New Types Of Attacks Research Articles

Critical infrastructure protection based on memory-augmented meta-learning framework

Critical infrastructures are related to systems which are essential for sustaining the important functions of a society. Their potential failures can cause serious problems not only to the population and economy but also to national security as well. The importance of these infrastructures calls for measures toward their security and protection. The aim was the reduction of risk related to natural disasters, terrorist acts, and cyberthreats. Traditional security systems, even those that employ intelligent algorithms, fail to prevent advanced zero-day attacks as they require constant training. This research proposes a novel meta-learning architecture that considers the neural turing machines as the approach upon which the model is founded. The introduced model allows for the memorization of useful data from past processes, by integrating external storage memory. Moreover, it facilitates the rapid integration of new information without the need for retraining. In particular, the proposed novel architecture is called memory-augmented neural network (M-ANN) whose core is a sophisticated, very fast, and highly efficient extreme learning machine. The M-ANN is assisted by a series of original modifications, related to fine-tuning of training, to memory retrieval mechanisms, to addressing techniques, and to ways of attention-weight allocation to memory vectors. The efficiency of the proposed system has been successfully tested using an extremely complex scenario for the protection of critical infrastructures. According to the testing scenario, memory could quickly encode and record information about new types of attacks, while any stored representation from previous experience was easily and consistently accessible, to maximize the detection efficiency.

Advanced persistent threat organization identification based on software gene of malware

AbstractSince the concept of IoT (Internet of Things) was proposed, it has digitized the real world and has a wide range of applications. However, with tremendous evolution in data acquisition and transfer, a new type of attack represented by advanced persistent threat (APT) has attracted wide attention. APT organization identification for malware is a method to detect APT attacks. However, most of malware is tailored to the goal, it is complex and changeable, or can be updated very quickly. The traditional analysis method is difficult to obtain the source information of APT organization from the malware in the IoT. To this end, we propose a software genes method to solve this problem. Software gene is binary fragment of specific function or information in the software body. In this paper, different from traditional data flow and instruction flow, a new gene model is proposed which combine with knowledge graph of malware behavior. We fill the processed malware information into the gene model to obtain the APT organization gene pool. Of course, the gene pool should be optimized to include the genetic characteristics of APT. In theory, there genetic characteristics can help us identify malware and APT accurately in the IoT. However, biological genetic similarity algorithms cannot be used directly. A genetic similarity algorithm for APT organization identification of malware will be designed instead. Simulations on real‐world dataset corroborate theoretical analysis and reveal the possibility of using genes for malware traceability.

Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU

Currently, most anomaly detection approaches in industrial control systems (ICSs) use network event logs to build models, and current unsupervised machine learning methods rarely use spatiotemporal correlations and other dependencies between multiple variables (sensors/actuators) in a system to detect anomalies. Most of the existing anomaly detection technologies simply compare the current states with the predicted normal range. Due to the highly dynamic characteristic of industrial control systems, it is insufficient to simply compare the current states with the predicted normal range. As a result, these approaches have low detection rates for unknown or new types of attacks. In view of these shortcomings, this paper presents a network model for predicting sensor/controller parameters in industrial control systems. To predict the parameter values of the sensors and controllers more accurately, the 1D convolutional neural network (1D_CNN) and gated recurrent unit (GRU) are combined to fully learn the spatiotemporal correlation and other dependencies between the parameter values of the sensors and controllers at each moment. An abnormal state detection method based on the calculation of the statistical deviation is proposed to realize the anomaly detection of industrial control systems. The model is validated on the Secure Water Treatment (SWaT) dataset. The precision, recall and F1 scores are used to evaluate the effectiveness of this method in anomaly detection on the SWaT dataset. The experimental results show that the average precision and recall of this method are 0.99 and 0.85, respectively, and that the average F1 score is 0.91. The experimental results show that the proposed method can be successfully applied to anomaly detection systems in industrial control systems with lower false positive rates.

Verification of Cryptocurrency Mining Using Ethereum

With advancement in computer technology, financial technology has also evolved. Blockchain technology has evolved over the past decade; however, this has also resulted in some malicious attacks. To earn mining rewards of a blockchain, a new type of attack, called cryptojacking, has emerged in the online world. This attack uses the computer resources of a victim to obtain mining rewards without user confirmation. However, this monetization model was originally intended to replace advertising as a source of revenue for a website. To resolve such problems, a storage verification architecture based on smart contracts was proposed in the study. The decentralized system of blockchain enables users to identify and participate in verification of mining sites through Ethereum smart contracts.

Aerial and Under-water Dronal Communication: Potentials, Issues and Vulnerabilities

The use of UAVs has been on the rise since the past decade. These UAVs are very versatile and can be applied to several fields ranging from agriculture to military reconnaissance. Due to the immense functionality of the UAVs, it has now become a very popular topic in Research. With the advent of Deep Learning and Machine Learning the autonomous navigation functionalities have been improved but it still poses a challenge as navigating a drone involves the integration of its software and hardware functionalities. This paper reviews both indoor and outdoor navigation. Topics in navigation such as Control, Hardware, Algorithms, Path-Planning, and communication are touched upon in this paper. The paper also presents a discussion on the Navigation of UAVs using vision-based technologies, this technology encompasses the use of various sensors and cameras and integrate it with the navigation system of the UAV to ensure the success of UAV’s operation. UAVs play a pivotal role in networking, many applications have been developed which have UAVs as an important component in them. Their applications include Urban computing, Internet of Things, Ubiquitous Computing to name a few. Safely operating a UAV as a network node is not a simple task, these nodes are prone to various types of attacks. A new type of attack introduced in this paper is termed as “Coagulation Attack”. This attack gets its name from the coagulation property of fluids wherein fluids clot and their particles settle down. This paper explores the concept, issues, challenges and research aspects of Coagulation attack. This paper also introduces the concept of Underwater Wireless Communication. On a planet where 70% of the surface is covered in water, UWC has a lot of potentials to be exploited. Moreover UWC is critical in many key areas of Maritime research, commerce, and surveillance. UWC is used for experimental observation, data collection and analysis, underwater navigation, disaster prevention and early detection warning of a tsunami. In addition, we summarize emerging technologies in the UWC, future research directions and recommendations using fifth-generation (5G) communication techniques.

Intrusion Detection System in Manets

One of the most challenging issue nowadays is providing security on MANET architecture. The key issue in MANET is the design of intrusion detection system, that is able to detect attacks in a rapid manner .Traditional methods like genetic algorithms, fuzzy logic, game theory techniques are helpful in designing of IDs. However, these techniques have a limitation on the effects of prevention techniques in general and they are designed for a set of known attacks. These techniques are also tends to increase the false positive ratio, detection rate is low and values of ROC characteristics due to training of feature set of attack patterns . The techniques also failed to detect any new type of attacks by any existing methods. This paper focuses on designing of intrusion detection system based on hybrid approach that effectively able to detect any type of attacks using Evolutionary algorithm techniques.

Security Attacks in Named Data Networking: A Review and Research Directions

Contents such as audios, videos, and images, contribute most of the Internet traffic in the current paradigm. Secure content sharing is a tedious issue. The existing security solutions do not secure data but secure the communicating endpoints. Named data networking (NDN) secures the data by enforcing the data publisher to sign the data. Any user can verify the data by using the public key of the publisher. NDN is resilient to most of the probable security attacks in the TCP/IP model due to its new architecture. However, new types of attacks are possible in NDN. This article surveys the most significant security attacks in NDN such as interest flooding attacks, cache privacy attacks, cache pollution attacks, and content poisoning attacks. Each attack is classified according to their behavior and discussed for their detection techniques, countermeasures, and the affected parameters. The article is an attempt to help new researchers in this area to gather the domain knowledge of NDN. The article also provides open research issues that could be addressed by researchers.

UIDS: a unified intrusion detection system for IoT environment

Intrusion detection system (IDS) using machine learning approach is getting popularity as it has an advantage of getting updated by itself to defend against any new type of attack. Another emerging technology, called internet of things (IoT) is taking the responsibility to make automated system by communicating the devices without human intervention. In IoT based systems, the wireless communication between several devices through the internet causes vulnerability for different security threats. This paper proposes a novel unified intrusion detection system for IoT environment (UIDS) to defend the network from four types of attacks such as: exploit, DoS, probe, and generic. The system is also able to detect normal category of network traffic. Most of the related works on IDS are based on KDD99 or NSL-KDD 99 data sets which are unable to detect new type of attacks. In this paper, UNSW-NB15 data set is considered as the benchmark dataset to design UIDS for detecting malicious activities in the network. The performance analysis proves that the attack detection rate of the proposed model is higher compared to two existing approaches ENADS and DENDRON which also worked on UNSW-NB15 data set.

Http Rule Base Intrusion Detection and Prevention System

The objective of HTTP Rule Base Intrusion Detection and Prevention System (IDPS) is to provide security for one of the application layer protocols namely HTTP (Hyper-Text Transfer Protocol). Such an HTTP based Intrusion Detection System (IDS) detects header attacks and attacks in payload (includes HTML and scripting). Misuse detection uses signature based approach where predefined patterns are defined. The input text or pattern is compared with the predefined signatures to detect malicious activity. Furthermore new types of attacks are continuously created. The new attacks created by attacker are also detected by these IDS, only if attacks are in the form of signatures. Signatures are defined either in a single-line or by complex script languages and are used in rule base to detect attacks. These signatures and rules have to be updated periodically as the attacks are continuously changing its nature of attacks

Mitigating Electrical-level Attacks towards Secure Multi-Tenant FPGAs in the Cloud

A rising trend is the use of multi-tenant FPGAs, particularly in cloud environments, where partial access to the hardware is given to multiple third parties. This leads to new types of attacks in FPGAs, which operate not only on the logic level, but also on the electrical level through the common power delivery network. Since FPGAs are configured from the software-side, attackers are enabled to launch hardware attacks from software, impacting the security of an entire system. In this article, we show the first attempt of a countermeasure against attacks on the electrical level, which is based on a bitstream checking methodology. Bitstreams are translated back into flat technology mapped netlists, which are then checked for properties that indicate potential malicious runtime behavior of FPGA logic. Our approach can provide a metric of potential risk of the FPGA bitstream being used in active fault or passive side-channel attacks against other users of the FPGA fabric or the entire SoC platform.

Fusion of Feature Selection and Random Forest for an Anomaly-Based Intrusion Detection System

Considering current network scenario hackers and intruders has become a big threat today. As new technologies are emerging fast, extensive use of these technologies and computers, what plays an important role is security. Most of the computers in network can be easily compromised with attacks. Big issue of concern is increase in new type of attack these days. Security to the sensitive data is very big threat to deal with, it need to consider as high priority issue which should be addressed immediately. Highly efficient Intrusion Detection Systems (IDS) are available now a days which detects various types of attacks on network. But we require the IDS which is intelligent enough to detect and analyze all type of new threats on the network. Maximum accuracy is expected by any of this intelligent intrusion detection system. An Intrusion Detection System can be hardware or software that analyze and monitors all activities of network to detect malicious activities happened inside the network. It also informs and helps administrator to deal with malicious packets, which if enters in network can harm more number of computers connected together. In our work we have implemented an intellectual IDS which helps administrator to analyze real time network traffic. IDS does it by classifying packets entering into the system as normal or malicious. This paper mainly focus on techniques used for feature selection to reduce number of features from KDD-99 dataset. This paper also explains algorithm used for classification i.e., Random Forest which works with forest of trees to classify real time packet as normal or malicious. Random forest makes use of ensembling techniques to give final output which is derived by combining output from number of trees used to create forest. Dataset which is used while performing experiments is KDD-99. This dataset is used to train all trees to get more accuracy with help of random forest. From results achieved we can observe that random forest algorithm gives more accuracy in distributed network with reduced false alarm rate.

An ensemble detection method for shilling attacks based on features of automatic extraction

Faced with the evolving attacks in recommender systems, many detection features have been proposed by human engineering and used in supervised or unsupervised detection methods. However, the detection features extracted by human engineering are usually aimed at some specific types of attacks. To further detect other new types of attacks, the traditional methods have to re-extract detection features with high knowledge cost. To address these limitations, the method for automatic extraction of robust features is proposed and then an Adaboost-based detection method is presented. Firstly, to obtain robust representation with prior knowledge, unlike uniform corruption rate in traditional mLDA (marginalized Linear Denoising Autoencoder), different corruption rates for items are calculated according to the ratings' distribution. Secondly, the ratings sparsity is used to weight the mapping matrix to extract low-dimensional representation. Moreover, the uniform corruption rate is also set to the next layer in mSLDA (marginalized Stacked Linear Denoising Autoencoder) to extract the stable and robust user features. Finally, under the robust feature space, an Adaboost-based detection method is proposed to alleviate the imbalanced classification problem. Experimental results on the Netflix and Amazon review datasets indicate that the proposed method can effectively detect various attacks.

RazorNet: Adversarial Training and Noise Training on a Deep Neural Network Fooled by a Shallow Neural Network

In this work, we propose ShallowDeepNet, a novel system architecture that includes a shallow and a deep neural network. The shallow neural network has the duty of data preprocessing and generating adversarial samples. The deep neural network has the duty of understanding data and information as well as detecting adversarial samples. The deep neural network gets its weights from transfer learning, adversarial training, and noise training. The system is examined on the biometric (fingerprint and iris) and the pharmaceutical data (pill image). According to the simulation results, the system is capable of improving the detection accuracy of the biometric data from 1.31% to 80.65% when the adversarial data is used and to 93.4% when the adversarial data as well as the noisy data are given to the network. The system performance on the pill image data is increased from 34.55% to 96.03% and then to 98.2%, respectively. Training on different types of noise can benefit us in detecting samples from unknown and unseen adversarial attacks. Meanwhile, the system training on the adversarial data as well as noisy data occurs only once. In fact, retraining the system may improve the performance further. Furthermore, training the system on new types of attacks and noise can help in enhancing the system performance.

Computer-Security-Oriented Escape Room

Every day, new types of attacks are being developed with companies as their targets. If employees are not aware of the consequences and tactics of such attacks, they cannot protect the companies that employ them. Current teaching methods, such as lectures and videos, may not adequately prepare participants in security-related courses for real-life situations. To raise awareness about computer security, teachers and students of l'Instititut National des Sciences Appliquees de Toulouse developed two escape rooms with different approaches to the same goal: raising awareness. Players learn how to reduce risks from computer attacks during hour-long real-life simulations. Choosing strong passwords and spotting phishing emails are just a few of the habits our escape-room scenarios can instill in participants to mitigate the damage of hacks and social-engineering attacks.

Cascading failures in complex networks caused by overload attacks

Complex networks are known to be vulnerable to the failure of components in terms of structural robustness. An as yet less researched topic is dynamical robustness, which refers to the ability of a network to maintain its dynamical activity against local disturbances. This paper introduces a new type of attack—the overload attack—to disturb the network’s dynamical activity. The attack is based on the load redistribution model for sequential attacks. The main contribution are heuristics to assess the vulnerability of complex networks with respect to this type of attack. The effectiveness of the heuristics is demonstrated with an application for real power networks.

Privacy-preserving model and generalization correlation attacks for 1:M data with multiple sensitive attributes

Preserved privacy and enhanced utility are two competing requirements in data publishing. For maintaining a trade-off between the two; a plethora of research work exist in 1:1 scenario (each individual has a single record) with a single sensitive attribute (SA). However, some practical scenarios i.e., data having 1:M records (an individual can have multiple records) with multiple sensitive attributes (MSAs), have been relatively understudied. In our current interconnected and digitalized society, the capability to deal with such scenarios is increasingly important due to the ever-increasing sources of data that could be drawn together and infer one's information (e.g. profile and lifestyle) and consequently, compromising one's privacy. In this paper, we present a new type of attack on 1:M records with MSAs, coined as MSAs generalization correlation attacks and perform formal modeling and analysis of these attacks. Then, we propose a privacy-preserving technique “(p, l)-Angelization” for 1:M–MSAs data publication. Extensive experiments over real-world datasets advocate the outperformance of our technique over its counterparts.

A Survey on Intrusion Detection System using Machine Learning and Deep Learning

As we know internet of Things (IoT) is one of the fastest growing paradigm which is composed of Internet and different physical devices with different domains or the smart applications like home automation, business automation applications, health and environmental monitoring applications. The dependency on IOT devices is increasing day by day with our daily activities, which leads to most important challenge for security. Since having a better monitoring system for better security is a need. From more than two decades the concept or the frame work called IDS (Intrusion detection system) is playing important role for detecting the attacks in the network. Since the network attacks are not fixed in nature, a new type of attacks are happening on the network applications. There are many traditional IDS techniques are available but they are complex to apply. Since machine learning is one of the important area which is achieving good results in many applications. In this paper we study about the different machine learning techniques used till now and the methodology for the attack detection and the validation strategy. We will also discuss about the performance metrics.

A Framework to Automate Cloud based Service Attacks Detection and Prevention

With the increasing demand for high availability, scalability and cost minimization, the adaptation of cloud computing is also increasing. By the demand from the data, consumer or the customers of the applications, the service providers or the application owners are migrating all the applications into the cloud. These migrations of the traditional applications and deploying new applications are benefiting the consumers and the service providers. The consumers are getting the higher availability of the applications and in the other hand, the consumers of the applications are getting benefits from of the cost reduction by optimal scalability and deploying additional features with the least cost, which intern providing the better customer satisfaction. Nevertheless, this migrations and new deployments are attracting the attention of the hackers and attackers as well. In the recent past, several attacks are reported on various popular services like search engines, storage services, and critical application ranging from healthcare to defence. The attacks are sometimes limited to the data exploration, where the attackers only consume the data and sometimes the attackers destroy crucial services. The major challenge in detecting these attacks is mostly identifying the nature of the connection request. Also, identifying the attacks are not sufficient in providing the security for the cloud services and must be deployed as security as a service in the applications or the services or in the data centre as automatic and continuous measures. Various research endeavours have shown critical enhancements in the on-going past for recognizing the security attacks. Nonetheless, these attempts have not provided any solution in preventing the security attacks. Also, the existing methods as mentioned are not automated and cannot be included in the services. Thus, this work provides a unique automated framework solution for detecting the application traffic pattern and generates the rule sets for detecting any anomalies in the request types. The major outcome of this work is to identify the attack types and prevent further damages to the cloud services with a minimal computational load. The additional benefits from this work are the preventive measure for popular attack types. The work also demonstrates the ability to detect a new type of attacks based on traffic pattern analysis and provides preventive measures for making the cloud computing application hosting industry a safer place.

Dynamically Detecting Security Threats and Updating a Signature-Based Intrusion Detection System’s Database

The electronic attacks that threaten the security of networks and information are increasing, especially during the current rapid electronic revolution. Therefore, it is necessary to use surveillance and protection systems in order to secure computer networks. An intrusion detection system (IDS) is one of the most important security systems available on the market. An IDS is a system that can be used to observe network traffic for illegal activities or illegitimate access to the network and to display alerts in such cases. There are three main types of IDSs: signature-based IDSs, anomaly-based IDSs and a hybrid of both. Auto-updating lists of attacks in order to overcome new types of attacks is one of the main challenges for a signature-based IDS. Most IDSs update their databases manually—done by network administrators—or by using websites that offer newly detected attack signatures. This paper proposes a model of auto-updating the attack lists using a filtering engine that acts as a second IDS engine. The results show an improvement in the overall accuracy of the IDS using the proposed model. In addition to detecting new attack signatures based on similarity, a blacklist of IP factors is used in the proposed model, which automates the updating process of IDS databases with the new attack signatures without human interference.

Non-linear Dimensionality Reduction-based Intrusion Detection using Deep Autoencoder

The intrusion detection has become core part of any network of computers due to increasing amount of digital content available. In parallel, the data breaches and malware attacks have also grown in large numbers which makes the role of intrusion detection more essential. Even though many existing techniques are successfully used for detecting intruders but new variants of malware and attacks are being released every day. To counterfeit these new types of attacks, intrusion detection must be designed with state of art techniques such as Deep learning. At present the Deep learning techniques have a strong role in Natural Language Processing, Computer Vision and Speech Processing. This paper is focused on reviewing the role of deep learning techniques for intrusion detection and proposing an efficient deep Auto Encoder (AE) based intrusion detection technique. The intrusion detection is implemented in two stages with a binary classifier and multiclass classification algorithm (dense neural network). The performance of the proposed approach is presented and compared with parallel methods used for intrusion detection. The reconstruction error of the AE model is compared with the PCA and the performance of both anomaly detection and the multiclass classification is analyzed using metrics such as accuracy and false alarm rate. The compressed representation of the AE model helps to lessen the false alarm rate of both anomaly detection and attack classification using SVM and dense NN model respectively.