Stealth Attacks Research Articles

An IoT-based Smart Doorbell System for Mitigating Stealth Attacks

The need for smart doorbell systems has increased in recent times. This is due to the general tendency for burglars to use stealth when breaking into homes and businesses. Also, visitors are known to spend time searching for doorbells around the house. Thus, to address this problem, this paper presents a smart doorbell system that detects human presence at the door and automatically notifies the homeowner. The system consists of a microcontroller, ultrasonic sensor, GSM module, and software. When a human presence is detected within the configured range of 1 to 70cm, the ultrasonic sensor sends a signal to the microcontroller, which in turn sends a command to the GSM module to notify the homeowner. The performance of the system was tested using various parameters with results showing that the device can detect human presence within the range of 1-80cm. Journal of Engineering Science 14(2), 2023, 47-58

Self-Healing Secure Blockchain Framework in Microgrids

Blockchain has recently been depicted as a secure protocol for information exchange in cyber-physical microgrids. However, it is still found vulnerable to consensus manipulation attacks. These stealth attacks are often difficult to detect as they use kernel-level access to mask their actions. In this paper, we firstly build a trusted and secured peer-to-peer network mechanism for physical DC microgrids’ validation of transactions over Distributed Ledger. Secondly, we leverage from a physics-informed approach for detecting malware-infected nodes and then recovering from stealth attacks using a self-healing recovery scheme augmented into the microgrid Blockchain network. This scheme allows compromised nodes to adapt to a reconstructed trustworthy signal in a multi-hop manner using corresponding measurements from the reliable nodes in the network. Additionally, recognizing the possible threat of denial-of-service attacks and random time delays (where information sharing via communication channels is blocked), we also integrate a model-free predictive controller with the proposed system that can locally reconstruct an expected version of the attacked/delayed signals. This supplements the capabilities of Blockchain, enabling it to detect and mitigate consensus manipulation attempts, and network latencies.

The feasibility and inevitability of stealth attacks

Abstract We develop and study new adversarial perturbations that enable an attacker to gain control over decisions in generic Artificial Intelligence (AI) systems including deep learning neural networks. In contrast to adversarial data modification, the attack mechanism we consider here involves alterations to the AI system itself. Such a stealth attack could be conducted by a mischievous, corrupt or disgruntled member of a software development team. It could also be made by those wishing to exploit a ‘democratization of AI’ agenda, where network architectures and trained parameter sets are shared publicly. We develop a range of new implementable attack strategies with accompanying analysis, showing that with high probability a stealth attack can be made transparent, in the sense that system performance is unchanged on a fixed validation set which is unknown to the attacker, while evoking any desired output on a trigger input of interest. The attacker only needs to have estimates of the size of the validation set and the spread of the AI’s relevant latent space. In the case of deep learning neural networks, we show that a one-neuron attack is possible—a modification to the weights and bias associated with a single neuron—revealing a vulnerability arising from over-parameterization. We illustrate these concepts using state-of-the-art architectures on two standard image data sets. Guided by the theory and computational results, we also propose strategies to guard against stealth attacks.

Multivariate Spectral Analysis and Hypothesis Testing-Based Robust Attack Detection for Multiarea Frequency Control

Frequency control is one of the critical systems responsible for maintaining grid stability, making it a vulnerable and attractive choice for cyber-attacks. This article presents a multivariate singular spectrum analysis (MSSA) for extracting the system’s dynamics under normal operation and proposes a projection-based distance tracking and hypothesis testing method to detect multiarea load frequency control (MA-LFC) attacks. The proposed methodology is robust, adaptive, and computationally efficient, especially, when system and measurement noises are considered. The three main features of the proposed method are that: 1) it uses standard SCADA data and does not require attack data; 2) it can be integrated with the existing grid control system with minimal hardware; and 3) it is independent of system configuration and upgrades. The attack detection algorithm can successfully detect different types of false data injection attacks (FDIAs), including stealth attacks on multiple sensors. The algorithm is tested on an IEEE 39-bus New England test system, 300 bus test system, and 1888 bus RTE system. The attack detection algorithm was found to be reliable, fast, robust, and scalable under noisy measurements compared to the existing methods.

Asymptotic Learning Requirements for Stealth Attacks on Linearized State Estimation

Information-theoretic stealth attacks are data injection attacks that minimize the amount of information acquired by the operator about the state variables, while simultaneously limiting the Kullback-Leibler divergence between the distribution of the measurements under attack and the distribution under normal operation with the aim of controling the probability of attack detection. For Gaussian distributed state variables, attack construction requires knowledge of the second order statistics of the state variables, which is estimated from a finite number of past realizations using a sample covariance matrix. Within this framework, the attack performance is studied for the attack construction with the sample covariance matrix. This results in an analysis of the amount of data required to learn the covariance matrix of the state variables used on the attack construction. The ergodic attack performance is characterized using asymptotic random matrix theory tools, and the variance of the attack performance is bounded. The ergodic performance and the variance bounds are assessed with simulations on IEEE test systems.

Stealth Data Injection Attacks With Sparsity Constraints

Sparse stealth attack constructions that minimize the mutual information between the state variables and the observations are proposed. The attack construction is formulated as the design of a multivariate Gaussian distribution that aims to minimize the mutual information while limiting the Kullback-Leibler divergence between the distribution of the observations under attack and the distribution of the observations without attack. The sparsity constraint is incorporated as a support constraint of the attack distribution. Two heuristic greedy algorithms for the attack construction are proposed. The first algorithm assumes that the attack vector consists of independent entries, and therefore, requires no communication between different attacked locations. The second algorithm considers correlation between the attack vector entries which results in larger disruption and smaller probability of detection at the expense of coordination between different locations. We numerically evaluate the performance of the proposed attack constructions on IEEE test systems and show that it is feasible to construct stealth attacks that generate significant disruption with a low number of compromised sensors.

How to protect smart and autonomous vehicles from stealth viruses and worms

Smart and autonomous vehicles are inseparable parts of the future Intelligent Transportation Systems (ITS). However, ITS components, and especially its vehicles, are prone to cyber threats. Interconnectivity of different parts, ranging from in-vehicle communication of different modules to vehicle and vehicle to infrastructure message exchanges open a window to the cyber attacks launched through these communication media. This paper introduces the concept of stealth virus or worm in smart and autonomous vehicles which can jeopardize the safety of passengers. Stealth attacks are designed to manipulate a system in a way that while the changes are not detectable by human, the system is negatively influenced over the time. A framework for Intrusion Detection System (IDS) is proposed afterward. The proposed IDS structure is scalable and easily deployable on current and future vehicles which are equipped with Controller Area Network (CAN) buses. Through a case study on car cruise control, a new stealth attack is presented. The attack is analytically discussed first. Then, it is shown how the proposed IDS can detect this kind of threats.

Secure Socket Shell Bruteforce Attack Detection With Petri Net Modeling

Secure Socket Shell exposes a secure interface for login to remote users. Password based authentication mechanism used by remote users is vulnerable to bruteforcing. In this attack an adversary systematically tries many passwords. These attacks can either be generated from a single source or collectively from a set of sources. In this paper we propose a method to detect such bruteforcing attacks and subsequently classify these attempts into three types as originating from single source, single domain and distributed attacks. We develop Petri-Net based model which identifies SSH connections corresponding to failed login attempts using network flow characteristics. The model also keeps track of sources of failed login attempts using which it subsequently labels a time interval as experiencing bruteforcing or not and if the interval is experiencing bruteforcing which type of attack it is. We experiment with network traffic collected from a production level server and also generated within a testbed setup and show that our model can detect attacks and also classify them. We also experiment with stealth attack variant where attacker keeps a low profile of attacks and suggest methods to handle such attack instances.

ANALYSIS OF CURRENT THREATS TO THE INFORMATION SECURITY OF ORGANIZATIONSAND THE FORMATION OF THE INFORMATION PLATFORM AGAINST THEM

Taking into account the process of complication of the geopolitical and geoeconomic landscape space, the development of information technologies and the formation of new security challenges associated with the emergence of new cyber threats, there is a need for constant monitoring and forecasting of them in order to prevent consequences in the form of damage and leakage of valuable and confidential information. The authors analyzed the new predictable cyber security threats to organizations, with special attention paid to the protection of endpoints. Threats identified in the field of artificial intelligence development (underground development of malicious Large Language Models (LLM); “Script Kiddies” update; voice fraud for social engineering, which is created by artificial intelligence); changing trends in the behavior of threat actors (attacks on supply chains against managed file transfer solutions, malware threats that are becoming multilingual); as new emerging threats and attack methods (growing QR code rivalry; stealth attacks on peripheral devices; Python implementation in Excel creating a potentially new vector for attacks; LOL drivers changing action algorithms). The resulting detection of future threats emphasizes the need for strategic planning for the adoption of new technologies and platforms: such as Endpoint Detection and Response (EDR) capabilities, as well as the use of EDR as part of a multi-instrumented enhanced detection and response (XDR) architecture. Gartner’s research has been proven to have a tremendous impact on improving organizations’ threat detection capabilities by providing valuable insight into the strengths and weaknesses of each cybersecurity service provider with respect to emerging threat intelligence, by focusing organizations’ attention on opportunities to identify gaps in their existing security infrastructure and adopt sound decisions to invest in additional solutions or services that effectively address these gaps. The spheres of activity of the world’s leading companies were analyzed, their connection with Ukrainian companies was found, and further cooperation was proposed for the effective protection of national cyberspace.

Piecewise Attack Strategy Design for T–S Fuzzy Cyber–Physical Systems

This article is concerned with the problem of the stealth attack strategy design for T–S fuzzy cyber–physical systems (CPSs). Virtual systems that reflect the attacker’s target are established, in which the parameter matrices of virtual systems rely on the different regions where the premise variables (PVs) of the T–S fuzzy CPS and the piecewise fuzzy observer are located at different past instants. Unlike the existing attack policies, a piecewise attack strategy is designed based on the established virtual systems, while the existing ones are required to be nonpiecewise. Furthermore, the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$H_{-}/H_{\infty }$ </tex-math></inline-formula> scheme is applied to maximize the impact of the attack on the estimation performance (EP) of the observer while avoiding detected by the detector. A simulation example is applied to verify the effectiveness and advantages of the designed attack scheme.

Alternate Data Stream Attack Framework to Perform Stealth Attacks on Active Directory Hosts

Microsoft’s file system, NTFS, is the most utilised file system by Windows OS versions XP, Vista, 7, and 10. These systems have a little-known file attribute feature known as alternate data streams (ADS) which allows each file in the NTFS file system to have multiple data streams. ADS cannot be removed from the NTFS operating systems. However, the presence of ADS is not inevitably an issue in the OS or file system. Valid instances can be found on systems if scanned and might be valid. Windows OS does not have any in-built tools or applications to determine and remove the presence of existing ADS. This research presents ADSA or alternate data stream attack framework to exploit the alternate data streams and perform cyberattacks on Microsoft operating systems. This research discusses the process of creating and searching alternate data streams with a standard file and an executable binary. The authors executed ADS-hidden executable binary in the ADS. The authors present methods to detect and perform a clean-up by deleting the alternate data stream.

Resilient control of cyber‐physical systems using adaptive super‐twisting observer

AbstractIn this work, the problem of online secure state estimation and attack reconstruction in the face of offensives that corrupt the sensor measurements and modify the actuator commands of cyber–physical systems is investigated for designing a resilient controller for the system. The states of cyber–physical system and its actuator attacks are estimated/reconstructed online using a novel adaptive line‐by‐line super‐twisting observer, whereas sparse stealth attacks on unprotected sensors are reconstructed using a sparse recovery algorithm. The estimated attacks are used for attack compensation by a resilient controller. The efficacy of the proposed technique is illustrated via simulation on a real electric power system under deception actuator attack and stealth sensor attack.

Sparse Data Injection Attacks on Smart Grid: An Information-Theoretic Approach

Sparse data injection attacks are data injection attacks that target a limited number of sensors in the smart grid paradigm. In this paper, sparse attack construction strategy is proposed for the information-theoretic stealth attacks, in which the attacker minimizes the amount of information acquired by the operator about the power system from the observations and the probability of being detected simultaneously. For Gaussian distributed state variables, closed-form expression is proposed for the optimal Gaussian sparse attacks when the attacker targets deterministic observations and gets access to the full system information. Based on that, two target observation selection strategies are introduced to find the vulnerable observations in the system, in which the algorithms take different tradeoff strategies between performance and computational time. Furthermore, a locally perfect stealthy attack construction strategy is proposed for the case in which the attacker only has partial system information but gets access to real-time realizations of the local state variables. The optimality of Gaussian sparse attacks and the performance of the selection strategies are validated on the IEEE 30 Bus and 118 Bus test systems.

Spectral analysis based robust multi-level intrusion detection in wide area frequency control

Frequency control is one of the critical systems responsible for maintaining grid stability, making it an attractive choice for cyber-attacks. The paper presents a singular spectrum analysis for extracting the system’s dynamics under regular operation and proposes a projection-based distance tracking method to detect Multi-area Load Frequency Control (MA-LFC) attacks. Two variations of the algorithm, namely single-variate and multi-variate algorithms, are proposed for detection at different levels of the power system. The proposed methodology is robust, adaptive, and computationally efficient, especially when system and measurement noises are considered. The method’s main advantage is that it does not require attack data and can be integrated with the existing grid control system. The algorithm can be implemented within the RTUs/IEDs without the need for additional processors. The detection algorithm successfully detects different types of attacks, including stealth attacks on multiple sensors. By selecting proper set of signals, it is possible to obtain 99.85% accuracy and 2 cycles deduction speed. The algorithm is tested on an IEEE 39-bus New England test system in the MATLAB environment, and its performance under noisy measurements is better than existing methods.

Graph Neural Networks Based Detection of Stealth False Data Injection Attacks in Smart Grids

False data injection attacks (FDIAs) represent a major class of attacks that aim to break the integrity of measurements by injecting false data into the smart metering devices in power grids. To the best of authors' knowledge, no study has attempted to design a detector that automatically models the underlying graph topology and spatially correlated measurement data of the smart grids to better detect cyber attacks. The contributions of this paper to detect and mitigate FDIAs are twofold. First, we present a generic, localized, and stealth (unobservable) attack generation methodology and publicly accessible datasets for researchers to develop and test their algorithms. Second, we propose a Graph Neural Network (GNN) based, scalable and real-time detector of FDIAs that efficiently combines model-driven and data-driven approaches by incorporating the inherent physical connections of modern AC power grids and exploiting the spatial correlations of the measurement. It is experimentally verified by comparing the proposed GNN based detector with the currently available FDIA detectors in the literature that our algorithm outperforms the best available solutions by 3.14%, 4.25%, and 4.41% in F1 score for standard IEEE testbeds with 14, 118, and 300 buses, respectively.

Optimal Stealth Attacks to Cyber-Physical Systems: Seeking a Compromise between Maximum Damage and Effort*

This paper aims at modeling the optimal behavior for an attacker that has the objective to maliciously manipulate the output of an industrial power plant, which is fed via a public network to a digital twin in order to reconstruct the state. In particular, we consider a scenario where the attacker seeks a tradeoff between two conflicting objectives: dealing the maximum damage in terms of the norm of the estimation error for the observer and keeping the magnitude of the variation of the systems’ output to a minimum. In doing so, we assume the observer is equipped with a bad data detector and the attacker must choose the injected signals in a way that guarantees that the bad data detection condition is not triggered.

Artificial Neural Network-Based Stealth Attack on Battery Energy Storage Systems

As the number of installed Battery Energy Storage Systems (BESSs) increases, the concerns related to possible cyber-attacks to these systems rise accordingly. The most of BESS owners knows their systems may be vulnerable, but they often consider only denial of service attacks in their risk assessment. Unfortunately, other, subtler and more dangerous attacks exist. In this paper we show that a stealth attack to BESSs can be performed by applying a Man-in-the-Middle (MitM) approach. The aim of the attack is to stealthily manage the physical system by hiding the actual behavior of the system to its supervisory controller. In this case the attacker would be able to: (i) degrade the BESS by reducing its expected lifetime, (ii) produce economic losses for the prosumer, and (iii) affect the security and stability of the grid. The feasibility of the attack is demonstrated by providing an example of a stealth MitM attack on a real BESS coupled with a photovoltaic power plant. The proposed case study demonstrates that such attack can be performed without being discovered by end-users and shows that its effects can be severe. Finally, possible strategies to avoid or detect such kind of attack are discussed.

Software Supply Chain Attacks, a Threat to Global Cybersecurity: SolarWinds’ Case Study

Exploitation of a vulnerability that compromised the source code of the Solar Winds’ Orion system, a software that is used widely by different government and industry actors in the world for the administration and monitoring of networks; brought to the fore a type of stealth attack that has been gaining momentum: supply chain attacks. The main problem in the violation of the software supply chain is that, from 85% to 97% of the code currently used in the software development industry comes from the reuse of open source code frameworks, repositories of third-party software and APIs, creating potential vulnerabilities in the development cycle of a software product. This research analyzes the SolarWinds case study from an exploratory review of academic literature, government information, but also from the articles and reports that are published by different cybersecurity consulting firms and software providers. Then, a set of good practices is proposed such as: Zero trust, Multi-Factor authentication mechanisms (MFA), strategies such as SBOM and the recommendations of the CISA guide to defend against this type of attack. Finally, the research discusses about how to improve response times and prevention against this type of attacks, also future research related to the subject is suggested, such as the application of Machine Learning and Blockchain technologies. Additionally for risk reduction, in addition to the management and articulation of IT teams that participate in all the actors that are part of the software life cycle under a DevSecOps approach.

An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors

Advanced persistent threats pose a significant challenge for blue teams as they apply various attacks over prolonged periods, impeding event correlation and their detection. In this work, we leverage various diverse attack scenarios to assess the efficacy of EDRs against detecting and preventing APTs. Our results indicate that there is still a lot of room for improvement as state-of-the-art EDRs fail to prevent and log the bulk of the attacks that are reported in this work. Additionally, we discuss methods to tamper with the telemetry providers of EDRs, allowing an adversary to perform a more stealth attack.

Intrusion Detection, Measurement Correction, and Attack Localization of PMU Networks

Accurate state estimation is essential for correct supervision of power grids. With the existence of cyber-attacks, state estimation may become inaccurate, which can eventually lead to wrong supervisory decision making. To detect cyber-attacks in power grids equipped with phasor measurement units (PMUs), a new intrusion detection system based on clustering approach, called PMU Intrusion Detection System (PMUIDS), is proposed in this article. After solving the optimal PMU placement in <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> -1 contingency, several static state estimations are obtained by removing the measurements of one PMU in each time. The resulting state vectors are clustered in two steps: First, subtractive clustering is employed to obtain the number of clusters, which determines the number of integrity attacks; and second, fuzzy C-means clustering assigns the state vectors to the corresponding clusters, which determines the attacked PMUs. In addition, two theorems are proved, which indicate that the attacker cannot coordinate successful stealth attacks in cases that by removing attacked PMUs from state estimation, the power system still remains full observable. Furthermore, in the case of possible stealth attacks, the attacker cannot falsify the estimation of any arbitrary state variable. The hardware-in-the-loop results on a sample power system show that the proposed approach can detect integrity attacks, determine the number of attacks, obtain the correct state vector, and localize the attacks, even in case of multiple simultaneous attacks.