Semantic Attacks Research Articles

GA-GGD: Improving semantic discriminability in graph contrastive learning via Generative Adversarial Network

Graph contrastive learning has garnered considerable research interest due to its ability to effectively embed graph data without manual labels. Among them, methods based on Deep Graph Infomax (DGI) have been widely studied and favored in the industry because of their fast training speed, applicability to large-scale data. DGI-based methods usually obtain a noise graph through node shuffling. The proxy task of these methods encourages the encoder to distinguish whether the nodes come from the original graph or the noise graph, thereby maximizing the mutual information between the node representation and the graph it belongs to, while also maximizing the Jenson–Shannon divergence between the nodes of original graph and noise graph. However, we argue that these approaches only enable the encoder to differentiate between semantically meaningful graphs and noise graphs, but not to effectively identify different semantic graphs. This leads to the inability of the encoder to effectively embed information between different semantics, significantly reducing the robustness and affecting the performance of downstream tasks. In addition, this training mode makes the model more sensitive to attacks. To improve their semantic discriminability, we take advantage of the natural ability of generative adversarial networks to generate semantic data, proposing a method called Generative Adversarial Graph Group Discrimination (GA-GGD). Specifically, it consists of a graph group discriminator and a semantic attack generator. The discriminator aims to encode the graph and identify whether nodes originate from the original graph. The goal of the generator is to use random features and graph structure to find vulnerabilities of discriminator and generate node representations with similar but wrong semantic to confuse the discriminator. GA-GGD can improve the model’s semantic information embedding without significantly increasing computational overhead and memory occupancy. We test the effectiveness of the proposed model on commonly used data sets and large-scale datasets, as well as in various downstream tasks such as classification, clustering, and adversarial attacks defence. A wealth of experimental results confirm the efficacy of the proposed model.

Social Engineering Cyber Threats

The article explores the pervasive threat of social engineering in cybersecurity, emphasizing its success in infiltrating information systems by manipulating individuals rather than employing traditional hacking methods. The author underscores the vulnerability arising from human trust, as individuals, especially those lacking technology education, tend to be targets. While cryptography offers partial security, social engineering complicates overall system security. Mitigation strategies include educating employees on threats, risks, and security policies, coupled with enforcing penalties for noncompliance. Additionally, employing two-factor authentication and physical token-based access adds layers of protection. The article delves into semantic attacks, classifying various exploitation methods and emphasizing the critical role of user awareness. It addresses prevalent scams such as phishing, vishing, impersonation, and smishing, noting their impact on individuals and organizations. The study extends its focus globally, highlighting a unique advance fee fraud targeting vulnerable populations. Social engineering remains a significant challenge despite technological advancements, necessitating a multifaceted approach combining technical defenses, education, and public awareness.

PD-PAn: Prefix- and Distribution-Preserving Internet of Things Traffic Anonymization

One of the features of network traffic in Internet of Things (IoT) environments is that various IoT devices periodically communicate with their vendor services by sending and receiving packets with unique characteristics through private protocols. This paper investigates semantic attacks in IoT environments. An IoT semantic attack is active, covert, and more dangerous in comparison with traditional semantic attacks. A compromised IoT server actively establishes and maintains a communication channel with its device, and covertly injects fingerprints into the communicated packets. Most importantly, this server not only de-anonymizes other IPs, but also infers the machine states of other devices (IPs). Traditional traffic anonymization techniques, e.g., Crypto-PAn and Multi-View, either cannot ensure data utility or is vulnerable to semantic attacks. To address this problem, this paper proposes a prefix- and distribution-preserving traffic anonymization method named PD-PAn, which generates multiple anonymized views of the original traffic log to defend against semantic attacks. The prefix relationship is preserved in the real view to ensure data utility, while the IP distribution characteristic is preserved in all the views to ensure privacy. Intensive experiments verify the vulnerability of the state-of-the-art techniques and effectiveness of PD-PAn.

SEMANTIC ATTACK PREVENTION: GENERAL DECISION MODEL AND PREVENTION STRATEGIES

This publication analyses the vulnerability of entities to socio-technical threats, primarily focusingon semantic attacks. In the present information sphere, which is prominently manifested in theform of social networks, it garners the attention of the majority of individuals. This makes userssusceptible to attacks aimed at extracting key information. The article consists of three parts. Thefirst part introduces the reader to the general issues of semantic threats. Subsequently, using theproposed model, the author analyses the dissymmetry arising from two types of reactions. Thismodel is based on distinguishing between System I, where the subject acts intuitively, and System II,which involves reflection and analysis before decisions are made. The final part of the article presentsvarious preventive measures against semantic attacks. The work is focused on demonstrating variousstrategies for dealing with such attacks. The goal of the publication is to emphasize the importanceof psychological determinants of individual behaviour in the context of functioning in the virtualenvironment and to present prospective preventive approaches intended to minimise semanticthreats. In the development of this article, research methods such as analysis, synthesis, and literaturereview were employed. The results of the conducted research on individuals’ vulnerability tosemantic threats indicate a significant influence of intuitive behaviour on increasing the risk of fallingvictim to such attacks. To reduce this vulnerability, reliance cannot solely be placed on specializedsoftware or tools, as their effectiveness largely depends on human behaviour. Therefore, continuousknowledge expansion as regards those threats through participation in training and the developmentof appropriate habits that promote a more detailed analysis of received content is crucial.

Rule-based anomaly detection for railway signalling networks

We propose a rule-based anomaly detection system for railway signalling that mitigates attacks by a Dolev-Yao attacker who is able to inject control commands to perform semantic attacks by issuing licit but mistimed control messages. The system as well mitigates the effects of a signal box compromised by an attacker with the same effect. We consider an attacker that could cause train derailments and collisions, if our countermeasure is not employed. We apply safety principles of railway operation to create a distributed anomaly detection system that inspects incoming commands on the signals and points. The proposed anomaly detection system detects mistimed control messages against light signals, points and train detection systems that lead to derailments and collisions without producing false positives, while it requires only a small amount of overhead in terms of network communication and latency compared to normal train operation.

Semantic Attack on Disassociated Transaction Data

Accessing and sharing information, including personal data, has become easier and faster than ever because of the Internet. Therefore, businesses have started to take advantage of the availability of data by gathering, analysing, and utilising individuals’ data for various purposes, such as developing data-driven products and services that can help improve customer satisfaction and retention, and lead to better healthcare and well-being provisions. However, analysing these data freely may violate individuals’ privacy. This has prompted the development of protection methods that can deter potential privacy threats by anonymising data. Disassociation is one anonymisation approach used to protect transaction data. It works by dividing data into chunks to conceal sensitive links between the items in a transaction, but it does not account for semantic relationships that may exist among the items, which adversaries can exploit to reveal protected links. We show that our proposed de-anonymisation approach could break the privacy protection offered by the disassociation method by exploiting such semantic relationships. Our findings indicate that the disassociation method may not provide adequate protection for transactions: up to 60% of the disassociated items can be reassociated, thereby breaking the privacy of nearly 70% of the protected items. In this paper [an extension to our work reported in AlShuhail and Shao (Semantic attack on disassociated transactions. In: Proceedings of the 8th International Conference on information systems security and privacy-ICISSP, INSTICC. SciTePress, pp. 60–72, 2022)], we develop additional techniques to reconstruct transactions, with additional experiments to illustrate the impact of our attacking method.

DpGuard: A Lightweight Attack Detection Method for an Industrial Bus Network

In industrial control systems (ICSs), the PROFIBUS-DP (decentralized peripherals) protocol is widely used for communication between devices. Because PROFIBUS-DP is an unencrypted and insecure bus protocol, attackers can connect to the PROFIBUS-DP system and arbitrarily manipulate I/O process values, which may interrupt the normal operation of industrial equipment, or have more serious consequences. However, due to the complex structures of bus networks and the large number of attack areas, the existing scheme does not monitor all the messages in the industrial head office network and cannot effectively detect semantic attacks. To solve this problem, we propose a novel attack detection system DpGuard. DpGuard automatically builds a finite-state machine model of normal ICS behavior through a large number of historical ICS traffic data. The model includes state events, state transitions, state transition probability, and other normal behavior information. In addition, DpGuard records the execution status of the context data package, uses the real-time captured data package as the input of the model, and judges whether the state event and state transition probability conform to the constraints of the finite-state machine model, so as to identify the legitimate normal behavior of the ICS. Our proposal was evaluated using two Siemens PLCs (programmable logic controllers) deployed on the PROFIBUS-DP system. The experimental results demonstrated that the scheme could accurately detect fault injection and semantic attacks. Compared with other detection models, our scheme presented an improved detection performance, with a detection accuracy of 99.80%.

Smart Aided Device for Human Safety Using IoT

Smart Aided Device for Human Safety Using IoT

A URL-Based Social Semantic Attacks Detection With Character-Aware Language Model

Social engineering attacks rely on human errors and behavioral choices. The semantic attack, a subcategory of social engineering attacks, utilizes behavioral or cosmetic deception vectors (e.g., attacker creates a malicious website that looks like and behaves like the legitimate one). The most common types of social semantic attacks include phishing, spamming, defacement, and malware attacks. We investigate the feasibility of developing URL-based social semantic attack detection models utilizing character-aware language models. Specifically, we developed three types of models: long short-term memory (LSTM)-based detection model, convolutional neural network (CNN)-based detection model, and CharacterBERT-based detection model. We benchmarked performances of different models for different attacks. Using the characterBERT-based detection model, the overall evaluation recorded a high detection accuracy of 99.65% by averaging the results of performing a 5-fold cross-validation. Considering the model performance per class, the CharacterBERT model ranked the best model among our 3 models in detecting the social semantic attacks, reaching best accuracy of 99.90% in detecting defacement attack.

AGV semantic attack detection based on extended stochastic Petri net

AGV semantic attack detection based on extended stochastic Petri net

Blockchain-Aided Secure Semantic Communication for AI-Generated Content in Metaverse

The construction of virtual transportation networks requires massive data to be transmitted from edge devices to Virtual Service Providers (VSP) to facilitate circulations between the physical and virtual domains in Metaverse. Leveraging semantic communication for reducing information redundancy, VSPs can receive semantic data from edge devices to provide varied services through advanced techniques, e.g., AI-Generated Content (AIGC), for users to explore digital worlds. But the use of semantic communication raises a security issue because attackers could send malicious semantic data with similar semantic information but different desired content to break Metaverse services and cause wrong output of AIGC. Therefore, in this paper, we first propose a blockchain-aided semantic communication framework for AIGC services in virtual transportation networks to facilitate interactions of the physical and virtual domains among VSPs and edge devices. We illustrate a training-based targeted semantic attack scheme to generate adversarial semantic data by various loss functions. We also design a semantic defense scheme that uses the blockchain and zero-knowledge proofs to tell the difference between the semantic similarities of adversarial and authentic semantic data and to check the authenticity of semantic data transformations. Simulation results show that the proposed defense method can reduce the semantic similarity of the adversarial semantic data and the authentic ones by up to 30% compared with the attack scheme.

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

By violating semantic constraints that the control process impose, the semantic attack leads the Industry Control Systems (ICS) into an undesirable state or critical state. The spread of semantic attack has caused huge economic losses and casualties to critical infrastructure. Therefore, detecting semantic attack is referred to an urgent and critical task. However, few existing detecting techniques can achieve satisfactory effects in detecting semantic attack of ICS, due to the high requirements of complete critical state-based semantic behavior features description, joint detection on multivariate type state variables, and validity of field states datasets under semantic attacks. In an effort to deal with above challenges, We label device states databases with temporal characteristics and divide impacts on states of field devices under semantic attacks into three categories, including absent in states set, confused sequences, irregular frequency. On this basis, we establish a behavioral model based on secondary labeling of states-duration evolution graph (BMSLS), then implement an adaptive secure state-based semantic attack detection framework furtherly. Compared with the traditional Auto Regression (AR) algorithm, the newer time series correlation graph model, and other five deep learning algorithms, our proposed framework demonstrates the superior effect on the detection of semantic attack.

SegGuard: Segmentation-based Anonymization of Network Data in Clouds for Privacy-Preserving Security Auditing

Security auditing allows cloud tenants to verify the compliance of cloud infrastructure with respect to desirable security properties, e.g., whether a tenant’s virtual network is properly isolated from other tenants’ networks. However, the input to the auditing task, such as the detailed topology of the underlying cloud infrastructure, typically contains sensitive information which a cloud provider may be reluctant to hand over to a third party auditor. Additionally, auditing results intended for one tenant may inadvertently reveal private information about other tenants, e.g., another tenant’s VM is reachable due to a misconfiguration. How to anonymize both the input data and the auditing results in order to prevent such information leakage is a novel challenge that has received little attention. Directly applying most of the existing anonymization techniques to such a context would either lead to insufficient protection or render the data unsuitable for auditing. In this article, we propose SegGuard , a novel anonymization approach that prevents cross-tenant information leakage through per-tenant encryption, and prevents information leakage to auditors through hiding real input segments among fake ones; in addition, applying property-preserving encryption in an innovative way enables SegGuard to preserve the data utility for auditing while mitigating semantic attacks. We implement SegGuard based on OpenStack, and evaluate its effectiveness and overhead using both synthetic and real data. Our experimental results demonstrate that SegGuard can reduce the information leakage to a negligible level (e.g., less than 1 percent for an adversary with 50 percent pre-knowledge) with a practical response time (e.g., 62 seconds to anonymize a cloud infrastructure with 25,000 virtual machines).

Protecting Trajectory From Semantic Attack Considering ${k}$ -Anonymity, ${l}$ -Diversity, and ${t}$ -Closeness

Nowadays, human trajectories are widely collected and utilized for scientific research and business purpose. However, publishing trajectory data without proper handling might cause severe privacy leakage. A large body of works is dedicated to merging one’s trajectory with others’, so as to avoid any individual trajectory being re-identified. Yet their solutions do not provide enough protection since they cannot prevent semantic attack, which means the attackers are able to acquire individual’s private information by using the semantics features of frequently visited locations in the trajectory even without re-identification. In this paper, we are the first to recognize the semantic attack, which is another severe privacy problem in publishing trajectory datasets. We propose an algorithm providing strong privacy protection against both the semantic and re-identification attack while reserving high data utility. Extensive evaluations based on two real-world datasets demonstrate that our solution improves the quality of privacy protection by three times, sacrificing only 36% and 10% of spatial and temporal resolution, respectively.

Ensuring Privacy Protection in Location-based Services through Integration of Cache and Dummies

Location-Based Services (LBS) have recently gained much attention from the research community due to the openness of wireless networks and the daily development of mobile devices. However, using LBS is not risk free. Location privacy protection is a major issue that concerns users. Since users utilize their real location to get the benefits of the LBS, this gives an attacker the chance to track their real location and collect sensitive and personal information about the user. If the attacker is the LBS server itself, privacy issues may reach dangerous levels because all information related to the user's activities are stored and accessible on the LBS server. In this paper, we propose a novel location privacy protection method called the Safe Cycle-Based Approach (SCBA). Specifically, the SCBA ensures location privacy by generating strong dummy locations that are far away from each other and belong to different sub-areas at the same time. This ensures robustness against advanced inference attacks such as location homogeneity attacks and semantic location attacks. To achieve location privacy protection, as well as high performance, we integrate the SCBA approach with a cache. The key performance enhancement is storing the responses of historical queries to answer future ones using a bloom filter-based search technique. Compared to well-known approaches, namely the ReDS, RaDS, and HMC approaches, experimental results showed that the proposed SCBA approach produces better outputs in terms of privacy protection level, robustness against inference attacks, communication cost, cache hit ratio, and response time.

Achieving High Privacy Protection in Location-based Recommendation Systems

In recent years, privacy has become great attention in the research community. In Location-based Recommendation Systems (LbRSs), the user is constrained to build queries depend on his actual position to search for the closest points of interest (POIs). An external attacker can analyze the sent queries or track the actual position of the LbRS user to reveal his\her personal information. Consequently, ensuring high privacy protection (which is including location privacy and query privacy) is a fundamental thing. In this paper, we propose a model that guarantees high privacy protection for LbRS users. The model is work by three components: The first component (selector) uses a new location privacy protection approach, namely, the smart dummy selection (SDS) approach. The SDS approach generates a strong dummy position that has high resistance versus a semantic position attack. The second component (encryptor) uses an encryption-based approach that guarantees a high level of query privacy versus a sampling query attack. The last component (constructor) constructs the protected query that is sent to the LbRS server. Our proposed model is supported by a checkpoint technique to ensure a high availability quality attribute. Our proposed model yields competitive results compared to similar models under various privacy and performance metrics.

An Enhanced Multi-Stage Semantic Attack Against Industrial Control Systems

Industrial Control Systems (ICS) play a very important role in national critical infrastructures. However, the growing interaction between the modern ICS and the Internet has made ICS more vulnerable to cyber attacks. In order to protect ICS from malicious attacks, intrusion detection technology emerges. By analyzing the network meta data or the industrial process data, Intrusion Detection Systems (IDS) can identify attacks that violate communication protocols or system specifications. However, the existing intrusion detection technology is not omnipotent, which opens up a back door for some more advanced attacks. In this work, we design an enhanced multi-stage semantic attack against ICS, which is undetectable by existing IDS. By hijacking the communication channels between the Human Machine Interface (HMI) and the remote Programmable Logic Controllers (PLCs), the attacker can manipulate the measurement data and control instructions simultaneously. The fake measurement data deceives the human operator into making wrong decisions. Furthermore, the attacker can strategically manipulate the semantic meaning of control instructions according to system state transition rules. In the meanwhile, a fake view of measurement data is presented to the HMI to conceal the on-going malicious attack. This attack is totally stealthy since the message sizes and timing, the command sequences, and the system state values are all legitimate. Consequently, this attack can secretly bring the system into critical states. Experimental results have verified the strong attack ability of the proposed attack.

Cyber security for wireless semantic (SCADA/DCS) systems

Supervisory control and data acquisition and distributed control systems named (SCADA/DCS) have played a key role in the design of modern power smart applications, particularly in the automatic management of real-time energetic platforms. In this work, we present a semantic cyber security vulnerabilities add to classic one, with the use of semantic embedded application in smart devices in semantic wireless (SCADA/DCS) systems, focusing on the semantic attacks. In this work, we present a new security semantic wireless protocol as a secure communication support for these modern semantic wireless systems named (ZIGBEE/SOAP/SECURITY), obtained by the combination between wireless ZIGBEE protocol, SOAP protocol and the integration of our security mechanism, in the global message header obtained by the fusion between ZIGBEE message and SOAP message.

Cyber security for wireless semantic (SCADA/DCS) systems

Supervisory control and data acquisition and distributed control systems named (SCADA/DCS) have played a key role in the design of modern power smart applications, particularly in the automatic management of real-time energetic platforms. In this work, we present a semantic cyber security vulnerabilities add to classic one, with the use of semantic embedded application in smart devices in semantic wireless (SCADA/DCS) systems, focusing on the semantic attacks. In this work, we present a new security semantic wireless protocol as a secure communication support for these modern semantic wireless systems named (ZIGBEE/SOAP/SECURITY), obtained by the combination between wireless ZIGBEE protocol, SOAP protocol and the integration of our security mechanism, in the global message header obtained by the fusion between ZIGBEE message and SOAP message.

You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks

Semantic social engineering attacks are a pervasive threat to computer and communication systems. By employing deception rather than by exploiting technical vulnerabilities, spear-phishing, obfuscated URLs, drive-by downloads, spoofed websites, scareware, and other attacks are able to circumvent traditional technical security controls and target the user directly. Our aim is to explore the feasibility of predicting user susceptibility to deception-based attacks through attributes that can be measured, preferably in real-time and in an automated manner. Toward this goal, we have conducted two experiments, the first on 4333 users recruited on the Internet, allowing us to identify useful high-level features through association rule mining, and the second on a smaller group of 315 users, allowing us to study these features in more detail. In both experiments, participants were presented with attack and non-attack exhibits and were tested in terms of their ability to distinguish between the two. Using the data collected, we have determined practical predictors of users’ susceptibility against semantic attacks to produce and evaluate a logistic regression and a random forest prediction model, with the accuracy rates of. 68 and. 71, respectively. We have observed that security training makes a noticeable difference in a user’s ability to detect deception attempts, with one of the most important features being the time since last self-study, while formal security education through lectures appears to be much less useful as a predictor. Other important features were computer literacy, familiarity, and frequency of access to a specific platform. Depending on an organisation’s preferences, the models learned can be configured to minimise false positives or false negatives or maximise accuracy, based on a probability threshold. For both models, a threshold choice of 0.55 would keep both false positives and false negatives below 0.2.