Proposed Defense Research Articles

Cybersecurity in Critical Infrastructure: Defending Against Nation-State Groups

Cyber-attacks on critical infrastructure can be disastrous and undermine states' national security. Different groups execute these attacks for varying reasons; some may be state-sponsored, and their attack for geopolitical reasons or to achieve strategic national cyber objectives. Regardless of the nation-state actor, it is essential to identify the techniques used and defend critical infrastructure against these attacks. This study evaluated the attack methodology of five nation-state actors based on the MITRE ATT&CK ICS matrix and proposed a multi-layered defense architecture. A virtual organization with critical and enterprise infrastructure domains was created, and the proposed defense architecture and tooling were implemented there. Then, techniques of the nation-state adversaries were emulated against the infrastructure to evaluate the performance of the defense strategies. The results show that the multi-layered approach was sufficient to mitigate all the techniques of the nation-state actors.

Auto encoder-based defense mechanism against popular adversarial attacks in deep learning.

Convolutional Neural Network (CNN)-based models are prone to adversarial attacks, which present a significant hurdle to their reliability and robustness. The vulnerability of CNN-based models may be exploited by attackers to launch cyber-attacks. An attacker typically adds small, carefully crafted perturbations to original medical images. When a CNN-based model receives the perturbed medical image as input, it misclassifies the image, even though the added perturbation is often imperceptible to the human eye. The emergence of such attacks has raised security concerns regarding the implementation of deep learning-based medical image classification systems within clinical environments. To address this issue, a reliable defense mechanism is required to detect adversarial attacks on medical images. This study will focus on the robust detection of pneumonia in chest X-ray images through CNN-based models. Various adversarial attacks and defense strategies will be evaluated and analyzed in the context of CNN-based pneumonia detection. From earlier studies, it has been observed that a single defense mechanism is usually not effective against more than one type of adversarial attack. Therefore, this study will propose a defense mechanism that is effective against multiple attack types. A reliable defense framework for pneumonia detection models will ensure secure clinical deployment, facilitating radiologists and doctors in their diagnosis and treatment planning. It can also save time and money by automating routine tasks. The proposed defense mechanism includes a convolutional autoencoder to denoise perturbed Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) adversarial images, two state- of-the-art attacks carried out at five magnitudes, i.e., ε (epsilon) values. Two pre-trained models, VGG19 and VGG16, and our hybrid model of MobileNetV2 and DenseNet169, called Stack Model, have been used to compare their results. This study shows that the proposed defense mechanism outperforms state-of-the-art studies. The PGD attack using the VGG16 model shows a better attack success rate by reducing overall accuracy by up to 67%. The autoencoder improves accuracy by up to 16% against PGD attacks in both the VGG16 and VGG19 models.

Cyber‐attack and defense method for load frequency control in smart grid systems with electric vehicles

AbstractThe latest advancements in Vehicle‐to‐Grid (V2G) technology enable Electric Vehicles (EVs) to contribute to Frequency Regulation (FR), mitigating the impact of uncertain power fluctuations in renewable resources. However, diverse cyber‐attacks pose threats to the Load Frequency Control (LFC) system and smart grid infrastructure, compromising their accuracy and reliability. This research paper focuses on the effects of cyber‐attacks on frequency regulation in a smart grid system that relies on a communication network. The study proposes a two‐area system and a modified IEEE‐39 bus three‐area system, incorporating intermittent solar photovoltaic and wind turbine sources, traditional conventional sources, and electric vehicles. To ensure frequency stabilization and tie‐line power, the researchers introduce a cascade FOPIDN‐(1+TD) controller. Its parameters are optimized using a novel Quasi Opposition Arithmetic Optimization Algorithm (QOAOA). The proposed approach's dynamic response is compared with other commonly used controllers, demonstrating its effectiveness in maintaining stability. The article focuses on the LFC system and presents a novel approach involving a cyber‐physical model. It introduces a method for detecting and defending against cyber‐attacks using deep learning, specifically utilizing the Long‐Short‐Term‐Memory (LSTM) network. The effectiveness of the proposed defense strategy is demonstrated through experiments conducted on both a two‐area interconnected power system and the IEEE‐39 bus system. The outcomes indicate that the suggested defense mechanism effectively maintains acceptable levels of power system frequency and tie‐line power during cyber‐attacks. Additionally, the validity of the controller's performance is verified through real‐time analysis using Hardware‐In‐The‐Loop (HIL) simulation with the OPAL‐RT platform.

Securing demand–response in smart grids against false pricing attacks

Two-way communication systems in smart grids help to engage consumers in demand–response programs, which can bring many benefits but also make smart grids vulnerable to cyber attacks. In this paper, a cyber attack which aims to disturb the demand–response process by injecting false electricity price signals is considered. A real-time pricing model where the operator has incomplete knowledge of the private demand–response behaviors of the customers is proposed. The vulnerability of the power system to false pricing attacks is analyzed by a Markov decision process, and the dynamic interaction between the attacker and the defender is modeled as a zero-sum Markov game where neither player has full information of the game model. For the solution of the Markov game, a model-free multi-agent reinforcement learning method is proposed to find the Nash Equilibrium policies for both players. The proposed method is applied to the IEEE 34 Node Test Feeder, in which the effect of the defense on mitigating the impact of the attack is demonstrated and different policies of the players given various resources are analyzed. The results shows that the studied cyber attack can cause a maximum of 1.96% unsatisfied load and the proposed defense measure can reduce the unsatisfied load by 50%–70% compared with the cases without defense measures.

Robustness evaluation method and defense strategy of electricity-heat integrated energy system

Even though electricity-heat integrated energy systems (IESs) can improve energy utilization, the faults generated by extreme events can induce more complex and wider impacts. Therefore, it is urgent to study the effective defense strategies associated with electricity-heat IES. Considering the theory of complex networks, a dynamic model was established in this paper which comprehensively considered the actual operating characteristics and cascading failure process of the electricity-heat IES. The structural and functional robustness of the electricity-heat IES after failure was evaluated by link survivability, capacity survivability and power survivability. According to the post-disaster system robustness evaluation results and system characteristics without adopting the defense strategy, the critical links of the system were identified. Also, seven defense strategies were formulated based on the cascading failure mechanism of the electricity-heat IES. The testing network coupled with an improved IEEE118-node power grid and 23-node heat supply network was used to verify the effectiveness of the proposed defense strategy and to provide a theoretical basis for the resilience enhancement strategy and defense resource allocation of the electricity-heat IES.

Fast and Lightweight Vision-Language Model for Adversarial Traffic Sign Detection

Several attacks have been proposed against autonomous vehicles and their subsystems that are powered by machine learning (ML). Road sign recognition models are especially heavily tested under various adversarial ML attack settings, and they have proven to be vulnerable. Despite the increasing research on adversarial ML attacks against road sign recognition models, there is little to no focus on defending against these attacks. In this paper, we propose the first defense method specifically designed for autonomous vehicles to detect adversarial ML attacks targeting road sign recognition models, which is called ViLAS (Vision-Language Model for Adversarial Traffic Sign Detection). The proposed defense method is based on a custom, fast, lightweight, and salable vision-language model (VLM) and is compatible with any existing traffic sign recognition system. Thanks to the orthogonal information coming from the class label text data through the language model, ViLAS leverages image context in addition to visual data for highly effective attack detection performance. In our extensive experiments, we show that our method consistently detects various attacks against different target models with high true positive rates while satisfying very low false positive rates. When tested against four state-of-the-art attacks targeting four popular action recognition models, our proposed detector achieves an average AUC of 0.94. This result achieves a 25.3% improvement over a state-of-the-art defense method proposed for generic image attack detection, which attains an average AUC of 0.75. We also show that our custom VLM is more suitable for an autonomous vehicle compared to the popular off-the-shelf VLM and CLIP in terms of speed (4.4 vs. 9.3 milliseconds), space complexity (0.36 vs. 1.6 GB), and performance (0.94 vs. 0.43 average AUC).

Defense penetration strategy for unmanned surface vehicle based on modified soft actor–critic

This paper investigates the defense penetration problem for unmanned surface vehicle (USV) with limited detection range under unknown defenders. A novel end-to-end defense penetration strategy is proposed for the USV based on modified soft actor–critic (MSAC). Specifically, the state–action space of the attacker is designed by combining the maneuvering model of USV and detection information. To guide the USV to reach the target area under the interception of defenders, the penetration reward is constructed. Then, the long short-term memory network (LSTM) is applied in the actor–critic network design. A dynamic training mechanism is proposed by combining curriculum learning and multi-memory pools, which aims to improve the success rate of defense penetration. Finally, simulation results validate the effectiveness and superiority of the proposed defense penetration method for the USV suffering from unknown defenders. The higher success rate can be guaranteed by using MSAC compared to the previous methods.

Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks

Backdoor attacks have been shown to be a serious security threat against deep learning models, and various defenses have been proposed to detect whether a model is backdoored or not. However, as indicated by a recent black-box attack, existing defenses can be easily bypassed by implanting the backdoor in the frequency domain. To this end, we propose a new defense DTInspector against black-box backdoor attacks, based on a new observation related to the prediction confidence of learning models. That is, to achieve a high attack success rate with a small amount of poisoned data, backdoor attacks usually render a model exhibiting statistically higher prediction confidences on the poisoned samples. We provide both theoretical and empirical evidence for the generality of this observation. DTInspector then carefully examines the prediction confidences of data samples, and decides the existence of backdoor using the shortcut nature of backdoor triggers. Extensive evaluations on six backdoor attacks, four datasets, and three advanced attacking types demonstrate the effectiveness of the proposed defense.

Attack-model-agnostic defense against model poisonings in distributed learning

The distributed nature of distributed learning renders the learning process susceptible to model poisoning attacks. Most existing countermeasures are designed based on a presumed attack model, and can only perform under the presumed attack model. However, in reality a distributed learning system typically does not have the luxury of knowing the attack model it is going to be actually facing in its operation when the learning system is deployed, thus constituting a zero-day vulnerability of the system that has been largely overlooked so far. In this paper, we study the attack-model-agnostic defense mechanisms for distributed learning, which are capable of countering a wide-spectrum of model poisoning attacks without relying on assumptions of the specific attack model, and hence alleviating the zero-day vulnerability of the system. Extensive experiments are performed to verify the effectiveness of the proposed defense.

Crypto Analysis of the Key Distribution Scheme Using Noise-Free Resistances

Known key exchange schemes offering information-theoretic (unconditional) security are complex and costly to implement. Nonetheless, they remain the only known methods for achieving unconditional security in key exchange. Therefore, the explorations for simpler solutions for information-theoretic security are highly justified. Lin et al. [1] proposed an interesting hardware key distribution scheme that utilizes thermal-noise-free resistances and DC voltages. A crypto analysis of this system is presented. It is shown that, if Eve gains access to the initial shared secret at any time in the past or future, she can successfully crack all the generated keys in the past and future, even retroactively, using passively obtained and recorded voltages and currents. Therefore, the scheme is not a secure key exchanger, but it is rather a key expander with no more information entropy than the originally shared secret at the beginning. We also point out that the proposed defense methods against active attacks do not function when the original shared secret is compromised because then the communication cannot be efficiently authenticated. However, they do work when an unconditionally secure key exchanger is applied to enable the authenticated communication protocol.

Novel SMO-Based Detection and Isolation of False Data Injection Attacks Against Frequency Control Systems

The integration of modern power systems with information and communication technologies exposes them to various cyber threats. Load frequency control (LFC) is a communication-based automation in power systems that regulates the frequency of the grid. Its critical role makes it a highly attractive target for adversaries. This paper proposes a novel detection and isolation method of False Data Injection Attacks (FDIAs) against LFC. The defense method employs sliding mode observation techniques to detect FDIAs against LFC in real-time and discover which parts of the control loop have been compromised. Attacks are identified by comparing the generated residuals with a specific threshold that is designed in an adaptive manner. The proposed method is able to successfully distinguish the FDIAs from other system disturbances and is robust against uncertainties in power system parameters and noisy measurements. The effectiveness and scalability of the proposed defense method are confirmed on realistic power system models, considering nonlinearities, different topologies and diverse types of transmission links.

Cascade Vertical Federated Learning Towards Straggler Mitigation and Label Privacy over Distributed Labels

Vertical federated learning (VFL) enables collaborative machine learning on vertically partitioned data with privacy-preservation. Most VFL methods face three daunting challenges in real-world applications. First, most existing VFL methods assume that at least one party holds the complete set of labels of all data samples. However, this assumption often violates the nature of many practical scenarios, where the parties only have partial labels. Second, the heterogeneity and dynamic of computational and communication resources in participated parties may cause the straggler problem and slow down training convergence. Third, the confidential label information could be exposed through malicious parties during VFL. To address these challenges, we propose a novel VFL algorithm named Cascade Vertical Federated Learning (CVFL), in which partitioned labels can be fully utilized to train neural networks with privacy-preservation. To mitigate the straggler problem, we design a novel optimization objective to increase straggler's contribution to the trained models. To mitigate the label privacy risks, we design a novel defense approach to protect the label privacy of CVFL. We conduct comprehensive experiments and the results demonstrate the effectiveness and efficiency of CVFL. Further, the proposed defense approach can achieve a better tradeoff between label privacy and model utility than two widely-used defense approaches.

Toward enhancing web privacy on HTTPS traffic: A novel SuperLearner attack model and an efficient defense approach with adversarial examples

Web privacy-enhancing technologies have been grown to preserve the users' privacy against sophisticated traffic analysis attacks aimed at inferring sensitive information. An especially concerning form of traffic analysis attacks is website fingerprinting attacks, allowing local eavesdroppers to identify a user's visited websites over encrypted connections. Leveraging recent advances in AI methods and aligned with the principle of adversarial thinking (think like an adversary), our objective is to better understand privacy vulnerabilities of HTTPS traffic against ever-evolving traffic analysis attacks. Therefore, as a novel contribution, we propose an HTTPS website fingerprinting attack model called Super-Learner Attack, an ensemble of base learners to exploit the strengths and diminish the weaknesses of the individual base learners, including LogisticRegression, DecisionTreeClassifier, Gaussian Naive Bayes, KNeighborsClassifier, AdaboostClassifier, BaggingClassifier, RandomForestClassifier, and ExtraTreeClassifier. The SuperLearner aims to learn fusion weights in a data-adaptive manner to obtain the optimal combination of the base learners. The proposed attack attains a high accuracy of over 97% on HTTPS traffic, outperforming existing attack models. Furthermore, responding to the challenge of website fingerprinting attacks and in direct response to the SuperLearner Attacker, we propose HTTPS Obfuscation Defender. This is a novel and highly effective defense strategy rooted in deception. This strategy disrupts classification by skillfully introducing fake packets into real flows, obfuscating patterns, and disrupting classification. Unlike previous methods, our approach leverages adversarial example algorithms originally designed for image analysis, to generate maximal obfuscation in encrypted HTTPS traffic. It generates perturbations for encrypted HTTPS traffic through the utilization of three well-established adversarial example algorithms. Our experimental results demonstrate that HTTPS Obfuscation Defender significantly reduces the accuracy of website fingerprinting from 97.2% to 2.89%, even when an attacker attempts to adapt to the defense and retrain a classifier using defended traffic. Moreover, our proposed defense ensures a minimal impact on time and bandwidth, making it a highly practical and resource-efficient defense approach.

Backdoor attack and defense in federated generative adversarial network-based medical image synthesis.

Deep Learning-based image synthesis techniques have been applied in healthcare research for generating medical images to support open research and augment medical datasets. Training generative adversarial neural networks (GANs) usually require large amounts of training data. Federated learning (FL) provides a way of training a central model using distributed data while keeping raw data locally. However, given that the FL server cannot access the raw data, it is vulnerable to backdoor attacks, an adversarial by poisoning training data. Most backdoor attack strategies focus on classification models and centralized domains. It is still an open question if the existing backdoor attacks can affect GAN training and, if so, how to defend against the attack in the FL setting. In this work, we investigate the overlooked issue of backdoor attacks in federated GANs (FedGANs). The success of this attack is subsequently determined to be the result of some local discriminators overfitting the poisoned data and corrupting the local GAN equilibrium, which then further contaminates other clients when averaging the generator's parameters and yields high generator loss. Therefore, we proposed FedDetect, an efficient and effective way of defending against the backdoor attack in the FL setting, which allows the server to detect the client's adversarial behavior based on their losses and block the malicious clients. Our extensive experiments on two medical datasets with different modalities demonstrate the backdoor attack on FedGANs can result in synthetic images with low fidelity. After detecting and suppressing the detected malicious clients using the proposed defense strategy, we show that FedGANs can synthesize high-quality medical datasets (with labels) for data augmentation to improve classification models' performance.

LFighter: Defending against the label-flipping attack in federated learning

Federated learning (FL) provides autonomy and privacy by design to participating peers, who cooperatively build a machine learning (ML) model while keeping their private data in their devices. However, that same autonomy opens the door for malicious peers to poison the model by conducting either untargeted or targeted poisoning attacks. The label-flipping (LF) attack is a targeted poisoning attack where the attackers poison their training data by flipping the labels of some examples from one class (i.e., the source class) to another (i.e., the target class). Unfortunately, this attack is easy to perform and hard to detect, and it negatively impacts the performance of the global model. Existing defenses against LF are limited by assumptions on the distribution of the peers’ data and/or do not perform well with high-dimensional models. In this paper, we deeply investigate the LF attack behavior. We find that the contradicting objectives of attackers and honest peers on the source class examples are reflected on the parameter gradients corresponding to the neurons of the source and target classes in the output layer. This makes those gradients good discriminative features for the attack detection. Accordingly, we propose LFighter, a novel defense against the LF attack that first dynamically extracts those gradients from the peers’ local updates and then clusters the extracted gradients, analyzes the resulting clusters, and filters out potential bad updates before model aggregation. Extensive empirical analysis on three data sets shows the effectiveness of the proposed defense regardless of the data distribution or model dimensionality. Also, LFighter outperforms several state-of-the-art defenses by offering lower test error, higher overall accuracy, higher source class accuracy, lower attack success rate, and higher stability of the source class accuracy. Our code and data are available for reproducibility purposes at https://github.com/NajeebJebreel/LFighter.

Location Privacy-Aware and Energy-Efficient Offloading for Distributed Edge Computing

Driven by the ever-increasing scale and intensity of the computing tasks arising from various mobile applications, distributed edge computing has fostered wide research interests. It can effectively reduce the task processing delay by partitioning the original large-scale task into several small subtasks and offloading them to multiple edge nodes (ENs) for parallel computing. In edge computing, as the mobile user usually tends to offload computing tasks to closer ENs to save transmit power, the attacker may stealthily infer user location by exploiting this feature. Although there have been some pioneering works on offloading related location privacy, they mainly focused on the scenario where each task can only be offloaded to a single EN, and may not be directly applicable to distributed edge computing. Besides, the privacy issues considered in existing works are mainly based on good heuristics, and there is still a lack of concrete examples of location privacy attacks in edge computing. To the best of our knowledge, the location privacy issue in distributed edge computing still remains largely unexplored in existing literature. With this consideration, a location inference attack based on matrix sequential probability ratio test (MSPRT) is identified in this work. Besides, a countermeasure based on dynamic multi-EN selection is proposed, together with a location privacy-aware and energy-efficient distributed offloading scheme based on the generic Lyapunov optimization framework. Both theoretic analysis and simulations based on real-world channel measurements are employed to validate the feasibility of the identified MPSRT attack and the effectiveness of the proposed defense scheme.

A defense strategy for false data injection attacks in multi-agent systems

The issue of defense strategy for cooperative control in multi-agent systems under false data injection attacks is investigated in this paper. False data injection attacks are typical cyber-attacks, some of which can evade detection and result in system instability. A communication strategy is proposed to ensure the security of multi-agent systems. In the proposed defense strategy, each agent is assigned to transmit its state to its neighbours and extra communication edges are stochastically triggered by the designed trigger signals. Furthermore, the communication topology condition is derived to ensure the security of multi-agent systems under the defense strategy. The theoretical results are verified through numerical simulation.

Adversarial Defensive Framework for State-of-Health Prediction of Lithium Batteries

Neural Networks are subject to malicious data poisoning attacks affecting the ability of the model to make accurate predictions. The attacks are generated using adversarial techniques imperceptible to the human eye since they use minimal noise to alter features which end up affecting boundary decisions of the prediction Model. Predicting lithium-ion batteries' State of Health (SOH) in a adversarial context becomes a challenging task especially if the model is expected to always predict at a very high accuracy level. Our article presents three novel contributions. The first contribution is a SOH prediction model that shows one of the best accuracy rates in the literature ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$R2=99.82\%$</tex-math></inline-formula> ) and yet uses the simplest LSTM model configuration compared to literature. The second contribution is the implementation of three state-of-the-art adversarial data poisoning attacks at decision time, knowingly Fast Gradient Method (FGSM), Momentum Iterative Method (MIM) and Basic Iterative Method (BIM) and the assessment of their impact on the original prediction accuracy. Most of literature use the attacks in a classification context while we are applying it to a time series prediction context. The third and most important contribution of this article is presenting a generic defense strategy combined with a feature engineering method that can be genrelized to prevent any potential adversarial attack attempt on any prediction model in a time-series prediction context using the same suggested feature engineering approach as suggested in this paper. The accuracy of the model is assessed using error estimators Root Mean Square Error (RMSE), Mean Absolute Error (MAE) and the R square (R2).The results show that adversarial data poisoning attacks are lethal to a time-series prediction model and our proposed defense strategy is able to detect and flag the existence of malicious data using a Simple Vector Machine (SVM) classifier with a very high confidence rate ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$area\,uder\,curve=0.996$</tex-math></inline-formula> ) which allow our model to defend against any potential unseen adversarial attack.

A hybrid cyber defense framework for reconnaissance attack in industrial control systems

The convergence of information technology (IT) and operation technology (OT) has made Industrial Control Systems (ICS) a popular target for cyberattacks in recent years. Unlike traditional networks, enhancing availability is the ICS network's top priority rather than confidentiality in the CIA scheme. We propose a bio-inspired adaptive defense framework based on dissimilar redundancy, diversity, and adaptive defense strategies to achieve this aim. The proposed mechanism mixed optimal network shuffling and cyber deception techniques to maximise the time attackers spend on the decoys. Besides, to provide an extra layer of protection for system availability, we introduce dual heterogeneous subnets in the proposed framework that could be regenerated once compromised. We evaluate the performance of the proposed defense framework in a typical industrial manufacturing network using an SDN-based platform and test the defense framework in various scenarios. Compared with previous research, the simulation shows a considerable improvement in defense performance in the adaptive defense mode.

Towards the universal defense for query-based audio adversarial attacks on speech recognition system

Recently, studies show that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which add a small amount of noise to the original audio examples. These AE attacks pose new challenges to deep learning security and have raised significant concerns about deploying ASR systems and devices. The existing defense methods are either limited in application or only defend on results, but not on process. In this work, we propose a novel method to infer the adversary intent and discover audio adversarial examples based on the AEs generation process. The insight of this method is based on the observation: many existing audio AE attacks utilize query-based methods, which means the adversary must send continuous and similar queries to target ASR models during the audio AE generation process. Inspired by this observation, We propose a memory mechanism by adopting audio fingerprint technology to analyze the similarity of the current query with a certain length of memory query. Thus, we can identify when a sequence of queries appears to be suspectable to generate audio AEs. Through extensive evaluation on four state-of-the-art audio AE attacks, we demonstrate that on average our defense identify the adversary’s intent with over 90% accuracy. With careful regard for robustness evaluations, we also analyze our proposed defense and its strength to withstand two adaptive attacks. Finally, our scheme is available out-of-the-box and directly compatible with any ensemble of ASR defense models to uncover audio AE attacks effectively without model retraining.