Real Attacks Research Articles

Prawne aspekty wykorzystania dalekowschodnich sztuk walki w sytuacji przekroczenia granic obrony koniecznej w polskim prawie karnym

The author attempts to analyze the statutory countertype of absolute self-defence from Article 25 of the Polish Penal Code, the Act of June 6, 1997, taking into account the legal aspects of the use of martial arts skills when exceeding the borders of self-defence. He draws attention to the formation of positive values through exercises in which a trained student, using principles derived from the tradition of Far Eastern martial arts, does not seek confrontation with an unlawful, direct, and real attack, but tries to alleviate the situation before using his/her self-defence techniques. He points out that reacting in self-defence, for example, using one’s training, is not an obligation of the attacked person; it is his/her right, which is a natural right and one of the subjective human rights. This is illustrated by the legal Latin maxim that clearly states: “It is lawful to repel force with force.” This presents martial-arts practitioners as people who, through their skills, are obliged to protect life or health in the face of a threat to their own and to that of their loved ones, as well as to that of all people they can help using such a means of self-defence.

Distributed robust‐multivariate‐observer‐based FDI attacks estimation for nonlinear multi‐agent systems with directed graphs

AbstractThis article investigates the distributed robust estimation problem for false data injection (FDI) attacks in nonlinear multi‐agent systems with directed graphs. To approximate the realistic attack scenario, the case where both the actuator network channel and sensor network channel suffering from FDIs are considered, and the attack signals contain time‐varying circumstances. A novel distributed robust‐multivariate‐observer (DRMO) strategy is developed such that the online estimation of FDI attack dynamics can be realized with the partially unknown nonlinear dynamics, attack transient increments, and disturbances impact being eliminated. The designed DRMO scheme only depends on the received compromised/uncompromised measurement output information on the account that whole state information cannot be measured directly. Finally, two simulation examples, including a network of four one‐link flexible joint manipulator systems with comparisons to existing methods, are given to show the effectiveness of the proposed scheme.

Recommendation attack detection based on improved Meta Pseudo Labels

Attackers attempt to bias the outputs of collaborative recommender systems by maliciously rating goods or services. To detect such attacks, many deep learning-based detection methods have been proposed and shown to be feasible. However, most methods require a large number of labeled user profiles for training to ensure good detection performance. To address this issue, in this paper, we propose a deep semisupervised detection approach based on the improved Meta Pseudo Labels, named DSSD-ImMPL. DSSD-ImMPL can achieve high detection performance given a small number of labeled training samples and a certain number of unlabeled training samples. We first improve the Meta Pseudo Labels method by generating a group of student networks by an experienced teacher network instead of only one student network in the original Meta Pseudo Labels method to improve the classification performance. Then, we use the group of student networks to detect the recommendation attack. The detection performance is verified with classical, mixed, GSA-GANs, and real attacks on three benchmark datasets by comparing DSSD-ImMPL with the state-of-the-art detection methods.

Defending Root DNS Servers against DDoS Using Layered Defenses (Extended)

Distributed Denial-of-Service (DDoS) attacks exhaust resources, leaving a server unavailable to legitimate clients. The Domain Name System (DNS) is a frequent target of DDoS attacks. Since DNS is a critical infrastructure service, protecting it from DoS is imperative. Many prior approaches have focused on specific filters or anti-spoofing techniques to protect generic services. DNS root nameservers are more challenging to protect, since they use fixed IP addresses, serve very diverse clients and requests, receive predominantly UDP traffic that can be spoofed, and must guarantee high quality of service. In this paper we propose a layered DDoS defense for DNS root nameservers. Our defense uses a library of defensive filters, which can be optimized for different attack types, with different levels of selectivity. We further propose a method that automatically and continuously evaluates and selects the best combination of filters throughout the attack. We show that this layered defense approach provides exceptional protection against all attack types using traces of ten real attacks from a DNS root nameserver. Our automated system can select the best defense within seconds and quickly reduces traffic to the server within a manageable range, while keeping collateral damage lower than 2%. We show our system can successfully mitigate resource exhaustion using replay of a real-world attack. We can handle millions of filtering rules without noticeable operational overhead.

DEFIA: Evaluate defense effectiveness by fusing behavior information of cyberattacks

The existing researches point to a lack of studies addressing the quantitative evaluation of the effectiveness of cyber defense. This difficult matter has been plaguing cyber security researchers and managers. This paper provides a quantitative method to evaluate defense effectiveness, called DEFIA. DEFIA records information about attack behavior in a formatted way and evaluates the defense effectiveness based on the utility of attack behaviors. By calculating the probability features of the attack behavior in the attack sample, the physical space structure of the attack behavior information is constructed. In particular, we define the utility calculation principle of attack behaviors and regard it as the benchmark for evaluating defensive capabilities. DEFIA can quantitatively assess the defense effectiveness of defense methods deployed in computer systems. We explain how the method works by simulating some real attack scenarios and based on the information provided by Virustotal to prove that DEFIA is reasonable and feasible.

Translating theory into practice: assessing the privacy implications of concept-based explanations for biomedical AI.

Artificial Intelligence (AI) has achieved remarkable success in image generation, image analysis, and language modeling, making data-driven techniques increasingly relevant in practical real-world applications, promising enhanced creativity and efficiency for human users. However, the deployment of AI in high-stakes domains such as infrastructure and healthcare still raises concerns regarding algorithm accountability and safety. The emerging field of explainable AI (XAI) has made significant strides in developing interfaces that enable humans to comprehend the decisions made by data-driven models. Among these approaches, concept-based explainability stands out due to its ability to align explanations with high-level concepts familiar to users. Nonetheless, early research in adversarial machine learning has unveiled that exposing model explanations can render victim models more susceptible to attacks. This is the first study to investigate and compare the impact of concept-based explanations on the privacy of Deep Learning based AI models in the context of biomedical image analysis. An extensive privacy benchmark is conducted on three different state-of-the-art model architectures (ResNet50, NFNet, ConvNeXt) trained on two biomedical (ISIC and EyePACS) and one synthetic dataset (SCDB). The success of membership inference attacks while exposing varying degrees of attribution-based and concept-based explanations is systematically compared. The findings indicate that, in theory, concept-based explanations can potentially increase the vulnerability of a private AI system by up to 16% compared to attributions in the baseline setting. However, it is demonstrated that, in more realistic attack scenarios, the threat posed by explanations is negligible in practice. Furthermore, actionable recommendations are provided to ensure the safe deployment of concept-based XAI systems. In addition, the impact of differential privacy (DP) on the quality of concept-based explanations is explored, revealing that while negatively influencing the explanation ability, DP can have an adverse effect on the models' privacy.

Devising a method for detecting “evil twin” attacks on IEEE 802.11 networks (Wi-Fi) with KNN classification model

The object of research is IEEE 802.11 (Wi-Fi) networks, which are often the targets of a group of attacks called "evil twin". Research into this area is extremely important because Wi-Fi technology is a very common method of connecting to a network and is usually the first target of cybercriminals when they attack businesses. With the help of a systematic analysis of the literature focused on countering attacks of the "evil twin" type, this work identifies the main advantages of using artificial intelligence systems in the analysis of network data and identification of intrusions in Wi-Fi networks. To evaluate the effectiveness of intrusion detection and cybercrime analysis, a number of experiments as close as possible to real attacks on Wi-Fi networks were conducted. As part of the research reported in this paper, a method is proposed for detecting cybercrimes in IEEE 802.11 (Wi-Fi) wireless networks using artificial intelligence, namely a model built on the basis of the k-nearest neighbors method. This method is based on the classification of previously collected data, namely the signal strength from the access point, and then continuous comparison of the newly collected data with the trained model. A compact and energy-efficient prototype of a hardware and software system has been designed for the implementation of monitoring, analysis of ethernet network packets and data storage based on time series. In order to reduce the load on the computer network and taking into account the limited computing power of the system, a method of data aggregation was proposed, which ensures fast transfer of information. The results, namely 100 % of test cases (more than 7 thousand), were classified correctly, which indicates that the chosen method of data analysis will significantly increase the security of information and communication systems at the state and private levels

Security analysis of blockchain-based service network

Recently, the extensive applications of blockchain technology in fields like financial exchanges, insurance, Logistics and healthcare has proven to be pragmatic and revolutionary. In order to enable the blockchain to have a more complete development space, Blockchain-based Service Network (BSN) was proposed. It integrates the developers, portal, cloud resources and blockchain framework to provide the basic environment for blockchain applications. Researches on its security have kept place with the advent of blockchain technology, while potential issues on BSN security remain largely unexplored. In this paper, we are devoted to diving deep into BSN security-related problems, specifically the security of BSN is analysed, and corresponding real attacks are summarised and investigated by checking the blockchain system adopted by BSN, which will provide a good reference for the future research. Finally, we reach the conclusion that although security issues still exist, there are fewer security issues compared with traditional blockchain.

Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

There is a growing trend of cyberattacks against Internet of Things (IoT) devices; moreover, the sophistication and motivation of those attacks is increasing. The vast scale of IoT, diverse hardware and software, and being typically placed in uncontrolled environments make traditional IT security mechanisms such as signature-based intrusion detection and prevention systems challenging to integrate. They also struggle to cope with the rapidly evolving IoT threat landscape due to long delays between the analysis and publication of the detection rules. Machine learning methods have shown faster response to emerging threats; however, model training architectures like cloud or edge computing face multiple drawbacks in IoT settings, including network overhead and data isolation arising from the large scale and heterogeneity that characterizes these networks.This work presents an architecture for training unsupervised models for network intrusion detection in large, distributed IoT and Industrial IoT (IIoT) deployments. We leverage Federated Learning (FL) to collaboratively train between peers and reduce isolation and network overhead problems. We build upon it to include an unsupervised device clustering algorithm fully integrated into the FL pipeline to address the heterogeneity issues that arise in FL settings. The architecture is implemented and evaluated using a testbed that includes various emulated IoT/IIoT devices and attackers interacting in a complex network topology comprising 100 emulated devices, 30 switches and 10 routers. The anomaly detection models are evaluated on real attacks performed by the testbed’s threat actors, including the entire Mirai malware lifecycle, an additional botnet based on the Merlin command and control server and other red-teaming tools performing scanning activities and multiple attacks targeting the emulated devices.

An Observer With Cooperative Interaction Structure for Biasing Attack Detection and Secure Control

This article studies state estimation and attack reconstruction problems for sensor and actuator biasing attack detection and secure control in cyber–physical systems (CPSs) through the observer techniques. The considered unknown bounded biasing attacks are produced from any dynamical system satisfying the error system between it and its equilibrium to be input-to-state stable, so that some reported biasing attacks are contained as a special case. In order to deal with potential compromised sensor output signals, an auxiliary filter is first introduced. Then, an augmented system, including the CPS and filter dynamics is constructed. Furthermore, with the aid of the system structure and input–output data, fictitious systems comprising the information of attack reconstruction errors are given. And then, by the cooperative interaction between the dynamics of observer’s estimation errors and virtual systems, an observer with a cooperative interaction structure is proposed, where the fictitious systems can be viewed as co-workers conducing to the accurate state estimation and attack reconstruction. By the Lyapunov approach, it is shown that state estimations and reconstructed attack signals, respectively, converge to the small set around system states and real attack signals, and the set bound can be reduced by adjusting the observer’s parameter. The applications of the observer to biasing attack detection and secure control are further given. Finally, an illustrative example validates the proposed methods.

A Highly Interpretable Framework for Generic Low-Cost UAV Attack Detection

The increasing prevalence of cyber-attacks on unmanned aerial vehicles (UAVs) has led to research on effective detection methods. However, current approaches often lack transferability and interoperability, which limits their effectiveness. This study proposes a CNN-BiLSTM-Attention (CBA) model for efficient attack detection using real-time UAV sensor data. Additionally, the SHapley Additive exPlanations (SHAP) method is used to improve the interpretability of the model. The proposed approach is tested on real attack scenarios, including denial-of-service (DoS) attacks and global positioning system (GPS) spoofing attacks, and demonstrates both effectiveness and interpretability.

Synthetic dataset generator for anomaly detection in a university environment

This article introduces a recently developed synthetic dataset generator, which contains anonymised data from the Prague University of Economics and Business information system logs. The generator is opensource and is able to scale this data time-wise and also perform injection of the data with cyberattackers’ behaviour patterns. The anonymised data still contains user behaviour patterns; therefore, individual anomalous behaviour can be detected. Different types of real attack behaviour patterns in the university environment have been selected; they are used to demonstrate attackers’ behaviour in synthetically created system logs. The mentioned features allow other researchers to benchmark their anomaly detection algorithms with complex data.

Security challenges and defense approaches for blockchain-based services from a full-stack architecture perspective

As an advantageous technique and service, the blockchain has shown great development and application prospects. However, its security has also met great challenges, and many security vulnerabilities and attack issues in blockchain-based services have emerged. Recently, security issues of blockchain have attracted extensive attention. However, there is still a lack of blockchain security research from a full-stack architecture perspective, as well as representative quantitative experimental reproduction and analysis. We aim to provide a security architecture to solve security risks in blockchain services from a full-stack architecture perspective. Meanwhile, we propose a formal definition of the full-stack security architecture for blockchain-based services, and we also propose a formal expression of security issues and defense solutions from a full-stack security perspective. We use ConCert to conduct a smart contract formal verification experiment by property-based testing. The security vulnerabilities of blockchain services in the Common Vulnerabilities and Exposures (CVE) and China Nation Vulnerability Database (CNVD) are selected and enumerated. Additionally, three real contract-layer real attack events are reproduced by an experimental approach. Using Alibaba's blockchain services and Identity Mixer in Hyperledger Fabric as a case study, the security problems and defense techniques are analyzed and researched. At last, the future research directions are proposed.

CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN

Over the years, vehicles have become increasingly complex and an attractive target for malicious adversaries. This raised the need for effective and efficient Intrusion Detection Systemss (IDSs) for onboard networks able to work with the stringent requirements and the heterogeneity of information transmitted on the Controller Area Network. While state-of-the-art solutions are effective in detecting specific types of anomalies and work on a subset of the CAN signals, no single method can perform better than the others on all types of attacks, particularly if they need to provide predictions to comply with the domain’s real-time constraints. In this paper, we present CANova, a modular framework that exploits the characteristics of the different Controller Area Network (CAN) packets to select the Intrusion Detection Systemss (IDSs) that better fits them. In particular, it uses flow- and payload-based IDSs to analyze the packets’ content and arrival time. We evaluate CANova by comparing its performance against state-of-the-art Intrusion Detection Systemss (IDSs) for in-vehicle network and a comprehensive set of synthetic and real attacks in real-world CAN datasets. We demonstrate that our approach can achieve good performances in terms of detection, false positive rates, and temporal performances.

An automatic unsupervised complex event processing rules generation architecture for real-time IoT attacks detection

In recent years, the Internet of Things (IoT) has grown rapidly, as has the number of attacks against it. Certain limitations of the paradigm, such as reduced processing capacity and limited main and secondary memory, make it necessary to develop new methods for detecting attacks in real time as it is difficulty to adapt as has the techniques used in other paradigms. In this paper, we propose an architecture capable of generating complex event processing (CEP) rules for real-time attack detection in an automatic and completely unsupervised manner. To this end, CEP technology, which makes it possible to analyze and correlate a large amount of data in real time and can be deployed in IoT environments, is integrated with principal component analysis (PCA), Gaussian mixture models (GMM) and the Mahalanobis distance. This architecture has been tested in two different experiments that simulate real attack scenarios in an IoT network. The results show that the rules generated achieved an F1 score of .9890 in detecting six different IoT attacks in real time.

A Survey on Blockchain Technology Concepts, Applications and Security

In the past decade, blockchain technology has become increasingly prevalent in our daily lives. This technology consists of a chain of blocks that contains the history of transactions and information about its users. Distributed digital ledgers are used in blockchain. A transparent environment is created by using this technology, allowing encrypted secure transactions to be verified and approved by all users. As a powerful tool, blockchain can be utilized for a wide range of useful purposes in everyday life including cryptocurrency, Internet-of-Things (IoT), finance, reputation system, and healthcare. This paper aims to provide an overview of blockchain technology and its security issues for users and researchers. In particular, those who conduct their business using blockchain technology. This paper includes a comparison of consensus algorithms and a description of cryptography. Further, most applications used in blockchain are focused on in this paper also analyzing real attacks and then summarizing security measures in blockchain. Even though Blockchain holds a promising scope of development in several sectors, it is prone to several security and vulnerability issues that arise from different types of blockchain networks which represent a challenge to deal with blockchain. Finally, as a research community, we encourage future research challenges that can be addressed to improve security in blockchain systems.

Comparison of Feature Selection Methods for DDoS Attacks on Software Defined Networks using Filter-Based, Wrapper-Based and Embedded-Based

The development of internet technology is growing very rapidly. Moreover, keeping internet users protected from cyberattacks is part of the security challenges. Distributed Denial of Service (DDoS) is a real attack that continues to grow. DDoS attacks have become one of the most difficult attacks to detect and mitigate appropriately. Software Defined Network (SDN) architecture is a novel network management and a new concept of the infrastructure network. A controller is a single point of failure in SDN, which is the most dangerous of various attacks because the attacker can take control of the controller so that it can control all network traffic. Various detection and mitigation methods have been offered, but not many consider the capacity of the SDN controller. In this research, we propose a feature selection method for DDoS attacks. This research aims to select the most important features of DDoS attacks on SDN so that the detection of DDoS on SDN can be lightweight and early. This research uses a dataset [1] generated by a Mininet emulator. The simulation runs for benign TCP, UDP, and ICMP traffic and malicious traffic, which is the collection of TCP SYN attacks, UDP Flood attacks, and ICMP attacks. A total of 23 features are available in the dataset, some are extracted from the switches, and others are calculated. By using three methods, filter-based, wrapper-based, and embedded-based, we get consistent results where the pktcount feature is the highest feature importance of DDoS attacks on SDN.

Data Generation for Modeling Attacks on UAVs for the Purpose of Testing Intrusion Detection Systems

Today, issues related to ensuring the safety of UAVs are very relevant. Researchers need to develop new protection methods to detect attacks in a timely manner and implement mitigation measures. The authors propose a new concept of attack detection "from inside" the UAV. The idea is to analyze the cyber-physical parameters of the UAV, which may indicate an attack, and its possible consequences. It was determined that to detect an attack and determine the consequences to which it can lead, it is necessary to control not only the initial parameters, but also the internal cyber-physical parameters of the UAV. This will allow predicting the possible consequences of an attack and taking emergency measures. A scheme of the impact of an attack on UAVs and the relationship with security incidents, built using an ontological approach, has been worked out. Two main essences of the UAV are considered - the physical and digital aspects of the UAV. Examples of chains of attacks leading to various consequences are also shown. In the review part, the analysis of methods and algorithms for detecting spoofing attacks using data generators is carried out, based on which conclusions are drawn about their advantages and disadvantages. Further, based on the experiments performed, the authors propose a method for assessing the quality of data and a method for generating anomalous data sets similar to real attack data, which can be used to develop and test methods for detecting and blocking attacks. The architecture of the experimental stand, which was used in the framework of full-scale simulation, is described. At this stand, designed to parse GPS spoofing attacks (GPS spoofing), several scenarios of a normal flight, and then several attack scenarios, were tested. Based on the results of the experiments, a method has been proposed that allows simulating the data corresponding to the attack with the required accuracy. A method for assessing the quality of fake data has also been proposed.

Web Application Firewall Based on Anomaly Detection using Deep Learning

Anomaly detection has been researched in different areas and application domains. The main difficulty is to identify the outliers from the normals in case of encountering an input that has unique features and new values. In order to accomplish this task, the research focusses on using Machine Learning and Deep Learning techniques. In the world of the Internet, we are facing a similar problem to identify whether a website request contains malicious activity or just a normal request. Web Application Firewall (WAF) systems provide such protection against malicious requests using a rule based approach. In recent years, anomaly based solutions have been integrated in addition to rule based systems. Still, such solutions can only provide security up to a point and such techniques can generate false-positive results that leave the backend systems vulnerable and most of the time rules based protection can be bypassed with simple tricks (eg. encoding, obfuscation). The main focus of the research is WAF systems that employ single and stacked LSTM layers which are based on character sequences of user supplied data and revealing hyper-parameter values for optimal results. A semi-supervised approach is used and trained with PayloadAllTheThings dataset containing real attack payloads and only normal payloads of HTTP Dataset CSIC 2010 are used. The success rate of the technique - whether the user input is identified as malicious or normal - is measured using F1 scores. The proposed model demonstrated high F1 scores and success in terms of detection and classification of the attacks.

Towards realistic fingerprint presentation attacks: The ScreenSpoof method

Using mobile devices, people leave latent fingerprints on the screen that can be photographed and used as a mold to fabricate high-quality spoofs. In this paper, we analysed the threat level of realistic attacks using snapshot pictures of latent fingerprints against presentation attack detection systems. Our evaluation compares a semi-consensual acquisition, given by a voluntary pressure of the finger on the screen, with a completely non-consensual one, given by the normal use of the device.