New Types Of Attacks Research Articles

Computer attack technology for gaining access based on remote implementation of a document template

The article examines the technology of a new type of attack using viruses that are remotely introduced into Microsoft Word document templates. Microsoft Word has a feature that allows the user to create a document with a template. Whenever a Word document with a template is written/read, those templates are downloaded/used from the local or remote machine. In this way, attackers can place a Word document template (.dotm) file with malicious macros on their servers. Every time a victim opens a Word document, the document receives a malicious template from the attacker's server and executes it. The attack algorithm and methods of countering such attacks have been studied.

A hybrid deep learning-based intrusion detection system for IoT networks.

The Internet of Things (IoT) is a rapidly evolving technology with a wide range of potential applications, but the security of IoT networks remains a major concern. The existing system needs improvement in detecting intrusions in IoT networks. Several researchers have focused on intrusion detection systems (IDS) that address only one layer of the three-layered IoT architecture, which limits their effectiveness in detecting attacks across the entire network. To address these limitations, this paper proposes an intelligent IDS for IoT networks based on deep learning algorithms. The proposed model consists of a recurrent neural network and gated recurrent units (RNN-GRU), which can classify attacks across the physical, network, and application layers. The proposed model is trained and tested using the ToN-IoT dataset, specifically collected for a three-layered IoT system, and includes new types of attacks compared to other publicly available datasets. The performance analysis of the proposed model was carried out by a number of evaluation metrics such as accuracy, precision, recall, and F1-measure. Two optimization techniques, Adam and Adamax, were applied in the evaluation process of the model, and the Adam performance was found to be optimal. Moreover, the proposed model was compared with various advanced deep learning (DL) and traditional machine learning (ML) techniques. The results show that the proposed system achieves an accuracy of 99% for network flow datasets and 98% for application layer datasets, demonstrating its superiority over previous IDS models.

Review of Botnet Attack Detection in SDN-Enabled IoT Using Machine Learning.

The orchestration of software-defined networks (SDN) and the internet of things (IoT) has revolutionized the computing fields. These include the broad spectrum of connectivity to sensors and electronic appliances beyond standard computing devices. However, these networks are still vulnerable to botnet attacks such as distributed denial of service, network probing, backdoors, information stealing, and phishing attacks. These attacks can disrupt and sometimes cause irreversible damage to several sectors of the economy. As a result, several machine learning-based solutions have been proposed to improve the real-time detection of botnet attacks in SDN-enabled IoT networks. The aim of this review is to investigate research studies that applied machine learning techniques for deterring botnet attacks in SDN-enabled IoT networks. Initially the first major botnet attacks in SDN-IoT networks have been thoroughly discussed. Secondly a commonly used machine learning techniques for detecting and mitigating botnet attacks in SDN-IoT networks are discussed. Finally, the performance of these machine learning techniques in detecting and mitigating botnet attacks is presented in terms of commonly used machine learning models' performance metrics. Both classical machine learning (ML) and deep learning (DL) techniques have comparable performance in botnet attack detection. However, the classical ML techniques require extensive feature engineering to achieve optimal features for efficient botnet attack detection. Besides, they fall short of detecting unforeseen botnet attacks. Furthermore, timely detection, real-time monitoring, and adaptability to new types of attacks are still challenging tasks in classical ML techniques. These are mainly because classical machine learning techniques use signatures of the already known malware both in training and after deployment.

ILL-IDS: An incremental lifetime learning IDS for VANETs

Vehicle Ad Hoc Network (VANET) is one of the most important approaches for intelligent vehicles to communicate under complex road conditions. However, as a VANET is working under wireless and complex conditions, it is under the threat of various malicious attacks. One efficient solution to counter those attacks is the Intrusion Detection System (IDS), which can detect intrusions to the VANET based on the statistical machine learning method. However, most IDS solutions have a problem that they can only detect the attacks which have already known when the IDS is designed/trained. For unknown attacks, most IDSs become inefficient. A blockchain-based Lifetime Learning IDS (LL-IDS) framework has been designed to address this problem. It applies a blockchain to store uncertain data that an IDS cannot decide and is highly likely to be a new type of attacks. With the help of traditional security agencies such as universities, these uncertain data can be labelled to train the IDS model. The incremental learning models are shown to have a great potential in this scenario. In this paper, we introduces a novel IDS named as incremental IDS based on LL-IDS. Numerical experiments show that the computational time consumption and web payload could be decreased by applying the ILL-IDS to a public VANET dataset.

Multi‐loop networked control system design subject to interchange attack

AbstractThis paper deals with the design problem of multiloop networked control system (NCS) under interchange attack. This is a new type of attack where the transmitted data are swapped between different control loops which can be more destructive than other types of attacks, such as denial‐of‐service (DoS) attack. In this context, multiple sampled‐data control loops are first considered that use a shared communication network for data transmission. Then, the overall closed‐loop systems with the proposed attack are formulated in a unified stochastic delay system. The proposed framework is also applicable to DoS attack. Based on Lyapunov–Krasovskii theory and stochastic analysis techniques, some conditions in terms of linear matrix inequalities (LMIs) are derived for the control design problem. Finally, two inverted pendula are utilized for simulation to show the effectiveness of the proposed method. Also, the effects of DoS attack and interchange attack are compared.

Detection of Unknown Insider Attack on Components of Big Data System: A Smart System Application for Big Data Cluster

Big data applications running on a big data cluster, creates a set of process on different nodes and exchange data via regular network protocols. The nodes of the cluster may receive some new type of attack or unpredictable internal attack from those applications submitted by client. As the applications are allowed to run on the cluster, it may acquire multiple node resources so that the whole cluster becomes slow or unavailable to other clients. Detection of these new types of attacks is not possible using traditional methods. The cumulative network traffic of the nodes must be analyzed to detect such attacks. This work presents an efficient testbed for internal attack generation, data set creation, and attack detection in the cluster. This work also finds the nodes under attack. A new insider attack named BUSY YARN Attack has been identified and analyzed in this work. The framework can be used to recognize similar insider attacks of type DOS where target node(s) in the cluster is unpredictable.

Anomaly Detection Using Supervised learning Techniques in Social Networks

Intrusion detection corresponds to a suite of techniques that are used to identify attacks against computers and network infrastructures. As the cost of the information processing and Internet accessibility falls, more and more organizations are becoming vulnerable to a wide variety of cyber threats. Web mining based intrusion detection techniques generally fall into one of two categories; misuse detection and anomaly detection. In misuse detection, each instance in a data set is labelled as ‘normal’ or ‘intrusive’ and a learning algorithm is trained over the labelled data. These techniques are able to automatically retrain intrusion detection models on different input data that include new types of attacks, as long as they have been labelled appropriately. Evaluation results show that the proposed approach can reduce the number of alerts by 94.32%, effectively improving alert management process. Because of the use of ensemble approach and optimal algorithms in the proposed approach, it can inform network security specialist the state of the monitored network in an online manner.

CoNN-IDS: Intrusion detection system based on collaborative neural networks and agile training

The intrusion detection system (IDS) is the first and the most significant shield in Internet security. Nevertheless, with regard to confronting unknown attacks, such as zero-day attacks, it is difficult for IDS to detect and respond. To address this issue, we have designed a brand-new IDS framework to detect vague attacks and learn new types of attack more effectively based on the collaborative neural network (CoNN-IDS). The framework consists of an unknown attack detection (UAD) module and a malicious behavior parsing (MBP) module, where the autoencoder and the deep neural network serve as the UAD module and the MBP module, respectively. Furthermore, the aggregation strategy based on the DBSCAN algorithm and group decision system is employed to retrain the IDS for long term use. In particular, an agile training mechanism is introduced to enhance the efficiency of our model by retraining low-impact neuron. The experiments have been simulated with two individual datasets to reveal that the new method has a higher accuracy in unknown attack detection and shorter time spent on the retraining phase, which collectively evidence its advancement compared with the general IDS system.

Review Paper on Cyber Security and Types of Cyber Attacks

Cyber attacks have become increasingly dangerous and quite common in world of internet.so the demand of cyber security has been increased to safeguard the information personal data and computer network .now a days everything has been computerized and transaction are done online thus economic reimbursement are increasing due to cyber attacks as the technological evolution comes the progress of cyber-crime increases thus develops the new types of attacks are reported throughout the study the exact number of attack type determination is quite difficult however the most common cyber attacks are described in this article .the aim of this study is to survey and convincing manner review the strength and weakness presented in the field of cyber security. the article aim is to analyze various type of attacks existing to understand the state of being exposed to the possibility of being attacked. The main goal is to handle cyber attacks.

Improvement of attack detection performance on the internet of things with PSO-search and random forest

The presence of the internet of things allows various smart devices to be connected and interact with each other. Although IoT provides benefits in daily activities, however, with the presence of new technologies, IoT is vulnerable to new types of attacks. The massive IoT traffic results in a large number of traffic features and constructs complex network that makes intrusion detection systems (IDSs) require large resources to identify the type of attacks. On the other hand, most of the intrusion detection techniques are not feasible for IoT networks because they require more computing resources for attack detection, while IoT devices have limited computing resources and storage capacity. Thus, a lightweight IDS that has ability to identify new types of attacks is required. This research proposes a hybrid of Panigrahi and PSO-Search approaches to reduce the complexity of the network by eliminating the number of irrelevant features effectively and efficiently and combine with Random Forest optimization method to improve detection performance. The proposed IDS is validated with training and testing data, using hold-out, Stratified k-fold cross-validation, and percentage split test mode on CICIDS-2017 dataset MachineLearningCSV version. The dataset is chosen, as it represents real IoT network traffic data. Experimental results show that the performance improvement of the proposed hybrid IDS is very encouraging. The accuracy rate reaches 99.9 %, with an average Recall value of 1.000.

Defeat Magic with Magic: A Novel Ransomware Attack Method to Dynamically Generate Malicious Payloads Based on PLC Control Logic

The Industrial Control System (ICS) is a public facility that provides services to lots of users; thus, its security has always been a critical factor in measuring its availability. Recently, a new type of attack on ICS has occurred frequently, which realizes the extortion of users by invading the information domain and destroying the physical domain. However, due to the diversity and unavailability of an ICS control logic, the targets of such attacks are usually limited to PCs and servers, leaving more disruptive attack methods unexplored. To contribute more possible attack methods to strengthen the immunity of ICS, in this paper, we propose a novel ransomware attack method named Industrial Control System Automatic Ransomware Constructor (ICS-ARC). Compared to existing ICS ransomware, ICS-ARC can automatically generate an International Electrotechnical Commission (IEC) compliant payload to compromise the Programmable Logic Controller (PLC) without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. To evaluate the attack capability of ICS-ARC, we built a tap water treatment system as the simulation experiment target for verification. The experimental results determine that ICS-ARC can automatically generate malicious code without the control logic and complete the attack against target PLCs. In addition, to assist the related research on future attacks and defenses, we present the statistical results and corresponding analysis of PLC based on Shodan.

Beacon Non-Transmission attack and its detection in intelligent transportation systems

Message dropping by intermediate nodes as well as RF jamming attack have been studied widely in ad hoc networks. In this paper, we thoroughly investigate a new type of attack in intelligent transportation systems (ITS) defined as Beacon Non-Transmission (BNT) attack in which attacker is not an intermediate vehicle, but rather a source vehicle. In BNT attack, a vehicle suppresses the transmissions of its own periodic beacon packets to get rid of the automated driving misbehavior detection protocols running in ITS, or to mount a Denial-of-Service (DoS) attack to cripple the traffic management functionality of ITS. Considering BNT attack as a critical security threat to ITS, we propose two novel and lightweight techniques to detect it. Our first technique bases its detection by assuming a certain distribution of the number of beacons lost from a vehicle while accounting for loss due to channel-error. However, it fails to classify shortish BNT attacks wherein amount of denial and channel-error loss are comparable. Our second technique, suitable for identifying both shortish and longish BNT attacks, considers beacon loss pattern of a vehicle as a time-series data and employs autocorrelation function (ACF) to determine the existence of an attack. In order to trade-off detection accuracy for equitable use of limited computational resources, we propose a random inspection model in which the detection algorithm is executed at random time instances and for randomly selected set of vehicles. We have performed extensive simulations to evaluate the performance of proposed detection algorithms under random inspection and a practical attacker model. The results obtained corroborate the lightweight nature of both techniques, and the efficacy of ACF based technique over simple threshold based technique in terms of higher detection accuracy as well as smaller reaction delay.

A Quantum-Based Signcryption for Supervisory Control and Data Acquisition (SCADA) Networks

Supervisory Control and Data Acquisition (SCADA) systems are ubiquitous in industrial control processes, such as power grids, water supply systems, traffic control, oil and natural gas mining, space stations and nuclear plants. However, their security faces the threat of being compromised due to the increasing use of open-access networks. Furthermore, one of the research gaps involves the emergence of quantum computing, which has exposed a new type of risk to SCADA systems. Failure to secure SCADA systems can lead to catastrophic consequences. For example, a malicious attack can take control of the power supply to a city, shut down the water supply system, or cause malfunction of a nuclear reactor. The primary purpose of this paper is to identify the new type of attack based on quantum computing and design a novel security scheme to defend against traditional attacks as well as the quantum attack. The methodology of the proposed signcryption is built on the foundation of the classical Bennett and Brassard 1984 (BB84) cryptographic scheme and does not involve computationally expensive third-party validation. The proposed signcryption scheme provides both encryption and intrusion detection. In particular, it detects the man-in-the-middle attack that can lead to other types of attacks. We have simulated the proposed algorithm using the Quantum Information Toolkit in Python. Furthermore, we have validated and analyzed the proposed design through security verification tools, namely, Scyther and PRISM.

Generating a benchmark cyber multi-step attacks dataset for intrusion detection

Nowadays, with the rapid increase in the number of applications and networks, the number of cyber multi-step attacks has been increasing exponentially. Thus, the need for a reliable and acceptable Intrusion Detection System (IDS) solution is becoming urgent to protect the networks and devices. However, implementing a robust IDS needs a reliable and up-to-date dataset in order to capture the behaviors of the new types of attacks especially a multi-step attack. In this paper, a new benchmark Multi-Step Cyber-Attack Dataset (MSCAD) is introduced. MSCAD includes two multi-step scenarios; the first scenario is a password cracking attack, and the second attack scenario is a volume-based Distributed Denial of Service (DDoS) attack. The MSCAD was assessed in two manners; firstly, the MSCAD was used to train IDS. Then, the performance of IDS was evaluated in terms of G-mean and Area Under Curve (AUC). Secondly, the MSCAD was compared with other free open-source and public datasets based on the latest keys criteria of a dataset evaluation framework. The results show that IDS-based MSCAD achieved the best performance with G-mean 0.83 and obtained good accuracy to detect the attacks. Besides, the MSCAD successfully passing twelve keys criteria.

Amplification trojan network: Attack deep neural networks by amplifying their inherent weakness

Recent works found that deep neural networks (DNNs) can be fooled by adversarial examples, which are crafted by adding adversarial noise on clean inputs. The accuracy of DNNs on adversarial examples will decrease as the magnitude of the adversarial noise increase. In this study, we show that DNNs can be also fooled when the noise is very small under certain circumstances. This new type of attack is called Amplification Trojan Attack (ATAttack). Specifically, we use a trojan network to transform the inputs before sending them to the target DNN. This trojan network serves as an amplifier to amplify the inherent weakness of the target DNN. The target DNN, which is infected by the trojan network, performs normally on clean data while being more vulnerable to adversarial examples. Since it only transforms the inputs, the trojan network can hide in DNN-based pipelines, e.g. by infecting the pre-processing procedure of the inputs before sending them to the DNNs. This new type of threat should be considered in developing safe DNNs.

Network Intrusion Detection With Auto-Encoder and One-Class Support Vector Machine

Recent advances in machine learning have shown promising results for detecting network intrusion through supervised machine learning. However, such techniques are ineffective for new types of attacks. In the preferred unsupervised and semi-supervised cases, these newer techniques suffer from lower accuracy and higher rates of false alarms. This work proposes a machine learning model that combines auto-encoder with one-class support vectors machine. In this model, the auto-encoders learn the representation of the input data in a latent space and reduces the dimensionality of the input data. The dimensionality-reduced input is then extracted from the auto-encoder and passed to a one-class support vectors machine to classify the network event as an attack or a normal event. The model is trained on normal network events only. The proposed model is then evaluated and compared with several existing models. It achieves high accuracy when tested on the NSL-KDD and KDD99 datasets, with total accuracies of 96.24% and 99.45%, respectively.

Evolution of IoT Security: The Era of Smart Attacks

Internet of Things devices have become the new privileged targets for cyberattackers in recent years. This is in part due to the amount of sensitive data they provide. In parallel, security systems are becoming more and more robust with the help of machine learning (ML) algorithms. However, this advance can also benefit malicious people. In recent years, ML-based smart attacks have emerged and are significantly changing the threat landscape. This article focuses on the point of view of the attacker. We have designed a new attack framework based on Markov chain theory. The goal of this latter is to maximize the success probability of attacks while minimizing energy consumption. We tested this framework on both passive and active jamming attacks, thus exhibiting the effectiveness of our approach when compared against basic eavesdropping and jamming attacks. We show that this new type of attack can cut by half the energy consumption of an eavesdropping attack, while maintaining 88 percent attack efficiency.

GANBA: Generative Adversarial Network for Biometric Anti-Spoofing

Automatic speaker verification (ASV) is a voice biometric technology whose security might be compromised by spoofing attacks. To increase the robustness against spoofing attacks, presentation attack detection (PAD) or anti-spoofing systems for detecting replay, text-to-speech and voice conversion-based spoofing attacks are being developed. However, it was recently shown that adversarial spoofing attacks may seriously fool anti-spoofing systems. Moreover, the robustness of the whole biometric system (ASV + PAD) against this new type of attack is completely unexplored. In this work, a new generative adversarial network for biometric anti-spoofing (GANBA) is proposed. GANBA has a twofold basis: (1) it jointly employs the anti-spoofing and ASV losses to yield very damaging adversarial spoofing attacks, and (2) it trains the PAD as a discriminator in order to make them more robust against these types of adversarial attacks. The proposed system is able to generate adversarial spoofing attacks which can fool the complete voice biometric system. Then, the resulting PAD discriminators of the proposed GANBA can be used as a defense technique for detecting both original and adversarial spoofing attacks. The physical access (PA) and logical access (LA) scenarios of the ASVspoof 2019 database were employed to carry out the experiments. The experimental results show that the GANBA attacks are quite effective, outperforming other adversarial techniques when applied in white-box and black-box attack setups. In addition, the resulting PAD discriminators are more robust against both original and adversarial spoofing attacks.

An Efficient Hyperparameter Control Method for a Network Intrusion Detection System Based on Proximal Policy Optimization

The complexity of network intrusion detection systems (IDSs) is increasing due to the continuous increases in network traffic, various attacks and the ever-changing network environment. In addition, network traffic is asymmetric with few attack data, but the attack data are so complex that it is difficult to detect one. Many studies on improving intrusion detection performance using feature engineering have been conducted. These studies work well in the dataset environment; however, it is challenging to cope with a changing network environment. This paper proposes an intrusion detection hyperparameter control system (IDHCS) that controls and trains a deep neural network (DNN) feature extractor and k-means clustering module as a reinforcement learning model based on proximal policy optimization (PPO). An IDHCS controls the DNN feature extractor to extract the most valuable features in the network environment, and identifies intrusion through k-means clustering. Through iterative learning using the PPO-based reinforcement learning model, the system is optimized to improve performance automatically according to the network environment, where the IDHCS is used. Experiments were conducted to evaluate the system performance using the CICIDS2017 and UNSW-NB15 datasets. In CICIDS2017, an F1-score of 0.96552 was achieved and UNSW-NB15 achieved an F1-score of 0.94268. An experiment was conducted by merging the two datasets to build a more extensive and complex test environment. By merging datasets, the attack types in the experiment became more diverse and their patterns became more complex. An F1-score of 0.93567 was achieved in the merged dataset, indicating 97% to 99% performance compared with CICIDS2017 and UNSW-NB15. The results reveal that the proposed IDHCS improved the performance of the IDS by automating learning new types of attacks by managing intrusion detection features regardless of the network environment changes through continuous learning.

An Intelligent Approach for Intrusion Detection using Convolutional Neural Network

Intrusion Detection Systems (IDS) is one of the important aspects of cyber security that can detect the anomalies in the network traffic. IDS are a part of Second defense line of a system that can be deployed along with other security measures such as access control, authentication mechanisms and encryption techniques to secure the systems against cyber-attacks. However, IDS suffers from the problem of handling large volume of data and in detecting zero-day attacks (new types of attacks) in a real-time traffic environment. To overcome this problem, an intelligent Deep Learning approach for Intrusion Detection is proposed based on Convolutional Neural Network (CNN-IDS). Initially, the model is trained and tested under a new real-time traffic dataset, CSE-CIC-IDS 2018 dataset. Then, the performance of CNN-IDS model is studied based on three important performance metrics namely, accuracy / training time, detection rate and false alarm rate. Finally, the experimental results are compared with those of various Deep Discriminative models including Recurrent Neural network (RNN), Deep Neural Network (DNN) etc., proposed for IDS under the same dataset. The Comparative results show that the proposed CNN-IDS model is very much suitable for modelling a classification model both in terms of binary and multi-class classification with higher detection rate, accuracy, and lower false alarm rate. The CNN-IDS model improves the accuracy of intrusion detection and provides a new research method for intrusion detection.