Simple Attack Research Articles

Revisiting the transferability of adversarial examples via source-agnostic adversarial feature inducing method

Though deep neural networks (DNNs) have revealed their extraordinary performance in the fields of computer vision, it is evident that the vulnerability of DNNs to adversarial attacks with crafted human-imperceptible perturbations. Most existing adversarial attacks draw their attention to invading target deep task models by enhancing input-diagnostic features via image rotation, warp, or transformation to improve adversarial transferability. Such manners pay close concentration to operation on original inputs regardless of the properties from different source information. Research has inspired us to consider utilizing source-agnostic information and integrating generated features with raw inputs to enrich adversarial properties. For such needs, we propose a simple and flexible adversarial attack method with source-agnostic Feature Inducing Method (FIM) for improving the transferability of adversarial examples (AEs). FIM first focuses on generating perturbed features by imitating diverse patterns from multi-domain sources. Instead of exploiting the original inputs’ diversity, such proposed work gains the various properties by random feature imitation referring to different source distributions. By optimizing the generated features with norm bounds, FIM then integrates original inputs with imitative features. Such manner can diverse row positive class-general features, which reduce the capability of class-specific patterns on cross-model transferability. Based on the crafted property, FIM employs the adaptive gradient-based strategy on such information to generate perturbations, which helps to decrease probability dropping into local optimal when searching for the decision boundary of source and target models. We conduct detailed experiments to evaluate the performance of our proposed approach with existing baselines on three public datasets. The experimental results reveal the better performance of the proposed works on fooling source and target task models leading to a considerable margin in most adversarial scenarios. We further investigate adversarial attacks on adversarial defense models (with adversarial training and trades). Such a proposed attack strategy achieves better attack quality by a margin over 3.00% on CIFAR10 and reduces the robust accuracy of adversarially trained models by a large margin near 9.00% on MNIST. Furthermore, we exploit the performance of the proposed attack strategy applied to feature-level adversarial domains and conduct evaluations to demonstrate its adversarial feasibility in integrating with various attack mechanisms, which gains better adversarial effectiveness over 20.00% than the base attacks on studied deep task models.

Area‐time efficient point multiplication architecture on twisted Edwards curve over general prime field GF(p)

AbstractElliptic curve point multiplication is the main primitive required in almost all security schemes using elliptic curve cryptography (ECC). It is the leading computationally intensive operation that sets the overall performance of the associated cryptosystem. This work presents a highly novel area–time efficient elliptic curve point multiplier over a general prime field . It is based on an efficient radix‐23 parallel multiplier, which performs a ‐bit multiplication in clock cycles. On the system level, the twisted Edwards curves with unified point addition using projective coordinates are adopted, where an efficient scheduling technique is presented to schedule several operations on deployed modular arithmetic units. Due to the introduced optimization at different stages of the design, latency, hardware resource requirement, and total clock cycle count are reduced significantly. Synthesis, and implementation of the proposed design over different Xilinx FPGA platforms are completed using the Xilinx ISE Design Suite tool for key sizes of 192, 224, and 256 bits. The 256‐bit Xilinx Virtex‐7 FPGA implementation reveals that it completes a single point multiplication operation in 0.8 ms and occupies 6.7K FPGA slices in a clock cycle count of 132.2K. It produces significantly better area–time product and throughput per slice than the contemporary designs. The proposed design also has the potential to counter simple power analysis and timing attacks. Thus, it is an elegant solution to develop ECC‐based cryptosystems for applications, where both speed and hardware resource consumption are important.

Cryptanalysis of ARX-based White-box Implementations

At CRYPTO’22, Ranea, Vandersmissen, and Preneel proposed a new way to design white-box implementations of ARX-based ciphers using so-called implicit functions and quadratic-affine encodings. They suggest the Speck block-cipher as an example target.In this work, we describe practical attacks on the construction. For the implementation without one of the external encodings, we describe a simple algebraic key recovery attack. If both external encodings are used (the main scenario suggested by the authors), we propose optimization and inversion attacks, followed by our main result - a multiple-step round decomposition attack and a decomposition-based key recovery attack.Our attacks only use the white-box round functions as oracles and do not rely on their description. We implemented and verified experimentally attacks on white-box instances of Speck-32/64 and Speck-64/128. We conclude that a single ARX-round is too weak to be used as a white-box round.

RPL-Based IoT Networks under Simple and Complex Routing Security Attacks: An Experimental Study

Effective security support still remains a challenge even for a standardized Internet of Things network protocol such as the IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL). It provides limited protection against external security attacks but stays highly vulnerable to internal routing attacks. The inherent RPL design of RPL, particularly its topology establishment and maintenance mechanism, makes it easy to initiate such kinds of attacks which target overall network performance and topology stability. Establishing a firm and practical understanding of the impacts of these attacks on RPL networks is still critically needed for further investigation. This is more demanding when considering varying-scale RPL deployments targeted by complex attack scenarios. In this research work, an extensive experimental study of these critical RPL routing attacks considering simple-to-complex attack scenarios in varying-scale RPL network setups is presented. It provides a practical contribution toward experimentally understanding the effectiveness of internal routing attacks when targeting RPL-based IoT networks. The main objective is to provide future research works with a practical reference to the effectiveness of these security attacks and the overall performance of RPL networks under routing attacks. The results indicate the adverse impacts of routing attacks on the overall performance of RPL networks. Even in simple attack scenarios, it was found that the attacked networks experienced noticeable degradation in QoS performance and topology stability. In addition, the attacks incurred considerable increases in energy consumption and control traffic overhead. These were more evident in large-scale experimental setups and also under composite and hybrid routing attacks. QoS performance and topology stability degraded by more than 90% whereas energy consumption and network overhead increased by more than 200%.

Research on group distribution leakage analysis method for RSM

Side channel attack is a new and simple attack idea, and its proposal has created a significant threat to the security of cryptographic devices. With the continuous development of deep learning techniques, deep learning-based side channel attacks have enabled the attack techniques to reach new heights, but the attack efficiency and training time have become new problems. In order to improve the attack efficiency, researchers have proposed a large number of leakage analysis methods, which can effectively extract the intervals with significant leakage in the energy consumption curve and reduce the training parameters and data volume. In order to deal with side channel attacks, researchers have proposed various resistance strategies, among which masking protection is the simplest and widely used way. RSM rotating S-box masking scheme is a particularly important masking protection scheme, which uses a first-order masking scheme to randomize the leakage energy consumption of sensitive information using random masks, thus making the algorithm resistant to first-order side channel attacks. For this type of masking algorithm, this paper proposes a new leakage analysis algorithm, namely "Group Distribution Difference" (GDD). This algorithm is based on the distribution difference of energy consumption, and the energy consumption frequency in the group is calculated instead of the probability distribution. The KL distance is used to calculate the difference between groups and find out the leakage interval, so as to achieve an efficient attack.

Dispensing of quantum information beyond no-broadcasting theorem—is it possible to broadcast anything genuinely quantum?

No-broadcasting theorem is one of the most fundamental results in quantum information theory; it guarantees that the simplest attacks on any quantum protocol, based on eavesdropping and copying of quantum information, are impossible. Due to the fundamental importance of the no-broadcasting theorem, it is essential to understand the exact boundaries of this limitation. We generalize the standard definition of broadcasting by restricting the set of states which we want to broadcast and restricting the sets of measurements which we use to test the broadcasting. We show that in some of the investigated cases broadcasting is equivalent to commutativity, while in other cases commutativity is not necessary.

Poison Neural Network-Based mmWave Beam Selection and Detoxification With Machine Unlearning

Deep neural network-based learning methods have been considered promising techniques used in beam selection problems. However, existing research ignores the peculiar vulnerabilities of neural networks. The adversaries can use data poisoning to embed predefined triggers into a model during training time such that the neural network-based beam model may make an incorrect output decision of a test example when patched with the trigger. Data poisoning offers attackers the possibility to build backdoors. The goal of backdoors is often unethical, such as giving users a poor experience by manipulating infected models to output inappropriate beams. In this paper, first, we introduce a simple backdoor attack method by using data poisoning in a mmWave beam selection system. By numerical simulations, we verify that this poisoning attack is effective for neural networks with different structures. In addition, we explore the effect of poisoned data volume on the effect of backdoor attacks. The results show that the backdoor can be successfully implanted into the beam selection neural network. Besides, we fine-tune the trained model for a new wireless communication environment, and the results show that backdoors still exist even when the model is tuned with data from new scenarios. Then, we propose a machine unlearning solution to mitigate the backdoor of the trained beam selection model. The problem of eliminating backdoors is modeled as a minimax optimization problem. We propose a novel adversarial unlearning method along with label smoothing to solve the backdoor removal problem. We compared the proposed backdoor elimination method with the classical fine-tuning elimination method and the neural network pruning method through numerical simulations. The results show that the fine-tuning and the pruning methods cannot effectively remove the backdoor. The proposed machine unlearning method can make the trained model forget about the backdoor under the condition that the performance of the benign task (beam selection tasks when the trigger does not appear) is guaranteed to be slightly degraded. In summary, our work illustrates that data poisoning-based backdoor attacks may exist in wireless networks, and we propose a scheme to eliminate backdoors.

Coding Split and Adjustment to Defend OFDM-IM Against Jamming Attacks

Jamming is a simple but efficient attack method that challenges communications while traditional physical-layer defence solutions are limited. Recently, index modulation (IM) is proposed to enable index transmission in addition to data symbol transmission, which gains resistance against jamming but with limited efficacy. This letter proposes a coding split and adjustment (CSA) framework for low-density parity-check (LDPC) coding assisted orthogonal frequency division multiplexing with IM (OFDM-IM) to enhance its anti-jamming capability. CSA splits the traditionally single system code rate into an index code rate and a data code rate, each independently adjusted based on jamming impacts to error performance. Simulation results verify that OFDM-IM with CSA exhibits superior error performance over traditional OFDM-IM and OFDM in three investigated jamming scenarios. Moreover, this letter reveals that the CSA assisted OFDM-IM can still recover signals while OFDM-IM and OFDM completely fail under high jamming power.

GOF-TTE: Generative Online Federated Learning Framework for Travel Time Estimation

Estimating the travel time of a path is an essential topic for the intelligent transportation system. It serves as the foundation for real-world applications, such as traffic monitoring, route planning, and taxi dispatching. However, building a model for such a data-driven task requires a large amount of users’ travel information, which closely relates to their privacy and, thus, is less likely to be shared. The not independent and identically distributed (Non-IID) trajectory data across data owners also make a predictive model extremely challenging to be personalized if we directly apply federated learning. Finally, previous work on travel time estimation (TTE) does not consider the real-time traffic state of roads, which we argue, can significantly influence the prediction. To address the above challenges, we introduce GOF-TTE for the mobile user group, generative online federated learning framework for TTE, which 1) utilizes the federated learning approach, allowing private data to be kept on client devices while training, and designs the global model as an online generative model shared by all clients to infer the real-time road traffic state and 2) apart from sharing a base model at the server, adapts a fine-tuned personalized model for every client to study their personal driving habits, making up for the residual error made by localized global model prediction. We also employ a simple privacy attack to our framework and implement the differential privacy mechanism to guarantee privacy safety further. Finally, we conduct experiments on two real-world public taxi data sets of DiDi Chengdu and Xi’an. The experimental results demonstrate the effectiveness of our proposed framework.

The vibration knows who you are! A further analysis on usable authentication for smartwatch users

These days, smartwatches are becoming more common and can even operate in stand-alone mode. This increases the need for smartwatches to authenticate users independently without paired smartphones. Currently, password or pattern-based methods can authenticate the smartwatch users in stand-alone mode, but these methods are known to be vulnerable to simple attacks such as shoulder-surfing and password dictionary attacks. In addition, biometric-based methods, which are expected to release on smartwatches in the near future, require inconvenient user interaction or special sensors for measurement. In light of this, we propose a smartwatch user authentication method that does not require any additional sensors or user interaction. Based on the fact that the human body structure affects the way vibrations are absorbed, reflected, and propagated, we designed a smartwatch user authentication method based on a challenge-response structure using vibrations. In our method, a challenge is a set of fresh random vibrations, which are provided by default in current smartwatches, and a response to the challenge is measured by built-in gyroscope and accelerometer sensors. Our earlier study demonstrated that commercial smartwatch users can be authenticated with a low equal error rate (EER) of 1.37 %. In this paper, we extended the analysis of our method on various vibration types by using a prototype setup. As a result, we discovered an outperformed vibration type for user authentication. We conducted further analysis for users with heavier body weights as these individuals are more vulnerable to a not-in-wear attack. Finally, we conducted more advanced impersonation attacks on test participants with one or more similar physical indicators to demonstrate that our method is also secure against a wider range of more complex attacks.

Toward deceiving the intrusion attacks in containerized cloud environment using virtual private cloud‐based moving target defense

SummaryThe container‐based cloud has its distinct security challenges. In this article, moving target defense (MTD) is used to increase the cost and effort of the attacker to exploit resources and follow an attack path to compromise the critical resources in a container‐based cloud. The existing MTD mechanisms for cloud have not focused on intruder prevention inside containerized environment. The proposed solution is one of its kind that utilizes resource movement inside and across the virtual private network in the cloud to deceive intruders. The framework continuously changes the target/container to increase confusion about the routing path, so attackers cannot follow the simple attack path. This obscure cloud architecture increases the delay in attack and gives system/network administrators significant time to use Intrusion Detection mechanisms for countering the attack. The proposed scheme is implemented on the Google Cloud Platform (GCP) by using an extensive network of nodes hosting the stateful pods that are created and destroyed periodically. The experimental analysis confirmed that the proposed scheme substantially increased the attack path length and added obscurity at a low computation cost. However, as per experiments, implementing the proposed scheme in GCP slightly increases the dollar cost.

A Script-Based Cycle-True Verification Framework to Speed-Up Hardware and Software Co-Design: Performance Evaluation on ECC Accelerator Use-Case

Digital designs complexity has exponentially increased in the last decades. Heterogeneous Systems-on-Chip integrate many different hardware components which require a reliable and scalable verification environment. The effort to set up such environments has increased as well and plays a significant role in digital design projects, taking more than 50% of the total project time. Several solutions have been developed with the goal of automating this task, integrating various steps of the Very Large Scale Integration design flow, but without addressing the exploration of the design space on both the software and hardware sides. Early in the co-design phase, designers break down the system into hardware and software parts taking into account different choices to explore the design space. This work describes the use of a framework for automating the verification of such choices, considering both hardware and software development flows. The framework automates compilation of software, cycle-true simulations and analyses on synthesised netlists. It accelerates the design space exploration exploiting the GNU Make tool, and we focus on ensuring consistency of results and providing a mechanism to obtain reproducibility of the design flow. In design teams, the last feature increases cooperation and knowledge sharing from single expert to the whole team. Using flow recipes, designers can configure various third-party tools integrated into the modular structure of the framework, and make workflow execution customisable. We demonstrate how the developed framework can be used to speed up the setup of the evaluation flow of an Elliptic-Curve-Cryptography accelerator, performing post-synthesis analyses. The framework can be easily configured taking approximately 30 min, instead of few days, to build up an environment to assess the accelerator performance and its resistance to simple power analysis side-channel attacks.

Breaking Neural Reasoning Architectures With Metamorphic Relation-Based Adversarial Examples.

The ability to read, reason, and infer lies at the heart of neural reasoning architectures. After all, the ability to perform logical reasoning over language remains a coveted goal of Artificial Intelligence. To this end, models such as the Turing-complete differentiable neural computer (DNC) boast of real logical reasoning capabilities, along with the ability to reason beyond simple surface-level matching. In this brief, we propose the first probe into DNC's logical reasoning capabilities with a focus on text-based question answering (QA). More concretely, we propose a conceptually simple but effective adversarial attack based on metamorphic relations. Our proposed adversarial attack reduces DNCs' state-of-the-art accuracy from 100% to 1.5% in the worst case, exposing weaknesses and susceptibilities in modern neural reasoning architectures. We further empirically explore possibilities to defend against such attacks and demonstrate the utility of our adversarial framework as a simple scalable method to improve model adversarial robustness.

Efficiency of a predictive model for assessing the performance of the simple direct attack in terms of physical and motor abilities of junior fencers

The aim of this study was to identify the nature of the relationship between the performance of the skill of simple direct attack of the fencers and their physical and motor abilities, and also to build a predictive model for the performance of the skill of the simple direct attack of the fencers by knowing the efficiency of their physical and motor abilities for this performance. We used a descriptive, correlational, and survey approach to collect and analyze the data. The tests were applied on 40 fencers from the junior category (under 17 years old) in Diyala and Baghdad Clubs during the 2017-2018 season. The Statistical Package for the Social Sciences (SPSS) was used for statistical analysis. The majority of relationships between the results of the performance of the simple direct attack skill of the fencers and their physical and motor abilities were statistically significant (p < 0.05). So, most of the physical abilities and their various forms, as well as the motor abilities, have great contributions to the performance of the skill. We also have found the significance of the model’s coefficients (F = 12.672, p = 0.000), thus showing that the morality of the model confirms its efficiency. In conclusion, the effective relationships of physical and motor abilities were limited to the performance of the simple direct attack skill (straight) of junior fencers in: strength characterized by speed for the two legs, running (20 meters), accuracy, kinetic response, transitional speed with progress, transitional speed by retreat, endurance speed with progress and retreat, and agility. The predictive model did not show an effect of the predictors, although they are good predictors for the performance of the skill of simple direct attack for the fencers.

METODE ONE TIME PASSWORD MODIFIED SEBAGAI SISTEM KEAMANAN MONITORING IOT

Monitoring is an activity carried out to find out the process of running a program or system that has been designed, whether it runs well as expected or not, find out the obstacles that occur and how to overcome these obstacles. The cryptographic scheme to secure communication protocols is one of the most effective defenses against a variety of attacks, including eavesdropping and simple routing attacks, at the communication layer. One of the techniques studied in cryptography is encryption-description. This study aims to apply a one time password (OTP) modified algorithm into an IoT based temperature and humidity monitoring system using a Raspberry PI microcontroller device and a DHT 11 sensor. . The encryption process begins with hashing using the SHA method on the plaintext, followed by producing a private key and public key for RSA Signature encryption, the hashing results will be encrypted using the RSA Signature algorithm, the RSA Signature encryption results will be combined with the RSA Signature public key and plaintext, followed by producing an OTP that will be used as an AES key. Next the AES encryption process is executed, the OTP key will be encrypted RSA, the results of the RSA ciphertext and the AES ciphertext are combined and encoded with the Base64 method. The implementation of this security system gets the test results of the average duration for data encryption process is 435,163ms, and the data transmission with encryption process is 123,705ms

LTU Attacker for Membership Inference

We address the problem of defending predictive models, such as machine learning classifiers (Defender models), against membership inference attacks, in both the black-box and white-box setting, when the trainer and the trained model are publicly released. The Defender aims at optimizing a dual objective: utility and privacy. Privacy is evaluated with the membership prediction error of a so-called “Leave-Two-Unlabeled” LTU Attacker, having access to all of the Defender and Reserved data, except for the membership label of one sample from each, giving the strongest possible attack scenario. We prove that, under certain conditions, even a “naïve” LTU Attacker can achieve lower bounds on privacy loss with simple attack strategies, leading to concrete necessary conditions to protect privacy, including: preventing over-fitting and adding some amount of randomness. This attack is straightforward to implement against any model trainer, and we demonstrate its performance against MemGaurd. However, we also show that such a naïve LTU Attacker can fail to attack the privacy of models known to be vulnerable in the literature, demonstrating that knowledge must be complemented with strong attack strategies to turn the LTU Attacker into a powerful means of evaluating privacy. The LTU Attacker can incorporate any existing attack strategy to compute individual privacy scores for each training sample. Our experiments on the QMNIST, CIFAR-10, and Location-30 datasets validate our theoretical results and confirm the roles of over-fitting prevention and randomness in the algorithms to protect against privacy attacks.

Lightweight Architecture for Elliptic Curve Scalar Multiplication over Prime Field

In this paper, we present a novel lightweight elliptic curve scalar multiplication architecture for random Weierstrass curves over prime field Fp. The elliptic curve scalar multiplication is executed in Jacobian coordinates based on the Montgomery ladder algorithm with (X,Y)-only common Z coordinate arithmetic. At the finite field operation level, the adder-based modular multiplier and modular divider are optimized by the pre-calculation method to reduce the critical path while maintaining low resource consumption. At the group operation level, the point addition and point doubling methods in (X,Y)-only common Z coordinate arithmetic are modified to improve computation parallelism. A compact scheduling method is presented to improve the architecture’s performance, which includes appropriate scheduling of finite field operations and specific register connections. Compared with existing works, our design is implemented on the FPGA platform without using DSPs or BRAMs for higher portability. It utilizes 6.4~6.5k slices in Kintex-7, Virtex-7, and ZYNQ FPGA and executes an elliptic curve scalar multiplication for a field size of 256-bit in 1.73 ms, 1.70 ms, and 1.80 ms, respectively. Additionally, our design is resistant to timing attacks, simple power analysis attacks, and safe-error attacks. This architecture outperforms most state-of-the-art lightweight designs in terms of area-time products.

Adversarial attacks on voter model dynamics in complex networks.

This paper investigates adversarial attacks conducted to distort voter model dynamics in complex networks. Specifically, a simple adversarial attack method is proposed to hold the state of opinions of an individual closer to the target state in the voter model dynamics. This indicates that even when one opinion is the majority the vote outcome can be inverted (i.e., the outcome can lean toward the other opinion) by adding extremely small (hard-to-detect) perturbations strategically generated in social networks. Adversarial attacks are relatively more effective in complex (large and dense) networks. These results indicate that opinion dynamics can be unknowingly distorted.

Byzantine-Resilient Decentralized Stochastic Gradient Descent

Decentralized learning has gained great popularity to improve learning efficiency and preserve data privacy. Each computing node makes equal contribution to collaboratively learn a Deep Learning model. The elimination of centralized Parameter Servers (PS) can effectively address many issues such as privacy, performance bottleneck and single-point-failure. However, how to achieve Byzantine Fault Tolerance in decentralized learning systems is rarely explored, although this problem has been extensively studied in centralized systems. In this paper, we present an in-depth study towards the Byzantine resilience of decentralized learning systems with two contributions. First, from the adversarial perspective, we theoretically illustrate that Byzantine attacks are more dangerous and feasible in decentralized learning systems: even one malicious participant can arbitrarily alter the models of other participants by sending carefully crafted updates to its neighbors. Second, from the defense perspective, we propose Ubar, a novel algorithm to enhance decentralized learning with Byzantine Fault Tolerance. Specifically, Ubar provides a <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">U</b> niform <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">B</b> yzantine-resilient <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">A</b> ggregation <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">R</b> ule for benign nodes to select the useful parameter updates and filter out the malicious ones in each training iteration. It guarantees that each benign node in a decentralized system can train a correct model under very strong Byzantine attacks with an arbitrary number of faulty nodes. We conduct extensive experiments on standard image classification tasks and the results indicate that Ubar can effectively defeat both simple and sophisticated Byzantine attacks with higher performance efficiency than existing solutions.

Simple Black-Box Universal Adversarial Attacks on Deep Neural Networks for Medical Image Classification

Universal adversarial attacks, which hinder most deep neural network (DNN) tasks using only a single perturbation called universal adversarial perturbation (UAP), are a realistic security threat to the practical application of a DNN for medical imaging. Given that computer-based systems are generally operated under a black-box condition in which only input queries are allowed and outputs are accessible, the impact of UAPs seems to be limited because well-used algorithms for generating UAPs are limited to white-box conditions in which adversaries can access model parameters. Nevertheless, we propose a method for generating UAPs using a simple hill-climbing search based only on DNN outputs to demonstrate that UAPs are easily generatable using a relatively small dataset under black-box conditions with representative DNN-based medical image classifications. Black-box UAPs can be used to conduct both nontargeted and targeted attacks. Overall, the black-box UAPs showed high attack success rates (40–90%). The vulnerability of the black-box UAPs was observed in several model architectures. The results indicate that adversaries can also generate UAPs through a simple procedure under the black-box condition to foil or control diagnostic medical imaging systems based on DNNs, and that UAPs are a more serious security threat.