to model the phenomenon of malicious packet losses. Consequently, a novel method is presented to address the stochastically stability analysis and satisfies a given $H_{2}$ performance index simultaneously. The condition of the existence of the filter design algorithm is derived by a convex optimization approach to estimate the faults and to generate a residual. Finally, the proposed fault detection filtering method is then applied to an industrial nonisothermal continuous stirred tank reactor under realistic network conditions. Simulation results are given to show the effectiveness of the proposed design method and the designed filter.

Truthful Detection of Selfish Malicious Packet Dropping Nodes in Wireless Ad Hoc Network

Truthful Detection of Selfish Malicious Packet Dropping Nodes in Wireless Ad Hoc Network

A Secure data packet transmission in wireless sensor network using HECC algorithm and Finding malicious packet

A Secure data packet transmission in wireless sensor network using HECC algorithm and Finding malicious packet