Attack Methods Research Articles

Assessing and neutralizing multi-tiered security threats in blockchain systems

Blockchain technology, the backbone of digital cryptocurrencies, has rapidly ascended as a pivotal tool in modern commerce due to its decentralized, immutable nature. It offers fresh, innovative avenues for overcoming trust issues inherent in traditional trading systems. Yet, the unique traits that make blockchain advantageous also render it vulnerable. Cybercriminals are ceaselessly innovating, devising new tactics to exploit these vulnerabilities and resulting in a surge of security incidents that have led to substantial economic losses. The increasing frequency and sophistication of these attacks jeopardize the integrity and stability of blockchain networks. This paper offers a comprehensive study of blockchain system architecture, the principles underlying various attack methods, and viable defense strategies, all organized within a hierarchical framework. Initially, the paper categorizes blockchain attacks according to the hierarchy of blockchain systems, providing a detailed exploration of the characteristics and principles behind these attacks at each level. Next, the paper summarizes existing countermeasures and proposes effective new strategies for bolstering blockchain security. The paper concludes with a recap of its key findings and outlines the landscape for future research in blockchain security.

Adversarial Camera Patch: An Effective and Robust Physical-World Attack on Object Detectors

Physical adversarial attacks present a novel and growing challenge in cybersecurity, especially for systems reliant on physical inputs for Deep Neural Networks (DNNs), such as those found in Internet of Things (IoT) devices. They are vulnerable to physical adversarial attacks where real-world objects or environments are manipulated to mislead DNNs, thereby threatening the operational integrity and security of IoT devices. The camera-based attacks are one of the most practical adversarial attacks, which are easy to implement and more robust than all the other attack methods, and pose a big threat to the security of IoT. This paper proposes Adversarial Camera Patch (ADCP), a novel approach that employs a single-camera patch to launch robust physical adversarial attacks against object detectors. ADCP optimizes the physical parameters of the camera patch using Particle Swarm Optimization (PSO) to identify the most adversarial configuration. The optimized camera patch is then attached to the lens to generate stealthy and robust adversarial samples physically. The effectiveness of the proposed approach is validated through ablation experiments in a digital environment, with experimental results demonstrating its effectiveness even under worst-case scenarios (minimal width, maximum transparency). Notably, ADCP exhibits higher robustness in both digital and physical domains compared to the baseline. Given the simplicity, robustness, and stealthiness of ADCP, we advocate for attention towards the ADCP framework as it offers a means to achieve streamlined, robust, and stealthy physical attacks. Our adversarial attacks pose new challenges and requirements for cybersecurity.

Past and Present Russian Information Operations in Ukraine: Competition into Conflict

Sovereign nation-states seek to ensure the survival and advancement of national goals through cooperation, competition, and conflict. This paper explores the use of irregular warfare prior to and during the transition from competition to conflict as an international tool to assert control over public narratives. This stratagem has been made an increasingly effective tool through means of the Internet. Informational warfare is not a new concept, however, the precedent of operations in the information environment in concert with operations in the physical realm have started to take shape in the struggle between Ukraine and Russia over the past several decades. The visualization of the competition continuum model allows us to examine events and understand how actions taken in the cyber realm effect an informational narrative, and not simply be portrayed as a method of simple attack and defense.

Stealing complex network attack detection method considering security situation awareness.

Tracking and detection have brought great challenges to network security. Therefore, this paper proposes a monitoring method of stealthy complex network attacks considering security situation awareness. By constructing a tracking model of invisible complex network attacks, public monitoring nodes are selected for monitoring. The cost of a single monitoring node is calculated by the algorithm, and the monitoring node is determined by the monitoring node algorithm, so as to reduce the resource occupancy rate of the monitoring node and improve the monitoring accuracy. The simulation results show that this method is stable in the range of 1000 to 4000 nodes, and can effectively monitor the complex network attacks of stealing secrets.

Towards Attack Detection in Multimodal Cyber-Physical Systems with Sticky HDP-HMM based Time Series Analysis

Automatic detection of the precise occurrence and duration of an attack reflected in time-series logs generated by cyber-physical systems is a challenging problem. This problem is exacerbated when performing this analysis using logs with limited system information. In a realistic scenario, multiple and differing attack methods may be employed in rapid succession. Modern or legacy systems operate in multiple modes and contain multiple devices recording a variety of continuous and categorical data streams. This work presents a non-parametric Bayesian framework that addresses these challenges using the sticky Hierarchical Dirichlet Process Hidden Markov Model (sHDP-HMM) . Additionally, we explore metrics for measuring the accuracy of the detected events, their timings and durations, and compare the computational efficiency of different inference implementations of the model. The efficacy of attack detection is demonstrated in two settings: an avionics testbed and a consumer robot.

Adversarial attacks on video quality assessment models

Most currently developed video quality assessment (VQA) algorithms have achieved excellent performance by using deep neural network (DNN). However, DNN is vulnerable to adversarial attacks, as an efficient surrogate for validating the model robustness, and there lack adversarial attack methods against VQA models. To this end, we propose a spatiotemporal attack network to generate adversarial examples for evaluating the robustness of VQA models that contains a spatial subnetwork and a temporal subnetwork. The proposed network, dubbed the Space-Time Quality Attack Network (STQA-Net1), first computes the just noticeable difference (JND) maps of a video sequence as the input of the spatial subnetwork. The spatial subnetwork encodes the computed maps as spatial features and feeds the spatial features to the temporal subnetwork. Then, the spatial features are fused with the output of the temporal subnetwork and the fused features are decoded as attack weight maps. A visual constraint is used to control the visibility of perturbations and guide the generation of perturbation maps by multiplying JND maps with attack weight maps. Finally, the generated perturbation maps are added to the original video to form an adversarial example. Further, we also try to design a two-branch network to generate two opposite examples in a targeted attack scenario. The proposed attack methods against six state-of-the-art VQA algorithms are thoroughly tested on three VQA databases. The experimental results show that the proposed attack methods are very effective for testing the robustness of VQA models.

MEFF – A model ensemble feature fusion approach for tackling adversarial attacks in medical imaging

Adversarial attacks pose a significant threat to deep learning models, specifically medical images, as they can mislead models into making inaccurate predictions by introducing subtle distortions to the input data that are often imperceptible to humans. Although adversarial training is a common technique used to mitigate these attacks on medical images, it lacks the flexibility to address new attack methods and effectively improve feature representation. This paper introduces a novel Model Ensemble Feature Fusion (MEFF) designed to combat adversarial attacks in medical image applications. The proposed model employs feature fusion by combining features extracted from different DL models and then trains Machine Learning classifiers using the fused features. It uses a concatenation method to merge the extracted features, forming a more comprehensive representation and enhancing the model's ability to classify classes accurately. Our experimental study has performed a comprehensive evaluation of MEFF, considering several challenging scenarios, including 2D and 3D images, greyscale and colour images, binary classification, and multi-label classification. The reported results demonstrate the robustness of using MEFF against different types of adversarial attacks across six distinct medical image applications. A key advantage of MEFF is its capability to incorporate a wide range of adversarial attacks without the need to train from scratch. Therefore, it contributes to developing a more diverse and robust defence strategy. More importantly, by leveraging feature fusion and ensemble modelling, MEFF enhances the resilience of DL models in the face of adversarial attacks, paving the way for improved robustness and reliability in medical image analysis.

Anti-attack algorithm of cloud storage attribute base based on dynamic authorized access

Cloud storage attribute libraries usually store a large amount of sensitive data such as personal information and trade secrets. Attackers adopt diverse and complex attack methods to target the cloud storage attribute database, which makes the defense work more challenging. In order to realize the secure storage of information, an attribute based cloud storage anti-attack algorithm based on dynamic authorization access is proposed. According to the characteristic variables of the sample, the data correlation matrix is calculated, and the principal component analysis method is adopted to reduce the dimension of the data, build the anti-attack code model, simulate the dynamic authorization access rights, and calculate the packet loss rate according to the anti-attack flow. Design the initialization stage, cluster stage and cluster center update stage to realize the attack prevention of cloud storage attribute database. The experimental results show that the proposed algorithm can accurately classify the anti-attack code, has good packet processing ability, relatively short page request time, and anti-attack success rate is higher than 90%, which can effectively ensure the stability of the algorithm.

Fed-MPS: Federated learning with local differential privacy using model parameter selection for resource-constrained CPS

In Cyber-Physical Systems (CPS), distributed learning is essential for efficiently handling complex tasks when sufficient resources are available. However, when resources are limited, traditional distributed learning struggles to complete even simple tasks and presents a risk of privacy leakage. As a promising distributed learning paradigm, federated learning only requires the client to send the trained model to the server instead of private data, thereby preserving the client’s privacy to some extent. However, with the rapid development of artificial intelligence technology, attack methods such as inference attacks still cause privacy leakage for clients participating in federated learning. Moreover, due to its distributed learning nature, federated learning cannot escape the dilemma of model accuracy being constrained by resources. To address the aforementioned problems, this paper proposes a Federated local differential privacy scheme using Model Parameter Selection, named Fed-MPS, for resource-constrained CPS. Specifically, to resolve the issue of limited CPS resources, Fed-MPS adopts an update direction consistency-based parameter selection algorithm in federated learning to extract parameters that enhance model accuracy for subsequent training, thereby improving the final model accuracy and reducing communication overhead. Furthermore, Fed-MPS applies the local differential privacy mechanism to further enhance clients’ privacy. By adding noise only to the chosen parameters, the privacy budget is significantly reduced while ensuring model accuracy. Through privacy analysis, we prove that the proposed Fed-MPS scheme satisfies (ϵ,δ)−DP. Additionally, convergence analysis guarantees that Fed-MPS will converge to the global optimum with a convergence ratio of O(1T2) within T rounds of federated learning. Extensive experiments on prominent benchmark datasets Cifar10, Mnist, and FashionMNIST demonstrate that, compared with baseline schemes, the proposed Fed-MPS provides higher model accuracy for CPS under resource constraints.

Attack as Detection: Using Adversarial Attack Methods to Detect Abnormal Examples

As a new programming paradigm, deep learning (DL) has achieved impressive performance in areas such as image processing and speech recognition, and has expanded its application to solve many real-world problems. However, neural networks and DL are normally black-box systems; even worse, DL-based software are vulnerable to threats from abnormal examples, such as adversarial and backdoored examples constructed by attackers with malicious intentions as well as unintentionally mislabeled samples. Therefore, it is important and urgent to detect such abnormal examples. Although various detection approaches have been proposed respectively addressing some specific types of abnormal examples, they suffer from some limitations; until today, this problem is still of considerable interest. In this work, we first propose a novel characterization to distinguish abnormal examples from normal ones based on the observation that abnormal examples have significantly different (adversarial) robustness from normal ones. We systemically analyze those three different types of abnormal samples in terms of robustness and find that they have different characteristics from normal ones. As robustness measurement is computationally expensive and hence can be challenging to scale to large networks, we then propose to effectively and efficiently measure robustness of an input sample using the cost of adversarially attacking the input, which was originally proposed to test robustness of neural networks against adversarial examples. Next, we propose a novel detection method, named attack as detection (A 2 D for short), which uses the cost of adversarially attacking an input instead of robustness to check if it is abnormal. Our detection method is generic, and various adversarial attack methods could be leveraged. Extensive experiments show that A 2 D is more effective than recent promising approaches that were proposed to detect only one specific type of abnormal examples. We also thoroughly discuss possible adaptive attack methods to our adversarial example detection method and show that A 2 D is still effective in defending carefully designed adaptive adversarial attack methods—for example, the attack success rate drops to 0% on CIFAR10.

Detecting Adversarial Examples Utilizing Pixel Value Diversity

In this article, we introduce two novel methods to detect adversarial examples utilizing pixel value diversity. First, we propose the concept of pixel value diversity (which reflects the spread of pixel values in an image) and two independent metrics (UPVR and RPVR) to assess the pixel value diversity separately. Then we propose two methods to detect adversarial examples based on the threshold method and Bayesian method respectively. Experimental results show that compared to an excellent prior method LID, our proposed methods achieve better performances in detecting adversarial examples. We also show the robustness of our proposed work against an adaptive attack method.

FDNet: Imperceptible backdoor attacks via frequency domain steganography and negative sampling

Backdoor attacks against Deep Neural Networks (DNNs) have surfaced as a substantial and concerning security challenge. These backdoor vulnerabilities in DNNs can be introduced by third-party sources through maliciously manipulated training data. Existing backdoor attacks are primarily built on perturbation trigger patterns in the spatial domain, which makes practical deployment arduous due to the ease of detection by inspectors. Moreover, shortcut learning renders the backdoor network less robust against defense methods. This work advances an effective and adaptable approach to backdoor attacks, situated in the frequency domain. This methodology involves the incorporation of specific natural perturbations within the frequency domain of images. Remarkably, these introduced triggers yield minimal alterations in the image’s semantic content, rendering them nearly imperceptible to human observers. To evade detection by machine-based defenders, we introduce a new training paradigm that incorporates negative sampling techniques. This approach compels the neural network to learn richer differences as trigger patterns. We evaluate our attacks on popular convolutional neural networks, visual transformers, and MLP-Mixer models as well as four standard datasets including MNIST, CIFAR-10, GTSRB, and ImageNet. Experimental results demonstrate that the trained networks can be successfully injected with backdoors. Our attack methods exhibit remarkable efficacy, achieving high attack success rates in both All-to-one (near 100% on all datasets) and All-to-all (over 90% except on ImageNet) scenarios and also demonstrate robustness against contemporary state-of-the-art defense mechanisms. Furthermore, our work reveals that DNNs can capture discrepancies in the frequency components of images that are barely perceptible to humans.

EAP: An effective black-box impersonation adversarial patch attack method on face recognition in the physical world

Face recognition models and systems based on deep neural networks are vulnerable to adversarial examples. However, existing attacks on face recognition are either impractical or ineffective for black-box impersonation attacks in the physical world. In this paper, we propose EAP, an effective black-box impersonation attack method on face recognition in the physical world. EAP generates adversarial patches that can be printed by mobile and compact printers and attached to the source face to fool face recognition models and systems. To improve the transferability of adversarial patches, our approach incorporates random similarity transformations and image pyramid strategies, increasing input diversity. Furthermore, we introduce a meta-ensemble attack strategy that harnesses multiple pre-trained face models to extract common gradient features. We evaluate the effectiveness of EAP on two face datasets, using 16 state-of-the-art face recognition backbones, 9 heads, and 5 commercial systems. Moreover, we conduct physical experiments to substantiate its practicality. Our results demonstrate that EAP is capable of effectively executing impersonation attacks against state-of-the-art face recognition models and systems in both digital and physical environments.

Cyber Attack Detection

Cyber attack detection is a critical component of modern cybersecurity strategies. With the ever-increasing sophistication of cyber threats the need for robust and efficient detection mechanisms has become paramount. This abstract introduces the concept of cyber attack detection and its significance in safeguarding digital assets. It emphasizes the constant evolution of attack methods, necessitating adaptive and intelligent detection systems. The abstract highlights the importance of real-time monitoring, anomaly detection and behavioral analysis as key techniques in identifying cyber threats. It also underscores the role of machine learning in enhancing the accuracy and speed of detection. In conclusion, cyber attack detection is an indispensable aspect of cybersecurity playing a pivotal role in preventing data breaches ensuring data integrity and preserving the trust of digital ecosystems.

Enhancing CT Segmentation Security against Adversarial Attack: Most Activated Filter Approach

This study introduces a deep-learning-based framework for detecting adversarial attacks in CT image segmentation within medical imaging. The proposed methodology includes analyzing features from various layers, particularly focusing on the first layer, and utilizing a convolutional layer-based model with specialized training. The framework is engineered to differentiate between tampered adversarial samples and authentic or noise-altered images, focusing on attack methods predominantly utilized in the medical sector. A significant aspect of the approach is employing a random forest algorithm as a binary classifier to detect attacks. This method has shown efficacy in identifying genuine samples and reducing false positives due to Gaussian noise. The contributions of this work include robust attack detection, layer-specific feature analysis, comprehensive evaluations, physician-friendly visualizations, and distinguishing between adversarial attacks and noise. This research enhances the security and reliability of CT image analysis in diagnostics.

Generalizable Black-Box Adversarial Attack With Meta Learning.

In the scenario of black-box adversarial attack, the target model's parameters are unknown, and the attacker aims to find a successful adversarial perturbation based on query feedback under a query budget. Due to the limited feedback information, existing query-based black-box attack methods often require many queries for attacking each benign example. To reduce query cost, we propose to utilize the feedback information across historical attacks, dubbed example-level adversarial transferability. Specifically, by treating the attack on each benign example as one task, we develop a meta-learning framework by training a meta generator to produce perturbations conditioned on benign examples. When attacking a new benign example, the meta generator can be quickly fine-tuned based on the feedback information of the new task as well as a few historical attacks to produce effective perturbations. Moreover, since the meta-train procedure consumes many queries to learn a generalizable generator, we utilize model-level adversarial transferability to train the meta generator on a white-box surrogate model, then transfer it to help the attack against the target model. The proposed framework with the two types of adversarial transferability can be naturally combined with any off-the-shelf query-based attack methods to boost their performance, which is verified by extensive experiments. The source code is available at https://github.com/SCLBD/MCG-Blackbox.

Adversarial Patch Attack Method for Vehicle Target Detection

Due to the susceptibility of intelligent recognition systems to adversarial sample attacks, research on adversarial sample attack methods for target detection is of great significance for improving the safety of vehicle autonomous driving. By studying the transfer-based self-ensemble attack adversarial sample generation algorithm, and based on the trained Faster R-CNN and YOLOX white box target detectors, a cross-model and cross-instance vehicle target detection attack method was designed. Through training, a universal adversarial patch was obtained, which achieved recognition attacks on two types of target detectors and three types of vehicles, resulting in incorrect recognition results being output. Through testing, the average decrease in mAP was about 41.6%, The research results have certain reference significance for the study of autonomous driving safety.

Attacks on Machine Learning Models Based on the PyTorch Framework

This research delves into the cybersecurity implications of neural network training in cloud-based services. Despite their recognition for solving IT problems, the resource-intensive nature of neural network training poses challenges, leading to increased reliance on cloud services. However, this dependence introduces new cybersecurity risks. The study focuses on a novel attack method exploiting neural network weights to discreetly distribute hidden malware. It explores seven embedding methods and four trigger types for malware activation. Additionally, the paper introduces an open-source framework automating code injection into neural network weight parameters, allowing researchers to investigate and counteract this emerging attack vector.

Exploring Public Data Vulnerabilities in Semi-Supervised Learning Models through Gray-box Adversarial Attack

Semi-supervised learning (SSL) models, integrating labeled and unlabeled data, have gained prominence in vision-based tasks, yet their susceptibility to adversarial attacks remains underexplored. This paper unveils the vulnerability of SSL models to gray-box adversarial attacks—a scenario where the attacker has partial knowledge of the model. We introduce an efficient attack method, Gray-box Adversarial Attack on Semi-supervised learning (GAAS), which exploits the dependency of SSL models on publicly available labeled data. Our analysis demonstrates that even with limited knowledge, GAAS can significantly undermine the integrity of SSL models across various tasks, including image classification, object detection, and semantic segmentation, with minimal access to labeled data. Through extensive experiments, we exhibit the effectiveness of GAAS, comparing it to white-box attack scenarios and underscoring the critical need for robust defense mechanisms. Our findings highlight the potential risks of relying on public datasets for SSL model training and advocate for the integration of adversarial training and other defense strategies to safeguard against such vulnerabilities.

FlexibleFL: Mitigating poisoning attacks with contributions in cloud-edge federated learning systems

Cloud-edge architecture is an emerging technology that aims to meet the growing demands of intelligent applications. To address the issues of machine learning privacy leakages and benefiting from imbalanced data distribution, federated learning has been widely applied. Nevertheless, they present inherent vulnerabilities that make them vulnerable to poisoning attacks. Existing defense techniques are largely attack-rigid: they are designed to recognize client properties or model updates directly, aimed at specific attack scenarios or rules, but may not work well for critical feature patterns or flexible attack methods, mainly due to the potential influence of redundant features and model performance on defense. Yet few flexible defense methods have been developed. In this paper, we propose FlexibleFL, a flexible defense method against poisoning attacks in cloud-edge federated learning system (CEFL). The key idea of FlexibleFL is to evaluate the quality of uploaded model parameters and further determine the contribution of participants through an optimal threshold selection strategy. Based on these differences, FlexibleFL can thus implement penalties to potential attackers in a way that involves assigning the updated federated model. Extensive results demonstrate that our method has significant advantages in countering poisoning attacks in IID and Non-IID scenarios, and can effectively protect CEFL systems.