Masquerade Attack Research Articles

Risk‐Aware SDN Defense Framework Against Anti‐Honeypot Attacks Using Safe Reinforcement Learning

ABSTRACTThe development of multiple attack methods by external attackers in recent years poses a huge challenge to the security and efficient operation of software‐defined networks (SDN), which are the core of operational controllers and data storage. Therefore, it is critical to ensure that the normal process of network interaction between SDN servers and users is protected from external attacks. In this paper, we propose a risk‐aware SDN defense framework based on safe reinforcement learning (SRL) to counter multiple attack actions. Specifically, the defender uses SRL to maximize the utility by choosing to provide a honeypot service or pseudo‐honeypot service within predefined security constraints, while the external attacker maximizes the utility by choosing an anti‐honeypot attack or masquerade attack. To describe the system risk in detail, we introduce the risk level function to model the simultaneous dynamic attack and defense processes. Simulation results demonstrate that our proposed risk‐aware scheme improves the defense utility by 17.5% and 142.4% and reduces the system risk by 42.7% and 59.6% compared to the QLearning scheme and the Random scheme, respectively.

Secure and Swift: A Proactive Approach to Defend Lightweight Key Exchange Mechanisms Against Replay, Masquerade, and Message Forgery Attacks in Cloud-IoT Communication

The Internet of Things (IoT) has rapidly advanced, making it feasible to connect numerous embedded devices to the internet for data sharing. Since the embedded devices have limited power, storage, and processing capacity, it is necessary to integrate embedded devices with a big resource pool, like the cloud. This technological integration is anticipated to bring about a remarkable expansion in the present and future exciting uses of IoT. Security concerns such as device data privacy and authentication are important ones in this regard. The goal of the current study is to develop a lightweight key establishment for safe mutual authentication system for cloud servers and the Internet of Things. Lightweight key establishment are used in our approach for authentication, while advanced encryption standard is used for confidentiality and integrity. The suggested plan achieves efficiency in performance analysis as well as security aspects including confidentiality, integrity, and authentication in security analysis. Proposed mechanism additionally, does an informal analysis and comparison of the security attributes, including replay attack, masquerade attack, message forgery attack.

GLSBIoT: GWO-based enhancement for lightweight scalable blockchain for IoT with trust based consensus

Blockchain technology, which has gained much attention from researchers, faces challenges when applied to resource-constrained devices in the Internet of Things (IoT). These challenges include significant network overhead and energy-intensive processes. We propose a trust-based ensemble consensus and Grey Wolf Optimization (GWO) algorithm to address these limitations. The trust-based ensemble consensus leverages Proof of Work (PoW) and Proof of Stake (PoS) consensus procedures to improve trust levels within the network. To boost scalability and throughput without sacrificing the security and privacy of IoT data, we utilize sidechaining with the efficient GWO algorithm, allowing the construction of parallel chains connected to the main blockchain. Our experimental results outperformed conventional models by increasing throughput by 12.5% while decreasing mining delay by 19.5% and energy usage by 18.3%. The conducted security analysis reveals the presented lightweight framework is robust against Finney, DoS, Sybil, and Masquerade attacks. These improvements suggest the potential of this approach to provide privacy, integrity, and anonymity in blockchain-enabled IoT systems for smart city applications.

NDN Security: Cryptographic Approaches for Safeguarding Content-Centric Networking against Threats

The future of the internet demands innovative approaches to communication paradigms and security mechanisms. Named Data Networking (NDN) introduces a ground breaking data-centric communication paradigm, shifting the focus from host-centric networking to efficient content retrieval. This novel framework relies on the dynamic interplay of Interest and Data packets to enable seamless content dissemination and caching. NDN's security framework, built upon digital keys, certificates, and trust policies, ensures the integrity and confidentiality of data transactions within its ecosystem. Cryptographic keys exchanged in real-time through Interest and Data packets, forming the bedrock of secure interactions within NDN. This dynamic key exchange mechanism bolsters security and facilitates controlled data generation. Certificates play a pivotal role in establishing trust, solidifying the connection between names and public keys, while trust policies align with application-defined guidelines to govern key-data entity associations. This paper delves into the security challenges that NDN effectively addresses. By investigating vulnerabilities and assessing the susceptibility of common attacks, it underscores the resolute defense mechanisms inherent in the NDN framework. The inherently anonymous and non-identifying nature of NDN renders eavesdropping and traffic analysis infeasible, bolstering confidentiality. Digital signatures provide robust data integrity, thwarting any attempts at unauthorized modification. The comprehensive data signing mechanism effectively prevents masquerade attacks, and the integration of unique naming and nonce in Interest packets averts replay attacks. In essence, this research not only sheds light on the essential security components of NDN but also illuminates how this paradigm addresses a multitude of security challenges. NDN's forward-thinking content-centric approach and its robust security mechanisms hold the potential to reshape networking paradigms. As we look to the future of the internet, NDN stands as a promising contender for advancing secure, efficient, and transformative networking models.

A comprehensive guide to CAN IDS data and introduction of the ROAD dataset.

Although ubiquitous in modern vehicles, Controller Area Networks (CANs) lack basic security properties and are easily exploitable. A rapidly growing field of CAN security research has emerged that seeks to detect intrusions or anomalies on CANs. Producing vehicular CAN data with a variety of intrusions is a difficult task for most researchers as it requires expensive assets and deep expertise. To illuminate this task, we introduce the first comprehensive guide to the existing open CAN intrusion detection system (IDS) datasets. We categorize attacks on CANs including fabrication (adding frames, e.g., flooding or targeting and ID), suspension (removing an ID's frames), and masquerade attacks (spoofed frames sent in lieu of suspended ones). We provide a quality analysis of each dataset; an enumeration of each datasets' attacks, benefits, and drawbacks; categorization as real vs. simulated CAN data and real vs. simulated attacks; whether the data is raw CAN data or signal-translated; number of vehicles/CANs; quantity in terms of time; and finally a suggested use case of each dataset. State-of-the-art public CAN IDS datasets are limited to real fabrication (simple message injection) attacks and simulated attacks often in synthetic data, lacking fidelity. In general, the physical effects of attacks on the vehicle are not verified in the available datasets. Only one dataset provides signal-translated data but is missing a corresponding "raw" binary version. This issue pigeon-holes CAN IDS research into testing on limited and often inappropriate data (usually with attacks that are too easily detectable to truly test the method). The scarcity of appropriate data has stymied comparability and reproducibility of results for researchers. As our primary contribution, we present the Real ORNL Automotive Dynamometer (ROAD) CAN IDS dataset, consisting of over 3.5 hours of one vehicle's CAN data. ROAD contains ambient data recorded during a diverse set of activities, and attacks of increasing stealth with multiple variants and instances of real (i.e. non-simulated) fuzzing, fabrication, unique advanced attacks, and simulated masquerade attacks. To facilitate a benchmark for CAN IDS methods that require signal-translated inputs, we also provide the signal time series format for many of the CAN captures. Our contributions aim to facilitate appropriate benchmarking and needed comparability in the CAN IDS research field.

CrySyS dataset of CAN traffic logs containing fabrication and masquerade attacks

Despite their known security shortcomings, Controller Area Networks are widely used in modern vehicles. Research in the field has already proposed several solutions to increase the security of CAN networks, such as using anomaly detection methods to identify attacks. Modern anomaly detection procedures typically use machine learning solutions that require a large amount of data to be trained. This paper presents a novel CAN dataset specifically collected and generated to support the development of machine learning based anomaly detection systems. Our dataset contains 26 recordings of benign network traffic, amounting to more than 2.5 hours of traffic. We performed two types of attack on the benign data to create an attacked dataset representing most of the attacks previously proposed in the academic literature. As a novelty, we performed all attacks in two versions, modifying either one or two signals simultaneously. Along with the raw data, we also publish the source code used to generate the attacks to allow easy customization and extension of the dataset.

OFIDS : Online Learning-Enabled and Fingerprint-Based Intrusion Detection System in Controller Area Networks

As a widely used industrial field bus, the controller area network (CAN) lacks security mechanisms (e.g., encryption and authentication). With the development of network connectivity and the increase in external communication, CAN networks are vulnerable to security attacks (e.g., masquerade). Attackers can intrude on CAN networks to control CAN devices, causing security threats. A fingerprint-based intrusion detection system (IDS) in CAN networks can detect masquerade attacks by scanning the unique clock signals of CAN devices. However, most state-of-the-art fingerprint-based IDSs commonly use an analog-to-digital converter module with a low frequency of 60 MHz to sample CAN signals, lowering the accuracy of the trained fingerprint-based IDS model. In addition, almost all fingerprint-based IDSs are trained offline and then detected online in CAN networks, ignoring that system clock signals of hardware change over time, resulting in degraded detection performance. An intrusion detection system based on physical fingerprints can achieve effective identification of masquerade attacks. This paper proposes an online learning-enabled and fingerprint-based IDS (OFIDS) in CAN networks to increase the sampling frequency, simplify the sampling circuit, shorten the delay time, improve the detection response time, and increase the detection accuracy. OFIDS uses a high-speed comparator (i.e., TLV3501) and field-programmable gate arrays (FPGA; i.e., Xilinx ZYNQ-7010) to sample the CAN_High signal, achieving a low sampling delay time of 4.5 ns and a high sampling frequency of 1 GHz. The self-adaptability of the backpropagation neural network is taken advantage of and used to train the OFIDS model with a detection accuracy of 99.9992%. The OFIDS model is deployed to a CAN network prototype with five CAN devices (i.e., two Arduino UNO boards and three STM32 microcontrollers), where online learning is conducted with a low training time of less than 2 min to update the OFIDS model. Experimental results show that OFIDS can achieve at least 99.99% detection accuracy within 0.18 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> s in a CAN network prototype and can achieve 98% detection accuracy in a real vehicle.

A Model-Based Method for Enabling Source Mapping and Intrusion Detection on Proprietary Can Bus

With the deep integration of the Internet of Things (IoT) technology and the increase of computational power and memory, vehicles can also serve as the infrastructures for Intelligent Transportation System (ITS), e.g., as fog nodes. However, when connecting vehicles to the internet, alongside with the benefits it brings, it also opens many new challenges such as security attacks. Controller Area Network (CAN) is one of the main in-vehicle communication protocols in modern cars. Its lack of sender verification mechanism makes CAN particularly vulnerable to cyber-attacks including masquerade attack. Fingerprinting Electronic Control Units (ECUs) based on hardware characteristics has been proved feasible and effective on defending CAN buses. However, most state-of-the-art works exploited the supervised learning algorithm to identify the transmitter based on the signal characteristics. This makes the decision process hard to understand, and it also limits the deployment on proprietary CAN bus without prior knowledge. To solve this, we design a novel clock-skew-based approach capable of pinpointing the sender and detecting intrusion on proprietary CAN bus. We take a single CAN frame as the object for measurement, and adjust the measuring process such that our approach can be independent of the transmission time of frames. Based on the statistical analysis of data from real vehicles, we propose a novel box-plot algorithm based on score mechanism to filter the raw data. Finally, the clock skews are estimated and accumulated to build a linear model for representing the transmitter ECU. The evaluation results on one CAN prototype and two production vehicles show that our approach is able to well identify and differentiate ECUs on the bus without prior knowledge. The data processed by the proposed box-plot algorithm can describe the hardware characteristics of ECUs precisely. We also show the ability of our approach to protecting the CAN bus against the masquerade attack.

Design and implementation of secured file delivery protocol using enhanced elliptic curve cryptography for class I and class II transactions

&lt;p&gt;This research study introduces an ID-based identity authentication protocol that utilizes the enhanced elliptic curve digital signature algorithm, a cryptographic method developed on elliptic curve cryptography. The protocol enhances the Consultative Committee for Space Data Systems (CCSDS) File Delivery Protocol (CFDP), a pioneering protocol explicitly defined for distant space communications. This study employs both dependable and uncertain modes of the CFDP protocol. To make more secure data transactions, two key security risks are effectively mitigated in this research as a result of applying the proposed enhanced elliptic curve cryptography algorithm (ECC) over the ternary galois field. First, it thwarts the impersonation of a harmful entity during a passive attack. Second, it prevents masquerade attacks, further reinforcing the security of space data transmission. This ID-based authentication protocol, therefore, offers a significant advancement in protecting far-space communications, optimizing the integrity of data exchanged across vast distances.&lt;strong&gt;&lt;em&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;

Real-Time Security Warning and ECU Identification for In-Vehicle Networks

Vehicle intelligence and networking have manifested the significance of the embedded Controller Area Network (CAN) bus. However, the lack of message encryption and identity authentication leaves Electric Control Units (ECUs) exposed to cyber-attacks. To identify the potential attacks on the CAN, intrusion detection systems are required with consideration of their computational burden and their application in vehicles. Therefore, we propose a lightweight ECU identification scheme. Explicitly, the proposed method records the periodic intervals of frames and calculates accumulated clock offsets with the recursive least square algorithm; meanwhile, the empirical rules are adopted to eliminate the noises. Then, the ECU fingerprints have been formulated with the derived clock skew, clock offsets as well as their expectations. Furthermore, to accurately identify the attackers in the masquerade attacks, a double-verified attacker identification approach is proposed, in which the data dependency and intra-inter class algorithm are respectively utilized for better executability. Finally, we have tested the proposed method with an actual vehicle and the results manifest that the proposed method could identify the abnormal ECUs with an identification accuracy of at least 98% and its execution time is less than 3ms.

Beyond vanilla: Improved autoencoder-based ensemble in-vehicle intrusion detection system

Modern automobiles are equipped with a large number of electronic control units (ECUs) to provide safe, driver assistance and comfortable services. The controller area network (CAN) provides near real-time data transmission between ECUs with adequate reliability for in-vehicle communication. However, the lack of security measures such as authentication and encryption makes the CAN bus vulnerable to cyberattacks, which affect the safety of passengers and the surrounding environment. Detecting attacks on the CAN bus, particularly masquerade attacks, presents significant challenges. It necessitates an intrusion detection system (IDS) that effectively utilizes both CAN ID and payload data to ensure thorough detection and protection against a wide range of attacks, all while operating within the constraints of limited computing resources. This paper introduces an ensemble IDS that combines a gated recurrent unit (GRU) network and a novel autoencoder (AE) model to identify cyberattacks on the CAN bus. AEs are expected to produce higher reconstruction errors for anomalous inputs, making them suitable for anomaly detection. However, vanilla AE models often suffer from overgeneralization, reconstructing anomalies without significant errors, resulting in many false negatives. To address this issue, this paper proposes a novel AE called Latent AE, which incorporates a shallow AE into the latent space. The Latent AE model utilizes Cramér’s statistic-based feature selection technique and a transformed CAN payload data structure to enhance its efficiency. The proposed ensemble IDS enhances attack detection capabilities by leveraging the best capabilities of independent GRU and Latent AE models, while mitigating the weaknesses associated with each individual model. The evaluation of the IDS on two public datasets, encompassing 13 different attacks, including sophisticated masquerade attacks, demonstrates its superiority over baseline models with near real-time detection latency of 25ms.

Wireless Sensor Network with Blockchain Technology using Elliptic Curve Discrete Logarithm Problem and its Applications

Wireless sensor network (WSN), a type of communication system, is normally deployed into the unattended environment where the intended user can get access to the network. The sensor nodes collect data from this environment. If the data are valuable and confidential, then security measures are needed to protect them from the unauthorized access. This situation requires an access control protocol (ACP) in the design of sensor network because of sensor nodes which are vulnerable to various malicious attacks during the authentication and key establishment and the new node addition phase. Nowadays, wireless sensor networks are being widely applied in many fields of human life such as civil and military applications. Although WSNs can bring a lot of benefits and conveniences. However, when applying the WSNs in the real world we have to face many challenges such as security, storage due to its centralized server/client model. Therefore, it is necessary to apply the distributed model in the WSNs system. One of the newest distributed systems today is Blockchain (BC). Blockchain is a decentralized technology that can help the computation and management processes as well as security in WSNs. In this paper, we propose a secured ACP for such WSN. This protocol is based on Elliptic Curve Discrete Log Problem (ECDLP) and double trapdoor chameleon hash function which secures the WSN from malicious attacks such as node masquerading attack, replay attack, man-in-the-middle attack, and forgery attacks. Proposed ACP has a special feature known as session key security. Also, the proposed ACP is more efficient as it requires only one modular multiplication during the initialization phase. This article provides an overview of Blockchain integration in WSN with highlighting the benefits and challenges of applying this technology to WSN. We can conclude that using Blockchain technology to solve the problem of security and distributed storage for WSN can be an effective approach. It could pave the way for new research directions and distributed applications.

An authentication scheme for FANET packet payload using data hiding

Flying ad hoc networks (FANETs) are gaining much traction in recent years due to their wide range of applications, resulting in the emergence of a number of studies on the facilitation of their widespread adoption. One of the key areas being investigated is the establishment of security strategies to combat the large amount and variety of security threats that they inevitably face when they are operating in the field. Since a majority of FANET’s operations involve the transmission of network packets containing both instructions and sensitive data, the protection of these packets is critical. This paper proposes an authentication scheme to protect the payload of the packets being transmitted within the FANET. Since FANETs are highly resource-constrained, we opted for a lightweight and energy-efficient approach. The proposed scheme essentially encodes the payload of a physical layer data frame into a compact bit stream, which is subsequently embedded into the cyclic prefix (CP) at the physical layer. The encoding process includes the XOR-operation and JBIG2 lossless compression. At the receiver’s end, the hidden authentication data is extracted and decoded for comparison against the payload of the received data frame. Two enhancements are introduced to further enhance robustness against masquerade attack. The proposed scheme is evaluated in terms of bit error rate (BER) under different signal-to-noise ratio (SNR) settings. In all considered SNR settings, the proposed authentication scheme achieves BERs of <0.7∗10−4 when 7-bit Hamming code is implemented. Experiment results also confirm that proposed scheme is able to localize the tampered data frames.

An SSL-PUF Based Access Authentication and Key Distribution Scheme for the Space-Air-Ground Integrated Network.

The Space-Air-Ground Integrated Network (SAGIN) expands cyberspace greatly. Dynamic network architecture, complex communication links, limited resources, and diverse environments make SAGIN's authentication and key distribution much more difficult. Public key cryptography is a better choice for terminals to access SAGIN dynamically, but it is time-consuming. The semiconductor superlattice (SSL) is a strong Physical Unclonable Function (PUF) to be the hardware root of security, and the matched SSL pairs can achieve full entropy key distribution through an insecure public channel. Thus, an access authentication and key distribution scheme is proposed. The inherent security of SSL makes the authentication and key distribution spontaneously achieved without a key management burden and solves the assumption that excellent performance is based on pre-shared symmetric keys. The proposed scheme achieves the intended authentication, confidentiality, integrity, and forward security, which can defend against masquerade attacks, replay attacks, and man-in-the-middle attacks. The formal security analysis substantiates the security goal. The performance evaluation results confirm that the proposed protocols have an obvious advantage over the elliptic curve or bilinear pairings-based protocols. Compared with the protocols based on the pre-distributed symmetric key, our scheme shows unconditional security and dynamic key management with the same level performance.

A novel hybrid methodology to secure GOOSE messages against cyberattacks in smart grids

IEC 61850 is emerging as a popular communication standard for smart grids. Standardized communication in smart grids has an unwanted consequence of higher vulnerability to cyber-attacks. Attackers exploit the standardized semantics of the communication protocols to launch different types of attacks such as false data injection (FDI) attacks. Hence, there is a need to develop a cybersecurity testbed and novel mitigation strategies to study the impact of attacks and mitigate them. This paper presents a testbed and methodology to simulate FDI attacks on IEC 61850 standard compliant Generic Object-Oriented Substation Events (GOOSE) protocol using real time digital simulator (RTDS) together with open-source tools such as Snort and Wireshark. Furthermore, a novel hybrid cybersecurity solution by the name of sequence content resolver is proposed to counter such attacks on the GOOSE protocol in smart grids. Utilizing the developed testbed FDI attacks in the form of replay and masquerade attacks on are launched and the impact of attacks on electrical side is studied. Finally, the proposed hybrid cybersecurity solution is implemented with the developed testbed and its effectiveness is demonstrated.

An Effective Security Scheme for Attacks on Sample Value Messages in IEC 61850 Automated Substations

The trend of transforming substations into smart automated facilities has led to their swift digitalization and automation. To facilitate data exchange among equipment within these substations, the IEC 61850 standard has become the predominant standard. However, this standardization has inadvertently made these substations more susceptible to cyberattacks, which is a significant concern given the confidential information that is transmitted. As a result, cybersecurity in substations is becoming an increasingly critical topic. IEC 62351 standard provides guidelines and considerations for securing the IEC 61850 messages to mitigate their vulnerabilities. While securing Generic Object-Oriented Substation Event (GOOSE) messages has received considerable attention in literature, the same level of scrutiny has not been applied to Sampled Value (SV) messages despite their susceptibility to cyberattacks and similar frame format. This paper presents the impact of replay and masquerade attacks on SV messages. It also develops a scheme for securing SV messages against these attacks. Due to high sampling rate and time critical nature of SV messages, the time complexity of security scheme is critical for its applicability to SV messages. Hence, in this work, SV emulators have been developed in order to send these modified secure SV messages and investigate their timing performance. The results show that the proposed scheme can mitigate replay and masquerade attacks on SV messages while providing the necessary high sampling rate and stringent timing requirements.

Trusted Microservices: A Security Framework for Users' Interaction with Microservices Applications

Microservices architecture emerges as a promising software design approach that provides large scale software systems with flexibility, scalability and fault tolerance. Moreover, it is considered a suitable design to be implemented using software containers provided with several cloud providers. However, microservices suffer from several security challenges that hinder its progress. The concept of microservices is to break down the system functionality to a number of small coherent services. Hence, using microservices as a design approach increases the security risks by expanding the risk surface. In contrast to microservices, monolithic applications are implemented as a bulk of codes using single programming language. Such environment has several drawbacks related to flexibility and maintainability, but limits security issues. On the other hand, microservices implementation uses several programming languages and frameworks to implement small units of system functionality. Such environment opens the door to new critical security issues. The proposed work introduces the problem of securing microservices and provides a novel approach to protect microservices applications from masquerade attacks. The proposed framework also provides high protection to users from malicious services. The framework was implemented using 150 software containers to define users' HTTP requests and a set of 20 microservices were tested to proof its applicability and benefits

DETECTING CREDIT CARD FRAUD USING MACHINE LEARNING

Bank fraud is "The unauthorized use of an individual's confidential information to make purchases or withdraw funds from a user's account." E-commerce is growing rapidly, and the world is moving towards digitization, cashless transactions, the use of credit cards, the number of users is rapidly increasing, and with it the number of frauds associated with it. Due to the development of technology and the increase in the number of online transactions, fraud is also increasing, leading to huge financial losses. Therefore, effective methods to reduce losses are needed. In addition, scammers find ways to steal the user's credit card information by sending fake SMS and calls, as well as by masquerade attacks, phishing attacks, and so on. This article aims to use several machine learning algorithms such as Support Vector Machine (SVM), Decision Tree, Bayesian Belief Networks, Logistic Regression, k-Nearest Neighbor (Knn), and Artificial Neural Network (ANN) to predict the occurrence of fraud. In addition, we differentiate between the implemented supervised machine learning and deep learning methods to distinguish between fraudulent and non-fraudulent transactions.

Living in the Dark: MQTT-Based Exploitation of IoT Security Vulnerabilities in ZigBee Networks for Smart Lighting Control

The Internet of Things (IoT) has provided substantial enhancements to the communication of sensors, actuators, and their controllers, particularly in the field of home automation. Home automation is experiencing a huge rise in the proliferation of IoT devices such as smart bulbs, smart switches, and control gateways. However, the main challenge for such control systems is how to maximize security under limited resources such as low-processing power, low memory, low data rate, and low-bandwidth IoT networks. In order to address this challenge the adoption of IoT devices in automation has mandated the adoption of secure communication protocols to ensure that compromised key security objectives, such as confidentiality, integrity, and availability are addressed. In light of this, this work evaluates the feasibility of MQTT-based Denial of Service (DoS) attacks, Man-in-the-Middle (MitM), and masquerade attacks on a ZigBee network, an IoT standard used in wireless mesh networks. Performed through MQTT, the attacks extend to compromise neighboring Constrained Application Protocol (CoAP) nodes, a specialized service layer protocol for resource-constrained Internet devices. By demonstrating the attacks on an IKEA TRÅDFRI lighting system, the impact of exploiting ZigBee keys, the basis of ZigBee security, is shown. The reduction of vulnerabilities to prevent attacks is imperative for application developers in this domain. Two Intrusion Detection Systems (IDSs) are proposed to mitigate against the proposed attacks, followed by recommendations for solution providers to improve IoT firmware security. The main motivation and purpose of this work is to demonstrate that conventional attacks are feasible and practical in commercial home automation IoT devices, regardless of the manufacturer. Thus, the contribution to the state-of-the-art is the design of attacks that demonstrate how known vulnerabilities can be exploited in commercial IoT devices for the purpose of motivating manufacturers to produce IoT systems with improved security.

ClockIDS: A Real-Time Vehicle Intrusion Detection System Based on Clock Skew

Although intelligent connected vehicles (ICVs) can better assist drivers and improve their driving experience, they have huge network security problems and are frequently attacked. This is because the vehicle network is connected to the Internet, which expands the attack surface of ICV, and attackers have more ways to launch attacks. In recent years, many security experts fight against attackers and propose various types of vehicle intrusion detection systems (IDSs) to protect the controller area network (CAN). However, with the continuous enhancement of attack means, especially the appearance of the masquerade attack, most IDSs are no longer applicable. In this article, we design a new fingerprint-based vehicle IDS to protect the CAN, called ClockIDS. It establishes a unique fingerprint for each electronic control unit (ECU) based on clock skew. On this basis, ClockIDS realizes the functions of intrusion detection and attack source identification by utilizing the empirical rule and dynamic time warping. It neither occupies the bandwidth of CAN bus nor needs to modify the CAN protocol. Our experiments on two real vehicles show that ClockIDS can establish a unique fingerprint for ECU without being affected by the size of message period, and can detect three types of attack with a detection accuracy of 98.63%. In addition, this system can identify the attack source, and the average recognition accuracy is 96.77%. Furthermore, ClockIDS has high real-time performance, and the average time cost of each detection is only 1.99 ms.