Attack Detection Problem Research Articles

An Efficient Spoofing Attack Detection Using Deep Learning Based Physical Layer Security Technique

Spoofing attack detection plays a crucial role in the defence field, involving critical and highly secured data processing. The accurate attack detection mechanism prevents unauthorised access to sensitive information, thereby protecting National security. Physical Layer Security (PLS) is a promising emerging technique that uses the wireless channel’s randomness to secure the communication network. The spoofing attack is one of the severe threats to the wireless network, where the attacker imitates the legitimate user to launch an attack against the network. This paper investigates the channel characteristics-based physical layer technique to detect spoofing attacks. For static radio environments, the two-sample independent hypothesis testing is used to identify the spoofing attack, showing an improvement in detection accuracy of 97 %. The attack detection problem is considered a Reinforcement Learning (RL) based classification problem for a challenging dynamic radio environment. It is simulated using the actor-critic-based Deep Reinforcement Learning (DRL) technique with the help of the Reformed Deep Deterministic Policy Gradient (Re-DDPG) algorithm. The simulated results show that the proposed method performs better than the existing strategies and achieves a Receiver Operating Characteristics (ROC) value of 0.96. The detection accuracy of the proposed method can reach up to 98 %, with precision and recall of about 98 % and 99 %, respectively.

Clustering-based attack detection for adversarial reinforcement learning

Detecting malicious attacks presents a major challenge in the field of reinforcement learning (RL), as such attacks can force the victim to perform abnormal actions, with potentially severe consequences. To mitigate these risks, current research focuses on the enhancement of RL algorithms with efficient detection mechanisms, especially for real-world applications. Adversarial attacks have the potential to alter the environmental dynamics of a Markov Decision Process (MDP) perceived by an RL agent. Leveraging these changes in dynamics, we propose a novel approach to detect attacks. Our contribution can be summarized in two main aspects. Firstly, we propose a novel formalization of the attack detection problem that entails analyzing modifications made by attacks to the transition and reward dynamics within the environment. This problem can be framed as a context change detection problem, where the goal is to identify the transition from a “free-of-attack” situation to an “under-attack” scenario. To solve this problem, we propose a groundbreaking “model-free” clustering-based countermeasure. This approach consists of two essential steps: first, partitioning the transition space into clusters, and then using this partitioning to identify changes in environmental dynamics caused by adversarial attacks. To assess the efficiency of our detection method, we performed experiments on four established RL domains (grid-world, mountain car, carpole, and acrobot) and subjected them to four advanced attack types. Uniform, Strategically-timed, Q-value, and Multi-objective. Our study proves that our technique has a high potential for perturbation detection, even in scenarios where attackers employ more sophisticated strategies.

CYBERSECURITY: RESEARCH ON METHODS FOR DETECTING DDOS ATTACKS

This article describes the problem of DDoS attacks, analyzing their nature and consequences. The paper covers common DDoS attack types, such as SYN flood, ICMP flood, UDP flood. Existing methods for detecting attacks from literature are reviewed, including machine learning approaches, including artificial neural networks, support vector machines and decision trees. The paper introduces a decision tree-based machine learning model for the detection of DDoS attacks. The model is trained and tested on a publicly available dataset. The dataset consists of 1,04,345 rows of data, where every row includes 23 features, such as source IP, destination IP, port number, number of bytes transferred from the switch port, etc. A similar set of characteristics can be obtained on a real network hardware using simple calculations, which makes it possible to approximate the model evaluation to real operating conditions. SYN flood, ICMP flood and UDP flood attack types are present in the data, as well as legitimate traffic. To avoid overfitting, only some columns were used, and columns such as IP addresses were discarded. The field “label” in each row of the dataset contains either 0 or 1 where 0 corresponds to legitimate traffic and 1 to malicious one. The problem of DDoS attack detection is therefore formally reduced to the task of binary classification of each row from the dataset. The constructed model achieves an average classification accuracy of 0.94 with a standard deviation at the level of 0.06 in detecting the above mentioned types of attacks. To objectively assess the effectiveness of the model and avoid distortion of the results, stratified 5-fold cross-validation was used. The developed model can be applied in the real world network hardware to filter malicious packets or as a tool for warning the administrator about an attack. This research advances cybersecurity by enhancing DDoS attack detection.

Fuzzy decision-making framework for explainable golden multi-machine learning models for real-time adversarial attack detection in Vehicular Ad-hoc Networks

This paper addresses various issues in the literature concerning adversarial attack detection in Vehicular Ad-hoc Networks (VANETs). These issues include the failure to consider both normal and adversarial attack perspectives simultaneously in Machine Learning (ML) model development, the lack of diversity preprocessing techniques for VANETs communication datasets, the inadequate selection guidelines for real-time adversarial attack detection models, and the limited emphasis on explainability in adversarial attack detection. In this study, we propose an original fuzzy decision-making framework that incorporates multiple fusion standpoints. Our framework aims to evaluate multi-ML models for real-time adversarial attack detection in VANETs, focusing on three stages. The first stage involves identifying and preprocessing Dedicated Short-Range Communication (DSRC) data using standard and fusion preprocessing approaches. Two communication scenarios, normal and jammed, are considered, resulting in two DSRC datasets. In the second stage, we develop multi-ML models based on the DSRC datasets using standard preprocessing and feature fusion preprocessing for dataset-1 and dataset-2, respectively. The third stage evaluates the multi-ML models using a fuzzy decision-making approach based on the Fuzzy Decision by Opinion Score Method (FDOSM) and an adversarial attack decision fusion matrix. The External Fusion Decision (EFD) settings of the FDOSM address individual ranking variance, provide a unique rank and select the best model. Experimental results demonstrate that the K-Nearest Neighbors Algorithm (kNN) model achieves the highest explain score of 0.2048 in dataset-1 using standard preprocessing, while the Random Forest (RF) model applied to dataset-2 using fusion preprocessing emerges as the most robust and golden model against adversarial attacks, with a score of 0.1819. This finding suggests that the fusion preprocessing approach using Principal Component Analysis (PCA) is more suitable for addressing normal and adversarial attack perspectives. Furthermore, our fuzzy framework undergoes evaluation in terms of systematic rank, sensitivity analysis, explainability analysis, and comparison analysis. Overall, this framework provides valuable insights for researchers and practitioners in VANETs, informing the execution, selection, and interpretation of multi-ML models to tackle adversarial attack detection problems effectively. The new fuzzy framework demonstrates that multi-ML models based on feature fusion preprocessing are more effective.

False Data-Injection Attack Detection in Cyber-Physical Systems With Unknown Parameters: A Deep Reinforcement Learning Approach.

This article studies the detection of discontinuous false data-injection (FDI) attacks on cyber-physical systems (CPSs). Considering the unknown stochastic properties of the process noise and measurement noise, deep reinforcement learning is applied to designing an FDI attack detector. First, the discontinuous attack detection problem is modeled as a partially observable Markov decision process (POMDP) and a neural network is used to explore the POMDP. In the network, sliding observation windows which are composed of the offline fragment historical data are used as the input. An approach to designing the reward in POMDP is provided to ensure the precision of the detection when there are even some state recognition errors. Second, sufficient conditions on attack frequency and duration to guarantee the applicability of the detector and the expected estimation performance are further given. Finally, simulation examples illustrate the effectiveness of the attack detector.

Detection and Identification of Sparse Sensor Attacks in Cyber-Physical Systems With Side Information

This paper investigates the attack detection and identification problem for cyber physical systems under sparse sensor attacks. A novel candidate set construction algorithm, where only partial combinations of different channels are checked, is proposed to efficiently generate the candidate set containing all the possible sets of corrupted channels under stealthy attacks. Besides, through introducing a unified attack model which precisely characterizes the attack performance and stealthiness, necessary and sufficient conditions for the existence of undetectable/unidentifiable attacks are proposed. Based on the obtained conditions, a novel attack detection and identification strategy is proposed. Compared with the existing methods focusing only on the measurements, more attacks can be detected/identified through introducing side information and the reliability of detector is enhanced through making full use of the attack performance analysis result. Finally, a numerical simulation is provided to illustrate the correctness and effectiveness of the proposed conditions and methods.

Adaptive robust FDI attack detection for cyber–physical​ systems with disturbance

This paper investigates the problem of attack detection for cyber–physical systems (CPSs) with disturbances, measurement noises, and false data injection (FDI) attacks. A classical linear discrete-time system attack model is constructed and a robust attack detector based on the mixed H_/H ∞ is designed. Firstly, a system with an actuator that suffered a malicious attack is modeled. Then, a robust attack detector based on the mixed H_/H ∞ is designed in which the H_ index and H ∞ index are used to characterize the sensitivity to attacks and robustness to disturbances and measurement noises, respectively. And an adaptive detection threshold with a compensation term is proposed. Besides, the designed robust attack detector enables the attack detection dynamic system to be asymptotically stable and to guarantee the H_/H ∞ performance, and the robust attack detector gains are solved from a convex optimization. Finally, the obtained theoretical results are validated through a numerical simulation and a three-area power system simulation.

Attacks detection and security control for cyber-physical systems under false data injection attacks

This paper is concerned with the attack detection and security control problem for discrete-time nonlinear cyber-physical systems (CPSs) under false data injection (FDI) attacks, which can bypass the traditional error detection mechanism. With the help of the T–S fuzzy models, a novel robust extended state observer with H∞ performance is proposed to estimate this kind of attack. The attacks are included inside the observer as an internal state variable and the estimation of the FDI attack can be obtained from the outputs of the observer. By utilizing the observation of the FDI attack, a compensator is designed to negate the attack. Additionally, a controller is proposed to bring on the attack ineffective. Finally, simulation examples are given to illustrate the effectiveness of the developed schemes.

Survey on Different Morphology Detection Techniques

There is a lot of data traffic that translates and transports data in the digital environment of the World Wide Web. The data is presented as files and photos. Data can morph, so it's important to detect these instances. The suggested method will identify modified photographs and alert the user to the validity of the images. In recent years, the research community has paid a great deal of attention to the problem of morph attack detection. To accurately detect morph attacks, various studies have been done in this area and various methods have been used. Although enough morph images are not readily available for research purposes, a variety of face databases are used to create morph image databases. Attack detection via face morphing is difficult. Automated border control gates utilize both manual inspection and automatic categorization methods to identify morphing attacks. It is vital to comprehend how a machine learning system can recognise altered faces and the most pertinent facial regions.

The detection mechanism for false data injection attack via the ellipsoidal set‐membership approach

AbstractThe false data injection (FDI) attack detection problem in cyber‐physical systems (CPSs) is investigated in this paper. A novel attack detection algorithm is proposed based on the ellipsoidal set‐membership approach. In comparison to the existing FDI attack detection methods, the developed attack detection approach in this paper neither requires predefined thresholds nor specific statistical characteristics of the attacks. In order to guarantee that the estimation ellipsoid contains normal states despite the unknown but bounded (UBB) process and measurement noises, the one‐step ellipsoidal set‐membership estimation method is put forward. In addition, a convex optimization algorithm is introduced to calculate the gain matrix of the observer recursively. Moreover, with the help of the state estimation ellipsoid, the residual ellipsoid can be obtained for attack detection. Whether a detector can detect the FDI attack depends on the relationship between the residual value and residual ellipsoidal set. Finally, the effectiveness of the proposed method is demonstrated by a numerical simulation example.

Proactive attack detection scheme based on watermarking and moving target defense

In this paper, the attack detection problem is investigated for cyber–physical systems (CPSs) with unknown-but-bounded (UBB) noises. A new hybrid proactive detection scheme is proposed to detect stealthy attacks by combining watermarking and moving target (MT). The designed abnormal detector is based on the residual of the zonotopic observer which can be utilized to estimate states of the system with UBB noises. We prove that the approach proposed in this work does not introduce any performance loss in the absence of attacks. The proposed active detection framework can be employed to detect various types of attacks, such as denial-of-service (DoS), replay and covert attacks. Finally, numerical examples are provided to demonstrate the effectiveness of the proposed methods.

Dynamic load altering attack detection for cyber physical power systems via sliding mode observer

In this paper, the attack detection problem of smart grid under dynamic load altering attack (DLAA) is investigated. An attack detection scheme based on deviation signal is proposed. The system model is described by generator swing equation and power flow DC equation, and the PI controller model is considered in the model input. For state estimation, H∞ performance index is used to enhance the robustness of sliding mode observer against attacks. Then, an attack detection logic is designed to detect attacks by comparing the deviation signal and threshold. Finally, the proposed attack detection scheme is verified by numerical simulations, and the feasibility of the proposed algorithm in reality is verified by StaeSim hardware-in-the-loop simulation platform.

Real-time detection of stealthy IoT-based cyber-attacks on power distribution systems: A novel anomaly prediction approach

IoT-enabled appliances are essential components in the development of modern smart homes and cities as they offer energy-efficient solutions that bring comfort to customers, resulting in a better quality of life. Despite the advantages, these smart appliances also present new privacy and security challenges that create vulnerabilities in both smart homes and Power Distribution Systems (PDSs), ultimately affecting their efficiency and reliability. Hence, identifying the security risks linked with behind-the-meter (BTM) IoT-enabled appliances is crucial to develop appropriate countermeasures for safeguarding the PDSs. Previous studies have primarily focused on developing countermeasures for attacks on utility-scale domains, while the problem of attack detection has been largely neglected in the literature. This paper fills the gap by presenting a stealthy attack model applied to a group of compromised IoT-enabled appliances manipulating their operation to deteriorate the power quality of a PDS. The presented attack minimizes the chance of getting detected by maintaining the operating conditions of such appliances within the consumers’ comfort levels. Then, a novel real-time anomaly detection and prediction method is proposed based on demand power spectrum analysis and Long-short-term memory (LSTM) neural networks. Further, a Feeder Loading Abnormal Power Spectrum (FLAPS) index is introduced and utilized to estimate the attack onset time, which is then reported to the PDS’s operator for further investigation and action. The evaluation of the stealthy attack model and the anomaly prediction approach is carried out on a residential community modeled using the IEEE-13 bus power distribution feeder, which exhibits various power consumption patterns and appliance operation schedules. The effects of the proposed stealthy attack on the PDS are analyzed quantitatively by examining the occurrences of voltage violations and the wear and tear of the line voltage regulator (LVR) of the system. Numerical results show that compromising only 5% of the PDS’s load, the LVR operates 1.8 more times than during normal conditions. This impact increases to 8 times at 50% compromised load with many voltage violation cases. Also, the simulation results demonstrate the superiority of the proposed prediction technique to detect stealthy attacks 50% faster than threshold-based approaches, thereby enabling the system’s operator to take faster actions.

Event‐triggered attack detection and state estimation based on Gaussian mixture model

AbstractUnder the framework of event‐triggered transmission mechanism, the problem of attack detection and state estimation of multi‐sensor linear time‐invariant systems under static attacks is considered. First, for each transmission channel, the sensor collects measurement information according to an event‐triggered mechanism to reduce unnecessary energy consumption. Then, inspired by the clustering algorithm in machine learning, a detection mechanism based on Gaussian mixture model, which can set a confidence level for the measurement of each sensor is proposed. Finally, centralised data fusion is performed according to the results of attack detection and event‐triggered judgement to realise remote state estimation. A numerical example proves that the proposed algorithm can locate the damaged sensor, save the network transmission bandwidth under the premise of ensuring accuracy and efficiency of sensor estimation.

Sparse Actuator Attack Detection and Identification: A Data-Driven Approach.

This article aims to investigate the data-driven attack detection and identification problem for cyber-physical systems under sparse actuator attacks, by developing tools from subspace identification and compressive sensing theories. First, two sparse actuator attack models (additive and multiplicative) are formulated and the definitions of I/O sequence and data models are presented. Then, the attack detector is designed by identifying the stable kernel representation of cyber-physical systems, followed by the security analysis of data-driven attack detection. Moreover, two sparse recovery-based attack identification policies are proposed, with respect to sparse additive and multiplicative actuator attack models. These attack identification policies are realized by the convex optimization methods. Furthermore, the identifiability conditions of the presented identification algorithms are analyzed to evaluate the vulnerability of cyber-physical systems. Finally, the proposed methods are verified by the simulations on a flight vehicle system.

Survey on Different Morphology Detection Techniques

Abstract: There is a lot of data traffic that translates and transports data in the digital environment of the World Wide Web. The data is presented as files and photos. Data can morph, so it's important to detect these instances. The suggested method will identify modified photographs and alert the user to the validity of the images. In recent years, the research community has paid a great deal of attention to the problem of morph attack detection. To accurately detect morph attacks, various studies have been done in this area and various methods have been used. Although enough morph images are not readily available for research purposes, a variety of face databases are used to create morph image databases. Attack detection via face morphing is difficult. Automated border control gates utilize both manual inspection and automatic categorization methods to identify morphing attacks. It is vital to comprehend how a machine learning system can recognise altered faces and the most pertinent facial regions.

Decentralized attack detection for multi‐area power systems via interconnection‐decoupled sliding mode observer

AbstractThis article deals with the false data injection attack (FDIA) detection problem for multi‐area power systems. Considering the large‐scale characteristic of the multi‐area power systems, a novel decentralized detection scheme is proposed to detect FDIAs. First, an unknown input sliding mode observer (UI‐SMO) is designed to decouple the interconnected terms, meanwhile, a robust term in the UI‐SMO can attenuate the effect of the load variation, by which the obtained residual is only sensitive to local FDIAs. The strict reachability of the sliding surface in the estimate error space is ensured by the robust term with an auxiliary variable, and the stability of the sliding mode dynamics is achieved. Then, a detection logic is delicately designed based on a two‐phase residual threshold. Due to the strong attenuating ability to load variation, the proposed detection scheme shows better detectability than some existing works with only decoupling interconnections. Finally, the theoretical results are backed up by a three‐area power system simulation with comparison between proposed UI‐SMO‐based and traditional UIO‐based detection scheme.

Sequential Detection of Replay Attacks

One of the most studied forms of attacks on the cyber-physical systems is the replay attack. The statistical similarities of the replayed signal and the true observations make the replay attack difficult to detect. In this article, we address the problem of replay attack detection by adding watermarking to the control inputs and then perform resilient detection using cumulative sum (CUSUM) test on the joint statistics of the innovation signal and the watermarking signal, whereas existing work considers only the marginal distribution of the innovation signal. We derive the expression of the Kullback–Liebler divergence (KLD) between the two joint distributions before and after the replay attack, which is, asymptotically, inversely proportional to the detection delay. We perform a structural analysis of the derived KLD expression and suggest a technique to improve the KLD for the systems with relative degree greater than one. A scheme to find the optimal watermarking signal variance for a fixed increase in the control cost to maximize the KLD under the CUSUM test is presented. We provide various numerical simulation results to support our theory. The proposed method is also compared with a state-of-the-art method based on the Neyman–Pearson detector, illustrating the smaller detection delay of the proposed sequential detector.

A dynamic encryption–decryption scheme for replay attack detection in cyber–physical systems

This paper deals with the replay attack detection problem for a class of cyber–physical systems. A dynamic encryption–decryption scheme is proposed with the purpose of detecting the replay attacks launched by the malicious adversary. First, a new attack model is established to describe the periodic replay attacks that are generated by making use of a series of recorded past measurements. Then, the stealthiness is discussed for the proposed replay attack scheme against the χ2 detector. Subsequently, on basis of the established model, a dynamic encryption–decryption scheme is developed without sacrificing any system performance, guaranteeing 100% detection probability in the occurrence of attacks. Finally, a simulation example is provided to firstly verify the stealthiness of the proposed replay attack and secondly demonstrate the effectiveness of the exploited dynamic encryption–decryption detection algorithm.

Detection of Actuator Enablement Attacks by Petri Nets in Supervisory Control Systems

The feedback control system with network-connected components is vulnerable to cyberattacks. We study a problem of attack detection in supervisory control of discrete-event systems. The scenario of a system subjected to actuator enablement attacks is considered in this article. We also consider that some unsafe places that should be protected from an attacker exist in the system, and some controllable events that are disabled by a supervisor might be re-enabled by an attacker. This article proposes a defense strategy to detect actuator enablement attacks and disable all controllable events after detecting an attack. We design algorithmic procedures to determine whether the system can be protected against damage caused by actuator enablement attacks, where the damage is predefined as a set of “unsafe” places. In this way, the system property is called “AE-safe controllability”. The safe controllability can be verified by using a basis diagnoser or a basis verifier. Finally, we explain the approach with a cargo system example.