Multi-stage Attacks Research Articles

Simulation of multi-stage attack and defense mechanisms in smart grids

Simulation of multi-stage attack and defense mechanisms in smart grids

Мультиагентное тестирование на проникновение на основе AIRL

This paper explores the application of a multi-agent approach based on the Adversarial Inverse Reinforcement Learning (AIRL) method for penetration testing in information systems. Theoretical aspects of multi-agent AIRL are discussed, including the ability to model complex, multi-stage attacks, coordinate agent actions, and learn with partial observability, which accounts for limitations in information access. The practical application of this approach will demonstrate its effectiveness in identifying vulnerabilities, providing a deeper and more accurate security analysis.

AGCM: A multi-stage attack correlation and scenario reconstruction method based on graph aggregation

With an increase in the complexity and scale of networks, cybersecurity faces increasingly severe challenges. For instance, an attacker can combine individual attacks into complex multi-stage attacks to infiltrate targets. Traditional intrusion detection systems (IDS) generate large number of alerts during an attack, including attack clues along with many false positives. Furthermore, due to the complexity and changefulness of attacks, security analysts spend considerable time and effort on discovering attack paths. Existing methods rely on attack knowledgebases or predefined correlation rules but can only identify known attacks. To address these limitations, this paper presents an attack correlation and scenario reconstruction method. We transform the abnormal flows corresponding to the alerts into abnormal states relationship graph (ASR-graph) and automatically correlate attacks through graph aggregation and clustering. We also implemented an attack path search algorithm to mine attack paths and trace the attack process. This method does not rely on prior knowledge; thus, it can well adapt to the changed attack plan, making it effective in correlating unknown attacks and identifying attack paths. Evaluation results show that the proposed method has higher accuracy and effectiveness than existing methods.

Research on Network Security Situation Prediction Algorithm Combining Intuitionistic Fuzzy Sets and Deep Neural Networks

<div>The expansion of the internet has made everyone’s personal and professional lives more transparent. There are network security issues because people like sharing resources under the right conditions. Academics have demonstrated significant interest in situation awareness, which includes situation prediction, situation appraisal, and event detection, rather than focusing on the security of a single device in the network. Multi-stage attack forecasting and security situation awareness are two significant issues for network supervisors because the future usually is unknown. Hence, this study suggests combined intuitionistic fuzzy sets and deep neural network (CIFS-DNN) for network security situation prediction. The goal is to provide network administrators with a resource they can use as a point of reference while they formulate and carry out preventive actions in the event of a network assault. The job requires differentiating between the event of an assault and a typical instance, as well as differentiating between the various sorts of attacks and a typical case. In this article, we present a model that can more accurately and effectively forecast network security scenarios, and our experiments bear this out. The results show that the proposed technique is successful and exact in predicting network security issues. The suggested CIFS-DNN approach has a low delay rate of 10%, a low latency rate of 20%, a low error rate of 25%, a high prediction ratio of 98.6%, a high security rate of 98.3%, a high accuracy ratio of 99.6%, and a high efficiency ratio of 93.9%</div>

Anomaly based multi-stage attack detection method.

Multi-stage attacks are one of the most critical security threats in the current cyberspace. To accurately identify multi-stage attacks, this paper proposes an anomaly-based multi-stage attack detection method. It constructs a Multi-Stage Profile (MSP) by modeling the stable system's normal state to detect attack behaviors. Initially, the method employs Doc2Vec to vectorize alert messages generated by the intrusion detection systems (IDS), extracting profound inter-message correlations. Subsequently, Hidden Markov Models (HMM) are employed to model the normal system state, constructing an MSP, with relevant HMM parameters dynamically acquired via clustering algorithms. Finally, the detection of attacks is achieved by determining the anomaly threshold through the generation probability (GP). To evaluate the performance of the proposed method, experiments were conducted using three public datasets and compared with three advanced multi-stage attack detection methods. The experimental results demonstrate that our method achieves an accuracy of over 99% and precision of 100% in multi-stage attack detection. This confirms the effectiveness of our method in adapting to different attack scenarios and ultimately completing attack detection.

Robustness assessment of weakly coupled cyber-physical power systems under multi-stage attacks

Evaluating the robustness of cyber-physical system (CPS) under multi-stage attacks is fundamental to enhancing CPS resilience. Currently, many models inadequately consider information flow, which is not aligned with reality. The initial focus of this paper is on introducing a weakly coupled interdependent model for CPS. This model considers probabilistic line outage rules, cyber flow transmission characteristics, and the probabilities of inter-system coupling failures. Subsequently, the multi-stage attack strategies are presented and employed by the proposed model during disaster scenarios, along with the proposed robustness assessment indicators. The numerical results illustrate the robustness of the weakly-coupled CPS model under multi-stage attacks. This lays a modeling and simulation foundation for repair crew to enhance the CPS resilience.

PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks

The increase in scale of cyber networks and the rise in sophistication of cyber-attacks have introduced several challenges in intrusion detection. The primary challenge is the requirement to detect complex multi-stage attacks in realtime by processing the immense amount of traffic produced by present-day networks. In this paper we present PRISM, a hierarchical intrusion detection architecture that uses a novel attacker behavior model-based sampling technique to minimize the realtime traffic processing overhead. PRISM has a unique multi-layered architecture that monitors network traffic distributedly to provide efficiency in processing and modularity in design. PRISM employs a Hidden Markov Model-based prediction mechanism to identify multi-stage attacks and ascertain the attack progression for a proactive response. Furthermore, PRISM introduces a stream management procedure that rectifies the issue of alert reordering when collected from distributed alert reporting systems. To evaluate the performance of PRISM, multiple metrics have been proposed, and various experiments have been conducted on a multi-stage attack dataset. The results exhibit up to 7.5x improvement in processing overhead as compared to a standard centralized IDS without the loss of prediction accuracy while demonstrating the ability to predict different attack stages promptly.

Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack

In recent years, the growing threat of cyber attacks has made more researchers focus on the study of alert correlation and attack prediction. While numerous solutions have been proposed, the existing works still have some shortcomings. Without aggregation, previous approaches directly put the excessive and duplicate alerts into models, ignoring the internal logic between adjacent payloads, which we believe is a significant clue to distinguish different types of attacks. In this paper, we propose a similarity based aggregation algorithm to correlate and aggregate alerts, then train a Transformer based model to handle input with variable length and complete the attack prediction. Additionally, a threat estimation method as well as its practical application has been proposed to assess the predicted output. Experimental results demonstrate that our proposed framework has the capability to effectively aggregate alerts, predict different attack intelligence in good mode as well as assess how much threat the administrator would face in the near future.

A Detection and Response Architecture for Stealthy Attacks on Cyber-Physical Systems

There has been an increased reliance on interconnected Cyber-Physical Systems (CPS) applications. This reliance has caused tremendous growth in high assurance challenges. Due to the functional interdependence between the internal systems of CPS applications, the utilities' ability to reliably provide services could be disrupted if security threats are not addressed. To address this challenge, we propose a multi-level, multi-agent detection and response architecture built on the formalisms of Hidden Markov Models (HMM) and Markov Decision Processes (MDP). We have evaluated the performance of the proposed architecture on one of the critical smart grid applications, Advanced Metering Infrastructure (AMI). This paper utilizes a simulation tool called SecAMI for performance evaluation. A Stealthy attack scenario contains multiple distinct multi-stage attacks deployed concurrently in a network to compromise the system and stop several critical services in a CPS. The results show that the proposed architecture effectively detects and responds to stealthy attack scenarios against Cyber-Physical Systems. In particular, the simulation results show that the proposed system can preserve the availability of more than 93% of the AMI network under stealthy attacks. A future study may evaluate the effectiveness of various stealthy attack strategies and detection and response systems. The high availability of any AMI should be protected against new attack techniques. The proposed system will also determine a distributed IDS's efficient placement for intrusion detection sensors and response nodes within an AMI.

MAGD: Minimal Attack Graph Generation Dynamically in Cyber Security

Cyber security faces challenges in detecting and mitigating complex attacks. Security solutions have employed Attack Graphs (AGs) for modeling multi-stage attacks, but traditional AGs suffer from scalability issues and may miss new vulnerabilities and attack paths. Also, traditional AGs construct the graph using information about previously known attacks. In this paper, we propose Minimal Attack Graph Generation Dynamically (MAGD), which leverages data from a deception system based on Honeypots to generate a minimal AG dynamically. In this paper, the AG has been constructed from real-time attacker’s behavior data directly. In addition, MAGD specifically focuses on modeling the attacker’s behavior at the host level, in contrast to traditional network-based AGs that encompass all possible attack paths at the network level. MAGD contains three custom algorithms to construct attacker behavior, generate a minimal AG, and continuously update the graph with new attack information. Complexity analyses demonstrate that MAGD’s generation process can accomplish within polynomial time. Our approach offers several advantages over traditional AGs, including the ability to model attackers’ real-time behavior, construct attackers’ action paths in the target host, and detect new vulnerabilities and attack paths in the victim host. Also, MAGD includes information about the effects of the actions in the target system. This information can be used for other security purposes. We demonstrate MAGD’s efficacy through a case study. MAGD provides a more effective way to detect and mitigate cyber threats by utilizing Honeypot data and proposed algorithms.

Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs

Early attack detection is essential to ensure the security of complex networks, especially those in critical infrastructures. This is particularly crucial in networks with multi-stage attacks, where multiple nodes are connected to external sources, through which attacks could enter and quickly spread to other network elements. Bayesian attack graphs (BAGs) are powerful models for security risk assessment and mitigation in complex networks, which provide the probabilistic model of attackers’ behavior and attack progression in the network. Most attack detection techniques developed for BAGs rely on the assumption that network compromises will be detected through routine monitoring, which is unrealistic given the ever-growing complexity of threats. This paper derives the optimal minimum mean square error (MMSE) attack detection and monitoring policy for the most general form of BAGs. By exploiting the structure of BAGs and their partial and imperfect monitoring capacity, the proposed detection policy achieves the MMSE optimality possible only for linear-Gaussian state space models using Kalman filtering. An adaptive resource monitoring policy is also introduced for monitoring nodes if the expected predictive error exceeds a user-defined value. Exact and efficient matrix-form computations of the proposed policies are provided, and their high performance is demonstrated in terms of the accuracy of attack detection and the most efficient use of available resources using synthetic Bayesian attack graphs with different topologies.

Replay attack detection and mitigation for cyber–physical systems via RADIR algorithm with encryption scheduling

This paper investigates the security state estimation issue facing replay attacks in confidential cyber–physical systems. Smart sensor equipped with a power harvester transmits critical measurements to the remote estimator over wireless networks, in which the transmission modes include encrypted and normal. In order to complete the persistent threats, the adversary launches multi-stage discontinuous replay attacks to compromise the estimation process. In virtue of the designed label detection scheme, we transform attack detection into encryption scheduling optimization under the constraint of sensor energy harvesting and acquire a rigorous relationship between detection probability, attack duration, and encryption ratio. Different from most existing studies only focusing on attack detection, the localization of replay interval measured by detection immediacy is also analyzed. Subsequently, the optimal periodic encryption scheduling strategy is given to maximally determine the attack interval by adopting an optimization-based approach. Further, a complete algorithm of replay attack detection, isolation, and recovery (RADIR) is designed to minimize deterioration from multi-stage attacks, which can guarantee the estimated performance of the system as much as possible. Finally, the unmanned ground vehicle system is applied to validate the theoretical results, where the dataset of replay attacks is obtained by capturing the normal operation data of a moving vehicle. Also, we compare the optimal encryption strategy designed in this paper with general centralized and random scheduling strategies.

Attack scenario reconstruction via fusing heterogeneous threat intelligence

Nowadays, new-generation threats often use multiple means or perform several steps to intrude into networks and ultimately reach their objective. These new threats have multi-staged, and we can understand their intrusion pattern from the kill-chain defensive model. This paper focuses on fusing heterogeneous threat intelligence collected from security information and event management systems to reconstruct multi-step attack scenarios and discover critical attack paths. However, the need for an agreed-upon vocabulary to represent the heterogeneous threat intelligence makes it difficult to model the attack scenarios accurately and efficiently. Therefore, we devise a heterogeneous threat intelligence fusing approach for real-time reconstruction of the attack scenarios. Firstly, we use structured threat information expression (STIX) to format heterogeneous threat intelligence (TI). We analyze the causal relationship of each heterogeneous threat intelligence and piece them together. Then, we model the multi-stage attack scenario reconstruction as a community discovery problem. We mine the attack scenarios with semantic correlation weight and a community detection algorithm. We finally use the open-source benchmark datasets (DARPA 2000, CICIDS 2017) and the real Internet traffic captured from the China Education Research Network backbone (CERNET) to evaluate our work. Extensive results demonstrate that our proposal can accurately reconstruct multi-step attack scenarios and discover covert C&C channels.

Cyber-physical attack graphs (CPAGs): Composable and scalable attack graphs for cyber-physical systems

Attack graphs are a fundamental security tool focused on depicting how multi-stage attacks can be carried out through a network to compromise specific assets and systems. While attack graphs have been widely utilised in the IT cyber domain, their use in Operational Technology (OT) environments requires new approaches able to properly model and analyse Cyber-Physical Systems (CPS). In this paper, we introduce Cyber-Physical Attack Graphs (CPAGs) as a class of attack graphs able to cover both cyber and physical aspects. CPAGs aim at extending the reach of standard attack graphs to cyber-physical networks typically observed in industrial environments and critical infrastructure systems, analyse how an attacker can move within the network, and understand the impact that these actions may have on the system. We propose a constructive methodology to design CPAGs backed up by a formal rule-based approach that specifies how integral parts of the model can be generated and later composed to build more complex CPAGs. We then explore the semantics of CPAGs associated to cyber and physical attack actions as well as their impact on CPS environments. We also discuss potential CPAG-based analysis techniques and focus on risk analysis using Bayesian CPAGs. Finally, we show the application of the proposed model over a realistic scenario on smart farming using our open source tool T-CITY.

Phishing URL Detection using Machine Learning

Abstract: Phishing attacks continue to pose a major threat for computer system defenders, often forming the first step in a multistage attack. There have been great strides made in phishing detection; however,some phishing emails appear to pass through filters by making simple structural and semantic changes to the messages. We tackle this problem through the use of a machine learning classifier operating on a large corpus of phishing and legitimate emails. We design a system to extract features, elevating some to higherlevel feature, that are meant to defeat common phishing email detection strategies. This paper presents an approach to detect phishing URLs in an efficient way based on URL features only. For detecting the phishing URLs SVM classifier is used. The performances are evaluated for different size of datasets using different number of features. The results are compared with other machine learning classification techniques. The proposed system is able to detect phishing websites using URL features only.

Napadi na sajber bezbednost - koji skup podataka treba koristiti za evaluaciju sistema za detekciju upada?

Introduction: Analyzing the high-dimensional datasets used for intrusion detection becomes a challenge for researchers. This paper presents the most often used data sets. ADFA contains two data sets containing records from Linux/Unix. AWID is based on actual traces of normal and intrusion activity of an IEEE 802.11 Wi-Fi network. CAIDA collects data types in geographically and topologically diverse regions. In CIC-IDS2017, HTTP, HTTPS, FTP, SSH, and email protocols are examined. CSECIC-2018 includes abstract distribution models for applications, protocols, or lower-level network entities. DARPA contains data of network traffic. ISCX 2012 dataset has profiles on various multi-stage attacks and actual network traffic with background noise. KDD Cup '99 is a collection of data transfer from a virtual environment. Kyoto 2006+ contains records of real network traffic. It is used only for anomaly detection. NSL-KDD corrects flaws in the KDD Cup '99 caused by redundant and duplicate records. UNSW-NB-15 is derived from real normal data and the synthesized contemporary attack activities of the network traffic. Methods: This study uses both quantitative and qualitative techniques. The scientific references and publicly accessible information about given dataset are used. Results: Datasets are often simulated to meet objectives required by a particular organization. The number of real datasets are very small compared to simulated dataset. Anomaly detection is rarely used today. Conclusion: 95 The main characteristics and a comparative analysis of the data sets in terms of the date they were created, the size, the number of features, the traffic types, and the purpose are presented.

An end-to-end method for advanced persistent threats reconstruction in large-scale networks based on alert and log correlation

Nowadays, advanced persistent threats (APTs) compromise critical large-scale networks more frequently, however, detecting these APTs is difficult. Since security sensors often miss some key steps of APTs, a lot of missed alerts exist. Moreover, large-scale networks often generate thousands of repeated alerts every day. To address this issue, a novel method for APT reconstruction in large-scale networks is proposed for attack forensics and traceability in this paper. Additionally, the proposed method consumes low transmission cost, and it doesn't require raw data from terminal devices, which makes it more appropriate for large-scale networks with numerous terminal devices. Specifically, an alert reduction and correlation method is first designed to reduce the alert volume. Then, these alerts are transformed into an alert graph, and the key missed alerts are obtained by searching history alerts and logs using Monte Carlo Tree Search (MCTS), which fast assembles multi-stage attacks with high confidence. The evaluation results on the modified CSE-CIC-IDS-2018 dataset indicate that the proposed method is robust against false negatives. Compared with other research, the proposed method has more advantages in efficiency and accuracy, and it can detect APTs within a longer time horizon.

Detecting Phishing Website using Machine Learning

Phishing attacks continue to pose a major threat for computer system defenders, often forming the first step in a multi-stage attack. There have been great strides made in phishing detection; however, some phishing emails appear to pass through filters by making simple structural and semantic changes to the messages. We tackle this problem through the use of a machine learning classifier operating on a large corpus of phishing and legitimate emails. We design SAFEPC (Semi-Automated Feature generation for Phish Classification), a system to extract features, elevating some to higher level features, that are meant to defeat common phishing email detection strategies. To evaluate SAFE-PC, we collect a large corpus of phishing emails from the central IT organization at a tier-1 university. The execution of SAFE-PC on the dataset exposes hitherto unknown insights on phishing campaigns directed at university users. SAFEPC detects more than 70a state-of-the-art email filtering tool. It also outperforms Spam Assassin, a commonly used email filtering tool. We also developed an online version of SAFE-PC, that can be incrementally retrained with new samples. Its detection performance improves with time as new samples are collected, while the time to retrain the classifier stays constant.

A hierarchical intrusion detection system based on extreme learning machine and nature-inspired optimization

The surge in cyber-attacks has driven demand for robust Intrusion detection systems (IDSs) to protect underlying data and sustain availability of network services. Detecting and classifying multiple type of attacks requires robust machine learning approaches that can analyze network traffic and take appropriate measures. Traffic data usually consists of redundant, irrelevant, and noisy information, which could have a negative influence on the model performance. In this paper, we propose an improved bio-inspired meta-heuristic algorithm for efficient detection and classification of multi-stage attacks. The proposed model uses a one-versus-all sub-model based technique to deal with the multi-class classification problem. Each sub-model employs an enhanced Harris Hawk optimization with extreme learning machine (ELM) as the base classifier. This hierarchy produces the best subset of features per attack, along with optimized ELMs weights, which can improve the detection rate significantly. The proposed technique was tested against various meta-heuristic algorithms and multi-class classifiers using the UNSWNB-15 dataset. In seven different types of attacks, experimental results outperformed other existing methods in terms of decreasing the crossover-error rate and obtaining the best values for the G-mean measure.

A resilience-based recovery scheme for smart grid restoration following cyberattacks to substations

The recent surge of interest towards deploying cyber systems in power grids exposes the resulted Smart Grids (SGs) to cyberattacks, and consequently resilience degradation. Among different possible remedies, i.e., prevention, mitigation, and recovery, developing a well-crafted recovery scheme following these cyberattacks can noticeably improve the system resilience. However, an appropriate resilience-based optimization problem with a metric to capture the system resilience during each step of recovery is needed to be solved and enhance it by the right decisions. To address such a concern, this paper proposes an innovative recovery framework based on a novel metric that captures the resilience posture of SGs against cyberattacks. The developed metric captures (i) Power-side Resilience (PsR) including load, available reserve capacity, available line capacity, and reliability, of which the last three are traditionally overlooked in resilience literature, and (ii) Cyber-side Resilience (CsR) considering the maximum possible implication of attacks on the power grid. PsR will calculate the physical side resilience based on immediate damage and CsR measure the cyber-side resilience e based on possible damage to the system. The SG is fully recovered from an attack when the proposed scheme brought back all the cyber and physical aspects to the proximity of the pre-disturbance conditions. For practical feasibility, we have incorporated different SG capabilities and limitations including generator Automatic Generation Control (AGC) capability and ramp rate, load variations during the recovery phase, transient stability, and multi-stage attacks. Moreover, an AC multi-island load flow is utilized to check the power balance, voltage boundaries, and transmission lines limitations in each recovery step. The proposed framework is evaluated on the 39-bus New England test system to demonstrate its effectiveness and also applied to the IEEE 30-bus test case to compare the results of the proposed approach with those of existing works. The comparisons show that the proposed approach can enhance the overall system resilience by 22% in comparison to existing works.