New Types Of Attacks Research Articles

Convolutional Neural Networks Based Detection System for Cyber-attacks in Industrial Control Systems

Convolutional Neural Networks (CNNs) have emerged as a powerful tool for various pattern recognition tasks, including the detection of cyber-attacks in Industrial Control Systems (ICS). This paper presents a CNN-based detection system specifically designed to safeguard ICS from sophisticated cyber threats. The proposed system leverages the capability of CNNs to automatically learn and extract high-level features from raw data, enabling it to identify anomalies indicative of cyber-attacks with high accuracy. Utilizing a comprehensive cyber-attack dataset containing 59 different types of attacks, the system is trained to distinguish between normal and malicious traffic effectively. Based on the extensive dataset, this study demonstrates that the CNN-based detection system achieves a detection rate of 98.5% and a false-positive rate of 1.2%, significantly outperforming traditional methods. The high detection rate indicates the system's ability to accurately identify a wide range of attack types, while the low false-positive rate ensures minimal disruption to normal operations due to incorrect alerts. These results underscore the system's robustness and reliability in identifying subtle and complex attack patterns. Moreover, the CNN-based system is designed to adapt to new types of attacks as it continues to learn from updated datasets, making it a scalable and future-proof solution. Implementing this system can significantly enhance the cybersecurity posture of industrial environments by providing real-time monitoring and rapid response capabilities. The CNN-based detection system offers a significant advancement in ICS cybersecurity. Effectively identifying and mitigating cyber-attacks contributes to the resilience and reliability of critical infrastructure. The proposed approach improves security measures and ensures industrial processes' continuous and safe operation, which is vital for economic stability and public safety.

A Real-Time Intrusion Detection System for DoS/DDoS Attack Classification in IoT Networks Using KNN-Neural Network Hybrid Technique

As more devices are connected to the Internet through the Internet of Things (IoT), there are huge security challenges. One of the major problems is Distributed Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. These attacks floods networks with useless traffic, disrupting IoT services. There is a need for better security measures to handle this. Intrusion Detection Systems (IDS) is used to find suspicious activities, but many of them can't keep up with new types of attacks in real time. This study focuses on creating an efficient real time hybrid framework that uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks. This proposed framework aims to identify and categorize DoS/DDoS attacks in real time through the utilization of a simulation model and MQTT-IoT-IDS2020 dataset and compared with existing frameworks, our proposed framework excels in accuracy, precision, and recall.

Insights into Modern Intrusion Detection Strategies for Internet of Things Ecosystems

The swift explosion of Internet of Things (IoT) devices has brought about a new era of interconnectivity and ease of use while simultaneously presenting significant security concerns. Intrusion Detection Systems (IDS) play a critical role in the protection of IoT ecosystems against a wide range of cyber threats. Despite research advancements, challenges persist in improving IDS detection accuracy, reducing false positives (FPs), and identifying new types of attacks. This paper presents a comprehensive analysis of recent developments in IoT, shedding light on detection methodologies, threat types, performance metrics, datasets, challenges, and future directions. We systematically analyze the existing literature from 2016 to 2023, focusing on both machine learning (ML) and non-ML IDS strategies involving signature, anomaly, specification, and hybrid models to counteract IoT-specific threats. The findings include the deployment models from edge to cloud computing and evaluating IDS performance based on measures such as accuracy, FP rates, and computational costs, utilizing various IoT benchmark datasets. The study also explores methods to enhance IDS accuracy and efficiency, including feature engineering, optimization, and cutting-edge solutions such as cryptographic and blockchain technologies. Equally, it identifies key challenges such as the resource-constrained nature of IoT devices, scalability, and privacy issues and proposes future research directions to enhance IoT-based IDS and overall ecosystem security.

МОДЕЛЮВАННЯ МУЛЬТИАГЕНТНИХ СИСТЕМ ЗАХИСТУ ІНФОРМАЦІЙНИХ РЕСУРСІВ

Traditional centralized information protection systems do not provide an adequate level of adaptability and efficiency in a dynamically changing threat environment. Multi-agent systems, having a distributed architecture and the possibility of autonomous decision-making, represent a promising direction for solving information security problems. The novelty of the research lies in the development of a multi-agent information protection system with enhanced capabilities for vulnerability analysis and intrusion detection. Unlike existing solutions, the proposed system provides active analysis of threats, reduction of the number of false positives, adaptation to new types of attacks, and minimization of the impact on the target traffic of information flows. In the proposed formal model and prototype of the agent-oriented attack modeling system (ASMA), distributed coordinated attacks on a computer network are considered as a sequence of joint actions of hacker agents, which are performed from different hosts. Hackers are supposed to coordinate their actions according to some common script. At each step of the attack scenario, they try to implement a specific private subgoal. The developed agent-oriented attack modeling system (ASMA) allows simulating distributed coordinated attacks on computer networks. It is based on a hierarchy of grammars, each of which is interpreted as a finite automaton. The system takes into account both macro- and micro-levels of attack description, providing detailed simulation of each stage of the attack. The use of KQML for communication between agents and XML for describing the content of messages allows effective coordination of agents' actions and ensures realistic simulation of attacks.

Blockchain integration for in-vehicle CAN bus intrusion detection systems with ISO/SAE 21434 compliant reporting.

The development of Intrusion Detection Systems (IDS) for in-vehicle buses has gained a lot of momentum in recent years as the number of reported vulnerabilities and the degree of interconnectivity for modern vehicles are on the rise. Since intrusion detection is resource consuming, it can be performed on computationally capable Android head units that are now present inside vehicles. Moreover, these units are connected to the internet, which enables the use of more complex algorithms that run in cloud environments. In this work we develop one such approach: an IDS that consists of a locally installed copy, running on head units, and a centralized instance of it that runs in the cloud and monitors traffic for groups of similar vehicles. Additionally, the centralized instance is part of a cloud service for intrusion detection which is continuously updated with the most recent types of attacks. The classification results of the cloud-based service are further analyzed by an incident response team which confirms the presence of known attacks, analyzes new types of attacks and assesses their impact. The output of this activity is stored on the Blockchain as ISO/SAE 21434 compliant reports, ensuring the transparency and traceability of the reported incidents.

IoT Attack Detection using Machine Learning and Deep Learning in Smart Home

The Internet of Things (IoT) has revolutionized the traditional Internet, pushing past its former boundaries by implementing smart linked gadgets. The IoT is steadily becoming a staple of everyday life, having been implemented into various diverse applications, such as cities, smart homes, and transportation. However, despite the technological advancements that the IoT brings, various new security risks have also been introduced due to the development of new types of attacks. This prevents current intelligent IoT applications from adaptively learning from other intelligent IoT applications, which leaves them in a volatile state. In this paper, we conducted a structured literature review (SLR) on Smart Home's IoT attack detection using machine learning and deep learning. Four journal databases were used to perform this review: IEEE, Science Direct, Association for Computing Machinery (ACM), and SpringerLink. Sixty articles were selected and studied, where we noted the various patterns and techniques present in the framework of the selected research. We also took note of the different machine learning and deep learning methods, the types of attacks, and the Network layers present in Smart Home. By conducting an SLR, we analyzed the numerous techniques of IoT attack detection for smart homes proposed by various theoretical studies. We enhanced the studied literature by proposing a new solution for better IoT attack detection in smart homes.

State-of-the-Art and New Challenges in 5G Networks with Blockchain Technology

As mobile communications transform, 5G technology can potentially change many industries and businesses. The change will have a great influence across many fields, such as the automotive, healthcare, and manufacturing sectors. This paper aims to review the existing applications of blockchain technology in providing 5G network security and identify new possibilities for such security solutions. We consider different aspects of blockchain in 5G, particularly data transmission, access control, and applications including vertical industry-oriented applications and specific solutions supporting such sectors of economic activity. The paper briefly describes modern technologies in 5G networks and introduces blockchain’s properties and different aspects of using such technology in practical applications. It also presents access control management with blockchain applied in 5G and related problems, reviews other blockchain-enforced network technologies, and shows how blockchain can help in services dedicated to vertical industries. Finally, it presents our vision of new blockchain applications in modern 5G networks and beyond. The new-generation networks use two fundamental technologies, slicing and virtualization, and attackers attempt to execute new types of attacks on them. In the paper, we discuss one of the possible scenarios exhibiting the shortcomings of the slicing technology architecture. We propose using blockchain technology to create new slices and to connect new or existing subscribers to slices in the 5G core network. Blockchain technology should solve these architectural shortcomings.

DDOS Attack Detection

A Distributed Denial of Service (DDoS) attack is an attempt to make a service unavailable by overwhelming the server with malicious traffic. DDoS attacks have become the most tedious and cumbersome issue in recent past. The number and magnitude of attacks have increased from few megabytes of data to 100s of terabytes of data these days. Due to the differences in the attack patterns or new types of attack, it is hard to detect these attacks effectively. In this paper, we devise new techniques for causing DDoS attacks and mitigation which are clearly shown to perform much better than the existing techniques. We also categorize DDoS attack techniques as well as the techniques used in their detection and thus attempt an extensive scoping of the DDoS problem. We also compare our attack module with a couple of tools available

Opportunities for developing the information security capability at hazardous plants given current challenges

Aim: One of the biggest challenges people face today is the development of an effective and efficient defence capability against cyber attacks. Nowadays, this is not only an expectation at the public level, but also a real need at the corporate and private user level. In this study, the author primarily wishes to draw attention to the global trends of new types of threats in the 21st century, the most vulnerable sectors, as well as to the development possibilities of the cyber security capabilities of domestic hazardous plants.Methodology: The author has conducted a qualitative research method using primary and secondary data to identify current trends and attack vectors of threats in cyberspace at global and regional levels. In addition, the author has also conducted empirical research using primary data to determine the development possibilities of the management/safety management systems of plants dealing with hazardous substances, as well as to build the resilience of the electronic information systems of these plants against cyber threats.Findings: The number of cyber-attacks have continued to grow over the last few decades, and industrial companies have become the main targets of these new types of attacks. In order for Hungary to develop an effective defence capability, especially in the case of industrial actors, it is important to create the cyber defence capability of plants dealing with hazardous materials under the supervision of the disaster management, industrial safety authority.Value: Taking stock of the possibilities of developing the security management system of domestic hazardous materials plants to protect against 21st century threats. This scientific work intends to provide more detailed information on the addition and feasibility of the management system with information security aspects.

METHODS AND MEANS TO IMPROVE THE EFFICIENCY OF NETWORK TRAFFIC SECURITY MONITORING BASED ON ARTIFICIAL INTELLIGENCE

This paper aims to provide a solution for malicious network traffic detection and categorization. Remote attacks on computer systems are becoming more common and more dangerous nowadays. This is due to several factors, some of which are as follows: first of all, the usage of computer networks and network infrastructure overall is on the rise, with tools such as messengers, email, and so on. Second, alongside increased usage, the amount of sensitive information being transmitted over networks has also grown. Third, the usage of computer networks for complex systems, such as grid and cloud computing, as well as IoT and “smart” locations (e.g., “smart city”) has also seen an increase. Detecting malicious network traffic is the first step in defending against a remote attack. Historically, this was handled by a variety of algorithms, including machine learning algorithms such as clustering.
 However, these algorithms require a large amount of sample data to be effective against a given attack. This means that defending against zero‑day attacks or attacks with high variance in input data proves difficult for such algorithms. In this paper, we propose a semi‑supervised generative adversarial network (GAN) to train a discriminator model to categorize malicious traffic as well as identify malicious and non‑malicious traffic. The proposed solution consists of a GAN generator that creates tabular data representing network traffic from a remote attack and a classifier deep neural network for said traffic. The main goal is to achieve accurate categorization of malicious traffic with a few labeled examples. This can also, in theory, improve classification accuracy compared to fully supervised models. It may also improve the model’s performance against completely new types of attacks. The resulting model shows a prediction accuracy of 91 %, which is lower than a conventional deep learning model; however, this accuracy is achieved with a small sample of data (under 1000 labeled examples). As such, the results of this research may be used to improve computer system security, for example, by using dynamic firewall rule adjustments based on the results of incoming traffic classification. The proposed model was implemented and tested in the Python programming language and the TensorFlow framework. The dataset used for testing is the NSL‑KDD dataset.

Improved Phishing Attack Detection with Machine Learning: A Comprehensive Evaluation of Classifiers and Features

In phishing attack detection, machine learning-based approaches are more effective than simple blacklisting strategies, as they can adapt to new types of attacks and do not require manual updates. However, for these approaches, the choice of features and classifiers directly influences detection performance. Therefore, in this work, the contributions of various features and classifiers to detecting phishing attacks were thoroughly analyzed to find the best classifier and feature set in terms of different performance metrics including accuracy, precision, recall, F1-score, and classification time. For this purpose, a brand-new phishing dataset was prepared and made publicly available. Using an exhaustive strategy, every combination of the feature groups was fed into various classifiers to detect phishing websites. Two existing benchmark datasets were also used in addition to ours for further analysis. The experimental results revealed that the features based on the uniform resource locator (URL) and hypertext transfer protocol (HTTP), rather than all features, offered the best performance. Also, the decision tree classifier surpassed the others, achieving an F1-score of 0.99 and being one of the fastest classifiers overall.

AI-powered intrusion detection in large-scale traffic networks based on flow sensing strategy and parallel deep analysis

Current intrusion detection systems, which rely on signature-based detection using rules derived from the inspection of past traffic flows and their signatures, are incapable of detecting new types of attacks. They also face challenges from large-scale traffic networks when deployed in the inline mode. This paper presents the SAID method combining signature-based and AI-powered deep analysis, called PAID, controllable by a flow sensing strategy for accelerating the intrusion detection in large-scale networks. PAID is designed as a parallel ensemble learning of DNN, XGB, and GBM to boost the deep analysis in terms of speed and quality. In order to enhance the performance of PAID, we also propose a method to augment the quality of the training dataset by compressing samples in the majority classes and generating more realistic samples in minority classes. Moreover, SAID includes a flow sensing strategy based on a configurable sampling cycle and window for analyzing the large-scale traffic network. Well-known datasets, such as CSE-CIC-IDS2018 and NSL-KDD, are used to demonstrate the performance of PAID. Our deep experiments prove that PAID obtains the same remarkable precision and F1-score of 99.97% and 99.69%, respectively. It also outperforms the other recent methods, and the typical PAID-based inspection time per flow (i.e., 4.89μs/flow) is fast enough to detect and prevent intrusions in real-time for large-scale networks.

Detecting covert channel attacks on cyber‐physical systems

AbstractCyberattacks on cyber‐physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real‐life, providing flexibility and adaptability in detecting new types of attacks.

Intelligent Risk-Based Cybersecurity Protection for Industrial Systems Control—A Feasibility Study

Summary Intelligent automated industrial process control, enabled by IR 4.0 technology, requires increased system integration and connectedness. With such development comes a heightened risk of cyberattack for operational technology (OT) systems, including industrial control systems (ICS) and industrial automation and control systems (IACS), historically shielded from cyberspace. Cyberattacks on OT systems can also impact the physical world. The recent attack on the US Colonial Pipeline interrupted delivery of oil along the US West coast for several days, resulting in a declaration of a state of emergency, while the Ukraine power grid attacks interrupted electrical power supply in Kyiv, impacting thousands of consumers. In 2021, an Equinor-operated platform on the Norwegian Continental shelf was hit by malware. The incident had the potential to affect the drilling control system (DCS). For ICS, the concern is ensuring a safe process, as opposed to the more traditional concern with data protection for information technology (IT) system management. To ensure safe implementation of advanced industrial systems control, while avoiding unnecessary operational downtime, there is a need for cybersecurity solutions that account for risk for the whole cyberphysical system (CPS), including the ICS, the work environment, the product, and the physical surroundings. Diagnostic models and methods must therefore be developed that cover the functionality of the whole CPS. Further, to account for process dynamics and evolving cyberattack threats, adaptability is required with respect to both process state and new types of attacks. For this purpose, knowledge-based awareness monitoring combined with existing cyberattack detection tools for ICS, known as ICS intrusion detection systems (IDS), is proposed, providing an element of artificial intelligence. Results from studies in a DCS environment indicate that existing monitoring applications can be used to detect and discern between different types of cyberattacks on CPSs. This indicates feasibility with respect to monitoring the control and IT components of the ICS system for building risk-based cybersecurity decision support solutions. The key challenge and novelty of the proposed approach is to extend the capability of cybermonitoring in systems control to automated evaluation of process risk, including risk to the physical environment. Such capability will enable appropriate decision support with respect to both process risk and operational downtime.

Targeted Context-Based Attacks on Trust Management Systems in IoT

Trust management systems play an important role in Internet of Things (IoT) by providing a means of finding whether a given device can provide a service to a satisfactory level, and for identifying potentially malicious devices in the network. Context awareness extends trust models by allowing a trustor to filter and aggregate evidence by their relevance to the current situation. Context awareness is important in the formulation of trust in IoT networks due to their heterogeneity and due to the dynamic changes in the capabilities of IoT devices. In this paper, we have proposed a new type of attack on context aware trust models for IoT systems, context-based attacks. In this attack, an adversary manipulates the context to impact a target group of IoT devices, while other devices in non-targeted groups are not even aware of the attack. We have demonstrated the effectiveness of this new type of attack on seven previously proposed trust models through practical simulations and theoretical proofs. This paper also proposes a new trust management system that can mitigate such context-based attacks.

DDoS Attack Detection using ML

Abstract: DDoS attacks are an attempt to prevent the service from being unavailable by overloading the server with malicious traffic. In the past few years, distributed denial of service attacks is becoming the most difficult and burdensome problem. The number and magnitude of attacks have increased from few megabytes of data to 100s of terabytes of data these days. As there are different attack patterns or new types of attacks, it is difficult to detect such attacks effectively. New techniques for generating and mitigating distributed denial of service attacks have been developed in the present paper, which demonstrate that they are far superior to those currently used. In addition, in order to carry out a thorough investigation of the challenges presented by distributed denial of service attacks, we classify DDoS attack methods and techniques used for their detection. We're comparing the attack module to a few other tools out there.

ANOMALY DETECTION IN ZIGBEE-BASED IOT USING SECURE AND EFFICIENT DATA COLLECTION

This article outlines various techniques for detecting types of attacks that may arise in ZigBee-based IoT system. The researchers introduced a hybrid Intrusion Detection System (IDS), combining rule-based intrusion detection and machine learning-based anomaly detection. Rule-based attack detection techniques are used to provide an accurate detection method for known attacks. However, determining accurate detection rules requires significant human effort that is susceptible to error. If it is done incorrectly, it can result in false alarms. Therefore, to alleviate this potential problem, the system is being upgraded by combining it (hybrid) with machine learning-based anomaly detection. This article expounds the researchers’ IDS implementation covering a wide variety of detection techniques to detect both known attacks and potential new types of attacks in ZigBee-based IoT system. Furthermore, a safe and efficient meth-od for large-scale IDS data collection is introduced to provide a trusted reporting mechanism that can operate on the stringent IoT resource requirements appropriate to today's IoT systems.

INTRUSION DETECTION SYSTEM FOR ZIGBEE-BASED IOT USING DATA ANALYSIS RULES

The market for Internet of Things (IoT) products and services has grown rapidly. It has been predicted that the deployment of these IoT applications will grow exponentially in the near future. However, the rapid growth of IoT brings new security risks and potentially opens new types of attacks for systems and networks. This article outlines various techniques for detecting known attacks in ZigBee-based IoT systems. We introduced an Detection System (IDS) specific for ZigBee using data analytics method, that are used to provide an accurate detection method for known attacks. This article looks at our IDS implementation covering a wide variety of detection techniques to detect known attacks ZigBee IoT systems.

INVESTIGATION AND PENETRATION OF DIGITAL ATTACKS ON ZIGBEE-BASED IOT SYSTEMS

The market for Internet of Things (IoT) products and services has grown rapidly. It has been predicted that the deployment of these IoT applications will grow exponentially in the near future. However, the rapid growth of IoT brings new security risks and potentially opens up new types of attacks for systems and networks. This article outlines various techniques to carry out attacks on ZigBee-based IoT systems. We conducted penetration experiments on various possible attacks on Zigbee-based IoT. The purpose of this experiment’s results is for reference in developing an Intrusion Detection System (IDS) specifically for ZigBee-based IoT.

Reputation Systems: A framework for attacks and frauds classification

Reputation and recommending systems have been widely used in e-commerce, as well as online collaborative networks, P2P networks and many other contexts, in order to provide trust to the participants involved in the online interaction. Based on a reputation score, the e-commerce user feels a sense of security, leading the person to trust or not when buying or selling. However, these systems may give the user a false sense of security due to their gaps. This article discusses the limitations of the current reputation systems in terms of models to determine the reputation score of the users. We intend to contribute to the knowledge in this field by providing a systematic overview of the main types of attack and fraud found in those systems, proposing a novel framework of classification based on a matrix of attributes. We believe such a framework could help analyse new types of attacks and fraud. Our work was based on a systematic literature review methodology.