Timing Attacks Research Articles

HARNESSING BLOCKCHAIN WITH ENSEMBLE DEEP LEARNING-BASED DISTRIBUTED DOS ATTACK DETECTION IN IOT-ASSISTED SECURE CONSUMER ELECTRONICS SYSTEMS

Consumer electronics (CE) and the Internet of Things (IoTs) are transforming daily routines by integrating smart technology into household gadgets. IoT allows devices to link and communicate from the Internet with better functions, remote control, and automation of various complex systems simulation platforms. The quick progress in IoT technology has continuously driven the progress of further connected and intelligent CEs, shaping more smart cities and homes. Blockchain (BC) technology is emerging as a promising technology offering immutable distributed ledgers that improve the security and integrity of data. However, even with BC resilience, the IoT ecosystem remains vulnerable to Distributed Denial of Service (DDoS) attacks. In contrast, the malicious actor overwhelms the network with traffic, disrupting services and compromising device functionality. Incorporating BC with IoT infrastructure presents groundbreaking techniques to alleviate these threats. IoT networks can better detect and respond to DDoS attacks in real time by leveraging BC cryptographic techniques and decentralized consensus mechanisms, which safeguard against disruptions and enhance resilience. There must be a reliable mechanism of recognition based on adequate techniques to detect and identify whether these attacks have happened or not in the system. Artificial intelligence (A) is the most common technique that uses machine learning (ML) and deep learning (DL) to recognize cyber threats. This research presents a new Blockchain with Ensemble Deep Learning-based Distributed DoS Attack Detection (BCEDL-DDoSD) approach in the IoT platform. The primary intention of the BCEDL-DDoSD approach is to leverage BC with a DL-based attack recognition process in the IoT platform. BC technology is utilized to enable a secure data transmission process. In the BCEDL-DDoSD approach, Z-score normalization is initially employed to measure the input data. Besides, the selection of features takes place using the Fractal Wombat optimization algorithm (WOA). For attack recognition, the BCDL-DDoSD technique applies an ensemble of three models, namely denoising autoencoder (DAE), gated recurrent unit (GRU), and long short-term memory (LSTM). Lastly, an orca predator algorithm (OPA)-based hyperparameter tuning procedure has been implemented to select the parameter value of DL models. A sequence of simulations is made on the benchmark database to authorize the performance of the BCDL-DDoSD approach. The simulation results showed that the BCDL-DDoSD approach performs better than other DL techniques.

Functional Response of Four Phytoseiid Mites to Eggs and First-Instar Larvae of Western Flower Thrips, Frankliniella occidentalis.

The predation capacity and functional responses of adult females of the phytoseiid mites Amblyseius largoensis (Muma), Proprioseiopsis lenis (Corpuz and Rimando), Paraphytoseius cracentis (Corpuz and Rimando), and Amblyseius swirskii (Athias-Henriot) were studied on eggs and first instars of the western flower thrips, Frankliniella occidentalis (Pergande), in the laboratory at 25 °C and 30 °C. At both temperatures, the functional response of all four phytoseiid mites was type II to first instars of the thrips. In contrast, when offered thrips eggs, the functional response was type III. At both temperatures tested, A. swirskii had the highest mean daily consumption of first-instar F. occidentalis, followed by A. largoensis, P. cracentis, and P. lenis. Amblyseius largoensis had the shortest handling time and the highest maximum attack rate when first-instar thrips were the prey. When fed on thrips eggs, A. largoensis had the highest mean daily consumption, followed by A. swirskii, P. cracentis, and P. lenis. On thrips eggs, A. swirskii showed the shortest handling time and highest maximum attack rate. Our findings indicate that all four phytoseiids had a better ability to prey on first-instar larvae of F. occidentalis compared to thrips eggs. At 25 and 30 °C, A. largoensis was the better predator on thrips larvae, whereas A. swirskii was superior in consuming eggs of F. occidentalis. Proprioseiopsis lenis was the inferior predator on both thrips larvae and eggs compared to the other phytoseiids tested.

Evict+Spec+Time: Exploiting Out-of-Order Execution to Improve Cache-Timing Attacks

Evict+Spec+Time: Exploiting Out-of-Order Execution to Improve Cache-Timing Attacks

Using Machine Learning Multiclass Classification Technique to Detect IoT Attacks in Real Time.

This paper presents a real-time intrusion detection system (IDS) aimed at detecting the Internet of Things (IoT) attacks using multiclass classification models within the PySpark architecture. The research objective is to enhance detection accuracy while reducing the prediction time. Various machine learning algorithms are employed using the OneVsRest (OVR) technique. The proposed method utilizes the IoT-23 dataset, which consists of network traffic from smart home IoT devices, for model development. Data preprocessing techniques, such as data cleaning, transformation, scaling, and the synthetic minority oversampling technique (SMOTE), are applied to prepare the dataset. Additionally, feature selection methods are employed to identify the most relevant features for classification. The performance of the classifiers is evaluated using metrics such as accuracy, precision, recall, and F1 score. The results indicate that among the evaluated algorithms, extreme gradient boosting achieves a high accuracy of 98.89%, while random forest demonstrates the most efficient training and prediction times, with a prediction time of only 0.0311 s. The proposed method demonstrates high accuracy in real-time intrusion detection of IoT attacks, outperforming existing approaches.

Secure-by-Design Real-Time Internet of Medical Things Architecture: e-Health Population Monitoring (RTPM)

The healthcare sector has undergone a profound transformation, owing to the influential role played by Internet of Medical Things (IoMT) technology. However, there are substantial concerns over these devices’ security and privacy-preserving mechanisms. The current literature on IoMT tends to focus on specific security features, rather than wholistic security concerning Confidentiality, Integrity, and Availability (CIA Triad), and the solutions are generally simulated and not tested in a real-world network. The proposed innovative solution is known as Secure-by-Design Real-Time IoMT Architecture for e-Health Population Monitoring (RTPM) and it can manage keys at both ends (IoMT device and IoMT server) to maintain high privacy standards and trust during the monitoring process and enable the IoMT devices to run safely and independently even if the server is compromised. However, the session keys are controlled by the trusted IoMT server to lighten the IoMT devices’ overheads, and the session keys are securely exchanged between the client system and the monitoring server. The proposed RTPM focuses on addressing the major security requirements for an IoMT system, i.e., the CIA Triad, and conducts device authentication, protects from Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, and prevents non-repudiation attacks in real time. A self-healing solution during the network failure of live e-health monitoring is also incorporated in RTPM. The robustness and stress of the system are tested with different data types and by capturing live network traffic. The system’s performance is analysed using different security algorithms with different key sizes of RSA (1024 to 8192 bits), AES (128 to 256 bits), and SHA (256 bits) to support a resource-constraint-powered system when integrating with resource-demanding secure parameters and features. In the future, other security features like intrusion detection and prevention and the user’s experience and trust level of such a system will be tested.

A Real-Time Intrusion Detection System for DoS/DDoS Attack Classification in IoT Networks Using KNN-Neural Network Hybrid Technique

As more devices are connected to the Internet through the Internet of Things (IoT), there are huge security challenges. One of the major problems is Distributed Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. These attacks floods networks with useless traffic, disrupting IoT services. There is a need for better security measures to handle this. Intrusion Detection Systems (IDS) is used to find suspicious activities, but many of them can't keep up with new types of attacks in real time. This study focuses on creating an efficient real time hybrid framework that uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks. This proposed framework aims to identify and categorize DoS/DDoS attacks in real time through the utilization of a simulation model and MQTT-IoT-IDS2020 dataset and compared with existing frameworks, our proposed framework excels in accuracy, precision, and recall.

An international survey assessing the effects of the duration of attack-free period on health-related quality of life for patients with hereditary angioedema

BackgroundHereditary angioedema (HAE) is characterized by unpredictable and often severe cutaneous and mucosal swelling that affects the extremities, face, larynx, gastrointestinal tract, or genitourinary area. Introduction of novel long-term prophylactic treatment options (lanadelumab, berotralstat, and C1-esterase inhibitor SC [human]) into the treatment armamentarium has substantially reduced HAE attacks, allowing patients to be attack free for longer with improvements to their quality of life. Using data drawn from a wide-ranging survey of patients with HAE, we examined the relationship between duration of time attack free and health-related quality of life (HRQoL), exploring the possibility that there is an association between observed improvement in HRQoL and attack-free duration.MethodsA survey among patients with HAE on long-term prophylaxis (LTP) in six countries (the US, Australia, Canada, UK, Germany, and Japan) assessed the relationship between attack-free duration and mean Angioedema Quality of Life (AE-QoL) scores, quality of life benefits, and rescue medication used. Analysis of covariance (ANCOVA) was used to assess the roles of LTP and attack-free period (< 1 month, 1– < 6 months, ≥ 6 months) on total AE-QoL scores. Results include descriptive p-values for strength of association, without control for multiplicity. Descriptive statistics were used to show the relationship between time attack free and quality of life benefits.ResultsLonger durations of time for which participants reported being attack free at the time of the survey correlated with better AE-QoL scores and less use of rescue medication. The mean total AE-QoL scores were 51.8, 33.2, and 19.9 for those who reported having been attack free for < 1 month, 1– < 6 months, and ≥ 6 months, respectively, with higher scores reflecting more impairment. The ANCOVA results showed a strong association between attack-free duration and AE-QoL total score.ConclusionThis study shows that longer attack-free duration has an influential role for better HRQoL in patients receiving LTP. Prolonging the attack-free period is an important goal of therapy and recent advances in LTP have increased attack-free duration. However, opportunities exist for new treatments to further increase attack-free duration and improve HRQoL for all patients with HAE.

Lightweight Hardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe)

Cache Side-Channel Attacks (CSCAs) have been haunting most processor architectures for decades now. Existing approaches to mitigation of such attacks have certain drawbacks, namely software mishandling, performance overhead, and low throughput due to false alarms. Hence, “mitigation only when detected” should be the approach to minimize the effects of such drawbacks. We propose a novel methodology of fine-grained detection of timing-based CSCA using a hardware-based detection module. We discuss the design, implementation, and use of our proposed detection module in processor architectures. Our approach successfully detects attacks that flush secret victim information from cache memory like Flush+Reload, Flush+Flush, Prime+Probe, Evict+Probe, and Prime+Abort, commonly known as cache timing attacks. Detection is on time with minimal performance overhead. The parameterizable number of counters used in our module allows detection of multiple attacks on multiple sensitive locations simultaneously. The fine-grained nature ensures negligible false alarms, severely reducing the need for any unnecessary mitigation. The proposed work is evaluated by synthesizing the entire detection algorithm as an attack detection block, Edge-CaSCADe, in a RISC-V processor as a target example. The detection results are checked under different workload conditions with respect to the number of attackers and the number of victims having RSA-, AES-, and ECC-based encryption schemes like ECIES, and on benchmark applications like MiBench and Embench. More than 98% detection accuracy within 2% of the beginning of an attack can be achieved with negligible false alarms. The detection module has an area and power overhead of 0.9% to 2% and 1% to 2.1% for the targeted RISC-V processor core without cache for one to five counters, respectively. The detection module does not affect the processor critical path and hence has no impact on its maximum operating frequency.

SDN Network DDOS Detection Using ML

This paper describes a technique that uses the Ryu Controller and Mininet to identify and mitigate Distributed Denial of Service (DDoS) threats in Software Defined Networks (SDN). Using Mininet, the suggested method entails building a virtual network topology with connected switches and hosts. The Ryu Controller gathers traffic data while Mininet simulates several DDoS attack types, such as ICMP flood, land assault, TCP SYN flood, and UDP attacks. The Ryu Controller collects both benign and DDoS traffic into a dataset that is used to build a machine learning (ML) model that can detect DDoS attacks in real time.

A Lyapunov-based control design for centralised networked control systems under false-data-injection attacks

ABSTRACT A central processing unit receives data from all agents and transmits control commands in a Networked Control System (NCS) which is centralised. Centralised NCSs have numerous applications in industrial settings due to their efficiency, simplicity and cost-effective design. However, centralised NCSs are vulnerable to false data injection (FDI) attacks. Despite the fact that researchers have developed detection and mitigation defense mechanisms during past several years, most of these methods have focused on systems with linear dynamics. Furthermore, the existing literature only assumes the injection of FDI attacks on measurement signals. In this paper, we assume that an adversary has injected the FDI attack into both state measurements and control signals with nonlinear dynamics while considering communication noises and disturbances. We propose a secure nonlinear control design that mitigates FDI attacks in real time by combining learning and model-based approaches. We used Lyapunov stability analysis to design the controller, estimator and updating laws of the neural network (NN). In addition, we selected a network of two robots with Euler–Lagrange dynamics to illustrate the robustness of the proposed controller and estimator.

Machine learning for network defense: automated DDoS detection with telegram notification integration

As the prevalence and sophistication of distributed denial of service (DDoS) attacks escalate, the imperative for advanced defense mechanisms becomes paramount, especially in rapidly growing digital landscapes like Indonesia. This research presents the development of an innovative intrusion detection system (IDS) that harnesses machine learning (ML) algorithms to automate the detection of DDoS attacks in real time. By monitoring TCP streams, the system utilizes ML-enhanced IDS components to identify malicious traffic patterns indicative of DDoS activities. An automatic alert is dispatched to network administrators via Telegram upon detection, ensuring immediate awareness and facilitating swift countermeasures. Additionally, the system embodies a self-improving architecture by retraining its ML model with newly encountered attack data, thus continuously refining its detection capabilities. The system's efficacy, marked by its adaptive learning and proactive notification system, not only contributes to the fortification of network security but also underscores the potential for ML in cybersecurity within Indonesia’s expanding digital domain. The deployment of this system is anticipated to significantly bolster cybersecurity infrastructure by addressing the urgent need for advanced and responsive defense strategies against the evolving landscape of cyber threats.

Timing Side-channel Attacks and Countermeasures in CPU Microarchitectures

Microarchitectural vulnerabilities, such as Meltdown and Spectre, exploit subtle microarchitecture state to steal the user’s secret data and even compromise the operating systems. In recent years, considerable discussion lies in understanding the attack-defense mechanisms and exploitability of such vulnerabilities. Unfortunately, there have been few investigations into a systematic elaboration of threat models, attack scenarios and requirements, and defense targets of the resulting attacks. In this article, we fill this gap and make the following contributions. We first propose two sets of taxonomies for classifying microarchitectural timing side-channel attacks and their countermeasures according to various attack conditions. Based on the taxonomies proposed, we then review published attacks and existing defenses and systematically analyze their internals. In particular, we also provide a comprehensive analysis of the similarities and differences among those attacks, uncovering the corresponding practicality and severity by identifying the attack targets/platforms and the security boundaries that can be bypassed to reveal information. We further examine the scalability of those defenses through specifying expected defense goals and costs. We also discuss corresponding detection methods based on different classifications. Finally, we propose several key challenges of existing countermeasures and the attack trends, and discuss directions for future research.

Security Enhancement for Deep Reinforcement Learning-Based Strategy in Energy-Efficient Wireless Sensor Networks.

Energy efficiency and security issues are the main concerns in wireless sensor networks (WSNs) because of limited energy resources and the broadcast nature of wireless communication. Therefore, how to improve the energy efficiency of WSNs while enhancing security performance has attracted widespread attention. In order to solve this problem, this paper proposes a new deep reinforcement learning (DRL)-based strategy, i.e., DeepNR strategy, to enhance the energy efficiency and security performance of WSN. Specifically, the proposed DeepNR strategy approximates the Q-value by designing a deep neural network (DNN) to adaptively learn the state information. It also designs DRL-based multi-level decision-making to learn and optimize the data transmission paths in real time, which eventually achieves accurate prediction and decision-making of the network. To further enhance security performance, the DeepNR strategy includes a defense mechanism that responds to detected attacks in real time to ensure the normal operation of the network. In addition, DeepNR adaptively adjusts its strategy to cope with changing network environments and attack patterns through deep learning models. Experimental results show that the proposed DeepNR outperforms the conventional methods, demonstrating a remarkable 30% improvement in network lifespan, a 25% increase in network data throughput, and a 20% enhancement in security measures.

Modern approaches to information security: analysis of intrusion detection, firewalls and auditing in the context of organizational data protection

Today’s business environment presents organizations with growing information security challenges. The threats posed by cyber-attacks and the leakage of sensitive information require effective and innovative approaches to data protection. This paper explores a combination of tools and techniques, including intrusion detection system (IDS), firewalls, and information security auditing, as key elements of organizational data protection. The paper provides a detailed overview of each of these components and discusses their roles in information security. For an intrusion detection system, its ability to detect and respond to different types of attacks in real time is investigated. For firewalls, consider how they restrict access to network resources and regulate traffic. Finally, information security audits act as a means of assessing the effectiveness of security measures and identifying weaknesses. Statistical data and best practices are presented to support our recommendations. This article discusses the integration of these systems in a comprehensive information security strategy and provides tips for maximizing data protection in today’s digital world.

SecurityCloak: Protection against cache timing and speculative memory access attacks

Microarchitectural innovations such as deep cache hierarchies, out-of-order execution, branch prediction and speculative execution in modern processors have made possible to meet ever-increasing demands for performance. However, these innovations have inadvertently introduced vulnerabilities that are exploited by cache-side channel attacks such as Flush & Reload, Prime & Probe, Evict & Time, and attacks such as Spectre and Meltdown that exploit speculative executions. These attacks can potentially leak information which should be secured.Mitigating the attacks while preserving the performance of out-of-order execution has been a challenge. Previous hardware mitigation techniques against cache timing or side-channel attacks include complex cache indexing mechanisms, encrypting addresses, partitioning cache memories, assigning specific ways of a set for each process, or obfuscating cache accesses by using ghost threads. Previous techniques for preventing or at least mitigating attacks based on speculative executions include hiding speculative data accesses using separate buffers or caches, or undoing the effects of speculation throughout program execution. Most techniques address either attacks that exploit speculation such as Spectre or cache side-channel attacks but not both. In many cases, changes to the microarchitecture with additional hardware are needed to implement the security protection. In some cases the mitigations cause performance penalties. In contrast we present very simple designs aimed at preventing both timing based cache side-channel attacks and Spectre style attacks based on speculative executions. Our approach combines obfuscation of cache timing making it more difficult for side-channel attacks to succeed and delaying speculative data accesses that miss in cache until the speculation is resolved. We will show that these approaches prevent both timing attacks such as Flush & Reload, Prime & Probe, Evict & Time as well as speculative attacks such as Spectre. Our technique requires very minimal changes to hardware.

RRIoT: Recurrent reinforcement learning for cyber threat detection on IoT devices

To address the recent worldwide proliferation of cybersecurity attacks across computing systems, especially internet-of-things devices, new robust and automated methods are needed to detect and mitigate the attacks in real time, ensuring the confidentiality, integrity, and availability of systems. Machine Learning (ML) techniques have shown promise in detecting some types of attacks. However, they are not universally successful in detecting sequential attacks. In this study, we propose RRIoT, to mitigate this issue. RRIoT applies a Deep Deterministic Policy Gradient reinforcement learning (RL) algorithm in conjunction with an LSTM layer within an adversarial environment to detect and identify attacks. We evaluate our method against novel and state-of-the-art ML/RL algorithms which build upon previous RL algorithms such as deep Q-networks (DQN), dueling deep Q-networks (DDQN), and deep deterministic policy gradient (DDPG). Our results indicate that our proposed RRIoT generally performs better than existing ML algorithms and performs as well as or better than novel RL algorithms with new network architectures. We leverage Shapley Additive Global Importance (SAGE) to provide additional insight into which features contribute most to a model's performance and verify feature importance through the implementation of an ablation study across three IoT telemetry datasets.

Probing RSA's weak spots: Dissecting timing attacks and Euclidean method exploitations

The RSA encryption system, a cornerstone of numerous cryptographic frameworks, has long enjoyed a reputation for robustness. However, its strength is inherently tethered to the meticulous selection and management of its foundational prime numbers, p and q. This study delves into a nuanced vulnerability that surfaces when p and q assume particularly large values. Within this context, we illuminate how the Euclidean method can be weaponized to swiftly decipher RSA-encrypted messages, unveiling the original plaintext with surprising efficiency. Intriguingly, our analysis also uncovers that harnessing parallel computation for the Euclidean method expedites decryption exponentially, accentuating this vulnerability. Such revelations cast a spotlight on a delicate balancing act between computational prowess and cryptographic fortitude. The insights gleaned from our research emphasize the paramount importance of judicious prime selection in the RSA framework. They also caution about the unforeseen pitfalls that might lurk behind algorithmic enhancements in cryptographic contexts. Through this investigation, we aspire to catalyse a critical re-evaluation of RSA's real-world deployments and champion a more circumspect, continually adaptive approach to designing cryptographic systems.

Model exploration of grid adjustment and restoration strategy based on intelligent decision system

In the present scenario, Distributed Energy Resources (DERs) are included into power grid distribution networks to withstand power outages. Restoration is a smart and efficient method for self-healing systems to maintain functionality and re-configure themselves in response to outside breakdowns or attacks. Intelligent decision making framework is required for ensuring that the system as a whole survives external breakdowns and attacks by autonomously reconfiguring itself. Further, the power grid faces serious security concerns, network congestion delay, and packet loss due to improper grid adjustments. As a result, in this research Edge computing assisted Intelligent Decision Model (EC-IDM) has been proposed to address the issue of breakdowns and attacks in real time. The emergence of edge computing has substantially improved the smart grid's ability to operate effectively and communicate effectively by reducing the effects of security concerns, packet loss, latency, and overloaded networks. The integration Smart Grid's peripheral index (SSGPI) optimizes the system's performance and operating efficiency. This research presents a real-time EC-IDM for fixing the electricity grid that can automatically develop the restoration plan and identify the blackout scenario. For restoration choices across several time-and-space axes in EC-IDM, an improved hierarchical coordination technique and a local object optimization method are integrated to optimize breakdowns and attacks in real time. EC-IDM utilizes Smart grid self-healing using distributed automation (DA) to address issues of dependability and reliability of power. The simulation results demonstrates that the suggested approach achieves best in security concerns, optimizes network congestion delay, and packet loss security, improves efficiency and performance compared to the other conventional methods.

Wasm-Mutate: Fast and effective binary diversification for WebAssembly

WebAssembly is the fourth officially endorsed Web language. It is recognized because of its efficiency and design, focused on security. Yet, its swiftly expanding ecosystem lacks robust software diversification systems. We introduce Wasm-Mutate, a diversification engine specifically designed for WebAssembly. Our engine meets several essential criteria: 1) To quickly generate functionally identical, yet behaviorally diverse, WebAssembly variants, 2) To be universally applicable to any WebAssembly program, irrespective of the source programming language, and 3) Generated variants should counter side-channels. By leveraging an e-graph data structure, Wasm-Mutate is implemented to meet both speed and efficacy. We evaluate Wasm-Mutate by conducting experiments on 404 programs, which include real-world applications. Our results highlight that Wasm-Mutate can produce tens of thousands of unique and efficient WebAssembly variants within minutes. Significantly, Wasm-Mutate can safeguard WebAssembly binaries against timing side-channel attacks, especially those of the Spectre type.

RSPP: Restricted Static Pseudo-Partitioning for Mitigation of Cross-Core Covert Channel Attacks

Cache timing channel attacks exploit the inherent properties of cache memories: hit and miss time along with the shared nature of the cache to leak secret information. The side channel and covert channel are the two well-known cache timing channel attacks. In this article, we propose Restricted Static Pseudo-Partitioning (RSPP), an effective partition-based mitigation mechanism that restricts the cache access of only the adversaries involved in the attack. It has an insignificant impact of only 1% in performance, as the benign processes have access to the full cache and restrictions are limited only to the suspicious processes and cache sets. It can be implemented with a maximum storage overhead of 1.45% of the total Last-Level Cache (LLC) size. This article presents three variations of the proposed attack mitigation mechanism: RSPP, simplified-RSPP (S-RSPP) and corewise-RSPP (C-RSPP) with different hardware overheads. A full system simulator is used for evaluating the performance impact of RSPP. A detailed experimental analysis with different LLC and attack parameters is also discussed. RSPP is also compared with the existing defense mechanisms effective against cross-core covert channel attacks.