Simple Attack Research Articles

Steering cooperation: Adversarial attacks on prisoner’s dilemma in complex networks

This study examines the application of adversarial attack concepts to control the evolution of cooperation in the prisoner’s dilemma game in complex networks. Specifically, it proposes a simple adversarial attack method that drives players’ strategies towards a target state by adding small perturbations to social networks. The proposed method is evaluated on both model and real-world networks. Numerical simulations demonstrate that the proposed method can effectively promote cooperation with significantly smaller perturbations compared to other techniques. Additionally, this study shows that adversarial attacks can also be useful in inhibiting cooperation (promoting defection). The findings reveal that adversarial attacks on social networks can be potent tools for both promoting and inhibiting cooperation, opening new possibilities for controlling cooperative behavior in social systems while also highlighting potential risks.

Kibernetski napadi preko stranskih kanalov

When implementing cryptographic primitives in software, we often resort to optimizing the software code in order to reduce unnecessary computation time. Such decisions can have negative consequences on data leakage outside the implementation. Attackers can exploit the additional information generated by the execution of the software solution in a way that gives them additional insights into the operation of the software, the values calculated and access to the data itself. Insights can be gained in the form of execution time, memory access patterns, power consumption, and other seemingly unrelated system parameters. Such attacks are referred to as “side-channel attacks”. This paper presents several examples of such attacks and the magnitude of information leakage, as well as how to protect against such attacks. Time-based cryptanalysis, power-based cryptanalysis, including a special variant – video-based cryptanalysis – and memory-based cryptanalysis are described. A simple timing cryptanalysis attack is used as an example to present the analysis process and the results before and after the implementation of the proposed mitigation. Članek predstavlja več primerov takšnih napadov in razsežnosti uhajanja informacij ter načinov zaščite pred napadi. Opisane so časovna kriptoanaliza, kriptoanaliza na podlagi porabe energije in njena posebna različica -- kriptoanaliza na podlagi videoposnetka -- ter pomnilniška kriptoanaliza. Na primeru preprostega napada s časovno kriptoanalizo je predstavljen postopek analize in rezultati pred in po implementaciji predlagane zaščite.

A Not So Discrete Sampler: Power Analysis Attacks on HAWK signature scheme

HAWK is a lattice-based signature scheme candidate to the fourth call of the NIST’s Post-Quantum standardization campaign. Considered as a cousin of Falcon (one of the future NIST post-quantum standards) one can wonder whether HAWK shares the same drawbacks as Falcon in terms of side-channel attacks. Indeed, Falcon signature algorithm and particularly its Gaussian sampler, has shown to be highly vulnerable to power-analysis attacks. Besides, efficiently protecting Falcon’s signature algorithm against these attacks seems a very challenging task. This work presents the first power analysis leakage review on HAWK signature scheme: it extensively assesses the vulnerabilities of a central and sensitive brick of the scheme, the discrete Gaussian sampler. Knowing the output x of the sampler for a given signature leads to linear information about the private key of the scheme. This paper includes several demonstrations of simple power analysis attacks targeting this sample x with various attacker strengths, all of them performed on the reference implementation on a ChipWhisperer Lite with STM32F3 target (ARM Cortex M4). We report being able to perform key recoveries with very low (to no) offline resources. As this reference implementation of HAWK is not claimed to be protected against side-channel attacks, the existence of such attacks is not surprising, but they still concretely warn about the use of this unprotected signature on physical devices. To go further, our study proposes a generic way of assessing the performance of a sidechannel attack on x even when less information is recovered, in a setting where some protections are implemented or when the attacker has less measurement possibilities. While it is easy to see that x is a sensitive value, quantifying the residual complexity of the key recovery with some knowledge about x (like the parity or the sign of some coefficients) is not straightforward as the underlying hardness assumption is the newly introduced Module-LIP problem. We propose to adapt the existing methodology of leaky LWE estimation tools (Dachman-Soled et al. at Crypto 2020) to exploit the retrieved information and lower down the residual key recovery complexity. To finish, we propose an ad-hoc technique to lower down the leakage on the identified vulnerability points. These modifications prevent our attacks on our platform and come with essentially no cost in terms of performance. It could be seen as a temporary solution and encourages more analysis on proven side-channel protection of HAWK like masking.

A joint lightly perturbation and synthesizing optimization attack framework for point cloud perturbation

Due to the inherent characteristic of deep learning models, prior researchers have focused on studying adversarial strategies aimed at uncovering their vulnerabilities. However, these strategies have been primarily been confined to the realm of image processing. When considering 3D vision structures, such as point clouds and meshes, the robustness of learning models also diminishes significantly in the presence of discernible outliers, and these strategies often fail to generalize across different DNN architectures. In this paper, a simple adversarial perturbation and optimization attack framework, Tangent Plane Perturbation and Synthesizing Optimization Attack (TPSOA) is presented. TPSOA provides a point cloud projection direction for point clouds, subtly inducing imperceptible perturbations on their tangent planes. Furthermore, acknowledging the geometry form of adversarial generation and its potential for 3D printing in physical scenarios, we reconstruct the adversarial mesh alongside the adversarial point cloud. A synthesized loss, incorporating both the Sobolev loss and the Chamfer loss, is utilized to optimize the distances between the adversarial generation and ground truth. Through a combination of visualization and quantitative analysis experiments, we validate the imperceptible nature of TPSOA, the necessity of the loss terms, and the magnitude of perturbations. These experiments that TPSOA enables targeted point cloud attacks that are imperceptible and of minor magnitude. In real-world adversarial attack and defense scenarios, as evidenced by both white-box and black-box experiments, the results show that TPSOA surpasses other state-of-the-art adversarial attack models, effectively manipulating a greater number of victim models while maintaining high efficiency, all without compromising its original structural integrity.

Simple and Efficient Partial Graph Adversarial Attack: A New Perspective

Simple and Efficient Partial Graph Adversarial Attack: A New Perspective

Sequential fusion‐based defense strategy against sophisticated Byzantine attacks in cognitive IoT networks

Abstract5G and 6G promise to be catalysts for the Internet of Things (IoT), enabling ultra‐massive and mission‐critical IoT. The demands of new IoT applications and the large number of connected objects being announced will exacerbate the thorny issue of spectrum scarcity in wireless communications. Cognitive radio (CR) is a revolutionary technology that promises to mitigate the problem of spectrum scarcity through more efficient use of spectrum. Integrating CR into the IoT allows objects to opportunistically access spectrum resources already allocated to a Primary User (PU) without causing interference. Spectrum sensing (SS) allows objects to be aware of the PU's spectrum occupancy status. In radio environments where the PU signal is subject to multipath and shadowing effects that degrade the channel between the PU and objects, SS performed by a single object could be inaccurate and lead to incorrect decisions about the PU's status. Cooperative spectrum sensing (CSS) has been proposed to improve detection performance. However, this cooperation between objects has opened the way to a new form of attack known as the Spectrum Sensing Data Falsification (SSDF) or Byzantine attack. In a SSDF attack, attackers falsify their local sensing results before sharing them in the CSS. This attack is very harmful to the CSS and can lead to a loss of spectrum opportunities or interference with the PU. In this paper, from the attack point of view, a sophisticated Byzantine attack model that generalizes well the simple attack strategies has been proposed and allows an attacker to implement other attack strategies. From a defense point of view, a new and innovative Weighted Sequential Hypothesis Testing (WSPRT) scheme has been suggested. This ensures the security of the CSS while significantly reducing the average number of samples required for overall decision‐making in a very hostile IoT network. The results obtained from simulations carried out in various attacks scenarios show that the proposed secure CSS scheme requires at most six samples to detect the state of the PU without error when the proportion of attackers reaches 80%. This performance far exceeds that of other defense mechanisms such as classic WSPRT, SPRT, and majority rule, with which we have compared it under the same conditions. In general, for the classic WSPRT, SPRT, and majority rule mechanisms, the error rate starts to deteriorate at ratio 40% of attackers and the number of samples is greater than six and reaches 50.

A real-time network based anomaly detection in industrial control systems

Data manipulation attacks targeting network traffic of SCADA systems may compromise the reliability of an Industrial Control system (ICS). This can mislead the control center about the real-time operating conditions of the ICS and can alter commands sent to the field equipment. Deep Learning techniques appear as a suitable solution for detecting such complicated attacks. This paper proposes a Network based Anomaly Detection System (NADS) to detect data manipulation attacks with a focus on Modbus/TCP-based SCADA systems. The proposed NADS is a sequence to sequence auto encoder which uses the long short term memory units with embedding layer, teacher forcing technique and attention mechanism. The model has been trained and tested using the SWaT dataset, which corresponds to a scaled-down water treatment plant. The model detected 23 of 36 attacks and outperformed two other existing NADS with an improvement of 0.22 for simple attacks and obtained a recall value of 0.86 on attack 36 compared to the other NADS which obtained 0.74.

Efficient adversarial training with multi-fidelity optimization for robust neural network

Adversarial examples (AEs) pose a significant threat to the security and reliability of deep neural networks. Adversarial training (AT) is one of the effective defense methods, involving the integration of a number of generated AEs into the training process to enhance model robustness. However, the computational cost associated with AE generation is unbearable, particularly for large-scale tasks. In pursuit of fast AT, many algorithms generate AEs by adopting a simple attack strategy, but they often sacrifice the quality of AEs and suffer from catastrophic overfitting, resulting in suboptimal model robustness. To address these issues, our approach incorporates multi-fidelity optimization, which employs a dynamic attack strategy to generate AEs with varying fidelity within a suitable range. Furthermore, we introduce a surrogate-assisted fidelity estimation module at the beginning of our proposed algorithm, allowing for the adaptive determination of the fidelity range tailored to specific tasks. Comparative experiments with seven state-of-the-art algorithms on three networks and three datasets demonstrate that the proposed algorithm obtains a competitive robust accuracy but spends only 50% of the training time of the projected gradient descent algorithm.

Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs

Real-world graphs are dynamic, constantly evolving with new interactions, such as financial transactions in financial networks. Temporal Graph Neural Networks (TGNNs) have been developed to effectively capture the evolving patterns in dynamic graphs. While these models have demonstrated their superiority, being widely adopted in various important fields, their vulnerabilities against adversarial attacks remain largely unexplored. In this paper, we propose T-SPEAR, a simple and effective adversarial attack method for link prediction on continuous-time dynamic graphs, focusing on investigating the vulnerabilities of TGNNs. Specifically, before the training procedure of a victim model, which is a TGNN for link prediction, we inject edge perturbations to the data that are unnoticeable in terms of the four constraints we propose, and yet effective enough to cause malfunction of the victim model. Moreover, we propose a robust training approach T-SHIELD to mitigate the impact of adversarial attacks. By using edge filtering and enforcing temporal smoothness to node embeddings, we enhance the robustness of the victim model. Our experimental study shows that T-SPEAR significantly degrades the victim model's performance on link prediction tasks, and even more, our attacks are transferable to other TGNNs, which differ from the victim model assumed by the attacker. Moreover, we demonstrate that T-SHIELD effectively filters out adversarial edges and exhibits robustness against adversarial attacks, surpassing the link prediction performance of the naive TGNN by up to 11.2% under T-SPEAR. The code and datasets are available at https://github.com/wooner49/T-spear-shield

Past and Present Russian Information Operations in Ukraine: Competition into Conflict

Sovereign nation-states seek to ensure the survival and advancement of national goals through cooperation, competition, and conflict. This paper explores the use of irregular warfare prior to and during the transition from competition to conflict as an international tool to assert control over public narratives. This stratagem has been made an increasingly effective tool through means of the Internet. Informational warfare is not a new concept, however, the precedent of operations in the information environment in concert with operations in the physical realm have started to take shape in the struggle between Ukraine and Russia over the past several decades. The visualization of the competition continuum model allows us to examine events and understand how actions taken in the cyber realm effect an informational narrative, and not simply be portrayed as a method of simple attack and defense.

Event-Triggered Reverse Attacks on Remote State Estimation

Security issues in cyber-physical systems have attracted increasing attention in recent years. In this paper, a security problem in a remote estimation application is considered, where an attacker tries to degrade estimation performance via malicious attacks. In our scenario, a smart sensor transmits its innovation to a remote estimator with a residue-based false data detector. Instead of assuming that the attacker launches a consecutive man-in-the-middle attack, we consider the case with intermittent attacks. Reverse attack is a simple attack strategy, which enables an attacker to change signs of the innovation sequences. Therefore, owing to the above reasons, an event-triggered reverse attack strategy is proposed to degrade system performance. First, the stealthiness of the event-triggered linear deception attack strategy is studied. Then, the evolution of the estimation error covariance is computed and the reverse attack is proven to be the optimal linear deception attack. We demonstrate that our event-triggered reverse attack is more destructive than a random reverse attack. Furthermore, a convex optimization problem is established to design event-triggered parameters. Comparisons of attack strategies are provided in a numerical example to validate the superiority of the reverse attack.

RollBack: A New Time-Agnostic Replay Attack Against the Automotive Remote Keyless Entry Systems

Automotive Keyless Entry (RKE) systems provide car owners with a degree of convenience, allowing them to lock and unlock their car without using a mechanical key. Today’s RKE systems implement disposable rolling codes, making every key fob button press unique, effectively preventing simple replay attacks. However, a prior attack called RollJam was proven to break all rolling code–based systems in general. By a careful sequence of signal jamming, capturing, and replaying, an attacker can become aware of the subsequent valid unlock signal that has not been used yet. RollJam, however, requires continuous deployment indefinitely until it is exploited. Otherwise, the captured signals become invalid if the key fob is used again without RollJam in place. We introduce RollBack, a new replay-and-resynchronize attack against most of today’s RKE systems. In particular, we show that even though the one-time code becomes invalid in rolling code systems, replaying a few previously captured signals consecutively can trigger a rollback-like mechanism in the RKE system. Put differently, the rolling codes become resynchronized back to a previous code used in the past from where all subsequent yet already used signals work again. Moreover, the victim can still use the key fob without noticing any difference before and after the attack. Unlike RollJam, RollBack does not necessitate jamming at all. In fact, it requires signal capturing only once and can be exploited at any time in the future as many times as desired. This time-agnostic property is particularly attractive to attackers, especially in car-sharing/renting scenarios in which accessing the key fob is straightforward. However, while RollJam defeats virtually any rolling code–based system, vehicles might have additional anti-theft measures against malfunctioning key fobs, hence against RollBack. Our ongoing analysis (with crowd-sourced data) against different vehicle makes and models has revealed that ∼ 50% of the examined vehicles in the Asian region are vulnerable to RollBack, whereas the impact tends to be smaller in other regions, such as Europe and North America.

Exploring the Frontier of Password Cracking: Methods, Effectiveness, and Defense Strategies

The manner of attacker's behavior cannot be underestimated; hackers use simple traditional attacks such as brute-force and dictionary attacks as well as sophisticated algorithms including: Markov models, probabilistic context-free grammars (PCFG), and generative adversarial networks (GANs). These are one of among the most advanced approaches which utilize artificial intelligence and machine learning to identify the patterns in passwords, guess them and crack them. Markov models calculate transitions from one character state to another, so they estimate password guesses as a probability which is sampled from the distribution. PCFGs further advance the concept by making use of context-specific inputs for producing the passwords, and as a result it is possible to come up with the candidates who are balanced and have the contextually valid characters. Years ago, the CPA attack was considered the ultimate approach for password cracking. Today, GANs have taken their place, implementing adversarial networks that use them as generators to generate valid password examples. It is evident from the research that abusing users' habits and context during password cracking has been proved that it can lead to a tremendous speed gain of the cracking process. The crackers exploit here patterns in the behavior and environmental features and tailor the cracking strategies. Besides that, recurrent neural networks (RNNs) and convolutional neural networks (CNNs) are considered to be good options in password modeling as well, where the ongoing researches are devoted to the structures of neural network so that the guessing powers of networks can improve. These new approaches have demonstrated an improvement of at least 10-15% over the outdated ones, thus they are credible in forming the password cracking paradigm shift. Thus, for defeating such sophisticated threats, companies should take into account such robust passphrase policies, teach the user about safety of passwords and implementation of rigid access mechanisms. Educating people on cyber threats basics and development of the reasonable cybersecurity culture are the factors that provide the impact reduction of attacks based on users’ behavior and contextual information.

The Maillard reactions: Pathways, consequences, and control.

The century old Maillard reactions continue to draw the interest of researchers in the fields of Food Science and Technology, and Health and Medical Sciences. This chapter seeks to simplify and update this highly complicated, multifaceted topic. The simple nucleophilic attack of an amine onto a carbonyl group gives rise to a series of parallel and subsequent reactions, occurring simultaneously, resulting into a vast array of low and high mass compounds. Recent research has focused on: (1) the formation and transformationof α-dicarbonyl compounds, highly reactive intermediates which are essential in the development of the desired color and flavor of foods, but also lead to the production of the detrimental advanced glycation end products (AGEs); (2) elucidation of the structures of melanoidins in different foods and their beneficial effects on human health; and (3) harmful effects of AGEs on human health. Considering that MRs have both positive and negative consequences, their control to accentuate the former and to mitigate the latter, is also being conscientiously investigated with the use of modern techniques and technology.

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

The use of Electronic Toll Collection (ETC) systems is on the rise, as these systems have a significant impact on reducing operational costs. Toll service providers (TSPs) access various information, including drivers' IDs and monthly toll fees, to bill drivers. While this is legitimate, such information could be misused for other purposes violating drivers' privacy, most prominent, to infer drivers' movement patterns. To this end, privacy-preserving ETC (PPETC) schemes have been designed to minimize the amount of information leaked while still allowing drivers to be charged. We demonstrate that merely applying such PPETC schemes to current ETC infrastructures may not ensure privacy. This is due to the (inevitable) minimal information leakage, such as monthly toll fees, which can potentially result in a privacy breach when combined with additional background information, such as road maps and statistical data. To show this, we provide a counterexample using the case study of Brisbane's ETC system. We present two attacks: the first, being a variant of the presence disclosure attack, tries to disclose the toll stations visited by a driver during a billing period as well as the frequency of visits. The second, being a stronger attack, aims to discover cycles of toll stations (e.g., the ones passed during a commute from home to work and back) and their frequencies. We evaluate the success rates of our attacks using real parameters and statistics from Brisbane's ETC system. In one scenario, the success rate of our toll station disclosure attack can be as high as 94%. This scenario affects about 61% of drivers. In the same scenario, our cycle disclosure attack can achieve a success rate of 51%. It is remarkable that these high success rates can be achieved by only using minimal information as input, which is, e.g., available to a driver's payment service provider or bank, and by following very simple attack strategies without exploiting optimizations. As a further contribution, we analyze how the choice of various parameters, such as the set of toll rates, the number of toll stations, and the billing period length, impact a driver's privacy level regarding our attacks.

Adv-4-Adv: Thwarting changing adversarial perturbations via adversarial domain adaptation

Whereas adversarial training can be useful against specific adversarial perturbations, they have also been proven ineffective in generalizing towards attacks deviating from those used for training. However, we observe that this ineffectiveness is intrinsically connected to domain adaptability, another crucial issue in deep learning for which adversarial domain adaptation appears to be a promising solution. Consequently, we propose Adv-4-Adv as a novel adversarial training method that aims to retain robustness against unseen adversarial perturbations. Essentially, Adv-4-Adv treats attacks incurring different perturbations as distinct domains, and by leveraging the power of adversarial domain adaptation, it aims to remove the domain/attack-specific features. This forces a trained model to learn a robust domain-invariant representation, which in turn enhances its generalizability. Extensive evaluations on Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100 demonstrate that a model trained by Adv-4-Adv based on examples crafted by simple attacks (e.g., FGSM) can be generalized to more advanced attacks (e.g., PGD), and the performance exceeds state-of-the-art proposals on these datasets.

Effects of Functional Training on the Achievement Level of Direct Simple Attack for Junior Epée Fencers (less than 11 years)

Effects of Functional Training on the Achievement Level of Direct Simple Attack for Junior Epée Fencers (less than 11 years)

Cybersecurity vulnerability analysis of medical devices purchased by national health services

The growing integration of software within medical devices introduces the potential for cybersecurity threats. How significant is this risk, and to what extent are citizens currently exposed? In this study, we adopt a new data-gathering methodology using datasets provided in Open Contracting Data Standard (OCDS). This allowed us to perform an extensive analysis across over 36 countries within a 12-year range, searching 92 million public administration purchase records for potentially vulnerable medical devices. The findings reveal a concerning landscape wherein numerous medical devices purchased by national health services possessed or still possess 661 distinct vulnerabilities—more than half of which are deemed critical or high-severity. These vulnerabilities enable relatively simple attacks to impact data confidentiality, integrity, and accessibility severely. Even if patches were applied immediately upon discovery, these vulnerabilities would still result in roughly 3.2 years of system exposure from the time a device is purchased until a software vulnerability is announced, with all classes of devices affected, including high-risk IIB and III devices which accounts for 74% of instances. While a full analysis requires interactivity, this noninvasive methodology enables a large-scale study, emphasizing the need to move faster from the safety to the security of medical devices.

Towards evaluating the robustness of deep neural semantic segmentation networks with Feature-Guided Method

Although deep neural networks (DNNs) demonstrated its superior performance in computer vision, recent works proved that the vulnerability of deep neural task systems to carefully crafted human-imperceptible perturbations. We observe that the majority of adversarial attack methods for generating perturbations are based on rotation or modification of the input-diagnostic. Regardless of the characteristics completed by additional sources, such approaches yield comparable properties to enrich initial details. It motivates us to consider views about using various information apart from original inputs to deliver adversarial features. For such needs, we induce a simple yet adaptable adversarial attack strategy with a Feature-Guided Method (FGM) for crafting adversarial examples (AEs) in segmentation domain. FGM first induces the multi-source patterns that are apart from the original inputs. Then, producing feature diversities generated with the original data to deliver the perturbed components. Finally, FGM blends original inputs with created features in a defined norm constraint to form the adversarial examples. In such way, it preserves the original positive class-general characteristics and enriches the new positive class-specific diversities when performing adversarial attacks. Moreover, FGM employs the adaptive gradient-based strategy on such generated information, which lowers the risk of falling into the local optimum when searching for the decision boundary of the source and target models in latent space. We conduct detailed experiments to evaluate the performance of the proposed method compared to baselines on public segmentation models. The experimental results reveal better performance of FGMs in fooling source and target segmentation systems leading large margins over 5% on mIoU, mRec, and mAcc. We also deploy the adversarial training with proposed work and PGD on widely used models. Our approach improves the robust quality of adversarially trained models on FCN, PSPNet, and DeepLabv3 with various backbones by significant margins with over 13% improvement on mIoU and 12% on mRec, which indicates a better impact of deploying such mechanisms on robust deep neural segmentation models.

Adversarial Sample Generation using the Euclidean Jacobian-based Saliency Map Attack (EJSMA) and Classification for IEEE 802.11 using the Deep Deterministic Policy Gradient (DDPG)

One of today's most promising developments is wireless networking, as it enables people across the globe to stay connected. As the wireless networks' transmission medium is open, there are potential issues in safeguarding the privacy of the information. Though several security protocols exist in the literature for the preservation of information, most cases fail with a simple spoof attack. So, intrusion detection systems are vital in wireless networks as they help in the identification of harmful traffic. One of the challenges that exist in wireless intrusion detection systems (WIDS) is finding a balance between accuracy and false alarm rate. The purpose of this study is to provide a practical classification scheme for newer forms of attack. The AWID dataset is used in the experiment, which proposes a feature selection strategy using a combination of Elastic Net and recursive feature elimination. The best feature subset is obtained with 22 features, and a deep deterministic policy gradient learning algorithm is then used to classify attacks based on those features. Samples are generated using the Euclidean Jacobian-based Saliency Map Attack (EJSMA) to evaluate classification outcomes using adversarial samples. The meta-analysis reveals improved results in terms of feature production (22 features), classification accuracy (98.75% for testing samples and 85.24% for adversarial samples), and false alarm rates (0.35%).