Network Attacks Research Articles

A High-Concurrency Tasks Emergency Offloading Framework for Industrial Edge Networks

In the envisioned scenario of smart factories, large-scale distributed intelligent industrial devices generate a substantial number of concurrent heterogeneous industrial tasks. A single device is inadequate to meet the demanding requirements of complex tasks, which necessitate high computational capabilities and low latency in the system. Typically, multi-access edge computing (MEC) is employed to address this challenge. However, industrial edge networks face threats such as network attacks, natural disasters, and hardware failures, posing security risks to the industrial edge network. Therefore, we have designed an emergency offloading framework to enhance its resilience. Based on a task path analysis method with multiple priority levels, we developed an emergency task scheduling pre-classification (ETSPC) algorithm. Experimental results demonstrate that the proposed algorithm significantly reduces the delay of emergency offloading for high-concurrency tasks, with a maximum reduction of up to 19.2%. In extreme scenarios, the task completion rate of the ETSPC algorithm increases by 45.3% compared to the control algorithm.

Timely Detection of DDoS Attacks with Dimenstionality Reduction

Due to the interconnectedness and exponential proliferation of IoT devices, the technology is more susceptible to network attacks like Distributed Denial of Service (DDoS), which disrupt network resources. A growing threat to cloud computing systems is the Distributed Denial of Service (DDoS) attack, in which the attacker starts the attack by taking advantage of computers both inside and outside the cloud system. Real-time analysis of cloud network data is essential for preventing DDoS attacks. DDoS attacks interfere with the operation of Io- connected apps and services by taking advantage of the constrained resources on IoT devices. The impacts of DDoS attacks, which seriously damage current systems, are thoroughly examined in this article in the context of the Internet of Things. One of the most common network attacks is the distributed denial-of-service attack (DDoS). DDoS assaults intensified due to the quick development of computer and communication technologies. Therefore, investigating the detection of a DDoS attack is crucial. A single technique cannot offer adequate security due to the variety of DDoS attack techniques.

An Effective Prevention Approach against ARP Cache Poisoning Attacks in MikroTik-based Networks

Nowadays, leading manufacturers of enterprise-grade networking devices offer the dynamic ARP inspection (DAI) feature in their Ethernet Switches to detect and prevent ARP cache poisoning attacks from malicious hosts. However, MikroTik Ethernet switches do not yet support this feature. Within MikroTik-based networks, three potential approaches exist to prevent ARP cache poisoning attacks, each with drawbacks. This paper proposes an innovative approach called Gateway-controlled ARP (GCA) to prevent ARP cache poisoning attacks on a router-on-a-stick (RoaS) network using MikroTik networking devices, where a single router performs inter-VLAN routing through one physical interface. With this approach, all Ethernet switches are configured to forward ARP messages from hosts directly to the router for inspection and handling. A RouterOS script based on the GCA approach was implemented and executed on the router to handle all incoming ARP requests from any host in all VLANs, ensuring all hosts receive legitimate ARP responses from the router. This approach can effectively prevent spoofed ARP packets sent by malicious attackers. This approach was tested and evaluated on an actual RoaS network, focusing on processing time, CPU Load, and response time. The evaluation results show that the approach effectively prevents ARP cache poisoning attacks.

Quantitative Studies on Hacking Methods and Types of Cyber-Attackers of Electronic Banking Networks

Cyber-attacks on electronic banking networks are a growing concern in today's digital age. Cybercriminals try to penetrate the Electronic Banking infrastructure, by bypassing all protection mechanisms, and the media continue to report new bank cyberattacks and thefts. The study attempts to identify the impact of attacks and methods that threaten bank networks. To know the kinds and methods of the attackers of bank networks, a questionnaire was prepared and distributed to the selected banks and their branches, namely Omdurman National Bank, Bank of Khartoum, and Bank of Sudan. From the studied sample, competitors stood out as the most qualitative network attackers on the banks, while penetration through the Internet was one of the ways through which the attacks on the financial banks networks could be carried out. The sample of the study showed that the quality of bank attackers are the competitors, with a rate of 29.2%, which is considered the largest percentage of all assumptions and the highest network attacker’s method Through the internet with a rate of 52.7%. The study concluded that Competitors and Internet have highest impact per methods and kinds of attacks respectively. This conclusion supports the problem statement since the impact was known within the case study Banks.

High-performance network attack detection in unknown scenarios based on improved vertical model

High-performance network attack detection in unknown scenarios based on improved vertical model

Detecting and Analyzing Network Attacks: A Time-Series Analysis Using the Kitsune Dataset

Network security is a critical concern in today’s digital world, requiring efficient methods for the automatic detection and analysis of cyber attacks. This study uses the Kitsune Network Attack Dataset to explore network traffic behavior for IoT devices under various attack scenarios, including ARP MitM, SYN DoS, and Mirai Botnet. Utilizing Python-based data analysis tools, we preprocess and analyze millions of network packets to uncover patterns indicative of malicious activities. The study employs packet-level time-series analysis to visualize traffic patterns and detect anomalies specific to each attack type. Key findings include high packet volumes in attacks such as SSDP Flood and Mirai Botnet, with the Mirai Botnet attack involving multiple IP addresses and lasting over 2 hours. Notable attack-specific behaviors include high traffic on port -1 and targeted traffic on specific ports like 53195. The SYN DoS and Mirai Botnet attacks are characterized by their prolonged durations, suggesting significant disruption. Overall, the study highlights distinctive attack patterns and underscores the importance of understanding these characteristics to enhance detection and response mechanisms.

Anomaly Intrusion Detection System for smart lighting

Smart lighting systems (SLS) are essential to smart cities, offering enhanced energy efficiency and public safety. However, they are susceptible to security threats, potentially leading to safety risks and service disruptions, making the protection of this infrastructure critical.This paper presents an anomaly-based Intrusion Detection System (IDS) designed for a real-world operational SLS. As commercial deployments vary in components, protocols, and functionalities, IDSs must be tailored to the characteristics of each deployment to perform effectively. Our anomaly IDS has been specifically defined based on the properties of available data and the types of attacks we aim to detect, providing explainability and exhibiting low complexity. The proposed system identifies anomalies in seven features of network traffic and telemetry data received at the central control (O&M) server. For the latter, we designed three customized anomaly detectors to identify abnormal data points, persistent deviations in power consumption of street lamps, and abnormal power value based on the time of day. Validation with real-world data and simulated attacks demonstrates the effectiveness of our approach. Network attacks (e.g., DoS, scanning) were detected by at least one of the seven flow-related anomaly detectors, while simulated data poisoning attacks and operational technology (OT) issues were detected with nearly 90% accuracy. The datasets used in this work are publicly available and may serve as a reference for the design of future IDS. While our detectors were designed specifically for our dataset, the variables examined and vulnerabilities addressed are common in most commercial SLSs.

Using virtual function replacement to mitigate 0-day attacks in a multi-vendor NFV-based network

Using virtual function replacement to mitigate 0-day attacks in a multi-vendor NFV-based network

Spatialspectral-Backdoor: Realizing backdoor attack for deep neural networks in brain–computer interface via EEG characteristics

Spatialspectral-Backdoor: Realizing backdoor attack for deep neural networks in brain–computer interface via EEG characteristics

Robust synchronization of Markovian jump complex dynamical networks under link attacks: Delay-dependent dynamic event-triggered control approach

This paper investigates the synchronization problem for Markovian jump complex dynamical networks (MJCDNs) subject to link attacks. An extended dynamic event-triggered (DET) control is proposed that takes into account limited network resources and time-varying delay constraints. The proposed method enhances the robustness and resource-saving ability of the DET mechanism, and avoids the Zeno phenomenon. It provides MJCDNs to have a buffering ability for external interference. Additionally, this paper introduces a robust model-based strategy to address scenarios where network attackers inject false data into the link channels between nodes. This approach reduces the complexity of processing MJCDNs subject to link attacks. By leveraging network topology and Lyapunov functions, the criteria are derived to achieve robust synchronization of MJCDNs under link attacks. Finally, simulation examples including Chua’s circuit are presented to verify the validity and superiority of the results.

SARM: A network State-Aware Adaptive Routing Mutation method for power IoT

With the rapid development of Power Internet of Things (PIoT), the application of Internet of Things technology in smart grids is becoming increasingly widespread, but it also enlarges the attack surface of the system. Against this backdrop, traditional defense methods are limited by the asymmetry of network attack and defense, which makes it difficult to effectively resist the ievolving sniffing attacks and link flooding attacks. In order to improve the security of PIoT, this paper proposes an Adaptive Route Mutation based on Network State Awareness (SARM). It generates a route mutation space using a path state matrix and optimizes the time complexity of mutation space generation with a backtracking method. Furthermore, the SARM can dynamically adjust the route mutation strategy according to the real-time network state to realize self-adaptive defense. In conclusion, SARM is evaluated through simulations conducted with Mininet. Compared to Random Routing Mutation (RRM), it enhances defense against Sniffing and Distributed Denial of Service attacks by approximately 30% and 35% respectively. Additionally, in various example topologies, SARM consistently outperforms RRM.

High-performance BFT consensus for Metaverse through block linking and shortcut loop

In recent years, the Metaverse has captured increasing attention. As the foundational technologies for these digital realms, blockchain systems and their critical component—the Byzantine Fault Tolerance (BFT) consensus protocol—significantly influence the performance of Metaverse. Due to vulnerabilities to network attacks, synchronous and partially synchronous consensus protocols often face compromises in their liveness or security. Consequently, recent efforts in BFT consensus have shifted towards asynchronous consensus protocols, notably the Multi-valued Validated Binary Agreement (MVBA) protocols, with sMVBA being particularly prominent. Despite its advances, sMVBA struggles to meet the high-performance demands of Metaverse applications. Each sMVBA instance commits only one block, discarding all others, which severely restricts throughput. Moreover, if a leader in a given view crashes, nodes must rebroadcast blocks in the subsequent view, resulting in increased latency.To overcome these challenges, this paper introduces Mercury, a protocol designed to enhance throughput under various conditions and reduce latency in less favorable scenarios where leaders are crashed. Mercury incorporates a mechanism whereby each block contains hashes from blocks of a previous instance, linking blocks across instances. This structure ensures that once a block is committed, all its linked blocks are also committed, thereby boosting throughput. Additionally, Mercury integrates a ‘shortcut loop’ mechanism, allowing nodes to bypass the last phase of the current view and the block broadcasting in the next view, significantly decreasing latency. Our experimental evaluations of Mercury confirm its superior performance. Compared to the cutting-edge protocols, sMVBA, CKPS, and AMS, Mercury boosts throughput by 1.03X, 1.65X, and 2.51X, respectively.

ML-based Intrusion Detection System for Precise APT Cyber-clustering

As more and more documents are converted from hard copies to digital formats and move to cloud storage, securing data access has become a critical and emergent security concern. Without a doubt, intrusion detection system (IDS) has become the primary defense mechanism for governments and enterprises to identify network attacks. However, the emergence of Advanced Persistent Threat (APT) has brought heightened challenges for an IDS, since malicious hackers can deploy various attacks to penetrate information systems invisibly over extended periods of time. Thus, the authors aim to design a High Discrimination APT Intrusion Detection System (HDAPT-IDS); consisting of Cyber Clustering Module (CCM) and Clustering Analysis Module (CAM). CCM conducts a preliminary classification of traffic packets and utilizes the random forest algorithm to predict the main-class, while CAM selects the applicable Deep Neural Network (DNN) based on the prediction results of CCM to derive the sub-class of traffic packets as the final result. Aside from laying out a high detection rate, HDAPT-IDS can effectively reduce the number of categories during classification to achieve better performance.

Network Attack Simulation and Defense System Optimization based on Big Data

Network Attack Simulation and Defense System Optimization based on Big Data

Design and Implementation of Internet of Things (IoT) Framework for Governing Modern Cyber Attacks in Computer Network

Design and Implementation of Internet of Things (IoT) Framework for Governing Modern Cyber Attacks in Computer Network

Blockchain-Enhanced Machine Learning for Robust Detection of APT Injection Attacks in the Cyber-Physical Systems

Cyber-Physical Systems (CPS) have become a research hotspot due to their vulnerability to stealthy network attacks like ZDA and PDA, which can lead to unsafe states and system damage. Recent defense mechanisms for ZDA and PDA often rely on model-based observation techniques prone to false alarms. In this paper, we present an innovative approach to securing CPS against Advanced Persistent Threat (APT) injection attacks by integrating machine learning with blockchain technology. Our system leverages a robust ML model trained to detect APT injection attacks with high accuracy, achieving a detection rate of 99.89%. To address the limitations of current defense mechanisms and enhance the security and integrity of the detection process, we utilize blockchain technology to store and verify the predictions made by the ML model. We implemented a smart contract on the Ethereum blockchain using Solidity, which logs the input features and corresponding predictions. This immutable ledger ensures the integrity and traceability of the detection process, mitigating risks of data tampering and reducing false alarms, thereby enhancing trust in the system's outputs. The implementation includes a user-friendly interface for inputting features, a backend for data processing and model prediction, and a blockchain interaction module to store and verify predictions. The integration of blockchain with Machine learning enhances both the precision and resilience of APT detection while providing an additional layer of security by ensuring the transparency and immutability of the recorded data. This dual approach represents a substantial advancement in protecting CPS from sophisticated cyber threats.

Analysis of Big Data Network Security Defense Mechanism Application of Artificial Intelligence

In the context of the close integration of computer network technology and daily life, big data network security faces many challenges. With its powerful information processing ability, this AI can effectively identify and handle potential threats in the network, thereby improving network security. This paper discusses the application of artificial intelligence (AI) in enhancing big data network security defense, especially in the threat detection link. This paper proposes a detection algorithm that combines support vector machine (SVM) and K nearest neighbor (KNN), namely SVM-KNN algorithm, for network attack detection and defense. When the hazard data is 60 under the test sample, the detection accuracy of KNN, SVM, and SVM-KNN is 86.88%, 89.51%, and 96.75% respectively; when the hazard data is 60 under the experimental sample, the detection accuracy of KNN, SVM, and SVM-KNN is 82.70%, 83.88%, and 89.26% respectively.response.

A Robust Hybrid Approach for Malware Detection: Leveraging CNN and LSTM for Encrypted Traffic Analysis

The rapid growth in Internet usage and advancements in network technologies have escalated the risk of network attacks. As the adoption of encryption protocols increases, so does the difficulty in identifying malware within encrypted traffic. Malware represents a significant danger in cyberspace, as it compromises personal data and harms computer systems. Network attacks involve unauthorized access to networks, often aiming to disrupt or damage them, with potentially severe consequences. To counter these threats, researchers, developers, and security experts are constantly innovating new malware detection techniques. Recently, deep learning has gained traction in network security and intrusion detection systems (IDSs), with models such as Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) showing promise in detecting malicious traffic. Despite these advancements, extracting relevant features from diverse malware types remains a challenge. Current solutions demand substantial computational resources and are often inefficient for large datasets. Additionally, existing image-based feature extraction methods consume significant resources. This study tackles these issues by employing a 1D CNN alongside LSTM for the detection and classification of encrypted malicious traffic. Using the Malware Analysis benchmark dataset, which consists of 42,797 malware and 1,079 goodware API call sequences, the proposed model achieved an accuracy of 99.2%, surpassing other state-of-the-art models

Network Attack Classification using Neural Network-Based Imputation Technique

Rapid technological developments have changed access to information significantly, especially in telecommunications. This growth creates new threats, such as network attacks, so detection becomes critical for network security. Leveraging machine learning algorithms to detect threats is promising, with effectiveness largely dependent on selecting relevant features optimized by the bat algorithm. Data imputation is critical in preparing data sets, and neural network-based imputation techniques demonstrate outstanding performance, achieving accuracy rates of 99.4% on validation data and 99.3% on test data. This method consistently maintains precision, recall, and scores around 98%. Models using this method also approach perfection in classifying normal and neptune labels. This imputation method can also be applied to other model architectures using autoML. Alternative models such as Light GBM, XGBoost, Random Forest, Extra Trees, and Weighted Ensemble L2 also exhibit exceptional accuracy, exceeding 99.8%.

Research and Design of Data Encryption Circuit based on D Flip-Flop

Since information technology is developing so quickly, the problem of data security has become increasingly prominent. Data encryption technology, as an important means of securing data transmission, plays a vital role in resisting network attacks and protecting privacy. In this paper, a data encryption circuit based on D flip-flop is studied, aiming to improve the efficiency and security of data encryption. First, this paper introduces the basic principles of data encryption and analyzes the application of D flip-flop in encryption circuit. Subsequently, the design principle of Moore’s state machine is elaborated, and encryption circuit is designed with the use of the state graph and state table. Further, this paper demonstrates the logic circuit design process., including the derivation of D-flip-flop input Circuit construction and Boolean expressions. This research provides a hardware implementation design solution for the design of data encryption circuits, which is expected to play a role in improving encryption speed and enhancing security.