Smart Attacks Research Articles

Whac-A-Mole: Smart node positioning in clone attack in wireless sensor networks

Wireless sensor networks are often deployed in unattended environments and, thus, an adversary can physically capture some of the sensors, build clones with the same identity as the captured sensors, and place these clones at strategic positions in the network for further malicious activities. Such attacks, called clone attacks, are a very serious threat against the usefulness of wireless networks. Researchers proposed different techniques to detect such attacks. The most promising detection techniques are the distributed ones that scale for large networks and distribute the task of detecting the presence of clones among all sensors, thus, making it hard for a smart attacker to position the clones in such a way as to disrupt the detection process. However, even when the distributed algorithms work normally, their ability to discover an attack may vary greatly with the position of the clones. We believe this aspect has been greatly underestimated in the literature. In this paper, we present a thorough and novel study of the relation between the position of clones and the probability that the clones are detected. To the best of our knowledge, this is the first such study. In particular, we consider four algorithms that are representatives of the distributed approach. We evaluate for them whether their capability of detecting clone attacks is influenced by the positions of the clones. Since wireless sensor networks may be deployed in different situations, our study considers several possible scenarios: a uniform scenario in which the sensors are deployed uniformly, and also not uniform scenarios, in which there are one or more large areas with no sensor (we call such areas “holes”) that force communications to flow around these areas. We show that the different scenarios greatly influence the performance of the algorithms. For instance, we show that, when holes are present, there are some clone positions that make the attacks much harder to be detected. We believe that our work is key to better understand the actual security risk of the clone attack in the presence of a smart adversary and also with respect to different deployment scenarios. Moreover, our work suggests, for the different scenarios, effective clone detection solutions even when a smart adversary is part of the game.

Protecting Secure Communication Under UAV Smart Attack With Imperfect Channel Estimation

In this paper, we investigate a secure communication system, where one transmitter sends some confidential message to one receiver, under the smart attack from one unmanned aerial vehicle (UAV). The UAV utilizes the programmable radio devices to execute multiple attack types, such as eavesdropping, jamming, and spoofing. We consider the practical communication scenarios where there are a limited number of pilot signals for channel estimation, and the channel estimation at the receiver side may be imperfect. To deal with the joint impact of smart attack and imperfect channel estimation, we use the non-cooperative game theory to propose a Q-learning-based power control algorithm in order to obtain an adaptive policy for the transmitter. In this algorithm, a Nash equilibrium strategy of the game under imperfect channel estimation is devised to maximize the utility of the transmitter and, meanwhile, suppress the smart attack from the UAV. The simulation results indicate that this strategy can effectively decrease the attack rate of the UAV attacker and increase the system secrecy capacity, regardless of the channel estimation accuracy. Moreover, the impact of the channel estimation error on the attack rate and secrecy capacity is also reflected.

Magic Train: Design of Measurement Methods against Bandwidth Inflation Attacks

Bandwidth measurement is important for many network applications and services, such as peer-to-peer networks, video caching and anonymity services. To win a bandwidth-based competition for some malicious purpose, adversarial Internet hosts may falsely announce a larger network bandwidth. Some preliminary solutions have been proposed to this problem. They can either evade the bandwidth inflation by a consensus view (i.e., opportunistic bandwidth measurements) or detect bandwidth frauds via forgeable tricks (i.e., detection through bandwidth's CDF symmetry). However, smart adversaries can easily remove the forgeable tricks and report an equally larger bandwidth to avoid the consensus analyses. To defend against the smart bandwidth inflation frauds, we design magic train , a new measurement method which combines an unpredictable packet train with estimated round-trip time (RTT) for detection. The inflation behaviors can be detected through highly contradictory bandwidth results calculated using different magic trains or a train's different segments, or large deviation between the estimated RTT and the RTT reported by the train's first packet. Being an uncooperative measurement method, magic train can be easily deployed on the Internet. We have implemented the magic train using RAW socket and LibPcap, and evaluated the implementation in a controlled testbed and the Internet. The results have successfully confirmed the effectiveness of magic train in detecting and preventing smart bandwidth inflation attacks.

A System for Profiling and Monitoring Database Access Patterns by Application Programs for Anomaly Detection

Database Management Systems (DBMSs) provide access control mechanisms that allow database administrators (DBAs) to grant application programs access privileges to databases. Though such mechanisms are powerful, in practice finer-grained access control mechanism tailored to the semantics of the data stored in the DMBS is required as a first class defense mechanism against smart attackers. Hence, custom written applications which access databases implement an additional layer of access control. Therefore, securing a database alone is not enough for such applications, as attackers aiming at stealing data can take advantage of vulnerabilities in the privileged applications and make these applications to issue malicious database queries. An access control mechanism can only prevent application programs from accessing the data to which the programs are not authorized, but it is unable to prevent misuse of the data to which application programs are authorized for access. Hence, we need a mechanism able to detect malicious behavior resulting from previously authorized applications. In this paper, we present the architecture of an anomaly detection mechanism, DetAnom , that aims to solve such problem. Our approach is based the analysis and profiling of the application in order to create a succinct representation of its interaction with the database. Such a profile keeps a signature for every submitted query and also the corresponding constraints that the application program must satisfy to submit the query. Later, in the detection phase, whenever the application issues a query, a module captures the query before it reaches the database and verifies the corresponding signature and constraints against the current context of the application. If there is a mismatch, the query is marked as anomalous. The main advantage of our anomaly detection mechanism is that, in order to build the application profiles, we need neither any previous knowledge of application vulnerabilities nor any example of possible attacks. As a result, our mechanism is able to protect the data from attacks tailored to database applications such as code modification attacks, SQL injections, and also from other data-centric attacks as well. We have implemented our mechanism with a software testing technique called concolic testing and the PostgreSQL DBMS. Experimental results show that our profiling technique is close to accurate, requires acceptable amount of time, and the detection mechanism incurs low runtime overhead.

The Performance Evaluation of an IEEE 802.11 Network Containing Misbehavior Nodes under Different Backoff Algorithms

Security of any wireless network is always an important issue due to its serious impacts on network performance. Practically, the IEEE 802.11 medium access control can be violated by several native or smart attacks that result in downgrading network performance. In recent years, there are several studies using analytical model to analyze medium access control (MAC) layer misbehavior issue to explore this problem but they have focused on binary exponential backoff only. Moreover, a practical condition such as the freezing backoff issue is not included in the previous models. Hence, this paper presents a novel analytical model of the IEEE 802.11 MAC to thoroughly understand impacts of misbehaving node on network throughput and delay parameters. Particularly, the model can express detailed backoff algorithms so that the evaluation of the network performance under some typical attacks through numerical simulation results would be easy.

Resilient Privacy Preservation Scheme to Detect Sybil Attacks in Vehicular Ad Hoc Networks

Objective: Vehicular Ad hoc Networks (VANETs) have the potential to improve road safety dramatically, regulate traffic, management of parking lots and public areas. Security and Privacy are two significant concerns in VANETs, as a malicious vehicle may deliberately deceive other vehicles in the network. Analysis: Disastrously, several privacy-preserving methods are susceptible to Sybil attacks, whereby a malicious vehicle impersonates as multiple benign vehicles for gaining a disproportionately large influence. Conventional pseudonym generation schemes preserve driver’s privacy and also facilitate identifying the Sybil attacker. However, the pseudonym scheme induces a brand new issue where in a smart attacker may compromise semi-trusted RSUs and launch a Sybil attack in a particular area. Findings: This paper proposes a System for detecting misbehavior vehicles with location Privacy (SYBIL-CAP), consisting TcA - Preserving Location Privacy (TAP-LOOP), and Resilience to RSU compromise (RESUME) for identifying Sybil attacker. SYBIL-CAP provides a temporarily authorized certificate that includes the trusted certificate and secret key trajectories to vehicles to recognize compromised RSU without requiring the unique identity of vehicles. More precisely, in TAP-LOOP, a vehicle approaches a TCA to receive a location-hidden trusted certificate via RSU to conceal its sensitive information at all times. RESUME implements Diffie-Hellman Key Exchange (DHKE) algorithm between two adjacent RSUs to generate a shared secret key, appended in the temporarily authorized certificate. A vehicle identifies the compromised RSU and malicious vehicle by verifying the authorized message at a group of three consecutive RSUs. Improvement: The simulation results depict that the SYBIL-CAP largely restricts Sybil attack by detecting compromised RSU with lower overhead, compared to existing P2DAP.

A Study on IEEE 802.11 MAC Layer Misbehavior under Different Back-off Algorithms

Security of any wireless network is an important issue. The IEEE 802.11 medium access control can be violated by several native or smart attacks that result to downgrade network performance. In recent years, there are several studies using analytical model to analyze MAC layer misbehavior issue to explore this problem but focused on binary exponential back-off only. Moreover, a practical condition such as freezing back-off issue is not included in the previous models. Hence, this paper presents a novel analytical model of the IEEE 802.11 MAC to thoroughly understand impacts of misbehaving node on network throughput and delay parameters. Especially, the model can express detailed back-off algorithms so that comforts to evaluate the network performance under some typical attacks by numerical simulation method.

Smart Attacks against Intelligent Wearables in People-Centric Internet of Things

The people-centric Internet of Things, as an essential part of the general IoT ecosystem, relies heavily on intelligent wearables to control and actuate the ambient/remote “things” according to the sensed information or collected instruction from the specific person. Intelligent wearables, although becoming increasingly prevalent and pervasive, are vulnerable to various cyber-attacks due to their intrinsic characteristics, which consequently brings up unprecedented security challenges in terms of privacy leakage, financial loss, and even malicious invasion of other connected IoT components and applications. Therefore, it is of great necessity to keep intelligent wearables reliable and trustworthy before being able to secure the core parts of IoT. Toward this end, we provide in this article a survey of available attack methodologies on intelligent wearables as well as the corresponding countermeasures, from the perspectives of data integrity, authenticity, and privacy.

A Delay-Based Countermeasure Against the Discovery of Default Rules in Firewalls

Denial of service (DoS) attack is purely malicious and commonly used to overwhelm a network system making network resources unavailable to legitimate users. One such DoS attack is to target the firewall system of the enterprise, whereby the attacker sends a large number of malicious packets to the firewall making it unavailable for the legitimate users. To launch a smart and effective DoS attack, an attacker makes priori assumption about the order of the ruleset of the firewall. An effective firewall does not reveal its ruleset, policies, or information to the attacker. In this paper, we first present a process that can be used by an attacker to reconnoiter a firewall system at leisure to collect information about ruleset of a target firewall. The collected information can be used by the attacker to launch a slow-rate DoS attack against the firewall. We then propose a countermeasure technique “Delay Induced Response (DIR)” which utilizes the underlying principle of moving target defense as a cyber maneuver technique. In DIR, the network frequently changes its properties visible to the attacker in order to confuse the attacker from discovering information about the firewall policy or its ruleset. The primary objective in DIR is to delude the attacker in his efforts in discovering the order of the firewall ruleset—specifically, the last matching rule (also known as the “default rule”) in a firewall.

A Mobile Offloading Game Against Smart Attacks

Mobile devices, such as smartphones, can offload applications and data to the cloud via access points or base stations to reduce energy consumption and improve user experience. However, mobile offloading is vulnerable to smart attackers that use smart and programmable radio devices, such as universal software radio peripherals, to perform multiple types of attacks, such as spoofing and jamming, based on the radio environment and offloading transmissions. In this paper, a mobile offloading game is investigated that consists of three players: a mobile device that chooses its offloading rate, a smart attacker that determines its attack mode, and a security agent that decides whether or not to initiate full protection for the serving access point during the offloading. Nash and Stackelberg equilibria of the offloading game are derived and their existence conditions are discussed. A Q-learning-based mobile offloading strategy is proposed for mobile devices that are unaware of system parameters, such as the channel conditions, in dynamic radio environments. Simulation results show that the proposed offloading strategy can improve the utility of the mobile device and reduce the attack rate of smart attackers.

Detection of Clone Node Attack in Mobile Wireless Sensor Network with Optimized cost Function

Clone attack is considered as the most important security challenge of wireless sensor networks. In this paper, an innovative distributed approach for the detection of clone node attack is proposed, that is robust against smart attacker in mobile wireless sensor networks. Previously proposed approaches suffer disadvantages such as memory and communication overheads, probability of false alarm and high detection time, however, the detection approach proposed here takes advantage of introducing the observer position concept and hence achieves clone node detection in one cycle of protocol execution leading to less communication overheads. Performance of the proposed approach is analysed in terms of security and cost. To improve performance, using a discrete model and detection cost function stated as a convex optimisation problem and parameters optimised values are calculated. Finally, the simulation results show that proposed approach has less communication overhead and false alarm probability and better performance compared to previously proposed approaches.

Adaptive Network Defense Management for Countering Smart Attack and Selective Capture in Wireless Sensor Networks

We propose and analyze adaptive network defense management for countering smart attack and selective capture which aim to cripple the basic data delivery functionality of a base station based wireless sensor network. With selective capture, the adversaries strategically capture sensors and turn them into inside attackers. With smart attack, an inside attacker is capable of performing random, opportunistic, and insidious attacks to evade detection and maximize their chance of success. We develop a model-based analysis methodology with simulation validation to identify the best defense protocol settings under which the sensor network lifetime is maximized against selective capture and smart attack.

A priori trust inference with context-aware stereotypical deep learning

In multi-agent systems, stereotypical trust models are widely used to bootstrap a priori trust in case historical trust evidences are unavailable. These models can work well if and only if malicious agents share some common features (i.e., stereotypes) in their profiles and these features can be detected. However, this condition may not hold for all the adversarial scenarios. Smart attackers can show different trustworthiness to different agents and services (i.e., launching context-correlated attacks). In this paper, we propose CAST, a novel Context-Aware Stereotypical Trust deep learning framework. CAST coins a comprehensive set of seven context-aware stereotypes, each of which can capture a unique type of context-correlated attacks, as well as a deep learning architecture to keep the trust stereotyping robust (i.e., resist training errors). The basic idea is to construct a multi-layer perceptive structure to learn the latent correlations between context-aware stereotypes and the trustworthiness, and thus can estimate the new trust by taking into account the context information. We have evaluated CAST using a rich set of experiments over a simulated multi-agent system. The experimental results have successfully confirmed that, our CAST can achieve approximately tens of times higher trust inference accuracy in average than the competing algorithms in the presence of context-correlated attacks, and more importantly can maintain a much better trust inference robustness against stereotyping errors.

An Improved Anonymous Remote user Authentication Scheme with Key Agreement based on Dynamic Identity

To keep the pace with the development of internet technology, remote user authentication techniques become more and more important to protect user’s privacy. Recently, Kumari, et al., presented an improved remote user authentication scheme with key agreement based on dynamic-identity using smart card. This scheme allows legal users to change the password at his will without the need to connect the server. They claimed that their scheme could resist smart card stolen or loss attack, user impersonation and server masquerading attack, and provide user anonymity and untraceability and so on. However, our research indicates that their scheme is completely unsafe. Furthermore, the scheme can’t provide the proper mutual authentication. In this manuscript, we will propose a new scheme, which can withstand those attacks mentioned above and provide the perfect user anonymity and forward secrecy. Security analysis makes it clear that the improved scheme apparently is more secure and practical.

Smart primary user emulation in cognitive radio networks: defence strategies against radio‐aware attacks and robust spectrum sensing

AbstractCognitive radio (CR), which provides dynamic spectrum access to combat spectrum scarcity, imposes some emerging threats to the network. One of the common threats in CR is primary user emulation (PUE) attack, in which some malicious users try to mimic primary signal and deceive CR users to prevent them from accessing the vacant frequency bands. In this paper, we propose a smart radio‐aware PUE attacker that is equipped with spectrum sensing and consumes malicious resources in a way that causes more destruction on CR performance than always present PUE attackers. We first analyse and formulate the destructive effect such an attacker imposes to the CR network, and then, we derive robust cooperative spectrum sensing rules for energy detection spectrum sensing under PUE attacks. Moreover, using a weighting vector at fusion centre of the CRs, we propose a scheme to combat fake signals by maximising the average cognitive signal to interference plus noise ratio. We combine proposed method with two widely used energy detection scheme, Neyman–Pearson and minimum probability of error criterion. Numerical results show the superiority and robustness of our proposed method in the presence of smart attackers compared with conventional methods. Copyright © 2014 John Wiley & Sons, Ltd.

Robust password and smart card based authentication scheme with smart card revocation

User authentication scheme allows user and server to authenticate each other, and generates a session key for the subsequent communication. How to resist the password guessing attacks and smart card stolen attacks are two key problems for designing smart cart and password based user authentication scheme. In 2011, Li and Lee proposed a new smart cart and password based user authentication scheme with smart card revocation, and claimed that their scheme could be immunity to these attacks. In this paper, we show that Li and Lee’s scheme is vulnerable to off-line password guessing attack once the information stored in smart card is extracted, and it does not provide perfect forward secrecy. A robust user authentication scheme with smart card revocation is then proposed. We use a most popular and widely used formal verification tool ProVerif, which is based on applied pi calculus, to prove that the proposed scheme achieves security and authentication.

A Revised Attack Taxonomy for a New Generation of Smart Attacks

The last years have seen an unprecedented amount of attacks. Intrusions on IT-Systems are rising constantly - both from a quantitative as well as a qualitative point of view. Well-known examples like the hack of the Sony Playstation Network or the compromise of RSA are just some samples of high-quality attack vectors. Since these Smart Attacks are specifically designed to permeate state of the art technologies, current systems like Intrusion Detection Systems (IDSs) are failing to guarantee an adequate protection. In order to improve the protection, a comprehensive analysis of Smart Attacks needs to be performed to provide a basis against emerging threats.Following these ideas and inspired by the original definition of the term Advanced Persistent Threat (APT) given by U.S. Department of Defense, this publication starts with defining the terms, primarily the group of Smart Attacks. Thereafter, individual facets of Smart Attacks are presented in more detail, before recent examples are illustrated and classified using these dimensions. Next to this, current taxonomies are presented including their individual shortcomings. Our revised taxonomy is introduced, specifically addressing the latest generation of Smart Attacks. The different classes of our taxonomy are discussed, showing how to address the specifics of sophisticated, modern attacks. Finally, some ideas of addressing Smart Attacks are presented.

Model-Based Attack Detection and Mitigation for Automatic Generation Control

Cyber systems play a critical role in improving the efficiency and reliability of power system operation and ensuring the system remains within safe operating margins. An adversary can inflict severe damage to the underlying physical system by compromising the control and monitoring applications facilitated by the cyber layer. Protection of critical assets from electronic threats has traditionally been done through conventional cyber security measures that involve host-based and network-based security technologies. However, it has been recognized that highly skilled attacks can bypass these security mechanisms to disrupt the smooth operation of control systems. There is a growing need for cyber-attack-resilient control techniques that look beyond traditional cyber defense mechanisms to detect highly skilled attacks. In this paper, we make the following contributions. We first demonstrate the impact of data integrity attacks on Automatic Generation Control (AGC) on power system frequency and electricity market operation. We propose a general framework to the application of attack resilient control to power systems as a composition of smart attack detection and mitigation. Finally, we develop a model-based anomaly detection and attack mitigation algorithm for AGC. We evaluate the detection capability of the proposed anomaly detection algorithm through simulation studies. Our results show that the algorithm is capable of detecting scaling and ramp attacks with low false positive and negative rates. The proposed model-based mitigation algorithm is also efficient in maintaining system frequency within acceptable limits during the attack period.

Cooperative spectrum sensing for cognitive radio networks in the presence of smart malicious users

Cognitive radio (CR) signaling imposes some threats to the network. One of these common threats is commonly referred to as primary user emulation attack, where some malicious users try to mimic the primary signal and deceive secondary users to prevent them from accessing vacant frequency bands. In this paper, we introduce a smart primary user emulation attacker (PUEA) that sends fake signals similar to the primary signal. We assume a smart attacker, in the sense that it is aware of its radio environment and may choose different transmission strategies and then, we compare it to an always present attacker. In the proposed smart attacker strategy, the occurrence of fake signal is adjusted according to the primary user activity. First, we investigate the received signal at the CR users under such attackers. Then, we formulate and derive cooperative spectrum sensing (CSS) rules for a cognitive network operating in the presence of a PUEA and propose a new spectrum sensing scheme based on energy detection. Simulation results show that our proposed method can mitigate the destructive effect of PUEA in spectrum sensing, compared to conventional energy detection spectrum sensing.

Effective Statistical Detection of Smart Confidentiality Attacks in Multi-Domain Networks

The need to preserve information confidentiality among network providers has prevented the actual deployment of effective Traffic Engineering (TE) solutions for QoS-enabled end-to-end connectivity services in multi-domain multi-provider networks. The use of Path Computation Element (PCE) architecture can foster the effective implementation of TE through a centralized engine devoted to end-to-end path computations. However, despite authentication, authorization and encryption, confidentiality issues may arise due to abuses of information included in path computation replies to bogus requests issued by malicious PCEs. This paper first demonstrates the security leak allowing the exposure of intra-domain information in current inter-PCE path computation procedures. Then it proposes an anomaly-based approach, namely PCE Anomaly Detector (PAD) in order to detect malicious utilization of path computation services. The proposed PAD employs a novel double-step multi-dimensional formulation based on the Sequential Hypothesis Testing (SHT) statistical classification procedure, able to recognize a suspicious sequence of requests while aiming at inferring confidential information about other domains. PAD is extensively evaluated through simulations. Results show good performance in terms of detection capabilities while guaranteeing the trade-off between accuracy and responsiveness, minimizing false alarm occurrences. Robustness against smart attacks is also proved with respect to a comprehensive set of attack patterns and under different network load conditions. Finally, intra-domain information exposition is evaluated, showing the PAD ability to preserve confidentiality.