Mitigate Cyber Attacks Research Articles

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

With the increased frequency and intensity of denial-of-service (DoS) attacks on critical cloud-hosted services, resource adaptation schemes adopted by the cloud service providers (CSPs) need to be intelligent. Specifically, they need to be adaptable to attack behavior and be dynamic to curb resource over-utilization. The concept of moving target defense (MTD) has recently emerged as an effective and agile defense mechanism against DoS attacks that particularly target cloud-hosted applications. However, the existing surveys that seek to explore this space either focus more on MTD for generic cyberattack mitigation or on DoS attack defense on cloud systems. In this survey, we particularly provide an in-depth analysis on how MTD can help recover critical cloud assets in the face of DoS attacks and how emerging programmable technologies such as software-defined networking (SDN) can be leveraged to achieve that goal. Unlike existing surveys, we categorize DoS attacks on cloud platforms based on their working mechanism. We also discuss the non-MTD-based DoS defense strategies for both cloud and non-cloud infrastructures in order to highlight the pros and cons of MTD-based strategies. We introduce MTD working mechanisms and present how existing research is envisioning MTD’s application in mitigating DoS attacks, both with and without SDN. We also take an in-depth look at the testbed implementations and resilience and performance evaluations of MTD approaches. Finally, we articulate the existing challenges in MTD for DoS mitigation in cloud systems and how these challenges are shaping the future research in this domain.

Cybersecurity decision support model to designing information technology security system based on risk analysis and cybersecurity framework

The proposed work was a recommendation model for designing cyber security decision support, in building an information technology security system based on risk analysis and the ISO/IEC 27001 cybersecurity framework. The proposed model aimed to obtain the best security system in mitigating security threats. This paper contributed to strategic policymakers in designing cyber security decision support recommendations to determine the best steps in designing information technology security systems. The model built can map the priority value of threat mitigation based on the relative threat score against the relative evaluation score of the implementation of ISO/IEC 27001 compliance. The mitigation priority value is the key in determining priority recommendations for building an information technology security system based on the ISO/IEC 27001 framework. Furthermore, the results implementation of information technology security system recommendations is tested by carrying out security attacks directly on the system being built. The work ends by conducting a statistical evaluation of the system built based on the recommendations of the information technology security system. The results achieved indicate an increase in the average value of the evaluation of ISO/IEC 27001 compliance from 36.27 to 82.37 with the p-value of Paired T-Test being 0.002138 < 0.05, meaning that there is a significant influence between threats to information technology security systems that implement and do not apply the recommendations of information technology security systems to the ISO/IEC 27001 compliance evaluation index value. Furthermore, based on 12 types of threat samples, it shows a decrease in the average threat criticality level from 8.75 to 4.00 with the p-value of the chi-square test being 0.0006605 < 0.05 and Fisher Test's p-value is 0.000008284 < 0.05, meaning that there is an association relationship between threats to information technology security systems that apply recommendations and do not apply recommendations to the criticality level of information technology security threats. While the results of the evaluation of the relationship between the implementation of security system recommendations on cybersecurity attack mitigation showed an increase in the effectiveness of cyber-attack mitigation from an average rating of 18.32 to 40.74 with the p-value of the chi-square test being 0.000005221 < 0.05 and the Fisher Test being 0.00000005658 < 0.05 means that there is an association relationship between systems that implement and do not implement recommendations based on ISO/IEC 27001 for cybersecurity attack mitigation.

CRUSOE: A toolset for cyber situational awareness and decision support in incident handling

The growing size and complexity of today’s computer network make it hard to achieve and maintain so-called cyber situational awareness, i.e., the ability to perceive and comprehend the cyber environment and be able to project the situation in the near future. Namely, the personnel of cybersecurity incident response teams or security operation centers should be aware of the security situation in the network to effectively prevent or mitigate cyber attacks and avoid mistakes in the process. In this paper, we present a toolset for achieving cyber situational awareness in a large and heterogeneous environment. Our goal is to support cybersecurity teams in iterating through the OODA loop (Observe, Orient, Decide, Act). We designed tools to help the operator make informed decisions in incident handling and response for each phase of the cycle. The Observe phase builds on common tools for active and passive network monitoring and vulnerability assessment. In the Orient phase, the data on the network are structured and presented in a comprehensible and visually appealing manner. The Decide phase opens opportunities for decision-support systems, in our case, a recommender system that suggests the most resilient configuration of the critical infrastructure. Finally, the Act phase is supported by a service that orchestrates network security tools and allows for prompt mitigation actions. Finally, we present lessons learned from the deployment of the toolset in the campus network and the results of a user evaluation study.

ANALISE DE DESEMPENHO EM ALGORITMOS DE APRENDIZAGEM DE MAQUINA NA DETECCAO DE INTRUSAO BASEADA EM FLUXO DE REDE USANDO O CONJUNTO DE DADOS UNSW-NB15

This work aims to research and analyze network flow intrusiondetection using seven machine learning algorithms.A classic offline literature database (UNSW-NB15) was usedfor the computer simulation. In general, the algorithms obtainedsatisfactory results regarding the values of the metricsused and the computational time spent, contributing tothe mitigation of cyberattacks on computer networks, whoserelevance is essential for the security of computer systems.

Quantum web of trust

AbstractAuthentication is the foremost requirement for any online secure transaction. In post quantum era, public key encryption is considered no longer a safe option. The research is therefore, progressing toward providing a quantum resistant solution using both classical as well as quantum computing medium. The paper proposes a quantum based mutual authentication protocol for autonomous system, utilizing the properties of quantum mechanics for exchange, storage and validation of confidential data. The protocol so designed evolves into a chain of mutually trusted nodes to form quantum web of trust. The protocol cater for devices infected with malware by utilizing physically unclonable function inside trusted platform module. The mathematical expressions conveying the correctness of operations has been demonstrated on a quantum machine to verify the efficacy of the protocol. The security analysis demonstrates the ability of the proposed protocol to mitigate cyber attacks and eavesdropping in the network.

A Cyber Attack Mitigation Scheme for Series Compensated DFIG-Based Wind Parks

Subsynchronous Interaction (SSI) phenomenon is known to be one of the most frequent and severe stability issues of a Wind Park (WP), and can potentially lead to a significant loss of power generation. The broad impacts of this phenomenon on a power grid have made WPs interesting targets for cyber attacks. To initiate the SSI, an adversary can target either the power grid (external attacks) or the cyber system of WPs (internal attacks). This paper proposes a mitigation scheme for attacks that initiate the SSI phenomenon in series compensated doubly-fed induction generator (DFIG)-based WPs. External attacks are addressed by employing a robust static-output-feedback Subsynchronous Damping Controller (SSDC), which is designed based on the insensitive strip region and Linear Matrix Inequality (LMI) techniques. Internal attacks, however, are detected by comparing the estimated and measured converters’ currents. Once the compromised measurements are detected, the designed SSDC is restructured to mitigate the attacks. The effectiveness of the proposed method is demonstrated using detailed Electromagnetic Transient (EMT) simulations for both internal and external cyber attacks. Additionally, the performance of the proposed method is corroborated using a real-time co-simulation framework.

A machine-learning approach for identification and mitigation of cyberattacks in networked process control systems

The robustness of process control systems to cyberattacks has become an increasingly important topic, especially in light of the increased dependence of process operations on networked control system architectures wherein dedicated sensor-controller and controller-actuator links are replaced by real-time, wired or wireless, shared communication networks. To mitigate the risks of cyberattacks, we propose in this work an integrated model-based framework for the detection, estimation and mitigation of false data injection cyberattacks in nonlinear networked process systems. The framework leverages a classification-based neural network scheme for attack detection and estimation, coupled with a stability-based attack mitigation strategy based on a model-based controller design. An illustrative chemical process example is used to demonstrate the effectiveness of the proposed framework and assess its robustness with respect to possible attack detection and estimation errors.

Trilevel smart meter hardening strategy for mitigating cyber attacks against Volt/VAR optimization in smart power distribution systems

Smart meter data are crucial information for applications in distribution management system (DMS) to manage the distribution system in a reliable and secure manner. However, the smart meter can be attacked by an adversary through the injection of false data into smart meters. This cyber attack can lead to malfunction of the applications that use smart meter data, thereby yielding an abnormal distribution system operation. This paper presents a multilevel optimization-based smart meter hardening strategy where a defender can mitigate the detrimental impact of cyber attacks on volt/VAR optimization (VVO) in DMS via the manipulation of smart meter data. A trilevel defender–attacker–defender (DAD) model with limited attack and defense resources is proposed to determine an optimal attack mitigation strategy. The proposed DAD model aims to identify smart meters that must be hardened from the VVO attack (upper level) while considering both the worst-case attack against the VVO (middle level) and the VVO during the attack (lower level). A nested column-and-constraint generation algorithm is applied to the DAD model to identify and prioritize the most essential smart meters that should be hardened to mitigate the impact of the VVO attack. An IEEE 33-node distribution feeder was used to quantify the performance of the proposed mitigation framework in terms of voltage deviation, solar photovoltaic (PV) penetration level, attack/defense resources, and computational complexity. The simulation results show that mean percentage errors for voltage deviation of the attack and the defense are calculated as 22.02% and 6.22%, respectively.

Comparing and Analyzing Applications of Intelligent Techniques in Cyberattack Detection

Now a day’s advancement in technology increases the use of automation, mobility, smart devices, and application over the Internet that can create serious problems for protection and the privacy of digital data and raised the global security issues. Therefore, the necessity of intelligent systems or techniques can prevent and protect the data over the network. Cyberattack is the most prominent problem of cybersecurity and now a challenging area of research for scientists and researchers. These attacks may destroy data, system, and resources and sometimes may damage the whole network. Previously numerous traditional techniques were used for the detection and mitigation of cyberattack, but the techniques are not efficient for new attacks. Today’s machine learning and metaheuristic techniques are popularly applied in different areas to achieve efficient computation and fast processing of complex data of the network. This paper is discussing the improvements and enhancement of security models, frameworks for the detection of cyberattacks, and prevention by using different machine learning and optimization techniques in the domain of cybersecurity. This paper is focused on the literature of different metaheuristic algorithms for optimal feature selection and machine learning techniques for the classification of attacks, and some of the prominent algorithms such as GA, evolutionary, PSO, machine learning, and others are discussed in detail. This study provides descriptions and tutorials that can be referred from various literature citations, references, or latest research papers. The techniques discussed are efficiently applied with high performance for detection, mitigation, and identification of cyberattacks and provide a security mechanism over the network. Hence, this survey presents the description of various existing intelligent techniques, attack datasets, different observations, and comparative studies in detail.

A Descriptive Study on Cybersecurity Challenges of Working from Home during COVID-19 Pandemic and a Proposed 8 step WFH Cyber-attack Mitigation Plan

Organizations struggle to strike the right balance between flexibility and security for remote work. With the major portion of the workforce in every country working from home during the covid-19 pandemic, employers might not have accounted for this scale of load on their IT infrastructure, not to mention their cybersecurity preparedness.

High-Order Observer-Based Sliding Mode Control for the Isolated Microgrid with Cyber Attacks and Physical Uncertainties

System security is essential for the operation of the island microgrid. However, the system security is generally threatened due to the presence of physical uncertainties and cyber attacks. In this article, a novel sliding mode load control strategy is proposed for the microgrid to mitigate cyber attacks and physical uncertainties. Firstly, a high-order disturbance observer (HODO) is designed to estimate the unmeasurable factors in the microgrid. Secondly, a HODO-based sliding mode control (SMC) strategy is proposed where the estimated value observed by the HODO is applied to the sliding mode surface and control law. It can better guarantee the security of the isolated microgrid. Then, the stability of the HODO-based SMC is demonstrated by Lyapunov stability theory. Finally, simulation results show that the proposed control strategy has excellent control performance.

An intelligent recommendation algorithm for red team strategy in edge computing powered massive Cyber Defense Exercise

The recent surge in the frequency and seriousness of cyber attacks is alarming and poses a critical threat against the stability of our society. Previously, most effort to mitigate cyber attacks has focused on the technical countermeasures. However, a number of recent cyber attacks showed the necessity of constantly offering proper massive Cyber Defense eXercise (CDX) to the workforce in a timely manner. In order to meet the ever growing demand, the most recent massive CDX platform utilizes various edge computing concepts to locally manage the overhead related to the trainees (blue team members) in real time unlike the traditional centralized CDX platform. So far, such massive CDX platform cannot be fully operational without sufficient number of qualified trainers (red team members) who have strong expertise in cyber offense and are willing to participate the CDX. Unfortunately, securing enough number of such red team members is greatly challenging in practice. To address this issue, this paper introduces an intelligent recommendation algorithm for the red team in a massive CDX so that such massive CDX can be organized without enough number of red team members with a strong expertise in cyber offense. Given a known attack graph for each cyber defense training module, we formally define the problem of identifying a subgraph including a victorious strategy for the red team as the victory subgraph computation problem. Then, we introduce a new algorithm to solve this problem as well as a new strategy to obtain a winning strategy for the offense team to assist such red team members. Besides, we also discuss about various approach to utilize our result to organize massive CDXs in an efficient manner.

Multi-agent-based hierarchical detection and mitigation of cyber attacks in power systems

This paper proposes a multi-agent-based hierarchical detection and mitigation (MHDM) scheme for power systems against physical faults and cyber attacks. The MHDM scheme is designed based on rule-based abnormal detection with a hierarchical structure managed by three-level agents according to the information of each layer. Lower-level and middle-level agents utilize physical measurement, cyber information and the characteristics of physical faults to detect various faults and cyber attacks, and upper-level agent takes advantage of the redundancy of wide-area data to verify the diagnosis results. Through the collaboration of agents at all levels, the MHDM scheme can identify the operation state of the power system, and mitigate the impact of cyber attacks while distinguishing them from physical faults. Simulation studies are undertaken on a platform constructed by interconnecting the New England 39-bus system developed in MATLAB/SIMULINK and a three-level multi-agent system implemented in JADE. Simulation results demonstrate the effectiveness of the MHDM scheme.

An Event-Driven Resilient Control Strategy for DC Microgrids

Though recent advancements in dc microgrids are largely based on distributed control strategies to enhance reliability, their susceptibility to cyber attacks still remains a challenging issue. Additionally in converter-dominated dc microgrids, mitigation of cyber attacks upon detection in a timely manner is the need of the hour to prevent the system from immediate shutdown. Since most of the existing research is primarily focused on the detection of cyber attacks in dc microgrids without giving prior attention to comprehensive steps of mitigation, this article classifies cyber attacks as events and introduces an event-driven cyber attack resilient strategy for dc microgrids, which immediately replaces the attacked signal with a trusted event-driven signal constructed using True transmitted measurements. This mechanism not only disengages the attack element from the control system, but also replaces it with an event-triggered estimated value to encompass normal consensus operation during both steady state as well as transient conditions even in the presence of attacks. Finally, the event detection criteria and its sensitivity are theoretically verified and validated using simulation and experimental conditions in the presence of both stealth voltage and current attacks.

Detection and Mitigation of Cyber Attacks on Voltage Stability Monitoring of Smart Grids

This paper investigates the possible cyber-physical attacks on voltage stability monitoring of a power transmission system. By considering a smart adversary that can launch a vector attack based on power flow equations, conventional voltage stability monitoring systems based on voltage stability indexes will fail to detect the instability issue. This can mislead the Power System Operator (PSO) to take inappropriate corrective action. In order to prevent and to combat such a malicious attack, a new indicator for efficient intrusion detection and a novel mitigation algorithm is proposed. This proposed detection algorithm employs the multi-port equivalent circuit of the power system to calculate the Thevenin Equivalent (TE) parameters. These TE parameters are then used to calculate an indicator, which reveals the attack on Phasor Measurement Unit (PMU) data. The proposed mitigation scheme then helps PSO to detect which PMU is under-attack. Furthermore, the amount of injected attack vectors is computed or estimated depending on the number of compromised PMUs. The effectiveness of the proposed techniques is demonstrated via illustrative case studies.

Analysis for the Evaluation and Security Management of a Database in a Public Organization to Mitigate Cyber Attacks

In data handling, security and privacy are essential for database administrators and users that own their information. Information about security models or architectures was analyzed for databases that minimize Cyber Attacks. The problem is that security models deployed in databases in public organizations suffer from computer attacks due to vulnerabilities in their security management systems. Data providers often publish the information for research purposes, publishing compromises on the privacy of the data of users registered in the entities. There are many security techniques for databases based on data encryption processes in transactions, however, the techniques found compromise information. The development of the document used the deductive method and exploratory research technique that allows us to study the information in the articles presented. In this document we have proposed a Security Model Assessment Prototype for Databases, a Prototype of Security Management Architecture in Blockchain for a Database, a Database Security Algorithm, a Logical Structure of the Management System in Blockchain, and a Prototype to mitigate cyberattacks. The use of a hybrid blockchain model provides the system with the optimal security that public organizations in relation to test results performed with a 99.50% security effectiveness. The simulations presented in this document were conducted based on in-depth studies and the data were randomly placed with a range according to the study results based on real-world situations.

Detection and Mitigation of Cyber-Attacks on AGC Systems of Low Inertia Power Grid

Automatic generation control (AGC) plays a salient role in modern power systems by maintaining grid frequency within acceptable limits. Since AGC is the only automatic feedback loop between cyber and physical infrastructures, it is greatly vulnerable to malicious attacks and hence, required urgent investigations. Attackers can falsify the sensor measurements employed for AGC operation causing service outage and infrastructural damage. In this article, a method is developed to detect and mitigate possible cyber-attack schemes such as false data injection and denial-of-service attacks targeting the AGC systems. The proposed method is termed as cyber-attack detection and mitigation platform (CDMP) and utilizes the forecasted data of area control error for identification and mitigation of attacks. The CDMP strategy involves three stages for optimal operation and identifies any arbitrary false data injected to the grid. For the investigation, three area system with multiple generations and distribution companies under bilateral trading is considered. The test model is also equipped with inertia emulation technique supported by battery management system. It is because the modern power system is advancing toward inverter-dominated system from synchronous-based system due to high penetration of renewables. The effectiveness of the proposed strategy is verified using rigorous simulation results.

A cloud-edge based data security architecture for sharing and analysing cyber threat information

Cyber-attacks affect every aspect of our lives. These attacks have serious consequences, not only for cyber-security, but also for safety, as the cyber and physical worlds are increasingly linked. Providing effective cyber-security requires cooperation and collaboration among all the entities involved. Increasing the amount of cyber threat information (CTI) available for analysis allows better prediction, prevention and mitigation of cyber-attacks. However, organizations are deterred from sharing their CTI over concerns that sensitive and confidential information may be revealed to others. We address this concern by providing a flexible framework that allows the confidential sharing of CTI for analysis between collaborators. We propose a five-level trust model for a cloud-edge based data sharing infrastructure. The data owner can choose an appropriate trust level and CTI data sanitization approach, ranging from plain text, through anonymization/pseudonymization to homomorphic encryption, in order to manipulate the CTI data prior to sharing it for analysis. Furthermore, this sanitization can be performed by either an edge device or by the cloud service provider, depending upon the level of trust the organization has in the latter. We describe our trust model, our cloud-edge infrastructure, and its deployment model, which are designed to satisfy the broadest range of requirements for confidential CTI data sharing. Finally we briefly describe our implementation and the testing that has been carried out so far by four pilot projects that are validating our infrastructure.

Cyber Attack Resilient Distance Protection and Circuit Breaker Control for Digital Substations

This paper proposes new concepts for detecting and mitigating cyber attacks on substation automation systems by domain-based cyber–physical security solutions. The proposed methods form the basis of a distributed security domain layer that enables protection devices to collaboratively defend against cyber attacks at substations. The methods utilize protection coordination principles to cross check protection setting changes and can run real-time power system analysis to evaluate the impact of the control commands. The transient fault signature (TFS)-based cross-correlation coefficient algorithm has been proposed to detect the false sampled values data injection attack. The proposed functions were verified in a hardware-in-the-loop (HIL) simulation using commercial relays and a real-time digital simulator (RTDS). Various types of cyber intrusions are tested using this test bed to evaluate the consequences and impacts of cyber attacks to power grid as well as to validate the performance of the proposed research-grade cyber attack mitigation functions.

Mitigating cyber attacks through the measurement of non-IT professionals’ cybersecurity skills

PurposeUsers’ mistakes due to poor cybersecurity skills result in up to 95 per cent of cyber threats to organizations. Threats to organizational information systems continue to result in substantial financial and intellectual property losses. This paper aims to design, develop and empirically test a set of scenarios-based hands-on tasks to measure the cybersecurity skills of non-information technology (IT) professionals.Design/methodology/approachThis study was classified as developmental in nature and used a sequential qualitative and quantitative method to validate the reliability of the Cybersecurity Skills Index (CSI) as a prototype-benchmarking tool. Next, the prototype was used to empirically test the demonstrated observable hands-on skills level of 173 non-IT professionals.FindingsThe importance of skills and hands-on assessment appears applicable to cybersecurity skills of non-IT professionals. Therefore, by using an expert-validated set of cybersecurity skills and scenario-driven tasks, this study established and validated a set of hands-on tasks that measure observable cybersecurity skills of non-IT professionals without bias or the high-stakes risk to IT.Research limitations/implicationsData collection was limited to the southeastern USA and while the sample size of 173 non-IT professionals is valid, further studies are required to increase validation of the results and generalizability.Originality/valueThe validated and reliable CSI operationalized as a tool that measures the cybersecurity skills of non-IT professionals. This benchmarking tool could assist organizations with mitigating threats due to vulnerabilities and breaches caused by employees due to poor cybersecurity skills.