Attack Trends Research Articles

A comprehensive survey on DDoS defense systems: New trends and challenges

In the past ten years, the source of DDoS has migrated to botnets composed of IoT devices. The scale of DDoS attacks increases dramatically with the number of IoT devices.New variants of DDoS attacks using different system vulnerabilities emerge in an endless stream. In response to this situation, researchers have made significant contributions to the field of DDoS defense by applying modern programmable network technology and network-level resource scheduling management technology. However, the existing review articles need more research on these technologies. After investigating the development trend of DDoS attacks in recent years and the new challenges caused by them, this paper classifies the new technologies that have emerged in the field of DDoS defense in the past ten years. Among them, the collaboration between domains and inter-domain resource scheduling is one of the critical challenges in designing a large-scale distributed DDoS cooperative defense system. In addition, modern programmable network technology has dramatically expanded network systems’ functional diversity and deployment flexibility. We will discuss building a defense system based on programmable networks and focus on SOTA defense solutions based on programmable switches. Finally, developing DDoS defense mechanisms with broad-spectrum detection capabilities, robustness against adversarial attacks, and cost-effective and collaborative DDoS defense mechanisms for establishing the Internet are future research directions in network security.

A holistic and proactive approach to forecasting cyber threats

Traditionally, cyber-attack detection relies on reactive, assistive techniques, where pattern-matching algorithms help human experts to scan system logs and network traffic for known virus or malware signatures. Recent research has introduced effective Machine Learning (ML) models for cyber-attack detection, promising to automate the task of detecting, tracking and blocking malware and intruders. Much less effort has been devoted to cyber-attack prediction, especially beyond the short-term time scale of hours and days. Approaches that can forecast attacks likely to happen in the longer term are desirable, as this gives defenders more time to develop and share defensive actions and tools. Today, long-term predictions of attack waves are mostly based on the subjective perceptiveness of experienced human experts, which can be impaired by the scarcity of cyber-security expertise. This paper introduces a novel ML-based approach that leverages unstructured big data and logs to forecast the trend of cyber-attacks at a large scale, years in advance. To this end, we put forward a framework that utilises a monthly dataset of major cyber incidents in 36 countries over the past 11 years, with new features extracted from three major categories of big data sources, namely the scientific research literature, news, blogs, and tweets. Our framework not only identifies future attack trends in an automated fashion, but also generates a threat cycle that drills down into five key phases that constitute the life cycle of all 42 known cyber threats.

Attention-based spatial–temporal multi-graph convolutional networks for casualty prediction of terrorist attacks

At present, terrorism has become an important factor affecting world peace and development. As the time series data of terrorist attacks usually show a high degree of spatial–temporal correlation, the spatial–temporal prediction of casualties in terrorist attacks is still a significant challenge in the field of counter-terrorism. Most of the existing terrorist attack prediction methods lack the ability to model the spatial–temporal dynamic correlation of the time series data of terrorist attacks, so they cannot yield satisfactory prediction results. In this paper, we propose a novel Attention-based spatial–temporal multi-graph convolutional network (AST-MGCN) for casualty prediction of terrorist attacks. Specifically, we construct the spatial adjacency graph and spatial diffusion graph based on the different social-spatial dynamic relationships of terrorist attacks and determine the multi-scale period of time series data of terrorist attacks by using wavelet transform to model the temporal trend, period and closeness properties of terrorist attacks. The AST-MGCN mainly consists of spatial multi-graph convolution for extracting social-spatial features in multi-views and temporal convolution for capturing the transition rules. In addition, we also use the spatial–temporal attention mechanism to effectively capture the most relevant spatial–temporal dynamic information. Experiments on public datasets demonstrate that the proposed model outperforms the state-of-the-art baselines.

Hybrid H-DOC: A bait for analyzing cyber attacker behavior

Cyber security is a vital concern for companies with internet-based cloud networks. These networks are constantly vulnerable to attack, whether from inside or outside organization. Due to the ever-changing nature of the cyber world, security solutions must be updated regularly in order to keep infrastructure secure. With the use of attack detection approaches, security systems such as antivirus, firewalls, or intrusion detection systems have become more effective. However, conventional systems are unable to detect zero-day attacks or behavioral changes. These drawbacks can be overcome by setting up a honeypot. In this paper, a hybrid Honeynet model deployed in Docker (H-DOC) bait has been proposed that comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services. It focuses only on the SSH protocol, as it is widely used for remote system access and is a popular target of attacks. The proposed Hybrid H-DOC method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The attack detection accuracy of the proposed Hybrid H-DOC method when compared with IDH, Decepti-SCADA, AS-IDS and HDCM is 13.97%, 11.82%, 8.60% and 5.07% respectively.

Terrorism Threats and Rising Bullion Van Robbery Attacks in Ghana

Bullion van robbery attacks have emerged as a significant security threat in Ghana in recent years. They pose grave consequences for national security and social, political, and economic stability. This paper provides an overview of Ghana’s rising bullion van robbery attacks. In the paper, realism theory is used to portray the rate of bullion van robberies and their daringness. The subsequent analysis illuminates the factors contributing to the rise of these attacks, including the current economic downturn, socioeconomic problems, and corruption complicity. It explores the potential involvement of organised crime syndicates. The paper recommends a multifaceted approach involving enhanced collaboration between security agencies. It also involves stringent regulation and oversight of cash transportation, technological innovations in security systems, and improved training for law enforcement personnel. Additionally, it emphasises the importance of public awareness campaigns and citizen engagement to foster a collective response to combat bullion van robberies. The paper concludes that the rising trend of bullion van robbery attacks in Ghana requires immediate attention from both the government and the private sector. A comprehensive strategy encompassing preventative measures, swift response mechanisms, and robust law enforcement efforts is imperative to mitigate the risks posed by these attacks. This will safeguard the nation's security and socioeconomic stability.

A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms

A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms

H-DOCTOR: Honeypot based firewall tuning for attack prevention

A honeypot is a well-known entrapment technique used by network and Internet of Things (IoT) security professionals to lure intruders. Unlike traditional security measures, they can capture information in real time from the attacker about how they are attacking. A network firewall protects Internet servers from unwanted and malicious traffic. Detecting ransomware with existing security systems such as IDPS (Intrusion Detection and Protection System) and AV (Antivirus) is difficult and time-consuming. In this paper, a novel hybrid Honeynet deployed in Docker for detecting attacker behavior with Tuning Of fiRewall (H-DOCTOR) has been proposed. The proposed H-DOCTOR technique comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services and tune the firewall. The proposed H-DOCTOR method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The proposed H-DOCTOR framework is compared with existing methods such as HyInt,IDS and honeypot-based IDS. The proposed system achieves higher accuracy of 86% and the existing system such as HyInt,IDS and honeypot-based IDS achieves 73.25%, 76.75% and 81.25%.

Dynamic Event-Triggered Output Feedback Control for Load Frequency Control in Power Systems With Multiple Cyber Attacks

This article presents a novel dynamic event-triggered scheme for the load frequency regulation with periodic denial-of-service (DoS) attacks and deception attacks via decentralized output-based control algorithm. Compared with the existing event-triggered strategy, the proposed one automatically changes the parameters of the triggered condition by detecting the frequency trend of the DoS attack to change the release frequency, which can ensure the stability of the power system while increasing the probability of effective transmission subject to DoS attack and thus, reducing network bandwidth usage. First, the proposed dynamic event-triggered strategy combined with the decentralized output-based controller is presented in a unified framework to deal with deception attacks and DoS attacks in the multiarea power system. Then, we utilize the Lyapunov stability theory to analyze the exponential stability in the mean-square sense and the robustness of the power system. By solving a set of linear matrix inequalities (LMIs), a procedure is given for the design of output-based load frequency controllers. Finally, a three-area power system is exploited as a simulation to verify the effectiveness of the proposed results.

Negative human–crocodile interactions in Kariba, Zimbabwe: data to support potential mitigation strategies

AbstractInteractions between people and wild animals often result in negative impacts, and different views on the management of such interactions can lead to conflicts. Both intentional and unintentional negative human–wildlife interactions are increasing problems in many places where people share space with wild animals. Here we focus on negative interactions between people and Nile crocodiles Crocodylus niloticus in and around Lake Kariba in Zimbabwe. In the study area, crocodile attacks on people occur frequently, leading to people being injured or killed, which in turn prompts retaliatory actions against crocodiles. However, despite the negative impact of such interactions on both people and crocodiles, little is known about the spatio-temporal patterns of crocodile attacks or environmental conditions under which attacks occur. We collected information about crocodile attacks on people that occurred during 2000–2020, including the date, time, season and location of attacks, the age of victims and the activities they were carrying out when attacks occurred, and water conditions during attacks. We analysed these data to discern patterns and trends of crocodile attacks on people. Attacks occurred in clear as well as turbid water, and nearly half of all reported attacks were at night or in the early morning. The locations with the highest number of recorded attacks were Nyanyana and Charara lakeside, and the fewest attacks occurred at Andora harbour. Most victims were 26–40 years old, and most were attacked in the dry-hot season, while they were fishing. Our findings can be used to design area-specific mitigation strategies to reduce negative human–crocodile interactions.

New approach for APT malware detection on the workstation based on process profile

The Advanced Persistent Threat (APT) attack is a form of dangerous, intentionally and clearly targeted attack. Currently, the APT attack trend is through the end-users and then escalating privileges in the system by spreading malware which is widely used by attackers. Therefore, the problem of early detection and warning of the APT attack malware on workstations is urgent. In this paper, we propose a new approach to APT malware detection on workstations based on the technique of analyzing and evaluating process profiles. The characteristics and principles of our proposed method are as follows: Firstly, processes are collected and aggregated into process profiles of APT malware; Secondly, these process profiles are used by Graph2Vec graph analysis algorithm to extract the characteristics of the process profile. Finally, in order to conclude about the sign of malicious APT, this paper proposes to use Long short-term memory (LSTM) and bidirectional LSTM (BiLSTM) algorithm. With the proposed approach in the paper, we have not only succeeded in building and synthesizing APT malware behavior on Workstations as a basis to improve the efficiency of predicting APT malware, but also have opened up a new approach to the task of synthesizing and analyzing anomalous behavior of malware.

Cyber attack awareness and prevention in network security

<span>This article aims to provide an overview of cyber attack awareness and prevention in network security. This article discussed the different types of cyber attacks, current trends of cyber attacks, how to prevent cyber attacks and uum students' awareness of cyber attacks. First, we will go over the different types of cyber attack, current trend, impact of cyber attack and the prevention. The approach entailed comparing and observing the outcomes of 13 different papers. The survey's findings would demonstrate the results obtained after analyzing the data collection which are the questionnaire filled out by respondents after watching the cyber attack awareness video to improve awareness of students through the cyber attack. Depending on the outcome of this survey, we will have a better understanding of current students' knowledge and awareness of cyber attacks, allowing us to improve students' understanding of cyber threats and the necessity of cyber security.</span>

Machine Learning Intrusion Detection as a Solution to Security and Privacy Issues in IoT: A Systematic Review

Billions of IoT devices are in use worldwide and generate a humongous amount of data for the IoT system. This continuous stream of data is open to attack during its collection, transportation, processing, dissemination and storage cycle. Also, IoT devices themselves are points of system vulnerability through which the system can be attacked. Machine learning (ML), due to its ability to identify inherent patterns and behaviour in data, has been applied by many researchers to IoT data such that strange patterns or intrusions into IoT systems can be speedily detected and real-time decisions on security and privacy (S&P) protection implemented in a timely manner. Different ML techniques with their different algorithms have provided solutions in various scenarios such that security and privacy requirements for the IoT system can be met. In particular, ML has been successfully applied in intrusion detection and has been shown to perform better than traditional means in flagging new trends of attacks. This paper presents a systematic literature review on ML intrusion detection in IoT. Academic journals from 2011 to 2021 from two databases (IEEE and Proquest) were explored using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework. A review of the final selected papers revealed that data preprocessing, feature extraction, model training and deployment of ML-based Intrusion Detection Systems (IDS) increase computational complexity resulting in greater resource requirement (CPU, memory, and energy); enable ML to be used in the execution of adversarial attacks on IoT devices and networks; require trade-offs between detection accuracy and false-positive events; and highlight the superior performance of deep learning methods over traditional ML ones in anomaly detection. Generally, the changing nature of attacks makes it difficult for any particular IDS to be able to detect all attack types thus making the development of IDS a continuing project.

Development of Cyber Weapons to Improve Indonesia's Cyber Security

It is indisputable that technical advancements have an impact on a country's military capability and security. This is inextricably linked to the deployment of numerous technologies and new discoveries aimed at boosting the military's defense system. As a result of this predicament, all governments are attempting to modernize their defense systems in order to deal with dangers posed by technological advancements. This is both a challenge and an opportunity for Indonesia's existing defense system. The goal of this study is to look into the development of cyber weapons and how they may help Indonesia improve its cyber security. The purpose of this study is to utilize a descriptive qualitative technique to investigate or explain the concerns surrounding the importance of cyber weapons in strengthening cyber security in Indonesia. The conclusions of this study show that as the number of Internet users grows, so does the global trend of cyber attacks. It's difficult to compare precision cyberweapons systems to existing kinetic weapons because of their new nature. Additionally, the development and use of cyber weapons can yield economic rewards. Human resources, as well as support and cooperation from Indonesian cyber defense groups with professionals in the field of hacking, are all crucial variables to consider while designing cyber weapons.

Environmental and Personal Factors Related to Asthma Severity among Children: Hospital Based Study, Egypt

Background: Childhood asthma is a complex disorder in which many environmental and personal factors play a role. However, the contribution of these factors to asthma severity is poorly understood. This study aims to determine the relationship between environmental exposures, personal factors and asthma severity among asthmatic children.
 Methods: This cross-sectional hospital based study was conducted on 180 asthmatic children; they were divided into mild, moderate and severe asthma according to forced expiratory volume in first second. Environmental factors (indoor and outdoor), food allergy, history of other allergic diseases, family history of allergic disorders, time trend of attacks as well as asthma outcome were reported.
 Results: Children with severe asthma were younger than those with mild or moderate asthma. Severe asthma was significantly linked to family history of allergy, presence of co-morbid allergic diseases, fish, egg and milk allergy, as well as exposure to passive smoking (73.7%) and poor housing conditions. Also, it was significantly linked to presence of unauthorized factories in residential area (31.6 %, p=0.001). As well as, contact with pets (42.1%). Children with severe asthma had more limitations of physical activities (73.7%), missed school days (81.5%), with poor school performance (p=0.04) than those with mild moderate or asthma.
 Conclusion: Severe asthma was linked to female gender and younger age, co-morbid allergic diseases, family history of atopy and food allergy. It was higher among children residing in places with unauthorized factories and living in substandard housing condition. Children with severe asthma had poor asthma outcome.

Analysis on the Evolution Trend of Network Attacks during COVID-19 Epidemic

Analysis on the Evolution Trend of Network Attacks during COVID-19 Epidemic

An integrated cyber security risk management framework and risk predication for the critical infrastructure protection

Cyber security risk management plays an important role for today’s businesses due to the rapidly changing threat landscape and the existence of evolving sophisticated cyber attacks. It is necessary for organisations, of any size, but in particular those that are associated with a critical infrastructure, to understand the risks, so that suitable controls can be taken for the overall business continuity and critical service delivery. There are a number of works that aim to develop systematic processes for risk assessment and management. However, the existing works have limited input from threat intelligence properties and evolving attack trends, resulting in limited contextual information related to cyber security risks. This creates a challenge, especially in the context of critical infrastructures, since attacks have evolved from technical to socio-technical and protecting against them requires such contextual information. This research proposes a novel integrated cyber security risk management (i-CSRM) framework that responds to that challenge by supporting systematic identification of critical assets through the use of a decision support mechanism built on fuzzy set theory, by predicting risk types through machine learning techniques, and by assessing the effectiveness of existing controls. The framework is composed of a language, a process, and it is supported by an automated tool. The paper also reports on the evaluation of our work to a real case study of a critical infrastructure. The results reveal that using the fuzzy set theory in assessing assets' criticality, our work supports stakeholders towards an effective risk management by assessing each asset's criticality. Furthermore, the results have demonstrated the machine learning classifiers’ exemplary performance to predict different risk types including denial of service, cyber espionage and crimeware.

Image Processing Based Approach for False Data Injection Attacks Detection in Power Systems

With more sensors being installed by utilities for accurate control of power grids, there is a growing risk of vulnerability to sophisticated data integrity attacks such as false data injection (FDI), circumventing current bad data detection schemes resulting in inaccurate state estimation solutions. While diverse automated detectors to battle FDI have been grown, such methodologies underestimate the strong analytical abilities of humans. This is while most proposed automated methods need observant human control. Although automated methods provide opportunities to improve scalability, humans can cope with exceptions and new attack trends. In this paper, to address the ever-increasing cyber-attack challenge in power systems, a visualization based attack detection framework using deep learning techniques is developed to provide human security researchers with improved techniques to uncover trends, identify outliers, recognize correlations, and communicate their results. Specifically, we first encode multivariate systems state time-series data into 2D colored images and then utilize a carefully designed deep convolutional neural network (CNN) classifier. The proposed method is developed to allow network operators to immediately capture and visually understand the statistical features of a network attack at a glance. The proposed method has been evaluated on the IEEE 14-bus and IEEE 118-bus systems. Our experiments show that the proposed framework accomplishes high classification accuracy.

An analysis of tomistoma (

Context Increasing human–crocodile conflict (HCC) is a major conservation and management issue. Although three species are responsible for most attacks, on occasion, some slender-snouted species, such as tomistoma (Tomistoma schlegelii), are also implicated. Aims To analyse reports of confirmed and suspected attacks on humans by tomistoma and explore potential causes and solutions. Methods Reports of attacks were collected for the CrocBITE project from January 2010 to December 2019, utilising media reports and communication with local authorities. Attack trends, including outcome, victim demographics and activities, geographic location, and other details were analysed. Key results We recorded 31 attacks, including 10 deaths, where the culprit species was confirmed or strongly suspected to be a tomistoma. The Jambi province of Sumatra was the site of most attacks and most victims were male and fishing at the time. In addition, most attacks were reported during the 3-year period from 2016 to 2018. Conclusions On rare occasions, tomistoma prey upon humans. Certain anthropogenic factors may be altering tomistoma behaviour and contributing to increased conflict. Implications Tomistoma were recently up listed from Vulnerable to Endangered on the IUCN Red List and this conflict is yet another threat facing the species, alongside the destruction habitat.

Spatio-Temporal Analysis of Boko Haram Attacks and its Effects on Education in Northern Nigeria (2009-2020)

The persistent attacks from Boko Haram have been issues of concern to the Nigerian government and its citizens. The study assessed spatio-temporal pattern of attacks by Boko-Haram insurgents and its effects on education in the Northern Region of Nigeria between 2009 and 2020 with specific objectives of ascertaining the pattern of the attacks, and appraising the trend of attacks’ fatalities over time, and reviewing the effects of the attacks on education. The study covered all three geopolitical zones (19 States with FCT) in the Northern Region of Nigeria. Data on Boko-Haram attacks were obtained from the Armed Conflict Location and Event Data Project (ACLED) database. Nearest Neighbourhood Analysis and Geographically Weighted Regression on ArcGIS 10.8 were analytical techniques adopted in this study. Results with a negative Z-value of -88.62 indicated the clustered pattern of Boko-Haram at an observed mean distance of 1213 metres from one attack to another. There were 28 792 reported fatalities due to Boko-Haram attacks from 2009 and 2020. Boko Haram has affected the education system of the Northern Region of Nigeria through attacks and abduction of students. The study revealed that geospatial technology has the potential to analyse and monitor insecurity issues, and it is thus recommended that geospatial technology need to be integrated into security surveillance and operation to curb the challenges of insecurity on education, not only in the northern region but the entire space of Nigeria, so that Sustainable Development Goal Four (quality education for all) can be achieved.

A review of cyber security attack trends in Kenya

The COVID 19 pandemic led to a situation where Kenyan institutions were forced to embrace remote learning, remote working and e-commerce services. These basically led to an upsurge in financial cyber activity and with it came an upsurge in cybercrime. This paper conducted a review of available secondary data on cyber attacks in Kenya with the aim of identifying the most popular trends embraced by attackers while perpetrating cyber-attacks on financial institutions and their clients. The paper was also able to obtain a ranking of the most popular trends associated with attacks within the Kenyan cyber space. Keywords: Cybersecurity, cyber-attacks, cybercrime, malware, phishing DOI: 10.7176/JIEA/11-2-09 Publication date: November 30 th 2021