Target Of Attacks Research Articles

CONSEQUENCES OF PAYING A RANSOM WHILE RANSOMWARE ATTACK

The subject of this article is devoted to the actions taken by personnel of organizations that havebecome the target of a ransomware attack. It should be noted here that within the framework ofthe considerations undertaken, reference was made not to technical - IT undertakings aimed atunlocking the attacked system, but to the harmfulness of ransomware behavior, both in the area ofactivities of public entities and in the business environment. The methodology for thedevelopment of the article was based on the analysis of information on the phenomenon ofransomware, as well as on the ranking and analysis of the legislation governing the issue ofliability in the event of ransomware placement. The research problem of the manuscript wascontained in the question: what are the consequences for those who decide to transferransomware, as well as those who seek a way to finance the ransomware attack? At the same time,it was assumed that this is the responsibility of both those who decide to pay the ransom and thepersonnel who supervise the activities of the entities. It was also attempted to depict that theresponsibility for the ransomware decision arises both in the area of public entities and withingthe scope of companies prospering in the private economic sector.

Securing Deployed Smart Contracts and DeFi With Distributed TEE Cluster

Smart contract technologies can be used to implement almost arbitrary business logic. They can revolutionize many businesses such as payments, insurance, and crowdfunding. The resulting birth of decentralized finance (DeFi) has gained significant momentum. Smart contracts and DeFi are now attractive targets for attacks. An important research question is how to protect deployed smart contracts and DeFi. Smart contracts cannot be modified once deployed, namely vulnerabilities cannot be fixed by patching. In this case, vulnerabilities in deployed contracts and DeFi might cause devastating consequences. In this paper, we put forward SolSaviour, a framework for protecting deployed smart contracts and DeFi. The core of SolSaviour is to build a smart contract protection mechanism based on democratic voting using a distributed trusted execution environment (TEE) cluster. Once a vulnerability in deployed contracts or DeFi is found, SolSaviour can destroy the defective contract and redeploy a patched contract via the distributed TEE cluster. Moreover, SolSaviour can migrate funds and state variables from the destroyed contract to the patched one. Compared with previous work, our approach can protect smart contracts and DeFi in a distributed manner, avoiding reliance on privileged users or trusted third parties. Our experiment results show that SolSaviour can protect smart contracts and complex DeFi protocols with feasible overhead.

A Network Security Prediction Method Based on Attack Defense Tree

Modern networks are vulnerable to coordinated assaults. To perform threat analysis on individual and combined attack behaviors, it is essential to establish a security situation analysis model based on offensive and defensive decisions. The standard attack tree model used in this study ignores the impact of defenses, and the defensive tree model is not well scalable. Game theory is introduced into the attack tree model to describe specific network attack and defense event scenarios. First, analyze the logical relationship of different levels of attack behaviors in the network, integrate the offensive and defensive trees corresponding to different levels of attack events, to obtain a complete network offensive and defensive behavior tree, and then build a network offensive and defensive behavior tree model. Second, the basic offensive and defensive behavior tree extends from network offensive and defensive behavior, network detection equipment, and network defense measures. Propose an algorithm for the success rate of the attack target and calculate its attack probability. Based on these findings, we assess the potential for an attack and investigate the current state of network defenses. An offensive and defensive behavior tree model based on the BGP (Border Gateway protoc01) attack tree was developed in order to test the viability and efficacy of the network offensive and defensive behavior tree model. The network attack and defensive behavior tree model brought out in this study is capable of performing a wide range of calculations. The effect of defensive measures, as well as the ability to add and delete offensive and defensive behaviors at any node, has strong scalability and can provide a scientific basis for decision-making for network managers and operators.

Online Weapon-target Assignment based on Distributed Auction Mechanism

To solve the problem of online weapon-target assignment (OWTA) in the integration of large-scale search and attack in unknown environment, an OWTA algorithm based on distributed auction mechanism is presented. Aiming at the problem that the traditional combinatorial optimization algorithm needs to set up the global battlefield situation in advance, considering the consumability of resources in the attack process, the integrated search and attack task flow is established. Considering the communication restricted environment, the unmanned aerial vehicles (uavs) are grouped, with centralized architecture within the group and distributed structure between the groups, and the corresponding distributed auction mechanism is constructed to achieve OWTA within the communication range limited. In order to solve the problem that it is difficult to ensure the time consistency of the coordinated attack target, a dubins cooperative path planning based on cooperative particle swarm optimization (CPSO) algorithm is proposed. Particle swarm optimization algorithm is used to adjust the radius of the dubins path of each bomb, so that the uav in the same group can hit the target simultaneously without collision and have the shortest flight range. The simulation results show that the designed distributed auction algorithm takes into account the consumption of attack resources, and quickly redistributes the firepower to the new targets in the dynamic uncertain environment, which ensures the maximization of the execution efficiency of the multi-machine cluster fire allocation task.

Antimicrobial resistance mechanisms characteristic of clinically important gram-negative baccili

Antimicrobial resistance is a global public health issue and one of the most serious threats to the mankind today. Some bacterial strains have acquired resistance to most antimicrobial drugs and, therefore, new antibacterial agents that would overcome resistant strains are needed. In 2017, the World Health Organization published a list of priority antimicrobial-resistant pathogens. Most of these agents are gram-negative bacteria. Due to their structure, the gram-negative bacteria are more resistant to antimicrobials than gram-positive bacteria and cause significant morbidity and mortality worldwide. The main resistance mechanisms are: restricted drug absorption, modification of the target attack, inactivation of the antimicrobial drug by production of hydrolyzing enzymes and active drug efflux. These mechanisms may be innate or acquired by microorganisms, and understanding those mechanisms may create new treatment options for infectious pathology and may contribute to the development of new antimicrobial drugs that counter the microbial attempts to become resistant.

Gaps in Asset Management Systems to Integrate Railway Companies’ Resilience

Railways and metros are safe, efficient, reliable, and environmentally friendly mass carriers. They are critical cyber-physical systems (CPS) that are attractive targets for cyber and/or physical attacks. SAFETY4RAILS project delivers methods and systems to increase the safety and resilience of track-based inter-city railway and intra-city metro transportation. Asset management plays a fundamental role in resilience management. This study analyses the gaps in asset management systems of rail infrastructure. The objective of the study is to understand the weaknesses and vulnerabilities in an asset management system that impacts resilience. The form of triangulation fashion was used for the analysis of consequences for each threat event. The research conducted included: a systematic literature review; a multiple case study review; and an analysis. The strength of asset inventory, condition inspection methods and decision-making scenarios were analysed, and as an expanded part of this analysis, mitigation actions linked to the vulnerabilities were identified. The study implies that asset management systems are most important in resilience management’s response and recovery phases where the largest sudden economic implications can take place. The results of the gap analysis could be used to provide policy recommendations and standardisation efforts.

A Bayesian-network approach for assessing the probability of success of physical security attacks to offshore Oil&Gas facilities

Offshore Oil&Gas facilities are attractive targets of intentional malicious attacks (security attacks) that may trigger cascading events (e.g., the release and dispersion of hazardous material and/or energy, fires, explosions) with consequences on people, environment, and assets. The severity of these consequences is potentially similar to those arising from major accident scenarios originated by conventional safety-related causes. Current practice in managing the risk of security attacks mostly relies on qualitative or semi-quantitative procedures developed over the years in the offshore Oil&Gas industry. In the present study, a systematic quantitative procedure is developed, based on a Bayesian Network (BN) approach, for calculating the probability of success of physical security attacks, taking into account both preventive and mitigative security intervention strategies. The procedure addresses the specific framework of the offshore Oil&Gas industry. A case study concerning an offshore fixed Oil&Gas platform allowed us to demonstrate the quality of the results that can be achieved and their potential towards the improvement of the security of the installations considered.

Iterative Feature Selection-Based DDoS attack Prevention Approach in Cloud

Distributed Denial of Service (DDOS) attacks aim to exploit the capacity and performance of a network's infrastructure, making the cloud environment one of the biggest targets for attackers. Many efforts are being made in the field of technology to prevent them from disrupting the services provided. Machine Learning techniques are a means to protect against DDOS attacks. Data preprocessing, feature selection, and classifiers are the main components of any prevention framework. The focus of this study is to find and enhance the feature selection approach for increasing the accuracy of the classifiers in detecting DDOS attacks from regular traffic. We used four different techniques, including Pearson Correlation Coefficient (PCC), Random Forest Feature Importance (RFFI), Mutual information (MI), and Chi-squared(X2) measure which we tested on different classifiers. The first selection approach was based on the feature’s independency level then the second iteration was based on the feature’s importance. We also examined the claim of dropping attacks from the dataset for better accuracy. The best performing set of features was from using PCC and RFFI together for feature selection with average accuracy and precision of 99.27% and 97.60%, which is higher than the use of PCC for both measures by almost 2%. The accuracy is also higher by nearly 12% from the same approach dropping 50% of the attacks.

An ensemble-based stegware detection system for information hiding malware attacks

Information hiding techniques like steganography are used by hackers to obfuscate malicious attack codes to carry malware scripts and deliver to crypto-miners in on-demand platforms like Cloud. Stegware is a type of information-hiding malware that employs steganography to avoid detection by modern malware detection systems. This work proposes a Stegware detection system that recognizes obfuscated payloads from input images and verifies whether the obfuscated payload is the target of any stegware attack. The proposed system detects the stegware in four phases: Obfuscated Payload Detection phase that detects the presence of any obfuscated item concealed inside the digital medium; Obfuscated Payload Extraction phase that decodes stego-repository images to extract the data that are steganographically obfuscated inside the input; Obfuscated Payload Classification phase that detects whether the extracted data is legitimate or malicious stegware file, using binary classifier; Calculation of malicious percentage phase that uses fuzzy C-means clustering algorithm to calculate the quantum and frequency of malicious activities. The proposed system is experimentally tested on real dataset and analyzed with existing models. The simulation results illustrate that the proposed Stegware detection system detects the steganographically-hidden attacks and identifies malicious activities in percentage terms as compared to other models.

Constrained trajectory planning for unmanned aerial vehicles using asymptotic optimization approach

Trajectory planning with the involvement of motion time has become a key and challenge for autonomous systems. This paper investigates trajectory planning of unmanned aerial vehicles (UAVs) under maneuverability and collision avoidance constraints. First, a polynomial-based trajectory planning framework is established, and a nonlinear programming problem (NLP) is formulated. Then, a novel asymptotic optimization approach is proposed to improve NLP solution success rate. Three operations of dividing the original NLP into sub-problems, adding constraints gradually, and using previous NLP solution as current initial guess value are designed in the approach. Third, an improved particle swarm optimization (PSO) path planning is also proposed to generate initial guess value for the first sub-problem. Benefited from these operations, the NLP solution success rate is significantly improved. Finally, simulations on simultaneous attack of a same target are carried out. Comparisons with other algorithms illustrate the advantage of the proposed approach.

함정 대공방어시스템의 효과도를 활용한 피격성 추정 가능성 연구

Recently, the increased use of anti-ship guided missiles, a weapon system that detects and attacks targets in naval engagement, has come to pose a major threat to the survivability of ships. In order to improve the survivability of ships in response to such anti-ship guided missiles, many studies of means to counteract them have been conducted in militarily advanced countries. The integrated survivability of a ship can be largely divided into susceptibility, vulnerability, and recoverability, and is expressed as the conditional probability, if the ship is hit, of damage and recovery. However, as research on susceptibility is a major military secret of each country, access to it is very limited and there are few publicly available data. Therefore, in this study, a possibility of estimating the susceptibility of ships using an anti-air defense system corresponding to anti-ship guided missiles was reviewed. To this, scenarios during engagement, weapon systems mounted to counter threats, and maximum detection/battle range according to the operational situation of the defense weapon system were defined. In addition, the effectiveness of the anti-air defense system and susceptibility was calculated based on the performance of the weapon system, the crew

Regret bounds for online-learning-based linear quadratic control under database attacks

This paper is concerned with understanding and countering the effects of database attacks on a learning-based linear quadratic adaptive controller. This attack targets neither sensors nor actuators, but just poisons the learning algorithm and parameter estimator that is part of the regulation scheme. We focus on the adaptive optimal control algorithm introduced by Abbasi-Yadkori and Szepesvari and provide regret analysis in the presence of attacks as well as modifications that mitigate their effects. A core step of this algorithm is the self-regularized on-line least squares estimation, which determines a tight confidence set around the true parameters of the system with high probability. In the absence of malicious data injection, this set provides an appropriate estimate of parameters for the aim of control design. However, in the presence of attack, this confidence set is not reliable anymore. Hence, we first tackle the question of how to adjust the confidence set so that it can compensate for the effect of the poisonous data. Then, we quantify the deleterious effect of this type of attack on the optimality of control policy by bounding regret of the closed-loop system under attack.

Evaluation of the decision-making process within the table-top exercise of the Terror and Disaster Surgical Care (TDSC®) course

PurposeThe threat of terror is omnipresent in Europe and the number of attacks worldwide is increasing. The target of attacks in Europe is usually the civilian population. Incalculable dangerous situations at the scene of the event and severe injury patterns such as complex gunshot and explosion injuries with a high number of highly life-threatening people present rescue forces, emergency physicians and subsequently hospitals with medical, organizational as well as tactical and strategic challenges. The Terror and Disaster Surgical Care (TDSC®) course trains clinical decision-makers to meet these challenges of a TerrorMASCAL in the first 24–48 h.MethodsA table-top exercise was developed for the TDSC® course as a decision training tool, which was prospectively evaluated in six courses. The evaluation took place in 3 courses of the version 1.0, in 3 courses in the further developed version 2.0 to different target values like, e.g., the accuracy of the in-hospital triage. Furthermore, 16 TDSC® course instructors were evaluated.ResultsFor the evaluation, n = 360 patient charts for version 1.0 and n = 369 for version 2.0 could be evaluated. Overall, the table-top exercise was found to be suitable for training of internal clinical decision makers. Version 2.0 was also able to depict the action and decision-making paths in a stable and valid manner compared to the previous version 1.0. The evaluation of the instructors also confirmed the further value and improvement of version 2.0.ConclusionWith this prospective study, the table-top exercise of the TDSC® course was tested for decision stability and consistency of the participants’ decision paths. This could be proven for the selected target variables, it further showed an improvement of the training situation. A further development of the table-top exercise, in particular also using digital modules, will allow a further optimization.http://www.bundeswehrkrankenhaus-ulm.de

Identification of SMEs in the Critical Factors of an IS Backup System Using a Three-Stage Advanced Hybrid MDM–AHP Model

Backup system work represents “the last mile” of information security (IS). To avoid data loss or damage, enterprises should execute data backup periodically to ensure the integrity and availability of such data. Additionally, due to the continuous emergence of IS incidents featuring malicious attacks in recent years, major firms in countries around the world have successively reported being under attack by ransomware viruses. In particular, small and medium enterprises (SMEs) became the potential targets of malicious attacks based on their different types of IS awareness and degrees of digitalization; therefore, IS work has become one of the essential topics with special significance for numerous SMEs. To this end, this paper studied the factors influencing SMEs’ adoption of IS backup systems in the hope that the critical decision-making behaviors of SMEs regarding the issue of IS could be learned. Practical suggestions can be made for the marketing schemes adopted by IS manufacturers concerning the planning of IS backup systems. Thus, this study used three methodological stages to address the exciting issue of IS backup systems for SMEs. In the first stage, 11 factors at two hierarchies involving three constructs influencing SMEs’ adoption of IS backup systems were summarized via a literature review. The constructs included financial consideration (FC), the IS incident, and business IS decision making (BISD-M). In the second stage, an expert questionnaire was applied; an advanced hybrid modified Delphi method (MDM) and analytic hierarchy process (AHP) with expert input were constructed to identify the sorting of overall weights based on the 11 factors included in the first stage. Following the empirical conclusions, the top three critical factors were “disaster loss amount”, “enterprise’s downtime”, and “supplier’s contractual requirements”. The conclusions of this study indicated that two factors were included in the FC construct; thus, the FC construct influenced IS the most, and the BISD-M construct took second place. In the final stage, through re-checking three actual cases, the results of this study were verified with specific respect to the FC. In conclusion, to popularize IS backup systems among SMEs and fully implement IS, manufacturers may start from the FC in the hope that the severe impact caused by IS incidents featuring malicious attacks can be slowed down and the losses encountered can be lowered. The empirical results and conclusions of this study can be used for reference by SMEs, and both theoretical and empirical foundations have been provided for further studies in academic circles; the results above also show a significant application contribution of this study.

Data driven intrusion detection for 6LoWPAN based IoT systems

Wide adoption of Internet of Things (IoT) devices and their limitations in terms of hardware cause them to be easy targets for attackers. This, in turn, requires monitoring such systems using intrusion detection systems and take mitigative actions against insider and outsider attackers. Recent studies have explored that machine learning based intrusion detection systems are quite successful in detecting different types of cyber threats targeting IoT systems. However, the proposed systems in these studies incurred limitations in terms of the characteristics of their datasets and detection models. Specifically, a big proportion of the proposed models were developed using simulation-based data generated through specific simulators. Some of these studies also used previously published testbed data that contain the samples of outdated IoT attacks and vulnerabilities. Furthermore, they focused on a lower attack variety and proposed binary classifiers which do not scale in multi-attack scenarios. In this study, we propose a machine learning based multi-class classifier that can classify 6 attack types together with the benign traffic. Our node based feature extraction and detection methodology allows locating the network addresses of the attackers, rather than a rough network level attack existence information, by modeling their traffic characteristics over a sliding time window. For training and testing our models, we also propose an intrusion detection dataset generated using the traffic data collected from real IoT devices running with 6LoWPAN and RPL protocols. Besides having RPL routing attacks in the dataset, we leverage Mirai botnet, employed frequently to target IoT devices. The results show that the proposed intrusion detection system can detect 6 attack types with high recall scores ranging from 79% to 100%. We also illustrate the practicality of the developed model via deployment in a proof of concept implementation over a testbed.

A Defense System: Jamming Detection and Mitigation for Safety Applications in Vehicular Networks

The periodically exchanged basic safety messages (BSM) in vehicular networks have become a new attack target for jamming attacks that are easy to conduct in a vehicular environment. The detection and mitigation must be cordially integrated to provide acceptable communication latency under attacking conditions. This paper considers a comprehensive defense system detecting and mitigating jamming attacks. We analyze the impact of the jamming attack on BSMs on our initially proposed random channel surfing scheme coupling with a detection method. The detection method can hardly provide 100% accuracy, and this consequently delays the reaction. We study the defense system by a mathematical model which is validated by simulations in NS-3. The obtained results depict how the performance of the channel surfing scheme depends on its preinstalled detection method

LSTM-Markov based efficient anomaly detection algorithm for IoT environment

The seamless integration of wireless and IoT device in normal day to day life and for smart homes has enabled more security and privacy needs. The attack or unauthorized access to these devices may result in issues in decision making inside the smart environment. Attacks and anomalies in open IoT system could provide false alarms and cause delay in processing the information’s. The problem statement considered is, Anomaly detection systems, on the other hand, can be targets of attacks, h/w s/w failures, and thus fall short of their objectives. Because these are power-hungry devices carrying highly sensitive data, an effective attack and anomaly alert system is critical in an IoT-based environment. The present algorithms require high training and additional memory to identify the anomalies in the network, which is not practically feasible to simple edge-based computing devices. The anomalies and false information inside the network are handled with effective anomaly detection algorithm designed in this paper. An efficient anomaly detection method in real-time sensor is identified through markov and LSTM based network and the outliers in the data is clearly removed through the proposed approach. The proposed approach is tested with the real-time DHT sensor monitoring room temperature and room humidity. The proposed methodology provides 96.03% effective anomalies detection with 92.48% high training accuracy. The methodology showcase improved with 6.54% of effective anomaly rejection and 5.13% of training accuracy when compared with KNN algorithm.

Joint mission and route planning of unmanned air vehicles via a learning-based heuristic

Unmanned air vehicles (UAVs) have been regularly employed in modern wars to conduct different missions. Instead of addressing mission planning and route planning separately, this study investigates the issue of joint mission and route planning for a fleet of UAVs. The mission planning determines the configuration of weapons in UAVs and the weapons to attack targets, while the route planning determines the UAV's visiting sequence for the targets. The problem is formulated as an integer linear programming model. Due to the inefficiency of CPLEX on large scale optimization problems, an effective learning-based heuristic, namely, population based adaptive large neighborhood search (P-ALNS), is proposed to solve the model. In P-ALNS, seven neighborhood structures are designed and adaptively utilized in terms of their historical performance. The effectiveness and superiority of the proposed model and algorithm are demonstrated on test instances of small, medium and large sizes. In particular, P-ALNS achieves comparable solutions or as good as those of CPLEX on small-size (20 targets) instances in much shorter time.

Response time optimization for vulnerability management system by combining the benchmarking and scenario planning models

<span>The growth of information and communication technology has made the internet network have many users. On the other side, this increases cybercrime and its risks. One of the main attack targets is network weakness. Therefore, cyber security is required, which first does a network scan to stop the attack. Points of vulnerability on the network can be discovered using scanning techniques. Furthermore, mitigation or recovery measures can be implemented. However, it needs a short response time and high accuracy while scanning to reduce the level of damage caused by cyber-attacks. In this paper, the proposed method improves the performance of a vulnerability management system based on network and port scanning by combining the benchmarking and scenario planning models. On a network scanning to discover open ports on a subnet, Masscan can achieve response times of less than 2 seconds, and on scenario planning for detection on a single host by Nmap can reach less than 4 seconds. It was combining both models obtained an adequate optimization response time. The total response time is less than 6 seconds.</span>

Correlation-Based Anomaly Detection in Industrial Control Systems.

Industrial Control Systems (ICSs) were initially designed to be operated in an isolated network. However, recently, ICSs have been increasingly connected to the Internet to expand their capability, such as remote management. This interconnectivity of ICSs exposes them to cyber-attacks. At the same time, cyber-attacks in ICS networks are different compared to traditional Information Technology (IT) networks. Cyber attacks on ICSs usually involve a sequence of actions and a multitude of devices. However, current anomaly detection systems only focus on local analysis, which misses the correlation between devices and the progress of attacks over time. As a consequence, they lack an effective way to detect attacks at an entire network scale and predict possible future actions of an attack, which is of significant interest to security analysts to identify the weaknesses of their network and prevent similar attacks in the future. To address these two key issues, this paper presents a system-wide anomaly detection solution using recurrent neural networks combined with correlation analysis techniques. The proposed solution has a two-layer analysis. The first layer targets attack detection, and the second layer analyses the detected attack to predict the next possible attack actions. The main contribution of this paper is the proof of the concept implementation using two real-world ICS datasets, SWaT and Power System Attack. Moreover, we show that the proposed solution effectively detects anomalies and attacks on the scale of the entire ICS network.