Attack Simulation Research Articles

Network Attack Simulation and Defense System Optimization based on Big Data

Network Attack Simulation and Defense System Optimization based on Big Data

Network Robustness Prediction: Influence of Training Data Distributions.

Network robustness refers to the ability of a network to continue its functioning against malicious attacks, which is critical for various natural and industrial networks. Network robustness can be quantitatively measured by a sequence of values that record the remaining functionality after a sequential node- or edge-removal attacks. Robustness evaluations are traditionally determined by attack simulations, which are computationally very time-consuming and sometimes practically infeasible. The convolutional neural network (CNN)-based prediction provides a cost-efficient approach to fast evaluating the network robustness. In this article, the prediction performances of the learning feature representation-based CNN (LFR-CNN) and PATCHY-SAN methods are compared through extensively empirical experiments. Specifically, three distributions of network size in the training data are investigated, including the uniform, Gaussian, and extra distributions. The relationship between the CNN input size and the dimension of the evaluated network is studied. Extensive experimental results reveal that compared to the training data of uniform distribution, the Gaussian and extra distributions can significantly improve both the prediction performance and the generalizability, for both LFR-CNN and PATCHY-SAN, and for various functionality robustness. The extension ability of LFR-CNN is significantly better than PATCHY-SAN, verified by extensive comparisons on predicting the robustness of unseen networks. In general, LFR-CNN outperforms PATCHY-SAN, and thus LFR-CNN is recommended over PATCHY-SAN. However, since both LFR-CNN and PATCHY-SAN have advantages for different scenarios, the optimal settings of the input size of CNN are recommended under different configurations.

Cyber Security Assessment of An Interoperable Port Call and Voyage Optimization tool

Abstract The MISSION project aims to revolutionize maritime transport by developing a digital tool for real-time optimization of port calls and voyages, thereby reducing fuel consumption, cutting greenhouse gas emissions, and decreasing waiting times through enhanced coordination and information sharing among stakeholders. However, the security of the involved IT systems is critical to ensure safe and reliable operations. This paper introduces harborLang, a novel threat modeling language tailored for the maritime sector, built on the Meta Attack Language (MAL) framework. harborLang addresses the unique security challenges in maritime transport by enabling the modeling and mitigation of potential threats through detailed attack simulations. By integrating harborLang with the Yet Another Cybersecurity Risk Assessment Framework (YACRAF), the project enhances its risk analysis capabilities, allowing for precise threat scenarios that reflect the maritime environment’s complexities. The combined use of harborLang and YACRAF facilitates comprehensive cybersecurity risk assessments, significantly improving decision-making, operational safety, and the overall cybersecurity posture of maritime and port operations.

Collaborative Intrusion Detection System with Snort Machine Learning Plugin

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

Analyses of Leveraging Generative AI (GAI) for Proactive Cybersecurity

Thе еscalating complеxity and volumе of cybеr thrеats dеmand innovativе dеfеnsе mеchanisms. This rеsеarch addrеssеs thе gap in lеvеraging gеnеrativе AI (GAI) for proactivе cybеrsеcurity. Whilе GAI has shown promisе in various domains, its application to cybеrdеfеnsе rеmains largеly unеxplorеd. Wе invеstigatе thе potеntial of GAI to gеnеratе novеl cybеrsеcurity tools and tеchniquеs by focusing on anomaly dеtеction, vulnеrability assеssmеnt and attack simulation. Kеy challеngеs includе thе gеnеration of rеalistic and divеrsе thrеat scеnarios, еnsuring thе rеliability and еxplainability of GAI modеls and mitigating advеrsarial attacks. This study contributеs to thе fiеld by dеvеloping a foundational framеwork for GAI drivеn cybеrdеfеnsе, idеntifying critical rеsеarch dirеctions, and dеmonstrating thе practical fеasibility of GAI basеd solutions. Our findings offеr thеorеtical insights into GAIgs capabilitiеs in cybеrsеcurity and providе a roadmap for futurе dеvеlopmеnt and implеmеntation.

Robust Optimization Research of Cyber-Physical Power System Considering Wind Power Uncertainty and Coupled Relationship.

To mitigate the impact of wind power uncertainty and power-communication coupling on the robustness of a new power system, a bi-level mixed-integer robust optimization strategy is proposed. Firstly, a coupled network model is constructed based on complex network theory, taking into account the coupled relationship of energy supply and control dependencies between the power and communication networks. Next, a bi-level mixed-integer robust optimization model is developed to improve power system resilience, incorporating constraints related to the coupling strength, electrical characteristics, and traffic characteristics of the information network. The upper-level model seeks to minimize load shedding by optimizing DC power flow using fuzzy chance constraints, thereby reducing the risk of power imbalances caused by random fluctuations in wind power generation. Furthermore, the deterministic power balance constraints are relaxed into inequality constraints that account for wind power forecasting errors through fuzzy variables. The lower-level model focuses on minimizing traffic load shedding by establishing a topology-function-constrained information network traffic model based on the maximum flow principle in graph theory, thereby improving the efficiency of network flow transmission. Finally, a modified IEEE 39-bus test system with intermittent wind power is used as a case study. Random attack simulations demonstrate that, under the highest link failure rate and wind power penetration, Model 2 outperforms Model 1 by reducing the load loss ratio by 23.6% and improving the node survival ratio by 5.3%.

Efficient Secure Mechanisms for In-Vehicle Ethernet in Autonomous Vehicles

The integration of external devices and network connectivity into autonomous vehicles has raised significant concerns about in-vehicle security vulnerabilities. Existing security mechanisms for in-vehicle bus systems, which mainly rely on appending authentication codes and data encryption, have been extensively studied in the context of CAN and CAN-FD buses. However, these approaches are not directly applicable to Ethernet buses due to the much higher data transmission rates of Ethernet buses compared to other buses. The real-time encryption and decryption required by Ethernet buses cannot be achieved with conventional methods, necessitating an acceleration in the speed of cryptographic operations to match the demands of Ethernet communication. In response to these challenges, our paper introduces a range of cryptographic solutions specifically designed for in-vehicle Ethernet networks. We employ an AES-ECC hybrid algorithm for critical vehicle control signals, combining the efficiency of AES with the security of ECC. For multimedia signals, we propose an improved AES-128 (IAES-128) and an improved MD5 (IMD), which improve encryption time by 15.77%. Our proposed security mechanisms have been rigorously tested through attack simulations on the CANoe (version 10) platform. These tests cover both in-vehicle control signals, such as braking and throttle control, and non-critical systems like multimedia entertainment. The experimental results convincingly demonstrate that our optimized algorithms and security mechanisms ensure the secure and reliable operation of real-time communication in autonomous vehicles.

DPKnob: A visual analysis approach to risk-aware formulation of differential privacy schemes for data query scenarios

Differential privacy is an essential approach for privacy preservation in data queries. However, users face a significant challenge in selecting an appropriate privacy scheme, as they struggle to balance the utility of query results with the preservation of diverse individual privacy. Customizing a privacy scheme becomes even more complex in dealing with queries that involve multiple data attributes. When adversaries attempt to breach privacy firewalls by conducting multiple regular data queries with various attribute values, data owners must arduously discern unpredictable disclosure risks and construct suitable privacy schemes. In this paper, we propose a visual analysis approach for formulating privacy schemes of differential privacy. Our approach supports the identification and simulation of potential privacy attacks in querying statistical results of multi-dimensional databases. We also developed a prototype system, called DPKnob, which integrates multiple coordinated views. DPKnob not only allows users to interactively assess and explore privacy exposure risks by browsing high-risk attacks, but also facilitates an iterative process for formulating and optimizing privacy schemes based on differential privacy. This iterative process allows users to compare different schemes, refine their expectations of privacy and utility, and ultimately establish a well-balanced privacy scheme. The effectiveness of this study is verified by a user study and two case studies with real-world datasets.

GCRL: a graph neural network framework for network connectivity robustness learning

Abstract The resilience and adaptability of complex networks is crucial in ensuring their functionality against disruptions. Particularly, maintaining network connectivity under various attack scenarios is a key aspect of such resilience. Network connectivity refers to the degree to which nodes within a network are interconnected and able to exchange information or resources. Its robustness reflects the ability of a network to maintain connectivity under various attacks. Such ability has profound physical significance, ensuring the stability and reliability of real-world systems. Currently, connectivity robustness assessments rely heavily on very time-consuming attack simulations. This paper introduces a graph neural network framework for network connectivity robustness learning (GCRL) to advance the study of network connectivity robustness. GCRL transforms initial degree distributions and network topology into informative embedding vectors, which are then processed by a robustness learning module mainly composed of multi-layer perceptron, achieving both high speed and precision. Our extensive experiments demonstrate the superior performance of GCRL obtained in less time compared to existing methods, especially in tough scenarios where test data distributions significantly differ from the training set. The framework also shows adaptability to networks of different sizes, making it a more generalized solution for complex network robustness learning.

Unleashing offensive artificial intelligence: Automated attack technique code generation

Artificial Intelligence (AI) technology is revolutionizing the digital world and becoming the cornerstone of the modern digital systems. The capabilities of cybercriminals are expanding as they adopt new technologies like zero-day exploits or new business models such as hacker-as-a-service. While AI capabilities can improve cybersecurity measures, this same technology can also be utilized as an offensive cyber weapon to create sophisticated and intricate cyber-attacks. This paper describes an AI-powered mechanism for the automatic generation of attack techniques, ranging from initial attack vectors to impact-related actions. It presents a comprehensive analysis of simulated attacks by highlighting the attack tactics and techniques that are more likely to be generated using AI technology, specifically Large Language Model (LLM) technology. The work empirically demonstrates that LLM technology can be easily used by cybercriminals for attack execution. Moreover, the solution can complement Breach and Attack Simulation (BAS) platforms and frameworks that automate the security assessment in a controlled manner. BAS could be enhanced with AI-powered attack simulation by bringing forth new ways to automatically program multiple attack techniques, even multiple versions of the same attack technique. Therefore, AI-enhanced attack simulation can assist in ensuring digital systems are bulletproof and protected against a great variety of attack vectors and actions.

The Role of PASTA in Addressing Future Trends in Regulatory Compliance: Emerging Cyber Threats

The evolving landscape of cyber threats necessitates an adaptive approach to threat modeling and regulatory compliance. This paper explores the integration of the PASTA (Process for Attack Simulation and Threat Analysis) framework with emerging regulatory trends to address future cyber threats. The study examines how PASTA can be aligned with regulatory frameworks such as PCI DSS, HIPAA, GDPR, and CCPA, to enhance cybersecurity resilience and compliance. By analyzing the application of PASTA to Advanced Persistent Threats (APTs) and ransomware, the paper demonstrates how this structured methodology can help organizations effectively model, simulate, and mitigate sophisticated attacks. The integration of PASTA with regulatory requirements provides a comprehensive approach to managing cyber risks, ensuring robust protection against both current and emerging threats.

Development and validation of coreLang: A threat modeling language for the ICT domain

ICT infrastructures are getting increasingly complex, and defending them against cyber attacks is cumbersome. As cyber threats continue to increase and expert resources are limited, organizations must find more efficient ways to evaluate their resilience and take proactive measures. Threat modeling is an excellent method of assessing the resilience of ICT systems, for example, by building Attack Graphs that illustrate an adversary’s attack vectors. Previously, the Meta Attack Language (MAL) was proposed, which serves as a framework to develop Domain Specific Languages (DSLs) and generate Attack Graphs for modeled infrastructures. coreLang is a MAL-based threat modeling language that utilizes Attack Graphs to enable attack simulations and security assessments. In this work, we present the first release version of coreLang in which MITRE ATT&CK tactics and techniques are mapped onto to serve as a validation and identify strengths and weaknesses to benefit the development cycle. Our validation showed that coreLang does cover 46% of all the techniques included in the matrix, while if we additionally exclude the tactics that are intrinsically not covered by coreLang and MAL, the coverage percentage increases to 64%.

An Audio Watermarking Algorithm Based on Adversarial Perturbation

Recently, deep learning has been gradually applied to digital watermarking, which avoids the trouble of hand-designing robust transforms in traditional algorithms. However, most of the existing deep watermarking algorithms use encoder–decoder architecture, which is redundant. This paper proposes a novel audio watermarking algorithm based on adversarial perturbation, AAW. It adds tiny, imperceptible perturbations to the host audio and extracts the watermark with a pre-trained decoder. Moreover, the AAW algorithm also uses an attack simulation layer and a whitening layer to improve performance. The AAW algorithm contains only a differentiable decoder, so it reduces the redundancy. The experimental results also demonstrate that the proposed algorithm is effective and performs better than existing audio watermarking algorithms.

Evaluation of ecological network resilience using OWA and attack scenario simulation in the Gansu section of the Yellow River Basin, NW China

Regional ecosystem quality has been rapidly declining as a result of rapid urbanization, which has also fragmented landscapes and reduced ecosystem connectedness. Strengthening ecological network resilience helps improve the ecological environment’s quality, protect biodiversity, and maximize ecological benefits. To quantitatively assess ecological network resilience based on 2020 data, we have selected the Gansu region of the Yellow River Basin as a case study in this study due to its significant ecological condition and sensitive vulnerability. Firstly, based on four ecosystem services (ESs)—water yield, carbon storage, soil conservation, and habitat quality—the ordered weighted averaging (OWA) method is introduced to determine ecological sources by calculating ordered weights under different risk coefficients to weigh multiple ESs. Two node attack simulations—random attack and deliberate attack—are used for quantitatively evaluating ecological network resilience, which can simulate the impact of external interference. The concept of a resilience threshold is introduced into the evaluation process of network resilience to improve the objectivity and accuracy of results. The findings indicate that (1) 156 ecological corridors spanning a total distance of 6,569.3 km and 73 ecological sources totalling 20,840 km2 were found in the study area. These findings generally demonstrate a concentrated and contiguous configuration in the southwestern region and a broken and scattered configuration in other regions. (2) With a mean degree of 4.27, a mean path length of 4.08, and a clustering coefficient of 0.47, an undirected and unweighted complex network with improved connectivity and no discernible clustering characteristics was established. (3) The ecological network is more resilient to perturbations from natural disasters when compared to assault simulations in two scenarios; the resilience threshold is 0.34. Considering the final results of node global features and resilience curves, ecological protection suggestions are proposed.

Embracing Multiheterogeneity and Privacy Security Simultaneously: A Dynamic Privacy-Aware Federated Reinforcement Learning Approach.

With growing demand for privacy-preserving reinforcement learning (RL) applications, federated RL (FRL) has emerged as a potential solution. However, existing FRL methods struggle with multiple sources of heterogeneity, while lacking robust privacy guarantees. In this study, we propose DPA-FedRL, the dynamic privacy-aware FRL framework, to simultaneously mitigate both issues. First, we innovatively put forward the concept of "multiheterogeneity" and embed the environmental heterogeneity into agents' state representations. Next, to ensure privacy during model aggregation, we incorporate a differentially private mechanism in form of Gaussian noise and modify its global sensitivity, tailored to suit FRL's unique characteristics. Encouragingly, our approach dynamically allocates privacy budget based on heterogeneity levels, which strikes a balance between privacy and utility. From the theoretical perspective, we give rigorous convergence, privacy, and sensitivity guarantees for our proposed method. Through extensive experiments on diverse datasets, we demonstrate that DPA-FedRL surpasses state-of-the-art approaches (PPO-DP-SGD, PAvg, and QAvg) in some highly heterogeneous environments. Notably, our novel privacy attack simulations enable quantitative privacy assessment, validating that DPA-FedRL offers over 1.359 × stronger protection than baselines.

A Multitask Network Robustness Analysis System Based on the Graph Isomorphism Network.

Despite various measures across different engineering and social systems, network robustness remains crucial for resisting random faults and malicious attacks. In this study, robustness refers to the ability of a network to maintain its functionality after a part of the network has failed. Existing methods assess network robustness using attack simulations, spectral measures, or deep neural networks (DNNs), which return a single metric as a result. Evaluating network robustness is technically challenging, while evaluating a single metric is practically insufficient. This article proposes a multitask analysis system based on the graph isomorphism network (GIN) model, abbreviated as GIN-MAS. First, a destruction-based robustness metric is formulated using the destruction threshold of the examined network. A multitask learning approach is taken to learn the network robustness metrics, including connectivity robustness, controllability robustness, destruction threshold, and the maximum number of connected components. Then, a five-layer GIN is constructed for evaluating the aforementioned four robustness metrics simultaneously. Finally, extensive experimental studies reveal that 1) GIN-MAS outperforms nine other methods, including three state-of-the-art convolutional neural network (CNN)-based robustness evaluators, with lower prediction errors for both known and unknown datasets from various directed and undirected, synthetic, and real-world networks; 2) the multitask learning scheme is not only capable of handling multiple tasks simultaneously but more importantly it enables the parameter and knowledge sharing across tasks, thus preventing overfitting and enhancing the performances; and 3) GIN-MAS performs multitasks significantly faster than other single-task evaluators. The excellent performance of GIN-MAS suggests that more powerful DNNs have great potentials for analyzing more complicated and comprehensive robustness evaluation tasks.

Consequence simulation of cyber attacks on key smart grid business cases

The increasing threat of cyber-attacks on modern power systems highlights the need for a comprehensive examination through simulations. This study conducts an in-depth simulation of cyber-attacks on critical smart grid components, including smart meters, substation automation, and battery management systems, to expose and analyze potential disruptions to power system operations. We identify vulnerabilities that can lead to severe grid instabilities, such as voltage variations, system collapses, and inverter failures. Our analysis underscores the complex interactions between cyber threats and grid components, revealing how disruptions extend beyond mere load interruptions to affect the core infrastructure. We advocate for integrating established cybersecurity frameworks like NIST, ISO/IEC 27001, and IEC 62443, essential in fortifying grid stability against these dynamic threats. Our findings highlight the urgent need for continuous adaptation and enforcement of these frameworks to enhance resilience and ensure the reliability of modern power grids against cyber-attacks.

CPSim: Simulation Toolbox for Security Problems in Cyber-Physical Systems

There are various applications of Cyber-Physical systems (CPSs) which are life-critical where failure or malfunction can result in significant harm to human life, the environment, or substantial economic loss. Therefore, it is important to ensure their reliability, security, and robustness to the attacks. However, there is no widely used toolbox to simulate CPS and target security problems, especially the simulation of sensor attacks and defense strategies against them. In this work, we introduce our toolbox CPSim, a user-friendly simulation toolbox for security problems in CPS. CPSim aims to simulate common sensor attacks and countermeasures to these sensor attacks. We have implemented bias attacks, delay attacks, and replay attacks. Additionally, we have implemented various recovery-based methods against sensor attacks. The sensor attacks and recovery methods configurations can be customized with the given APIs. CPSim has built-in numerical simulators and various implemented benchmarks. Moreover, CPSim is compatible with other external simulators and can be deployed on a real testbed for control purposes.

A Neural-Network-Based Watermarking Method Approximating JPEG Quantization.

We propose a neural-network-based watermarking method that introduces the quantized activation function that approximates the quantization of JPEG compression. Many neural-network-based watermarking methods have been proposed. Conventional methods have acquired robustness against various attacks by introducing an attack simulation layer between the embedding network and the extraction network. The quantization process of JPEG compression is replaced by the noise addition process in the attack layer of conventional methods. In this paper, we propose a quantized activation function that can simulate the JPEG quantization standard as it is in order to improve the robustness against the JPEG compression. Our quantized activation function consists of several hyperbolic tangent functions and is applied as an activation function for neural networks. Our network was introduced in the attack layer of ReDMark proposed by Ahmadi et al. to compare it with their method. That is, the embedding and extraction networks had the same structure. We compared the usual JPEG compressed images and the images applying the quantized activation function. The results showed that a network with quantized activation functions can approximate JPEG compression with high accuracy. We also compared the bit error rate (BER) of estimated watermarks generated by our network with those generated by ReDMark. We found that our network was able to produce estimated watermarks with lower BERs than those of ReDMark. Therefore, our network outperformed the conventional method with respect to image quality and BER.

МОДЕЛЮВАННЯ МУЛЬТИАГЕНТНИХ СИСТЕМ ЗАХИСТУ ІНФОРМАЦІЙНИХ РЕСУРСІВ

Traditional centralized information protection systems do not provide an adequate level of adaptability and efficiency in a dynamically changing threat environment. Multi-agent systems, having a distributed architecture and the possibility of autonomous decision-making, represent a promising direction for solving information security problems. The novelty of the research lies in the development of a multi-agent information protection system with enhanced capabilities for vulnerability analysis and intrusion detection. Unlike existing solutions, the proposed system provides active analysis of threats, reduction of the number of false positives, adaptation to new types of attacks, and minimization of the impact on the target traffic of information flows. In the proposed formal model and prototype of the agent-oriented attack modeling system (ASMA), distributed coordinated attacks on a computer network are considered as a sequence of joint actions of hacker agents, which are performed from different hosts. Hackers are supposed to coordinate their actions according to some common script. At each step of the attack scenario, they try to implement a specific private subgoal. The developed agent-oriented attack modeling system (ASMA) allows simulating distributed coordinated attacks on computer networks. It is based on a hierarchy of grammars, each of which is interpreted as a finite automaton. The system takes into account both macro- and micro-levels of attack description, providing detailed simulation of each stage of the attack. The use of KQML for communication between agents and XML for describing the content of messages allows effective coordination of agents' actions and ensures realistic simulation of attacks.