Stealthy Cyber Attacks Research Articles

Provenance-based APT campaigns detection via masked graph representation learning

Advanced Persistent Threats (APTs) are well-planned, persistent, and highly stealthy cyberattacks designed to steal confidential information or disrupt specific target systems. Recent studies have used system audit logs to construct provenance graphs that describe system interactions to detect potentially malicious activities. Although they are effective, they still suffer from problems such as the need for a priori knowledge, lack of attack data, and high computational overhead that limit their application. In this paper, we propose a self-supervised learning-based APT detection model, APT-MGL, which learns the embedded representations of nodes through a graph mask self-encoder and transforms the detection problem into an outlier detection problem for malicious nodes. APT-MGL characterizes the behavior of nodes based on node type, action, and interaction frequency, and fuses the features through a multi-head self-attention mechanism. Then the node embedding is obtained by combining graph features and structural information using masked graph representation learning. Finally, the unsupervised outlier detection method is used to analyze the computed embeddings and obtain the final detection results. The experimental results show that APT-MGL outperforms existing monitoring models and achieves a small overhead.

Evaluating the Effectiveness of Machine Learning-Based Intrusion Detection in Multi-Cloud Environments

In the dynamic landscape of cloud computing, multi-cloud environments have emerged as the prevalent ones due to offering a host of advantages including redundancy, flexibility, and increased security. These multi-cloud environments can, however, be vulnerable to stealthy cyber-attacks, thereby making it a challenging job to find efficient intrusion detection systems (IDS). The efficiency of the Machine Learning-based Intrusion Detection System in multi-cloud environments has been evaluated using a 1-D Convolutional Neural Network to classify network traffic based on the UNSW-NB15 dataset. The dataset included a wide variety of network features, and it was decided that it could be used directly after converting the categorical variables into their numerical forms and scaling them with MinMaxScaler. This was used for training and testing the 1D-CNN model, which had attained an accuracy of 84.02% during training and 82.79% on validation. Further, the performance of the model is elicited with metrics that include precision at 80.91%, recall at 82.79%, and an F1-score at 81.28%, showing its capability in identifying network intrusions effectively. The small difference between the accuracy of training and validation shows that overfitting was minimal; thus, the model will generalize well when applied to unseen data. This research underlines the possibility of using deep learning techniques, and particularly CNNs, for intrusion detection in complex multi-cloud infrastructures. Probably future work would be optimizing the model through hyperparameter tuning, using additional sources of data, and even exploring much more sophisticated architectures that will further improve the accuracy of intrusion detection.

Detection and Localization of Stealthy Cyberattacks in Cyber-Physical Discrete Event Systems

The widespread use of cyber-physical systems (CPS) not only brings new opportunities with it but also introduces the risk of cyber attacks on the system. One of the most dangerous and sophisticated types of attacks are the stealthy attacks that can hide their influence and are not detectable by conventional anomaly detection schemes. In this paper, a detection method for the replay attack and the covert attack on discrete event systems is proposed. Unexpected behavior is introduced into the transmitted signals by the integration of permutation matrices into the sensor and actuator channels. The permutation disrupts the stealthiness of an attacker and allows the detection of cyber attacks. Moreover, an attack localization scheme is proposed, which allows to determine which signals are attacked in case that the attacker only attacks a subset of communication channels and not the whole system.

Deep learning-based framework for real-time transient stability prediction under stealthy data integrity attacks

Cyber-attacks can degrade the performance of online transient stability prediction (TSP) and assessment functions offered for power systems. This paper proposes a cyber-resilient real-time TSP framework created by considering both perspectives, of the attacker, and of the smart grid operator. From the attacker’s viewpoint, to minimize the attack cost, a model-free data-driven algorithm for finding the measurements to which the TSP function is vulnerable is considered. The attack vector that maximizes the TSP classifier’s inaccuracy reduces the performance of TSP significantly. From the perspective of the system operator and to defend the system against data integrity attacks, two unsupervised learning algorithms which are principal component analysis and fuzzy c-means clustering, are combined and employed to detect the falsified phasor measurement units (PMUs) in the system. In the proposed framework, a denoising autoencoder model is also developed to eliminate the effect of stealthy cyber-attacks. When a cyber-attack is detected, the denoising autoencoder-based model is triggered to recover the damage of the cyber-attack, while a well-tuned long short-term memory model is implemented for the TSP application. The proposed framework is tested on two IEEE test systems, including 39-bus and 127-bus systems, with various attack scenarios. Results show that the developed system is more resilient to the attacks than the existing well-established TSP functions.

Stealthy Cyberattacks Detection Based on Control Performance Assessment Methods for the Air Conditioning Industrial Installation

This paper aims to study the workflow of the detection centre of stealthy attacks on industrial installations that generate an increase in energy consumption. Such long-lasting, undetected attacks on industrial facilities make production more expensive and less competitive or damage the installation in the long term. We present the concept of the remote detection system of cyberattacks directed at maliciously changing the controlled variable in an industrial process air conditioning system. The monitored signals are gathered at the PLC-controlled installation and sent to the remote detection system, where the discrepancies of signals are analysed based on the Control Performance Assessment indices. The results of performed tests prove the legitimacy of the adopted approach.

An LMI-Based Risk Assessment of Leader–Follower Multi-Agent System Under Stealthy Cyberattacks

This paper proposes a methodology for assessing the potential risk from cyberattacks in multi-agent systems (MASs). MASs inherently rely on communication between agents, rendering them more vulnerable to cyberattacks than single-agent systems. The impact of cyberattacks could lead to performance disruption and safety violations. To address these concerns, we propose a risk assessment method for MASs using reachability analysis which computes the reachable set of the MASs via a Lyapunov function and its corresponding linear matrix inequalities (LMIs). The proposed method can quantify the potential risk against cyberattacks at agent and entire system levels by deriving ellipsoidal over-approximated reachable sets. An illustrative example is provided to validate the potency of the method, which shows the risk associated with the formation control of a leader-following MAS in an adversarial environment with scattered obstacles.

Anomaly-Based Intrusion Detection System To Detect Advanced Persistent Threats: Environmental Sustainability

In an evolving digital world, Advanced Persistent Threats (APTs) pose severe cybersecurity challenges. These extended, stealthy cyber-attacks, often elude conventional Intrusion Detection Systems (IDS). To bridge this gap, our research introduces a novel, environmentally conscious, deep learning-based IDS designed for APT detection. The system encompasses various stages from objective definition, data collection and preprocessing, to model development, integration, validation, and deployment. The system, utilizing deep learning algorithms, scrutinizes network traffic to detect patterns characteristic of APTs. This approach improves IDS accuracy and allows real-time threat detection, enabling prompt response to potential threats. Importantly, our system contributes to environmental protection by minimizing power consumption and electronic waste associated with cyberattacks, promoting sustainable cybersecurity practices. Our research outcomes are expected to enhance APT detection, providing robust defense against sophisticated cyber threats. Our environmentally-conscious perspective adds a unique dimension to the cybersecurity domain, underlining its role in sustainable practices.

Security defense against long-term and stealthy cyberattacks

Modern cyberattacks such as advanced persistent threats have become sophisticated. Hackers can stay undetected for an extended time and defenders do not have sufficient countermeasures to prevent advanced cyberattacks. Reflecting on this phenomenon, we propose a game-theoretic model to analyze strategic decisions made by a hacker and a defender in equilibrium. In our game model, the hacker launches stealthy cyberattacks for a long time and the defender decides when to disable a suspicious user based on noisy observations of the user’s activities. Damages caused by the hacker can be enormous if the defender does not immediately ban a suspicious user under certain circumstances, which can explain the emerging sophisticated cyberattacks with detrimental consequences. Our model also predicts that the hacker may opt to be behavioral to avoid worst cases. This is because behavioral cyberattacks are less threatening and the defender decides not to immediately block a suspicious user to reduce cost of false detection.

Stealthy Local Covert Attacks on Cyber-Physical Systems

In cyber-physical systems (CPS), the networked structure not only enhances the accessibility of data, but also introduces the risk of cyber attacks. The stealthy attacks that are undetected by the monitoring system, are the most dangerous type of cyber attacks. In this article, we introduce a new attack strategy to call attention to the problem of stealthy cyber attacks on CPS. The proposed attack scenario does not require access to all control input signals and sensor output signals, so it needs fewer disruption resources and is called a local covert attack. We show that the local covert attack can be made completely stealthy by applying the decoupling technique or by combining the basic idea of a covert attack and a zero-dynamics attack. Simulation results are provided to demonstrate the stealthiness of the proposed local covert attacks.

Second-Order Cone Programming Relaxation of Stealthy Cyberattacks Resulting in Overvoltages in Cyber-Physical Power Systems

Deployment of photovoltaic generation in smart grids has introduced overvoltage problems. Cyberattackers can take advantage of this situation and cause intentional overvoltages in distribution systems using stealthy false data injections (FDIs). To protect distribution grids from these FDIs, the first step is to model cyberattacks that can cause overvoltages. An accurate nonlinear optimization model is developed for stealthy FDI cyberattacks that can result in overvoltages on targeted nodes in distribution grids without being detected by bad data detection algorithms. Compared to the existing research, which mainly focused on dc state estimation for transmission systems, the proposed model formulates cyberattacks that cause overvoltages using ac state estimation in distribution grids. The proposed nonlinear model is then approximated to a convex optimization model using second-order cone programming relaxation formulation to guarantee that a global optimum exists for the model. Several case studies are considered to validate the effectiveness of the proposed attack model. It is shown that by limiting the FDIs on targeted buses to 20% of their nominal load, multiple buses can experience severe overvoltages in a distribution grid.

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

As the next-generation power grids, smart grids are integrated with advanced information and communication technology (ICT) to make the grid more efficient and stable than conventional power systems. Given the mounting cyber-attack threats, these critical ICT systems create great security issues for smart grids. Additionally, the clever attackers have the ability to not only access and monitor the smart grid, but also hack it by launching well-established cyber-attacks. Thus, this article is devoted to understanding the potential stealthy cyber-attack and its countermeasure. First, this article proposes a stealthy sparse cyber-attack model in an ac smart grid by considering both the residual test-based detector and the interval-state-estimation-based detector, which is not considered in previous studies. The design model is formulated as a constrained optimization problem by minimizing the number of contaminated meters, where the characteristics of two types of detector are considered simultaneously as the constraints for the first time. A constrained differential evolution (CDE) is proposed as the solver because the optimization problem is NP-hard. Then, a generalized-cumulative-sum-based detector is developed to detect the proposed cyber-attacks, where a fractional-order state transition matrix is originally introduced into the estimator to describe the dynamics of the power system. Numerical studies illustrate the feasibility of CDE-based stealthy sparse cyber-attacks and the effectiveness of the proposed countermeasure.

Detection of Nonrandom Sign-Based Behavior for Resilient Coordination of Robotic Swarms

Cooperative multirobot systems coordinate their motion by exchanging information through consensus schemes to achieve a common goal. In the event of stealthy cyber attacks, compromised measurements and communication broadcasts can hijack a portion or the entire system toward undesired states. However, in order for these attacks to be effective, they have to exhibit nonrandom characteristics that contradict the expected multirobot system behavior. To deal with these hidden attacks, we propose a runtime monitoring framework that considers the signed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">residual</i> , defined as the difference between the expected and the received information to identify and isolate unexpected nonrandom behavior within the multirobot system. Specifically, the technique that we propose—named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Cumulative Sign</i> detector—monitors and compares changes in signed values of residual with their expected occurrences to detect inconsistencies and trigger alarms when an attack is discovered. Our results are validated theoretically by providing detection bounds and are demonstrated with simulations and experiments on swarms of unmanned ground vehicles under different attacks in comparison with state-of-the-art residual-based detection schemes.

Observer design for labeled finite automata with inputs under stealthy actuators attacks

This paper addresses the problem of cyber-attacks in discrete-event systems framework. Labeled finite state automata with inputs derived from a particular class of Petri net, called Output Synchronized Petri nets, are used to model a given cyber-physical system along with the information that circulate between controllers and plant. Stealthy cyber-attacks that may alter the control symbols, i.e., the orders sent by the controllers to the actuators, are considered. The objective is to construct an observer that uses both input and output information to provide a state estimation of the system under such stealthy actuators attacks. This observer provides a refined state estimation related to both normal and attack conditions.

Exploring cybersecurity issues in 5G enabled electric vehicle charging station with deep learning

The surging usage of electric vehicles (EVs) demand the robust deployment of trustworthy electric vehicle charging station (EVCS) with millisecond range latency and massive machine to machine communications where 5G could act. However, 5G suffers from inherent protocols, hardware, and software vulnerabilities that seriously threaten the communicating entities' cyber-physical security. To overcome these limitations in the EVCS system, this paper analyses the impact of False Data Injection (FDI) and Distributed Denial of Services (DDoS) attacks on the operation of EVCS. This work is an extension of our previously published conference paper about the EVCS. As new features, this paper simulates the FDI attack and the syn flood DDoS attacks on 5G enabled remote Supervisory Control and Data Acquisition (SCADA) system that controls the solar photovoltaics (PV) controller, Battery Energy Storage (BES) controller, and EV controller of the EVCS. The attacks make the EVCS system oscillate or shift the DC operating point. The frequency of oscillation, its damping, and the system's resiliency are found to be related to the attacks' intensity and target controller. Finally, we propose the novel stacked Long Short-Term Memory (LSTM) based intrusion detection systems (IDS) solely based on the electrical fingerprint. This model can detect the stealthy cyberattacks that bypass the cyber layer and go unnoticed in the monitoring system with nearly 100% detection accuracy.

A Blended Active Detection Strategy for False Data Injection Attacks in Cyber-Physical Systems

In recent years, different solutions have been proposed to detect advanced stealthy cyber-attacks against networked control systems. In this article, we propose a blended detection scheme that properly leverages and combines two existing detection ideas, namely, watermarking and moving target . In particular, a watermarked signal and a nonlinear static auxiliary function are combined to both limit the attacker's disclosure resources and obtain an unidentifiable moving target. The proposed scheme is capable of detecting a broad class of false data injection attacks, including zero-dynamics, replay, and covert attacks. Moreover, it is shown that the proposed approach mitigates the drawbacks of standard moving target and watermarking defense strategies. Finally, an extensive simulation study is reported to contrast the proposed detector with recent competitor schemes and provide tangible evidence of the effectiveness of the proposed solution.

Reachability Analysis for Linear Discrete-Time Systems Under Stealthy Cyber Attacks

In this article, the reachability analysis is investigated for the linear discrete-time systems in the presence of malicious cyber attacks. Moreover, the system disturbance and measurement noise are assumed to be unknown-but-bounded (UBB). Then, the attack model is built and a novel attack detector, which depends on the estimate residue is developed. Based on the stealthy cyber-attack set, reachability analysis is done, and the corresponding reachable set is computed. In order to reduce the computation burden, a recursive reachable set computation algorithm is proposed. Finally, an example is provided to illustrate the validity of main results.

Generating Adversarial Examples Against Machine Learning-Based Intrusion Detector in Industrial Control Systems

Deploying machine learning (ML)-based intrusion detection systems (IDS) is an effective way to improve the security of industrial control systems (ICS). However, ML models themselves are vulnerable to adversarial examples, generated by deliberately adding subtle perturbation to the input sample that some people are not aware of, causing the model to give a false output with high confidence. In this article, our goal is to investigate the possibility of stealthy cyber attacks towards IDS, including injection attack, function code attack and reconnaissance attack, and enhance its robustness to adversarial attack. However, adversarial algorithms are subject to communication protocol and legal range of data in ICS, unlike only limited by the distance between original samples and newly generated samples in image domain. We propose two strategies - optimal solution attack and GAN attack - oriented to flexibility and volume of data, formulating an optimization problem to find stealthy attacks, where the former is appropriate for not too large and more flexible samples while the latter provides a more efficient solution for larger and not too flexible samples. Finally, we conduct experiments on a semi-physical ICS testbed with a high detection performance ensemble ML-based detector to show the effectiveness of our attacks. The results indicate that new samples of reconnaissance and function code attack produced by both optimal solution and GAN algorithm possess 80 percent higher probability to evade the detector, still maintaining the same attack effect. In the meantime, we adopt adversarial training as a method to defend against adversarial attack. After training on the mixture of orginal dataset and newly generated samples, the detector becomes more robust to adversarial examples.

Stealthy Cyberattacks on Loads and Distributed Generation Aimed at Multi-Transmission Line Congestions in Smart Grids

Developing attack models is the first step to understand cyberattacks in smart grids and develop countermeasures. In this article, a three-level nonlinear programming formulation is proposed for false data injection (FDI) cyberattacks that could result in multiple transmission line congestions without being detected by conventional bad data detection (BDD) algorithms. The model is then converted to a mixed integer linear programming (MILP) formulation to guarantee a global optimum exists. A detection framework based on recursive least-square estimation (RLSE) is developed that can successfully detect the stealthy FDIs. The developed model with the detection framework is validated through various case studies in IEEE 118-bus benchmark.

Advanced algorithm to detect stealthy cyber attacks on automatic generation control in smart grid

One of the basic requirements of today's sophisticated world is the availability of electrical energy, and neglect of this matter may have irreparable damages such as an extensive blackout. The problems which were introduced about the traditional power grid, and also, the growing advances in smart technologies make the traditional power grid go towards smart power grid. Although widespread utilisation of telecommunication networks in smart power grid enhances the efficiency of the system, it will create a critical platform for cyber attacks and penetration into the system. Automatic generation control (AGC) is a fundamental control system in the power grid, and it is responsible for controlling the frequency of the grid. An attack on the data transmitted through the telecommunications link from the sensors to the AGC will cause frequency deviation, resulting in disconnection of the load, generators and ultimately global blackout. In this study, by using a Kalman filter and a proposed detector, a solution has been presented to detect the attack before it can affect the system. Contrary to existing methods, this method is able to detect attacks that are stealthy from the area control error signal and χ2 -detector. Simulations confirm the effectiveness of this method.

A Switching Multiplicative Watermarking Scheme for Detection of Stealthy Cyber-Attacks

This article addresses the detection of stealthy attacks on sensor measurements. Inspired in authentication schemes with weak cryptographic guarantees, we propose a watermarking approach to validate the data and its source. In particular, we propose a multiplicative scheme, where the sensor outputs are watermarked by a bank of filters, then transmitted through the possibly unsecured communication network. The original measurement data are finally reconstructed by a watermark remover. To allow the detection of replay attacks, the watermarking filters are devised as hybrid switching systems, whose parameters are assumed to be unknown to the adversary. Design rules are provided, guaranteeing that the nominal closed-loop performance is not deteriorated by the watermarking scheme and ensuring robust stability with mismatched filter parameters. Moreover, we design a switching protocol with no communication overhead to allow the watermarking filters to synchronously update their parameters. The detectability properties of cyber-attacks are analyzed, and the results are illustrated through numerical examples for replay and data injection attacks.