Types Of Attacks Research Articles

A Novel Anomaly Intrusion Detection Method based on RNA Encoding and ResNet50 Model

Cybersecurity refers to the actions that are used by people and companies to protect themselves and their information from cyber threats. Different security methods have been proposed for detecting network abnormal behavior, but some effective attacks are still a major concern in the computer community. Many security gaps, like Denial of Service, spam, phishing, and other types of attacks, are reported daily, and the attack numbers are growing. Intrusion detection is a security protection method that is used to detect and report any abnormal traffic automatically that may affect network security, such as internal attacks, external attacks, and maloperations. This paper proposed an anomaly intrusion detection system method based on a new RNA encoding method and ResNet50 Model, where the encoding is done by splitting the training records into different groups. These groups are protocol, service, flag, and digit, and each group is represented by the number of RNA characters that can represent the group's values. The RNA encoding phase converts network traffic records into RNA sequences, allowing for a comprehensive representation of the dataset. The detection model, utilizing the ResNet architecture, effectively tackles training challenges and achieves high detection rates for different attack types. The KDD-Cup99 Dataset is used for both training and testing. The testing dataset includes new attacks that do not appear in the training dataset, which means the system can detect new attacks in the future. The efficiency of the suggested anomaly intrusion detection system is done by calculating the detection rate (DR), false alarm rate (FAR), and accuracy. The achieved DR, FAR, and accuracy are equal to 96.24%, 6.133%, and 95.99%. The experimental results exhibit that the RNA encoding method can improve intrusion detection.

A secure image steganography based on LSB technique and 2D chaotic maps

This paper introduces a pioneering, effective data-hiding algorithm using different sizes of cover images and different types of secret data (image, txt, and audio). The proposed algorithm is based on a hybrid 1D chaotic map combined with a 2D composite chaotic map paired with optimization and Least Significant Bits (LSB) techniques. We employ chaotic maps to create the initial embedding position vector, and LSB to hide the secret message in the cover image. The optimization technique utilizes the chaotic maps to optimize the random embedding sites, looking for value matches between the cover image pixels and the secret data bits. This partial improvement leads to a high-quality stego-image, a large embedding capacity, imperceptibility to the human eye, undetectability, and enhanced security. The outcomes of the extensive experiments show that when the payload is 4.2 bits per pixel, the peak signal-to-noise ratio value (PSNR), which expresses the visual quality, is above 30 dB. Furthermore, the experimental results illustrate that the system exhibits robustness against various types of attacks. As a final point of strength, the large key space (2^206) prevents the secret data from being resolved if stego-images are accessed by intruders or third parties. Even minor changes in key bits can significantly alter the extracted secret data, resulting in entirely different secret data.

Detection of Cyber-Attacks in a Discrete Event System Based on Deep Learning

This paper addresses the problem of cyber-attack detection in a discrete event system by proposing a novel model. The model utilizes graph convolutional networks to extract spatial features from event sequences. Subsequently, it employs gated recurrent units to re-extract spatio-temporal features from these spatial features. The obtained spatio-temporal features are then fed into an attention model. This approach enables the model to learn the importance of different event sequences, ensuring that it is sufficiently general for identifying cyber-attacks, obviating the need to specify attack types. Compared with traditional methods that rely on synchronous product computations to synthesize diagnosers, our deep learning-based model circumvents state explosion problems. Our method facilitates real-time and efficient cyber-attack detection, eliminating the necessity to specifically identify system states or distinguish attack types, thereby significantly simplifying the diagnostic process. Additionally, we set an adjustable probability threshold to determine whether an event sequence has been compromised, allowing for customization to meet diverse requirements. Experimental results demonstrate that the proposed method performs well in cyber-attack detection, achieving over 99.9% accuracy at a 1% threshold and a weighted F1-score of 0.8126, validating its superior performance.

Cyber Security and Artificial Intelligence in Aviation

Airports are becoming increasingly interconnected and technologically advanced ecosystems. Airports handle sensitive data and depend on interconnected systems, which, while improving efficiency, also heighten vulnerability to cyber threats like data breaches and ransom ware. Additionally, with technological advancements artificial intelligence also plays a huge role, providing a new definition to cyber security in aviation. This paper examines the current state of cyber security in the aviation industry, implementation of artificial intelligence and how we can make the best use of technology, whilst focusing on the vulnerabilities and threats that accompany the adoption of advanced technologies such as Internet of Things (IoT) and Supervisory Control and Data Acquisition (SCADA) systems. The paper also explores the types of cyber attacks that can target smart airport systems, emphasising the need for robust cyber security measures to protect these critical infrastructures.

Efficient detection of intra/inter-frame video copy-move forgery: A hierarchical coarse-to-fine method

With a simple forgery technique but a realistic result, video copy-move forgery has currently become one of the most popular tampering manners. In the last couple of years, various new techniques deriving from machine intelligence and pattern recognition have been widely proposed for image forensics. However, it still faces a very challenging task in the field of video copy-move forgery for four reasons: i) Low F1 score and high false-alarm; ii) Lack of a synthesis processing framework; iii) Weak detection robustness and accuracy; iv) Low efficiency. A novel Hierarchical Coarse-to-Fine framework for effective video copy-move forgery detection is proposed to overcome these challenges: i) In the coarse forgery frame-pair matching, the coarse copy-move frame-pairs matching algorithm with the newly proposed two-pass filters can locate real forgery frame-pairs (FFP) and also reduce false-alarm. ii) Through further analysis of the actual FFP, the detection of intra-frame and inter-frame copy-move forgeries can be accurately and simultaneously determined. iii) In the fine keypoint-pairs matching, our newly designed two-hierarchical keypoint-pair filtering can accurately localize the forgery region at pixel level under various adverse conditions. iv) The novel Hierarchical Coarse-to-Fine framework (together with the newly designed algorithms above) considers only the real FFP and true keypoint-pairs for computation, resulting in higher efficiency and accuracy. Finally, Delaunay Triangulation-based region filling is employed to indicate the forgery regions. Compared to the latest methods, our algorithm has been tested extensively and found to be the best at detecting forgeries, with a top score of F1=0.77 and no false-alarms, even under different types of attacks, as validated by the well-known GRIP dataset.

DTL-5G: Deep transfer learning-based DDoS attack detection in 5G and beyond networks

Network slicing is considered as a key enabler for 5G and beyond mobile networks for supporting a variety of new services, including enhanced mobile broadband, ultra-reliable and low-latency communication, and massive connectivity, on the same physical infrastructure. However, this technology increases the susceptibility of networks to cyber threats, particularly Distributed Denial-of-Service (DDoS) attacks. These attacks have the potential to cause service quality degradation by overloading network function(s) that are central to network slices to operate seamlessly. This calls for an Intrusion Detection System (IDS) as a shield against a wide array of DDoS attacks. In this regard, one promising solution would be the use of Deep Learning (DL) models for detecting possible DDoS attacks, an approach that has already made its way into the field given its manifest effectiveness. However, one particular challenge with DL models is that they require large volumes of labeled data for efficient training, which are not readily available in operational networks. A possible workaround is to resort to Transfer Learning (TL) approaches that can utilize the knowledge learned from prior training to a target domain with limited labeled data. This paper investigates how Deep Transfer Learning (DTL) based approaches can improve the detection of DDoS attacks in 5G networks by leveraging DL models, such as Bidirectional Long Short-Term Memory (BiLSTM), Convolutional Neural Network (CNN), Residual Network (ResNet), and Inception as base models. A comprehensive dataset generated in our 5G network slicing testbed serves as the source dataset for DTL, which includes both benign and different types of DDoS attack traffic. After learning features, patterns, and representations from the source dataset using initial training, we fine-tune base models using a variety of TL processes on a target DDoS attack dataset. The 5G-NIDD dataset, which has a sparse amount of annotated traffic pertaining to several DDoS attack generated in a real 5G network, is chosen as the target dataset. The results show that the proposed DTL models have performance improvements in detecting different types of DDoS attacks in 5G-NIDD dataset compared to the case when no TL is applied. According to the results, the BiLSTM and Inception models being identified as the top-performing models. BiLSTM indicates an improvement of 13.90%, 21.48%, and 12.22% in terms of accuracy, recall, and F1-score, respectively, whereas, Inception demonstrates an enhancement of 10.09% in terms of precision, compared to the models that do not adopt TL.

Byzantine-robust Federated Learning via Cosine Similarity Aggregation

Federated Learning (FL) is proposed to train a machine learning model for clients with different training data. During the training of FL, a centralized server is usually employed to aggregate local models from clients iteratively. The aggregation process suffers from Byzantine attacks, where clients’ models could be maliciously modified by attackers to degrade the training performance. Existing defense aggregation solutions use distances or angles between different gradients to identify and eliminate malicious models from clients. However, they do not work well due to the high dimensional property of the machine learning model. Distance-based solutions cannot effectively identify attackers when the gradient direction of the model is maliciously tampered with. Angle-based solutions face the issue of low model accuracy for large models. In this paper, we propose Convolutional Kernel Angle-based Defense Aggregation (CKADA) to improve defense performance under various Byzantine attacks. The key of CKADA is to use the angle between convolutional kernels as the attack detection metric because the obtuse angle indicates the wrong training direction. CKADA calculates the angle between a client’s convolutional kernel gradients and the server’s convolutional kernel gradients as the attacker detection metric and eliminates convolutional kernel gradients of clients that create an obtuse angle to mitigate the impact of attackers on the model. We evaluate the performance of CKADA using AlexNet, ResNet-50, and GoogLeNet under two typical attacks. Simulation results show that CKADA mitigates the impact of Byzantine attacks and outperforms existing angle-based solutions and distance-based solutions by improving inference accuracy up to 67% and 89% respectively.

Are You the Outlier? Identifying Targets for Privacy Attacks on Health Datasets.

The identification of vulnerable records (targets) is an important step for many privacy attacks on protected health data. We implemented and evaluated three outlier metrics for detecting potential targets. Next, we assessed differences and similarities between the top-k targets suggested by the different methods and studied how susceptible those targets are to membership inference attacks on synthetic data. Our results suggest that there is no one-size-fits-all approach and that target selection methods should be chosen based on the type of attack that is to be performed.

Building an intrusion detection system on UNSW‐NB15: Reducing the margin of error to deal with data overlap and imbalance

SummaryThis study addresses the challenge of data imbalance and class overlap in machine learning for intrusion detection, proposing that targeted algorithmic adjustments can significantly enhance model performance. Our hypothesis contends that an ensemble framework, adeptly integrating novel threshold‐adjustment algorithms, can improve classification sensitivity and specificity. To test this, we developed an ensemble model comprising Balanced Bagging (BB), eXtreme Gradient Boosting (XGBoost), and Random Forest (RF), fine‐tuned using grid search for BB and XGBoost, and augmented with the Hellinger metric for RF to tackle data imbalance. The innovation lies in our algorithms, which adeptly adjust the discrimination threshold to rectify the class overlap problem, enhancing the model's ability to discern between negative and positive classes. Utilizing the UNSW‐NB15 dataset, we conducted a comparative analysis for binary and multi‐category classification. Our ensemble model achieved a binary classification accuracy of 97.80%, with a sensitivity rate of 98.26% for detecting attacks, and a multi‐category classification accuracy and sensitivity that reached up to 99.73% and 97.24% for certain attack types. These results substantially surpass those of existing models on the same dataset, affirming our model's superiority in dealing with complex data distributions prevalent in network security domains.

ShouldAR: Detecting Shoulder Surfing Attacks Using Multimodal Eye Tracking and Augmented Reality

Shoulder surfing attacks (SSAs) are a type of observation attack designed to illicitly gather sensitive data from "over the shoulder" of victims. This attack can be directed at mobile devices, desktop screens, Personal Identification Number (PIN) pads at an Automated Teller Machine (ATM), or written text. Existing solutions are generally focused on authentication techniques (e.g., logins) and are limited to specific attack scenarios (e.g., mobile devices or PIN Pads). We present ShotjldAR, a mobile and usable system to detect SSAs using multimodal eye gaze information (i.e., from both the potential attacker and victim). ShouldAR uses an augmented reality headset as a platform to incorporate user eye gaze tracking, rear-facing image collection and eye gaze analysis, and user notification of potential attacks. In a 24-participant study, we show that the prototype is capable of detecting 87.28% of SSAs against both physical and digital targets, a two-fold improvement on the baseline solution using a rear-facing mirror, a widely used solution to the SSA problem. The ShouldAR approach provides an AR-based, active SSA defense that applies to both digital and physical information entry in sensitive environments.

Face privacy protection scheme by security-enhanced encryption structure and nonlinear dynamics

This article proposes a secure communication enhancement scheme based on face detection and chaotic partition permutation. The scheme uses edge detection technology to detect facial information, which is then used as an encryption object. The hash value of the plaintext image is extracted as the secret key to the chaotic sequence generated by the chaotic system. Then a series of encryption operations are performed on the face image to obtain the final ciphertext image. In this article, two chaotic systems are used to generate pseudo-random chaotic sequences for different encryption steps. The initial key is computed by combining the hash function of the image and external parameters. The experimental results and security analysis show that the algorithm has excellent encryption effectiveness and security performance against various typical attacks.

EAIA: An Efficient and Anonymous Identity-Authentication Scheme in 5G-V2V.

Vehicle Ad-hoc Networks (VANETs) have experienced significant development in recent years, playing a crucial role in enhancing the driving experience by enabling safer and more efficient inter-vehicle interactions through information exchange. Vehicle-to-Vehicle (V2V) communication is particularly vital as it not only helps to prevent collisions and improve traffic efficiency but also provides essential situational awareness to drivers or autonomous driving systems. Communication is typically supported by roadside units (RSUs); however, in practical applications, vehicles may exceed the communication range of RSUs, thus exposing them to various malicious attacks. Additionally, considering the limited computational resources of onboard units (OBUs) in vehicles, there is a high demand for designing lightweight security protocols that support V2V communication. To address this issue, this paper proposes an efficient anonymous V2V identity-authentication protocol tailored for scenarios that lack RSU support. The proposed protocol was formally assessed using the Scyther tool, demonstrating its capability to withstand major typical malicious attacks. Performance evaluations indicate that the proposed protocol is efficient in terms of communication and computational overhead, making it a viable solution for V2V communication.

A Deniable Encryption Method for Modulation-Based DNA Storage.

Recent advancements in synthesis and sequencing techniques have made deoxyribonucleic acid (DNA) a promising alternative for next-generation digital storage. As it approaches practical application, ensuring the security of DNA-stored information has become a critical problem. Deniable encryption allows the decryption of different information from the same ciphertext, ensuring that the "plausible" fake information can be provided when users are coerced to reveal the real information. In this paper, we propose a deniable encryption method that uniquely leverages DNA noise channels. Specifically, true and fake messages are encrypted by two similar modulation carriers and subsequently obfuscated by inherent errors. Experiment results demonstrate that our method not only can conceal true information among fake ones indistinguishably, but also allow both the coercive adversary and the legitimate receiver to decrypt the intended information accurately. Further security analysis validates the resistance of our method against various typical attacks. Compared with conventional DNA cryptography methods based on complex biological operations, our method offers superior practicality and reliability, positioning it as an ideal solution for data encryption in future large-scale DNA storage applications.

SMPTC3: Secure Multi-Party Protocol Based Trusted Cross-Chain Contracts

We propose an innovative approach called SMPTC3, designed specifically to enhance security and privacy in cross-chain transaction verification. This approach addresses multi-chain, multi-participant information exchange and large-scale cross-chain transfers, resisting various types of malicious attacks. We leverage the verifiability of cross-chain transactions based on smart contracts and innovatively transform transaction information into confidential sets, organizing them into quadratic secret polynomials. By utilizing secret sharing and random distribution techniques, we construct a secure multiparty computation method, tailored for cross-chain transactions. To enhance the efficiency of cross-chain transactions, we introduce cross-chain batch processing technology, grouping inter-chain transactions into cross-chain transaction sets. Unlike traditional distributed notary technologies, SMPTC3 designates honest participants as a cross-chain notary group, reducing the time required for redundant signature confirmations and significantly lowering the possibility of malicious notaries. Theoretical analysis and empirical experiments demonstrate that SMPTC3 is highly efficient in addressing cross-chain transaction security issues.

Plasticine models confirm high predator pressure on surfaced earthworms in different ecosystems

Aboveground communities may strongly depend on the detrital subsidy, i.e. the release of energy and nutrients from the soil food webs. Earthworms predated by aboveground animals are seemingly among the most important links connecting belowground and aboveground food webs. Here, we conducted an experiment with plasticine models in alpine tundra, temperate, and monsoon tropical forests to estimate predator pressure on surfaced earthworms compared to aboveground prey (caterpillars). Earthworm models on the ground were attacked several times more often than caterpillar models on the plants. The attack rate was highest in the tropical forest; the most common types of attacks on earthworms were arthropod bites in both forests and mammal bites in tundra.

DNA dynamic coding image encryption algorithm with a meminductor chaotic system

With the acceleration of information technology development, the protection of information security becomes increasingly critical. Images, as extensively used multimedia tools, encounter serious challenges in safeguarding sensitive data, including personal privacy and business confidentiality. This research presents a novel algorithm for color image encryption, that combines a meminductor chaotic system and DNA encoding cross-coupling operations to enhance image security and effectively prevent unauthorized access and decryption. Initially, this paper designs an equivalent circuit model for the Meminductor and constructs the corresponding chaotic system, followed by an in-depth analysis of its nonlinear dynamic characteristics. Then, artificial neuron is employed to perturb the original chaotic sequence generated by the system, resulting in a highly random mixed sequence. The original image is then subjected to rearrangement and encoding through Arnold transformation and dynamic DNA encoding techniques. Additionally, this research introduces a DNA encoding cross-coupling operation method that operates at the block level of pixels to diffuse and confuse image data, enhancing the complexity of the image encryption algorithm. Finally, a dynamic decoding technique is employed to decode the encoded image, yielding the encrypted result. Experimental results show that the algorithm is capable of providing larger key space and higher complexity in image encryption applications, and is able to withstand various types of attacks.

Eye-Net: A Low-Complexity Distributed Denial of Service Attack-Detection System Based on Multilayer Perceptron

Distributed Denial of Service (DDoS) attacks disrupt service availability, leading to significant financial setbacks for individuals and businesses. This paper introduces Eye-Net, a deep learning-based system optimized for DDoS attack detection that combines feature selection, balancing methods, Multilayer Perceptron (MLP), and quantization-aware training (QAT) techniques. An Analysis of Variance (ANOVA) algorithm is initially applied to the dataset to identify the most distinctive features. Subsequently, the Synthetic Minority Oversampling Technique (SMOTE) balances the dataset by augmenting samples for under-represented classes. Two distinct MLP models are developed: one for the binary classification of flow packets as regular or DDoS traffic and another for identifying six specific DDoS attack types. We store MLP model weights at 8-bit precision by incorporating the quantization-aware training technique. This adjustment slashes memory use by a factor of four and reduces computational cost similarly, making Eye-Net suitable for Internet of Things (IoT) devices. Both models are rigorously trained and assessed using the CICDDoS2019 dataset. Test results reveal that Eye-Net excels, surpassing contemporary DDoS detection techniques in accuracy, recall, precision, and F1 Score. The multiclass model achieves an impressive accuracy of 96.47% with an error rate of 8.78%, while the binary model showcases an outstanding 99.99% accuracy, maintaining a negligible error rate of 0.02%.

An Intelligent Attack Detection Framework for the Internet of Autonomous Vehicles with Imbalanced Car Hacking Data

The modern Internet of Autonomous Vehicles (IoVs) has enabled the development of autonomous vehicles that can interact with each other and their surroundings, facilitating real-time data exchange and communication between vehicles, infrastructure, and the external environment. The lack of security procedures in vehicular networks and Controller Area Network (CAN) protocol leaves vehicles exposed to intrusions. One common attack type is the message injection attack, which inserts fake messages into original Electronic Control Units (ECUs) to trick them or create failures. Therefore, this paper tackles the pressing issue of cyber-attack detection in modern IoV systems, where the increasing connectivity of vehicles to the external world and each other creates a vast attack surface. The vulnerability of in-vehicle networks, particularly the CAN protocol, makes them susceptible to attacks such as message injection, which can have severe consequences. To address this, we propose an intelligent Intrusion detection system (IDS) to detect a wide range of threats utilizing machine learning techniques. However, a significant challenge lies in the inherent imbalance of car-hacking datasets, which can lead to misclassification of attack types. To overcome this, we employ various imbalanced pre-processing techniques, including NearMiss, Random over-sampling (ROS), and TomLinks, to pre-process and handle imbalanced data. Then, various Machine Learning (ML) techniques, including Logistic Regression (LR), Linear Discriminant Analysis (LDA), Naive Bayes (NB), and K-Nearest Neighbors (k-NN), are employed in detecting and predicting attack types on balanced data. We evaluate the performance and efficacy of these techniques using a comprehensive set of evaluation metrics, including accuracy, precision, F1_Score, and recall. This demonstrates how well the suggested IDS detects cyberattacks in external and intra-vehicle vehicular networks using unbalanced data on vehicle hacking. Using k-NN with various resampling techniques, the results show that the proposed system achieves 100% detection rates in testing on the Car-Hacking dataset in comparison with existing work, demonstrating the effectiveness of our approach in protecting modern vehicle systems from advanced threats.

Convolutional Neural Networks Based Detection System for Cyber-attacks in Industrial Control Systems

Convolutional Neural Networks (CNNs) have emerged as a powerful tool for various pattern recognition tasks, including the detection of cyber-attacks in Industrial Control Systems (ICS). This paper presents a CNN-based detection system specifically designed to safeguard ICS from sophisticated cyber threats. The proposed system leverages the capability of CNNs to automatically learn and extract high-level features from raw data, enabling it to identify anomalies indicative of cyber-attacks with high accuracy. Utilizing a comprehensive cyber-attack dataset containing 59 different types of attacks, the system is trained to distinguish between normal and malicious traffic effectively. Based on the extensive dataset, this study demonstrates that the CNN-based detection system achieves a detection rate of 98.5% and a false-positive rate of 1.2%, significantly outperforming traditional methods. The high detection rate indicates the system's ability to accurately identify a wide range of attack types, while the low false-positive rate ensures minimal disruption to normal operations due to incorrect alerts. These results underscore the system's robustness and reliability in identifying subtle and complex attack patterns. Moreover, the CNN-based system is designed to adapt to new types of attacks as it continues to learn from updated datasets, making it a scalable and future-proof solution. Implementing this system can significantly enhance the cybersecurity posture of industrial environments by providing real-time monitoring and rapid response capabilities. The CNN-based detection system offers a significant advancement in ICS cybersecurity. Effectively identifying and mitigating cyber-attacks contributes to the resilience and reliability of critical infrastructure. The proposed approach improves security measures and ensures industrial processes' continuous and safe operation, which is vital for economic stability and public safety.

An Empirical Study of Factors Influencing Drone Terrorist Attack Casualties

Recognizing the pivotal role of casualties as a metric for assessing the success of terrorist acts, this study endeavors to unravel the underlying factors shaping the casualty count in drone terrorist attacks across the globe. By applying Zero Negative Binomial Regression Analysis on data sourced from the Global Terrorism Database, we discern significant factors influencing the number of terrorist casualties. Our findings reveal the paramount importance of the target facility's significance, the attack type, the utilization of remote-controlled drones, the deployment of suicide drones equipped with explosive payloads, and the audacious strategy of swarming drone attacks.