Attack Signal Research Articles

Evaluation and Build to honeypot System about SCADA Security for Large-Scale IoT Devices

Under the trend of intelligent industrial control systems, it is very important to prevent network hackers from invading the system to attack devices. In particular, today’s hackers have multiple attacks and the number of attacks has increased year-by-year. How to stop hackers from attacking the system has become the main goal of this research. In this study, we explore how to build and evaluate Arduino and Raspberry Pi were used as real-world programmable logic controllers and camouflaged honeypots to simulate the honeymap of the industrial control system. And simulate the common sensors of industrial control systems, such as temperature, humidity, pressure sensors, to send the same type of signal as the real sensors to deceive the hacker, so the hacker will attack the simulated sensor with a high probability. After receiving the hacker’s attack signal, returns the spoofed attack result, which makes the hacker mistakenly think that the attack is successful, and no longer causes further damage to the system, and achieves the purpose of protecting the system. At the same time, record the attack means by honeypot to prevention other similar attacks.

Resilient and secure remote monitoring for a class of cyber-physical systems against attacks

This paper is concerned with the resilient and secure remote monitoring of a cyber-physical system of a discrete time-varying state-space form against attacks. The specific statistical characteristic, magnitude, occurring place and time of the attack signals are not required during the monitor design and attack detection procedures. First, an optimal ellipsoidal state prediction and estimation method is delicately developed in such a way that the recursively computed prediction ellipsoid and estimate ellipsoid can both guarantee the containment of the true system state at each time step regardless of the unknown but bounded input signal. It is expected that the two ellipsoids can resist certain attacks as the calculated state prediction and state estimate are sets in state-space rather than single pointwise vectors, thus potentially enhancing the resilience of the remote monitoring system. Second, a set-based evaluation mechanism in combination with a remedy measure are proposed to provide timely detection of certain attacks. Furthermore, a numerically efficient algorithm is established to achieve resilience and attack detection of the remote monitoring system. Finally, it is shown through several case studies on a water supply distribution system that the proposed methods can provide quantitative analysis and evaluation of the potential consequences of various attacks on the remote monitoring system.

Cooperative attack strategy design via H−/H∞ scheme for linear cyber‐physical systems

SummaryThis paper studies the problem of cooperative attack strategy design for cyber‐physical systems modeled by discrete‐time linear systems. A function that reflects the attacker's target is established, and a linear attack strategy is designed based on the objective function, in which the attack signal is unknown but energy bounded, while the statistical information of the existing ones is required to be known. Unlike the existing analysis methods for attack strategy, new Lyapunov functions that depend on the system states at different instants are constructed in the attack strategy analysis, and the sensitivity to the state estimator and the robustness against the detector are both enhanced on attack signals through using the H−/H∞ scheme. Finally, two simulation examples are given to show that the designed attack strategy achieves larger estimation errors and smaller detection probability simultaneously than the existing design methods.

A GPS Spoofing Generator Using an Open Sourced Vector Tracking-Based Receiver.

Spoofing can seriously threaten the use of the Global Positioning System (GPS) in critical applications such as positioning and navigation of autonomous vehicles. Research into spoofing generation will contribute to assessment of the threat of possible spoofing attacks and help in the development of anti-spoofing methods. However, the recent commercial off-the-shelf (COTS) spoofing generators are expensive and the technology implementation is complicated. To address the above problem and promote the GPS safety-critical applications, a spoofing generator using a vector tracking-based software-defined receiver is proposed in this contribution. The spoofing generator aims to modify the raw signals by cancelling the actual signal component and adding the spoofing signal component. The connections between the spreading code and carrier, and the states of the victim receiver are established through vector tracking. The actual signal can be predicted effectively, and the spoofing signal will be generated with the spoofing trajectory at the same time. The experimental test results show that the spoofing attack signal can effectively mislead the victim receiver to the designed trajectory. Neither the tracking channels nor the positioning observations have abnormal changes during this processing period. The recent anti-spoofing methods cannot detect this internal spoofing easily. The proposed spoofing generator can cover all open-sky satellites with a high quality of concealment. With the superiority of programmability and diversity, it is believed that the proposed method based on an open source software-defined receiver has a great value for anti-spoofing research of different GNSS signals.

Joint Detection and Mitigation of False Data Injection Attacks in AGC Systems

The ability to maintain the system frequency within specified operating limits is crucial for the stability and proper operation of power systems. Any small deviation out of the permissible frequency range must be well-mitigated by the automatic generation control (AGC) system, otherwise it may result in disruption of operation and/or damage to the power grid equipment. The data required by the AGC control system is sent to the control center through communication links which are susceptible to cyber attacks. Therefore, such AGC systems have to be well-protected against false data injection (FDI) attacks. In this paper, the use of a simultaneous input and state estimation based algorithm to detect and concurrently compensate for FDI attacks against the measurements of AGC systems is investigated. Throughout the use of this algorithm, the FDI attack signal is dealt with as an unknown input and its value is estimated accordingly. Then, the estimated value for the FDI is used to compensate for the effect of the attack so that the control center makes its decision based on the corrected sensor signals, and not the manipulated ones. The proposed approach is tested under different types of FDI attacks and the simulation results for a 2-area and a 4-area practical system confirm its ability to detect, estimate FDI attacks and successfully compensate for it.

Joint attack detection and secure state estimation of cyber‐physical systems

SummaryThis paper deals with secure state estimation of cyber‐physical systems subject to switching (on/off) attack signals and injection of fake packets (via either packet substitution or insertion of extra packets). The random set paradigm is adopted in order to model, via random finite sets (RFSs), the switching nature of both system attacks and the injection of fake measurements. The problem of detecting an attack on the system and jointly estimating its state, possibly in the presence of fake measurements, is then formulated and solved in the Bayesian framework for systems with and without direct feedthrough of the attack input to the output. This leads to the analytical derivation of a hybrid Bernoulli filter (HBF) that updates in real time the joint posterior density of a Bernoulli attack RFS and of the state vector. A closed‐form Gaussian mixture implementation of the proposed HBF is fully derived in the case of invertible direct feedthrough. Finally, the effectiveness of the developed tools for joint attack detection and secure state estimation is tested on two case studies concerning a benchmark system for unknown input estimation and a standard IEEE power network application.

A penalty-based adaptive secure estimation for power systems under false data injection attacks

This paper proposes a penalty-based adaptive secure estimation method for multi-area power systems under false data injection (FDI) attacks, the adaptive secure estimation method specifically takes the characteristics of FDI attacks into account. Firstly, a new measurement modeling is delicately constructed for subarea of power systems, in which both the state and FDI attack information are well considered. Secondly, for convenient solving of constructed mixed variational inequality (MVI), series virtual nodes are effectively introduced to transfer the multi-area power systems with boundary nodes to a boundary system. Then, a penalty-based distributed estimation method is proposed to estimate the state of multi-area power systems under FDI attacks, where the penalty parameter can be adaptively adjusted based on the dynamic internal error and boundary error. Compared with some existing methods, the efficiency and accuracy of proposed method are improved, and the state and attack signals can be estimated simultaneously. Finally, a case study shows the effectiveness of proposed method.

False-Data Injection Attack in Electricity Generation System Subject to Actuator Saturation: Analysis and Design

The secure operation of electricity generation system (EGS) is essential to the quality of electricity and the security of energy Internet. In order to design secure control strategy for EGS, the behavior and capacity of adversary and possible attack should be studied. From this point of view and considering the actuator saturation and the false-data injection attack in control input channel of EGS, we analyze the behavior and stealthiness of adversary and design stealthy attack strategies in this paper. First, we prove that the magnitude of effective attack signal is smaller than the magnitude of injected attack signal because of actuator saturation. Second, we find that smaller actuator saturation limit makes the adversary easier to be detected. Finally, two stealthy attack strategies are designed for EGS which incorporates a $\chi ^{2}$ attack detector, and the effectiveness of them are illustrated through simulation.

A reversible sketch-based method for detecting and mitigating amplification attacks

Amplification attacks bring serious threats to network security due to their characteristics of anonymity and amplification. How to detect amplification attacks attracts more and more attention. However, as the age of networking for big data is coming, traditional amplification attack detection methods become inefficient due to the impact of big-volume network traffic that swamp significant signals of attacks. The premise of accurate effective attack detection is efficiently processing big-volume traffic. In this paper, we propose a meaningful work that applies sketch technique to detect and mitigate amplification attacks. This step enables the detection method to handle big-volume network traffic. We use a Chinese Reminder Theorem based Reversible Sketch to directly collect network traffic and then monitor the abrupt changes in one-to-one mapping between request packets and response packets to identify amplification attack traffic. The detection mechanism is robust and efficient since it does not need to record complicated traffic features and makes full use of the basic characteristic of amplification attacks. We examine the performance of our method through a series of experiments conducted on simulation and real world traffic. The results denote that the method can accurately detect and mitigate amplification attacks.

A novel set-membership estimation approach for preserving security in networked control systems under deception attacks

This paper is concerned with the security problem for a networked control system subject to deception attacks. An adversary is present to corrupt both the sensor-to-controller channel and the controller-to-actuator channel with deception signals when sensor and control data are transmitted via the network medium. We model the malicious deception signals as unknown-but-bounded signals in such a way that no priori knowledge of the attack signals is required. First, a delicate set-membership performance index is proposed for meeting the system security requirement. Second, a novel set-membership estimation method is developed to obtain the desired ellipsoidal estimation set which guarantees the enclosing of true state of the system at every instant of time. Such an ellipsoidal estimation set is then used for deriving the sufficient conditions such that the resulting closed-loop system is set-membership input-to-state-stable and achieves the prescribed security requirement. Finally, a target tracking system is given to demonstrate the effectiveness of the proposed method.

Recalculating growth and defense strategies under competition: key roles of photoreceptors and jasmonates.

The growth-defense trade-off in plant biology has gained enormous traction in the last two decades, highlighting the importance of understanding how plants deal with two of the greatest challenges for their survival and reproduction. It has been well established that in response to competition signals perceived by informational photoreceptors, shade-intolerant plants typically activate the shade-avoidance syndrome (SAS). In turn, in response to signals of biotic attack, plants activate a suite of defense responses, many of which are directed to minimize the loss of plant tissue to the attacking agent (broadly defined, the defense syndrome, DS). We argue that components of the SAS, including increased elongation, apical dominance, reduced leaf mass per area (LMA), and allocation to roots, are in direct conflict with configurational changes that plants require to maximize defense. We hypothesize that these configurational trade-offs provide a functional explanation for the suppression of components of the DS in response to competition cues. Based on this premise, we discuss recent advances in the understanding of the mechanisms by which informational photoreceptors, by interacting with jasmonic acid (JA) signaling, help the plant to make intelligent allocation and developmental decisions that optimize its configuration in complex biotic contexts.

Mitigation of cyber-physical attacks in multi-area automatic generation control

In recent years, several cyber-attacks have been recorded against sensitive monitoring systems. Among them is the automatic generation control (AGC) system, a fundamental control system used in all power networks. AGC systems keep the network frequency at its desired value and maintain the tie-line power exchanges at their scheduled values. Motivated by the increasing need for robust and safe operation of AGCs, we introduce an attack resilient control scheme for the AGC system based on attack detection using state estimation. The proposed approach requires redundancy of sensors available at the transmission level in the power network and leverages recent results on attack detection using mixed integer linear programming (MILP). The proposed algorithm detects and identifies the sensors under attack in the presence of noise. The non-attacked sensors are then averaged and made available to the feedback controller. No assumptions about the nature of the attack signal are made. The proposed method is simulated using a large range of attack signals and uncertain sensors measurements.

Optimal Stealthy Deception Attack Against Cyber-Physical Systems.

This paper studies the problem of designing the optimal deception attack to maximize a utility function with the Kullback-Leibler divergence adopted as a detection constraint. The utility function reflects the goal of pulling the state away from the origin, increasing the cost of the controller and decreasing the cost of the attacker. To analyze the stealthiness of the attack, the attack signal is decomposed into two parts, one of which is strict stealthy. The necessary and sufficient condition is derived for the case that the strict stealthy attack cannot lead to an unbounded benefit. In this case, the linear transformation of the optimal attack is proved to be a Gaussian distribution. With the mean value and covariance of the Gaussian distribution as variables, the original problem is transformed into a new problem which may not be convex. A suboptimal attack policy is provided and the upper bound for the loss of benefit when using the suboptimal attack is also given. A numerical example of unmanned ground vehicle is illustrated to verify the effectiveness of the proposed attack policy.

Output Resilient Containment Control of Heterogeneous Systems With Active Leaders Using Reinforcement Learning Under Attack Inputs

The optimal solution to the distributed output containment control problem of heterogeneous multiple-agent systems (MASs) with unknown active leaders under attack inputs by using data-based off-policy reinforcement learning (RL) is proposed. Assume that the control input of each leader is bounded and non-zero. Moreover, followers are vulnerable to attack signals in real-world application. Firstly, distributed observers are designed such that the state and output of observers fall into the convex hull formed by leaders. Then, the output containment problem is converted into $H_{\infty }$ tracking problem by minimizing value function, Algebraic Riccati equations (AREs) are obtained in solving optimal $H_{\infty }$ tracking problem for each follower, which are computed by a data-based off-policy RL algorithm without using agents’ dynamics. At last, the effectiveness of the algorithm is verified by a simulation example.

Linear system security—Detection and correction of adversarial sensor attacks in the noise-free case

We address the problem of attack detection and attack correction for multi-output discrete-time linear time-invariant dynamical systems under sensor attack. More specifically, we focus on the situation where adversarial attack signals are added to some of the system’s output signals. Algorithms for sensor attack detection and correction are presented using the notion of ‘security index’ which characterizes the system’s vulnerability against such attacks. The results are illustrated by examples involving multiple sensors.

Using Improved Hilbert–Huang Transformation Method to Detect Routing-Layer Reduce of Quality Attack in Wireless Sensor Network

Denial of Service (DoS) attack is a serious threat to the security of Wireless Sensor Netwokr (WSN). Moreover, Reduce of Quality (RoQ) attack is a special DoS attack type. The RoQ attack is a potential DoS attack, it is simulator to normal traffic,so it is difficult to be detected by traditional detection method. Hilbert–Huang Transform (HHT) time–frequency analysis method can be used to analyze the non-linear signal generated by RoQ attack. However, mode mixing and false component are the challenge problems to analyze the RoQ attack by HHT method. Ensemble empirical mode decomposition (EEMD) method is used to eliminate the mode mixing problem. Correlated coefficient method is used to recognize the false components. In this paper, EEMD and correlated coefficient methods are combined to detect the weak signal generated by RoQ attack. Ad Hoc On-demand Multi-path Distance Vector routing protocol and random Routing REQuest flooding attack are simulated to implement RoQ attack in wireless sensor network by Network Simulator. Suitable white noises are added to original signal to detect the weak RoQ attack signal. Experiment results show that the improved HHT methods are highly effective to detect RoQ attack, when the standard deviation of white noise is 0.01 and the number of ensemble is 80, the detection results is best. When the correlated coefficient of intrinsic mode functions (IMFs) is greater than 0.2, the IMFs can be used to analyze and detect RoQ attack. To our knowledge, this is the first quantitative experiment and method research on the routing-layer RoQ attack detection in WSN.

Secure State Estimation and Control for Cyber Security of the Nonlinear Power Systems

We focus on securely estimating the state of a nonlinear dynamical system from a set of corrupted measurements for two classes of nonlinear systems, and propose a technique that enables us to perform secure state estimation for those systems. We then illustrate how the proposed nonlinear secure state estimation technique can be used to perform estimation in the cyber layer of interconnected power systems under cyber-physical attacks and communication failures. In particular, we focus on an interconnected power system comprised of several synchronous generators, transmission lines, loads, and energy storage units, and propose a secure estimator that allows us to securely estimate the dynamic states of the power network. Finally, we numerically demonstrate the effectiveness of the proposed secure estimation algorithm, and show that the algorithm enables the cyber layer to accurately reconstruct the attack signals.

Study on the Effect of Crosstalk Attack in 40Gb/s Optical Fiber Communication System

By using VPI simulation tool, the effects of intra-band crosstalk attack, inter-band crosstalk attack and gain competition on 40Gb/s optical fiber communication system are studied. The results show that the power of attack signal is the main factor that crosstalk attack damages the quality of user signal. The higher the power of crosstalk attack signal, the lower the signal quality of the attacked signal.

A data-driven covert attack strategy in the closed-loop cyber-physical systems

In this paper, a data-driven covert attack strategy is proposed for a class of closed-loop cyber-physical systems. Without the parameters of the system plant and the nominal controller, the attacker can only use the intercepted input and output data of the nominal system. The injected input attack signals are designed based on the subspace predictive control method, which can deviate the real outputs to the expected attack references in a future time horizon. Meanwhile, by injecting the designed output attack signals for compensation, the attack cannot be detected by the anomaly detector. The simulation results of an irrigation canal system illustrate the effect of the proposed strategy with satisfactory performances.

Observer‐based attack‐resilient control for linear systems against FDI attacks on communication links from controller to actuators

SummaryFor the adversarial attacks on the communication links from the controller to the actuators, most of the existing attack‐resilient control results focus on denial‐of‐service attacks. Unlike the existing results, this paper studies the observer‐based attack‐resilient control problem for linear systems with false data injection attacks and process disturbances. Due to limited resources, the malicious attacker is assumed to only manipulate a certain number of communication links from the controller to the actuators. A novel control architecture is proposed, which consists of an attack‐resilient state observer, a controller gain scheme, and a supervisory switching strategy. The observer is developed based on the maximin strategy, and state estimation will be used to construct the controller. The switching strategy is designed to pick an appropriate controller gain and prevent the attack signals from entering the plant automatically. It is shown that the closed‐loop system is stable with an attack‐resilient performance. Finally, to verify the effectiveness of the proposed controller, simulation results on a linearized reduced‐order aircraft system and an IEEE six‐bus power system are provided.