Threat Of Attacks Research Articles

MCAD: A Machine Learning Based Cyber Attack Detector using SDN for Healthcare Systems

The healthcare industry, increasingly reliant on digital technology, has become a prime target for cyberattacks. While traditional security measures address external threats, they often fail to effectively counter a particularly dangerous foe: insider threats. This project proposes MCAD (Machine Learning-based CyberAttack Detector), a groundbreaking approach that leverages the power of machine learning within Software-Defined Networks (SDNs) to bolster healthcare network security. Healthcare networks are inherently complex ecosystems, housing a diverse range of medical devices alongside traditional IT infrastructure. This intricate web creates a larger attack surface for malicious insiders with access to critical systems. These insiders can be disgruntled employees or attackers exploiting vulnerabilities in poorly designed systems. The COVID-19 pandemic further exacerbated this vulnerability as the surge in telehealth services and remote access points opened new avenues for exploitation. The statistics are alarming, with a staggering 92% of healthcare organizations reporting insider-caused security breaches. These breaches not only compromise sensitive patient data but can also disrupt critical healthcare services, potentially jeopardizing patient safety. MCAD, a Machine Learning-based Cyber Attack Detector, tackles the growing threat of insider attacks in healthcare networks. It employs a multi-pronged approach: collecting both normal and abnormal network traffic to train a real-time machine learning model. This model continuously analyzes network activity, identifying suspicious behavior indicative of insider threats. MCAD seamlessly integrates with SDN controllers for efficient deployment within existing infrastructure, and undergoes rigorous testing with various machine learning algorithms and simulated attacks to ensure optimal protection against evolving cyber threats.

APT Attack Detection Method Based on Traceability Graph

This article proposes an Advanced Persistent Threat (APT) attack detection method based on traceability graphs, aimed at addressing the complexity and concealment of APT attacks. This method describes system behavior by constructing a traceability graph, optimizing it to reduce redundant information, converting the traceability graph sequence into a feature vector sequence, and using an encoder decoder model to train the GRU (Gate Recurrent Unit) model to extract long-term features of the sequence. Finally, a normal behavior model is established through clustering to detect APT attacks.

Securecipher: An instantaneous synchronization stream encryption system for insider threat data leakage protection

The paper addresses the persistent challenge of insider threat in cybersecurity. Despite advancements in detection and prevention technologies and approaches, the complexity of digital environments and the ingenuity of insiders remain a problem. We propose an encryption algorithm called Securecipher, specifically designed to protect file systems from insider threats. The requirements that an algorithm must meet in this context are outlined, along with a method for its development. A context-based key generation mechanism is introduced, eliminating the need for key storage. A file marking mechanism is proposed that enables protection of the encryption algorithm against specific insider threat attacks. The proposed encryption algorithm meets the requirements posed by insider threats and has successfully passed 87 % of the NIST tests, equivalent to 13 out of 15 tests passed. Compared to conventional algorithms, the proposed encryption algorithm is more efficient in the context of insider threats, allowing access to distant locations instantaneously. In the specific case of the comparison with the RC4 algorithm, it showed a 0.25 s higher speed when accessing the last position of a 128-bytes file. Furthermore, a significant increase in the vocabulary of the encrypted text with Securecipher compared to the original text is observed, approximately 42 times more.

FedCrow: Federated-Learning-Based Data Privacy Preservation in Crowd Sensing

In the process of completing large-scale and fine-grained sensing tasks for the new generation of crowd-sensing systems, the role of analysis, reasoning, and decision making based on artificial intelligence has become indispensable. Mobile crowd sensing, which is an open system reliant on the broad participation of mobile intelligent terminal devices in data sensing and computation, poses a significant risk of user privacy data leakage. To mitigate the data security threats that arise from malicious users in federated learning and the constraints of end devices in crowd-sensing applications, which are unsuitable for high computational overheads associated with traditional cryptographic security mechanisms, we propose FedCrow, which is a federated-learning-based approach for protecting crowd-sensing data that integrates federated learning with crowd sensing. FedCrow enables the training of artificial intelligence models on multiple user devices without the need to upload user data to a central server, thus mitigating the risk of crowd-sensing user data leakage. To address security vulnerabilities in the model data during the interaction process in federated learning, the system employs encryption methods suitable for crowd-sensing applications to ensure secure data transmission during the training process, thereby establishing a secure federated-learning framework for protecting crowd-sensing data. To combat potential malicious users in federated learning, a legitimate user identification method based on the user contribution level was designed using the gradient similarity principle. By filtering out malicious users, the system reduces the threat of attacks, thereby enhancing the system accuracy and security. Through various attack experiments, the system’s ability to defend against malicious user attacks was validated. The experimental results demonstrate the method’s effectiveness in countering common attacks in federated learning. Additionally, through comparative experiments, suitable encryption methods based on the size of the data in crowd-sensing applications were identified to effectively protect the data security during transmission.

Network Security Defense Strategy of Deep Reinforcement Learning Oriented to Game Battle

With the popularity of online games and the increasing frequency of game battles, game platforms are facing more and more network security threats and attacks. In order to effectively deal with these threats, this study proposes a network security defense strategy of Deep Reinforcement Learning (DRL) for game warfare. Through the modeling of game battle environment and the application of DRL algorithm, this strategy can monitor and identify all kinds of network attacks in game battle in real time, and take corresponding measures to defend and deal with them. In this study, the corresponding experimental environment is designed, and the network security defense strategy based on DRL is evaluated and analyzed. The experimental results show that the strategy has obvious advantages in network attack detection rate and false alarm rate, and has good stability and reliability. In addition, the strategy also shows strong generalization ability and adaptability, and can effectively deal with different types of network attack threats. The results of this study are of great significance for strengthening the network security defense of the game platform and improving the user experience and the stability of the game environment.

Surveying Emerging Trends in DDoS Defense

This The DDoS attack threat is evolving, and because of this, organizations are discovering and using new modern technologies to lay the ground for more effective defensive strategies. This paper is devoted to the investigation of the most efficient methods fighting DDoS – downtime of the network, and ensuring cybersecurity on different domains. First of all, the integration of Convolutional Neural Networks (CNNs) into cybersecurity is a very promising move with respect to fighting exactly the phishing and application-layer DDoS attacks in greater details than the machine learning approaches like the LSTMs and SAEs. Another aspect of building the effective opposition against the dummy data attacks on the critical infrastructures, for example on the power systems, is creating the multi-dimensional mitigation models composed of various timely detection techniques and robust network architecture. In addition, the usage of Physically Unclonable Functions (PUFs) in network architectures provides a means of authentication as well as access control that can improve the resilience of a network against DDoS attacks. PUFs enables the blockade of unwanted packets of high volume traffic, allowing granular traffic filtration and isolation. By using hardware solutions such as Distributed-Denial-of-Service (DDoS) attack prevention, SDN-biased security frame with deep learning algorithms can improve network resilience with significant detection and response to slow-rate DDoS attacks. At last EWMA, KNN, and CUSUM as statistical methods integrated with FOG computing architectures ensure real time and effective solution for the detection and mitigation of DDoS attacks in the IoT networks, making them immune to the current as well as the continuously emerging cyber threats. Through the integration of these cutting edge methods, organizations will be able to hold their ground against cyberattacks catalyzed by DDoS menace and stay ahead of dynamic threats whenever they arise. Keywords— Cloud computing, Data threats, Data Protection, Cloud security.

Two-stage advanced persistent threat (APT) attack on an IEC 61850 power grid substation

Advanced Persistent Threats (APTs) are stealthy, multi-step attacks tailored to a specific target. Often described as ’low and slow’, APTs remain undetected until the consequences of the cyber-attack become evident, usually in the form of damage to the physical world, as seen with the Stuxnet attack, or manipulation of an industrial process, as was the case in the Ukraine Power Grid attacks. Given the increasing sophistication and targeted nature of cyber-attacks, especially APTs, this paper delves into the substantial threats APTs pose to critical infrastructures, focusing on power grid substations. Through a detailed case study, we present and explore a 2-stage APT attack on an IEC 61850 power grid substation, employing a Hardware-in-the-Loop (HIL) testbed to simulate real-world conditions. More specifically, this paper discusses two significant experiments conducted to assess vulnerabilities in the control protocols used in IEC 61850 substations: IEC 60870-5-104 and IEC 61850. The integration of findings from these experiments revealed a number of previously undiscussed potential threats to power grid infrastructure that could arise from attacking one or more substations. To better address these potential threats, the paper proposes an extension to the Industrial Control System (ICS) kill chain that explicitly accounts for the consequences of attacks on the physical aspects of Cyber-Physical Systems (CPSs).

Hierarchical Classification of Botnet Using Lightweight CNN

This paper addresses the persistent threat of botnet attacks on IoT devices, emphasizing their continued existence despite various conventional and deep learning methodologies developed for intrusion detection. Utilizing the Bot-IoT dataset, we propose a hierarchical CNN (HCNN) approach featuring three levels of classification. The HCNN approach, presented in this paper, consists of two networks: the non-hierarchical and the hierarchical network. The hierarchical network works by combining features obtained at a higher level with those of its descender. This combined information is subsequently fed into the following level to extract features for the descendant nodes. The overall network consists of 1790 parameters, with the hierarchical network introducing an additional 942 parameters to the existing backbone. The classification levels comprise a binary classification of normal vs attack in the first level, followed by 5 classes in the second level, and 11 classes in the third level. To assess the effectiveness of our proposed approach, we evaluate performance metrics such as Precision (P), Recall (R), F1 Score (F1), and Accuracy (Acc). Rigorous experiments are conducted to compare the performance of both the hierarchical and non-hierarchical models and existing state-of-the-art approaches, providing valuable insights into the efficiency of our proposed hierarchical CNN approach for addressing botnet attacks on IoT devices.

A miscellaneous model for comprehensive attractiveness assessment of chemical plants: Integrating chemical hazards, domino effects and plant traits

The growing threat of intentional attacks on major petrochemical plants underscores the urgent need for robust security risk assessments (SRA). Such assessments are widely acknowledged as crucial for risk mitigation and are currently a focus of active research. This study introduces a methodology for assessing the attractiveness of the petrochemical sector to intentional attacks, considering chemical hazards, domino effects, and plant traits. Within this framework, we have identified 12 risk factors that capture the multifaceted nature of targeting incentives, relating to the enterprise, location, population, and other key features. We have developed a hybrid decision-making model that analyzes the interrelationships among these factors and determines their weights, integrating the Decision-Making Trial and Evaluation Laboratory (DEMATEL) and the Analytic Network Process (ANP). The applicability of this method is demonstrated through a detailed case study. The results indicate that our method can effectively rank the attractiveness of chemical plants within a specific region, serving as a preliminary screening phase in the SRA. The findings of the attractiveness assessment may assist in identifying potential targets among numerous existing plants and support the allocation of security resources and the formulation of defensive measures.

Exploring Practical Acoustic Transduction Attacks on Inertial Sensors in MDOF Systems

In cyber-physical systems, inertial sensors are the basis for identifying motion states and making actuation decisions. However, extensive studies have proved the vulnerability of those sensors under acoustic transduction attacks, which leverage malicious acoustics to trigger sensor measurement errors. Unfortunately, the threat from such attacks is not assessed properly because of the incomplete investigation on the attack's potential, especially towards multiple-degree-of-freedom systems, e.g., drones. To thoroughly explore the threat of acoustic transduction attacks, we revisit the attack model and design a new yet practical acoustic modulation-based attack, named KITE. Such an attack enables stable and controllable injections, even under frequency offset based distortions that limit the effect of prior attacking approaches. KITE exploits the potential threat of transduction attacks without the need of strengthening attackers' abilities. Furthermore, we extend the attack surface to multiple-degree-of-freedom (MDOF) systems, which are more widely deployed but ignored by prior work. Our study also covers the scenario of attacking moving targets. By revealing the practical threat from acoustic transduction attacks, we appeal for both the attention to their harm and necessary countermeasures.

Adaptive Double-Spending Attacks on PoW-Based Blockchains

Previous state-of-the-art studies have proposed various analytical models to understand the double-spending attacks (DSA) occurred in Proof-of-Work (PoW) based Blockchains. Although many insights behind the double-spending attacks have been disclosed, we still believe that advanced versions of DSA can be developed to create new threats for the PoW-based blockchains such as the Bitcoin blockchain. In this paper, we present two new types of double-spending attacks in the context of the PoW-based blockchain and discuss the insights behind them. By considering more practical network parameters, such as the number of confirmation blocks, the hashpower of the double-spending attacker, the amount of coins in the target transaction, and the network-status parameter, we first analyze the success probability of the conventional double-spending attack, named Naive DSA. Based on Naive DSA, we create two new adaptive DSA, i.e., the Adaptive DSA and the Reinforcement Adaptive DSA (RA-DSA). In our analytical models, a double-spending attack is converted into a Markov Decision Process. We then exploit the Stochastic Dynamic Programming (SDP) approach to obtain the optimal attack strategies under Adaptive DSA and RA-DSA. Numerical simulation results demonstrate the correlations between each critical network parameter and the expected attacker's reward. Through the proposed analytical models, we aim to alert the PoW-based blockchain ecosystem that the threat of double-spending attacks is still at a dangerous level. For example, our findings show that the attacker can launch a successful attack with a small hashpower proportion much lower than 51% under RA-DSA.

Adversities in Abstract Interpretation - Accommodating Robustness by Abstract Interpretation

Robustness is a key and desirable property of any classifying system, in particular, to avoid the ever-rising threat of adversarial attacks. Informally, a classification system is robust when the result is not affected by the perturbation of the input. This notion has been extensively studied, but little attention has been dedicated to how the perturbation affects the classification. The interference between perturbation and classification can manifest in many different ways, and its understanding is the main contribution of the present article. Starting from a rigorous definition of a standard notion of robustness, we build a formal method for accommodating the required degree of robustness—depending on the amount of error the analyst may accept on the classification result. Our idea is to precisely model this error as an abstraction . This leads us to define weakened forms of robustness also in the context of programming languages, particularly in language-based security, e.g., information-flow policies, and in program verification. The latter is possible by moving from a quantitative (standard) model of perturbation to a novel qualitative model, given by means of the notion of abstraction. As in language-based security, we show that it is possible to confine adversities, which means to characterize the degree of perturbation (and/or the degree of class generalization) for which the classifier may be deemed adequately robust. We conclude with an experimental evaluation of our ideas, showing how weakened forms of robustness apply to state-of-the-art image classifiers.

Enhanced Local Binary Pattern Algorithm for Facial Recognition Using Chinese Remainder Theorem

Current biometrics research focuses on achieving a high authentication success rate for identity management and discussing the threat of various security attacks. Local Binary Pattern (LBP), one of the methods for feature extraction, and Chicken Swarm Optimization (CSO), one of the strategies for feature selection, were used for user identification and authentication. LBP requires high computational time to extract features from the facial images. The Chinese Remainder Theorem (CRT) was used to reduce its computational time by formulating an Enhanced Local Binary Pattern (ELBP). Michael Olugbenga Banji Abolarinwa (MOBA) database was created specifically for this study. 600 frontal facial images of 200 people were collected, each with three images. 360 images were used for training while 240 images were used for testing. MATLAB (R2016a) was used to run the simulation. The time it took to classify the facial images when LBP and CSO were combined and when ELBP and CSO were combined were enumerated. The LBP-CSO achieved a false-positive rate (FPR) of 11.67%, a sensitivity (SEN) of 92.78%, a specificity (SPEC) of 88.33%, a precision (PREC) of 95.98%, and an accuracy of 91.67% in 119.10 seconds at 0.80 thresholds for face recognition. ELBP-CSO obtained an FPR of 5.00%, SEN of 95.00%, SPEC of 95.00%, PREC of 98.28%, and accuracy of 95.00% in 79.16 seconds. The results showed that LBP-CSO took an average of 119.10 seconds and ELBP-CSO took an average of 79.16 seconds. In conclusion, the performance of CSO-ELBP justifies the usage of LBP enhancement with CRT.

Probabilistic models for evaluating network edge's resistance against scan and foothold attack

AbstractThe threat of Scan and Foothold Attack to the Network Edge (SFANE) is increasing, which greatly affects the application and development of edge computing network architecture. However, existing works focus on the implementation of specific technologies that resist the SFANE but ignore the effectiveness analysis of them. To overcome this limitation, this paper constructs probabilistic models for evaluating network edge's resistance against SFANE. In particular, the attacker models of the SFANE based on the ATT&CK model are first formalized. Afterward, according to the state‐of‐the‐art defense technologies, three different defense strategies are illustrated: no defense, address mutation, and fingerprint decoy. Subsequently, three different probabilistic models are constructed to provide a deeper analysis of the theoretical effect of these strategies on resisting the SFANE. Finally, the experimental results show that the actual defense effect of each strategy almost perfectly follows its probabilistic model.

Image encryption scheme using a new 4-D chaotic system with a cosinoidal nonlinear term in WMSNs

To protect the sensitive data captured in the wireless media sensor networks (WMSNs), this paper propounds a novel data encryption scheme by employing a new chaotic system and the semi-tensor product compressive sensing model driven by a linear congruence generator. In this scheme, the coefficients yielded by sparsely decomposing the plaintext image onto a wavelet packet basis are firstly compressed using a key-controlled measurement matrix. To minimize the threat of various attacks, the compressed image is then subjected to bidirectional diffusion manipulation to conceal its statistical properties under the control of chaotic sequences. Additionally, it is worth explaining that a lightweight 4D-chaotic system with only one nonlinear term is designed to accommodate the resource-constrained situation in WMSNs. Finally, theoretical analysis and investigations affirm its significant enhancement in visual security, compressibility, and encryption efficiency. Moreover, the proposed scheme is significantly superior to existing relevant encryption ones.

Security threats for Europe and summer Olympic games in Paris 2024

Sport has historically played a significant role in spreading positive values and connecting cultures and nations worldwide, but it can also be exploited for political, religious, and ideological motivations. Sporting events have become targets of terrorist attacks in recent years. Terrorists and extremist groups may use sports events as means to propagate their ideologies or to attract attention through acts of terrorism. The threat of attacks during sporting events poses a serious risk to the security of the civilian population and, consequently, a significant challenge for its protection. The most notable sporting event in 2024 will be the Summer Olympic Games in Paris. France has experienced the highest number of terrorist attacks in Europe, making the Olympics a major security concern. The study analyzes terrorists' strategies related to attacks on sports events and potential attack scenarios at the 2024 Olympic Games. The insights gained can contribute to strengthening the security of sporting events and the protection of participants and spectators against potential threats.

An Approach to Android Ransomware Detection Using Deep Learning

As mobile devices continue to grow in popularity, the threat of ransomware attacks on Android devices has escalated, leading to serious privacy and financial risks for users. Traditional methods of ransomware detection have become less effective due to the evolving nature of these attacks. Consequently, the application of deep learning techniques offers promising potential for the detection and prevention of Android ransomware. This paper proposes an approach that utilizes deep learning algorithms to analyze and identify ransomware behavior on Android devices, aiming to enhance the security measures against these malicious threats. The model we used is a feedforward neural network model using the Keras Sequential. The model consists of three layers of densely connected neurons. The first layer has 64 units, the second layer also has 64 units, and the third and final layer has 2 units. The proposed model gave accuracy 98.9%.

Enhancing Web Security: Implementing CAPTCHA for Government Websites

In the digital era, government websites serve as critical platforms for citizens to access essential services, information, and resources. However, with the increasing threat of cyber attacks and data breaches, ensuring the security of these websites is paramount. This research paper explores the implementation of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) as a mechanism to enhance web security on government websites. CAPTCHA is a widely adopted security measure designed to distinguish between human users and automated bots, thereby mitigating various forms of cyber threats such as brute force attacks, credential stuffing, and unauthorized access. This paper examines the effectiveness of CAPTCHA in safeguarding government websites, including its impact on user experience, accessibility, and usability. Furthermore, it explores various implementation strategies, best practices, and potential challenges associated with deploying CAPTCHA on government platforms. Through a comprehensive analysis of existing literature, case studies, and empirical data, this paper provides insights into the role of CAPTCHA in bolstering web security for government websites and offers recommendations for policymakers, web developers, and security professionals.

ATT&CK-based Advanced Persistent Threat attacks risk propagation assessment model for zero trust networks

In recent years, the growing frequency and intensity of Advanced Persistent Threats (APTs) have significantly undermined the legitimacy and financial stability of government agencies, enterprises, and other entities. Moreover, these attacks have shown the inherent vulnerabilities in conventional border defense strategies. The emergence of the zero trust network architecture can be attributed to the increasing complexity of the cyber threat landscape. With the application of risk assessment, this paper effectively tackles the challenges posed by conventional network defense limitations and enhances the efficiency of the access control decision-making process. Nevertheless, the existing risk assessment approaches primarily focus on conventional security assessment objectives, which exhibits a deficiency in the ability to dynamically assess APT attacks. The Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Framework introduced in this paper is a novel approach to mitigating APT attacks. This paper aims to mine and analyze the frequent item set and correlation of cyber threat penetration attack techniques. The paper also intends to construct an attack technique relationship diagram and develop a tactical prediction model for cyber threat penetration attacks using the Markov chain model. Finally, our study aims to establish a risk propagation model for APT threats based on the aforementioned model. The approach presented in this paper significantly enhances the capacity of zero trust networks in addressing sophisticated cyber threats.

PointCVaR: Risk-Optimized Outlier Removal for Robust 3D Point Cloud Classification

With the growth of 3D sensing technology, the deep learning system for 3D point clouds has become increasingly important, especially in applications such as autonomous vehicles where safety is a primary concern. However, there are growing concerns about the reliability of these systems when they encounter noisy point clouds, either occurring naturally or introduced with malicious intent. This paper highlights the challenges of point cloud classification posed by various forms of noise, from simple background noise to malicious adversarial/backdoor attacks that can intentionally skew model predictions. While there's an urgent need for optimized point cloud denoising, current point outlier removal approaches, an essential step for denoising, rely heavily on handcrafted strategies and are not adapted for higher-level tasks, such as classification. To address this issue, we introduce an innovative point outlier cleansing method that harnesses the power of downstream classification models. Using gradient-based attribution analysis, we define a novel concept: point risk. Drawing inspiration from tail risk minimization in finance, we recast the outlier removal process as an optimization problem, named PointCVaR. Extensive experiments show that our proposed technique not only robustly filters diverse point cloud outliers but also consistently and significantly enhances existing robust methods for point cloud classification. A notable feature of our approach is its effectiveness in defending against the latest threat of backdoor attacks in point clouds.