Types Of Attacks Research Articles

Towards Unified Robustness Against Both Backdoor and Adversarial Attacks.

Deep Neural Networks (DNNs) are known to be vulnerable to both backdoor and adversarial attacks. In the literature, these two types of attacks are commonly treated as distinct robustness problems and solved separately, since they belong to training-time and inference-time attacks respectively. However, this paper revealed that there is an intriguing connection between them: (1) planting a backdoor into a model will significantly affect the model's adversarial examples and (2) for an infected model, its adversarial examples have similar features as the triggered images. Based on these observations, a novel Progressive Unified Defense (PUD) algorithm is proposed to defend against backdoor and adversarial attacks simultaneously. Specifically, our PUD has a progressive model purification scheme to jointly erase backdoors and enhance the model's adversarial robustness. At the early stage, the adversarial examples of infected models are utilized to erase backdoors. With the backdoor gradually erased, our model purification can naturally turn into a stage to boost the model's robustness against adversarial attacks. Besides, our PUD algorithm can effectively identify poisoned images, which allows the initial extra dataset not to be completely clean. Extensive experimental results show that, our discovered connection between backdoor and adversarial attacks is ubiquitous, no matter what type of backdoor attack. The proposed PUD outperforms the state-of-the-art backdoor defense, including the model repairing-based and data filtering-based methods. Besides, it also has the ability to compete with the most advanced adversarial defense methods. The code is available here.

Network intrusion detection in big datasets using Spark environment and incremental learning

<p class="Abstract">Internet of things (IoT) systems have experienced significant growth in data traffic, resulting in security and real-time processing issues. Intrusion detection systems (IDS) are currently an indispensable tool for self-protection against various attacks. However, IoT systems face serious challenges due to the functional diversity of attacks, resulting in detection methods with machine learning (ML) and limited static models generated by the linear discriminant analysis (LDA) algorithm. The process entails adjusting the model parameters in real time as new data arrives. This paper proposes a new method of an IDS based on the LDA algorithm with the incremental model. The model framework is trained and tested on the IoT intrusion dataset (UNSW-NB15) using the streaming linear discriminant analysis (SLDA) ML algorithm. Our approach increased model accuracy after each training, resulting in continuous model improvement. The comparison reveals that our dynamic model becomes more accurate after each batch and can detect new types of attacks.</p>

SDN-Driven Security Framework for DDOS Attack Detection and Mitigation

The rising complexity and persistence of Distributed Denial of Service (DDoS) attacks, particularly low-rate variants, present significant challenges in detection and mitigation within Software-Defined Networking (SDN) environments. Existing detection systems often flood networks with alerts, burdening security personnel and delaying timely mitigation. Furthermore, many solutions are designed and tested in simulated conditions, limiting their real-world applicability. To address these challenges, we propose an SDN-based security framework enhanced with automated monitoring, detection, and mitigation capabilities, optimized for slow-rate DDoS attacks. Our framework was rigorously evaluated on a physical testbed, achieving mitigation efficiencies between 91.66% and 100% under varied attack conditions, thus proving its robustness in practical settings. Additionally, we introduce the SDN-SlowRate-DDoS dataset, designed to assist researchers and industry professionals in developing and testing intrusion detection solutions in more realistic scenarios. To further improve DDoS defense in SDN, we incorporate an ensemble online machine learning model that dynamically adapts to evolving attack patterns, enhancing accuracy across attack types and outperforming traditional models with a detection rate of 99.2% on benchmark datasets. This dual approach leverages both real-world testing and adaptive machine learning, advancing proactive DDoS threat management in SDN environments

Securing the Chain: Comprehensive Analysis of Vulnerabilities and Defense Mechanisms in Blockchain Systems

Blockchain systems, characterized by decentralization, traceability, and robust security, are increasingly adopted across various domains including finance due to their strong disaster recovery capabilities. This paper focuses on the security mechanisms underpinning Bitcoin and Ethereum, two dominant cryptocurrencies, and examines potential vulnerabilities and attack vectors targeting blockchain technologies. Specifically, it addresses attacks on consensus mechanisms, network structures, and application layers, outlining the cryptographic methods integral to blockchain security. The study delves into the types of attacks that exploit these vulnerabilities, such as forking, stale or orphaned blocks, selfish mining, and majority attacks, which threaten the integrity and consistency of blockchain systems. Additionally, it reviews the current defense mechanisms and proposes new strategies to enhance the security and resilience of these digital platforms. By exploring these security challenges comprehensively, the paper aims to provide deeper insights into the defense strategies that can fortify blockchain against such vulnerabilities, thereby enhancing its reliability and trustworthiness in digital transactions and ensuring its sustainable integration into the digital economy.

Jamming of optical network operation in physical layer

The paper presents the existing possibilities of disrupting the operation of optical/optoelectronic telecommunication networks in a physical layer, distinguishing between passive and active attacks. The latter relay on jamming the operation of the optical network, ranging from the deterioration of the quality of service to the complete prevention of transmission. Passive attacks, on the other hand, are aimed at eavesdropping on transmissions. The paper discusses the various types of attacks, which are specific to the physical layer of optical networks, as well as capabilities of detection and prevention them based on the machine learning approach among others. Finally, a realistic scenario of an active attack by using of a clip-on coupler has been examined in the context of a local area optical network. The results confirm a very disruptive impact on the transmission quality if the power of the jamming signal is comparable with the power of useful signal.

A Systematic Comparison of Large Language Models Performance for Intrusion Detection

We explore the capabilities of Large Language Models (LLMs) to assist or substitute devices (i.e., firewalls) and humans (i.e., security experts) respectively in the detection and analysis of security incidents. We leverage transformer-based technologies, from relatively small to foundational sizes, to address the problem of correctly identifying the attack severity (and accessorily identifying and explaining the attack type). We contrast a broad range of LLM techniques (prompting, retrieval augmented generation, and fine-tuning of several models) using state-of-the-art machine learning models as a baseline. Using proprietary data from commercial deployment, our study provides an unbiased picture of the strengths and weaknesses of LLM for intrusion detection.

K-means Optimized Network Security Management in the Internet Context

The rapid development of the Internet has had a broad and profound impact on humanity, making information acquisition and dissemination more convenient. It has also brought significant opportunities and benefits to business and the economy. However, there are some issues, such as personal factors and data security concerns. In order to solve the above problems, the K-means algorithm is optimized from the perspectives of K-value validity index, feature weighting and three-branch decision making. First, the optimal clustering results are determined according to K-value validity index, and the influence of different dimensional features on clustering is considered for feature weighting, and the uncertain objects in the three-branch decision deadlock class are divided into the boundary domain. The delay decision of the boundary domain data is carried out, and the K-means clustering optimization algorithm is improved by combining the above three aspects, and the intelligent network security management system is developed on this basis. The results showed that the K-means optimization algorithm achieved the highest average accuracy rate, adjusted Morandi index, and adjusted mutual information across various datasets, with values of 96.01%, 0.866, and 0.869, respectively. In practical network attack scenarios, the K-means optimization algorithm attained an attack threat recognition accuracy of 94.38%. Under unknown network attack types, its detection rate and false alarm rate were 94.63% and 1.32%, respectively. Surveys conducted post-implementation of the intelligent network security management system indicated that over 90% of users were satisfied with their experience of the system. In summary, the proposed method accurately identifies potential network threats in network data, fulfilling performance requirements for network security management systems and ensuring the security of network resources.

Missing Data Imputation Based on Causal Inference to Enhance Advanced Persistent Threat Attack Prediction

With the continuous development of network security situations, the types of attacks increase sharply, but can be divided into symmetric attacks and asymmetric attacks. Symmetric attacks such as phishing and DDoS attacks exploit fixed patterns, resulting in system crashes and data breaches that cause losses to businesses. Asymmetric attacks such as Advanced Persistent Threat (APT), a highly sophisticated and organized form of cyber attack, because of its concealment and complexity, realize data theft through long-term latency and pose a greater threat to organization security. In addition, there are challenges in the processing of missing data, especially in the application of symmetric and asymmetric data filling, the former is simple but not flexible, and the latter is complex and more suitable for highly complex attack scenarios. Since asymmetric attack research is particularly important, this paper proposes a method that combines causal discovery with graph autoencoder to solve missing data, classify potentially malicious nodes, and reveal causal relationships. The core is to use graphic autoencoders to learn the underlying causal structure of APT attacks, with a special focus on the complex causal relationships in asymmetric attacks. This causal knowledge is then applied to enhance the robustness of the model by compensating for data gaps. In the final phase, it also reveals causality, predicts and classifies potential APT attack nodes, and provides a comprehensive framework that not only predicts potential threats, but also provides insight into the logical sequence of the attacker’s actions.

A Hybrid Approach of Substitution and Permutation techniques for Modern Image-Cryptosystem

Abstract This paper proposes a new image encryption algorithm based on the introduction of cellular automata with Galois field-based methods to further encourage a higher level of security. This begins the encryption process by creating an initial substitution box from the irreducible polynomials in the Galois field, followed by the final substitution box obtained through permutation operations. This lays
the foundation for a sound cryptographic process. In order to handle different cryptographic attack types, balance in the substitution box has been closely analyzed. Additionally, we leverage the chaotic nature of the logistic map to incorporate a random element, significantly strengthening the encryption scheme against diverse cryptanalytic attacks. Nonlinear dynamics, as introduced by cellular automata, further develop the encryption process and disperse the image’s data, making it more intricate for any potential attacker. The differential analysis validates the encryption scheme’s resistance to differential attacks, thereby confirming its potential for secure image transmission and storage. The proposed hybrid approach presents a comprehensive solution for image encryption, ensuring high security and computational efficiency. This contribution is an added advantage in the development of image cryptosystems,
addressing the modern challenges facing secure data within the digital landscape.

Atypical Attack of the Dissimilar Metal Welds of a Water–Water Energetic Reactor Nuclear Power Plant Secondary Circuit: Possible Mechanisms of Failure

ABSTRACTDissimilar metal welds are utilized in the energy industry to connect two materials with different material characteristics. In the case of nuclear power plants, the connected materials tend to be low‐alloyed steel and high‐alloyed material. Despite different material and corrosion properties, under the proper environmental conditions, the used construction materials and weld metals are protected either by a passive layer or by a high‐temperature oxide. Although dissimilar metal welds are used in both primary and secondary circuits, the most frequently documented damage is in the secondary circuit, where, in addition to material heterogeneities, local environmental heterogeneities may form. For dissimilar metal welds in WWER nuclear power plants, a water–water energetic reactor, a subtype of pressure water reactor, we note two main types of attack near the dissimilar fusion boundary: on the carbon steel side or on the high‐alloyed weld metal side (X10CrNiMoN16‐25‐6). The possible causes of the latter “atypical” corrosion attack are debated and can be generalized as a consequence of change of the grain boundary condition.

Leveraging machine learning for the detection of structured interference in Global Navigation Satellite Systems

Radio frequency interference disrupts services offered by Global Navigation Satellite Systems (GNSS). Spoofing is the transmission of structured interference signals intended to deceive GNSS location and timing services. The identification of spoofing is vital, especially for safety-of-life aviation services, since the receiver is unaware of counterfeit signals. Although numerous spoofing detection and mitigation techniques have been developed, spoofing attacks are becoming more sophisticated, limiting most of these methods. This study explores the application of machine learning techniques for discerning authentic signals from counterfeit ones. The investigation particularly focuses on the secure code estimation and replay (SCER) spoofing attack, one of the most challenging type of spoofing attacks, ds8 scenario of the Texas Spoofing Test Battery (TEXBAT) dataset. The proposed framework uses tracking data from delay lock loop correlators as intrinsic features to train four distinct machine learning (ML) models: logistic regression, support vector machines (SVM) classifier, K-nearest neighbors (KNN), and decision tree. The models are trained employing a random six-fold cross-validation methodology. It can be observed that both logistic regression and SVM can detect spoofing with a mean F1-score of 94%. However, logistic regression provides 165dB gain in terms of time efficiency as compared to SVM and 3 better than decision tree-based classifier. These performance metrics as well as receiver operating characteristic curve analysis make logistic regression the desirable approach for identifying SCER structured interference.

A Systematic Literature Review on Cyber Attack Detection in Software-Define Networking (SDN)

The increasing complexity and sophistication of cyberattacks pose significant challenges to traditional network security tools. Software-defined networking (SDN) has emerged as a promising solution because of its centralized management and adaptability. However, cyber-attack detection in SDN settings remains a vital issue. The current literature lacks comprehensive assessment of SDN cyber-attack detection methods including preparation techniques, benefits and types of attacks analysed in datasets. This gap hinders the understanding of the strengths and weaknesses of various detection approaches. This systematic literature review aims to examine SDN cyberattack detection, identify strengths, weaknesses, and gaps in existing techniques, and suggest future research directions in this critical area. A systematic approach was used to review and analyse various SDN cyberattack detection techniques from 2017--2024. A comprehensive assessment was conducted to address these research gaps and provide a comprehensive understanding of different detection methods. The study classified attacks on SDN planes, analysed detection datasets, discussed feature selection methods, evaluated approaches such as entropy, machine learning (ML), deep learning (DL), and federated learning (FL), and assessed metrics for evaluating defense mechanisms against cyberattacks. The review emphasized the importance of developing SDN-specific datasets and using advanced feature selection algorithms. It also provides valuable insights into the state-of-the-art techniques for detecting cyber-attacks in SDN and outlines a roadmap for future research in this critical area. This study identified research gaps and emphasized the importance of further exploration in specific areas to increase cybersecurity in SDN environments.

Evaluation of the effectiveness of a firing battery in self-defense and protection in the area of firing positions using constructive simulation

The paper describes the results of an experiment based on the use of constructive simulation in the MASA SWORD environment to verify the ability of an artillery firing battery to provide self-defense and protection in the firing position area and to perform the firing task when different types of adversary attack the firing position area. The objective of the experiment is to verify the ability of the artillery battery to survive within the Artillery Reserved Areas/Artillery Maneuver Areas (ARA/AMA) while performing combat tasks and the necessity of allocating additional resources (equipment, personnel, material) to protect and defend the firing position area and the artillery firing unit assets operating within it. The experiment results are the initial basis for follow-on simulations that will assess the impact on the ability to accomplish an artillery battery operation’s planned and unplanned joint fire support tasks.

Mechanism of Strategic Decision Making in Emergency Situations of Terrorist Attacks in Indonesia

Terrorism is a global phenomenon experienced by all countries including Indonesia, manifested in terrorist attacks that involve violence as a main element with the motivation to achieve political, ideological, and certain belief goals. The threat of potential massive terrorist attacks continues to evolve to this day. Each era shows a tendency in terms of ideology and also types of terrorist attacks. In different times, it is not impossible to have the potential for attacks in different forms. Terrorist attacks that occur in a country can pose a threat to the stability of all aspects of life, thus requiring competent handling by looking at how the mechanism of strategic decision making in Indonesia faces emergency situations of terrorist attacks. Reflecting on the experience of handling the Bali Bombing I, this research was conducted with a qualitative approach based on literature studies and interviews with sources consisting of academics, practitioners, and strategic observers in the issue of terrorism using rational choice theory and criminal policy as the basis for writing. Through the study conducted, the authors found that although Indonesia has experience in handling terrorist actions, the readiness from the capacity aspect needs to be matured, especially in dealing with terrorist attacks. Therefore, a strategic and uncomplicated decision-making mechanism needs to be formulated immediately through a clear command flow or delegation of authority that applies when emergency conditions of terrorist attacks occur.

MACHINE LEARNING, DEEP LEARNING AND ENSEMBLE LEARNING BASED APPROACHES FOR INTRUSION DETECTION ENHANCEMENT

With the extensive application of Internet of Things and wireless sensor networks (WSNs) in various real-time fields, they have become increasingly vulnerable to several types of attacks that could have a serious impact in their functionalities. Recently, intrusion detection systems have become one of the crucial security components. We propose in this work an approach based on machine and deep learning for DoS and DDoS attack detection. We have evaluated, analyzed, and compared the efficiency of three learning models separately, including deep neural network (DNN), random forest, and decision tree, using the standard metrics of evaluation such as accuracy, precision, F1-score, and recall. In our contribution, an approach ensemble learning was introduced in order to enhance the accuracy rate of classification. Our study was carried out using two well-known benchmark and real-time datasets, CICIoT-2023 and WSN-DS, intended for wireless sensor networks and IoT. These datasets containing various types of attacks. CICIoT2023 dataset contains 33 attacks divided into 7 classes, while WSN-DS dataset contains four types of DoS attacks, including Blackhole, Grayhole, Flooding, and TDMA. The experiment result demonstrate the effectiveness of our approach in attacks detection with high accuracy achieved close to perfect. Our approach result demonstrates that using the ensemble learning technique works better than each ML architecture independently.

How Resilient Are Kolmogorov–Arnold Networks in Classification Tasks? A Robustness Investigation

Kolmogorov–Arnold Networks (KANs) are a novel class of neural network architectures based on the Kolmogorov–Arnold representation theorem, which has demonstrated potential advantages in accuracy and interpretability over Multilayer Perceptron (MLP) models. This paper comprehensively evaluates the robustness of various KAN architectures—including KAN, KAN-Mixer, KANConv_KAN, and KANConv_MLP—against adversarial attacks, which constitute a critical aspect that has been underexplored in current research. We compare these models with MLP-based architectures such as MLP, MLP-Mixer, and ConvNet_MLP across three traffic sign classification datasets: GTSRB, BTSD, and CTSD. The models were subjected to various adversarial attacks (FGSM, PGD, CW, and BIM) with varying perturbation levels and were trained under different strategies, including standard training, adversarial training, and Randomized Smoothing. Our experimental results demonstrate that KAN-based models, particularly the KAN-Mixer, exhibit superior robustness to adversarial attacks compared to their MLP counterparts. Specifically, the KAN-Mixer consistently achieved lower Success Attack Rates (SARs) and Degrees of Change (DoCs) across most attack types and datasets while maintaining high accuracy on clean data. For instance, under FGSM attacks with ϵ=0.01, the KAN-Mixer outperformed the MLP-Mixer by maintaining higher accuracy and lower SARs. Adversarial training and Randomized Smoothing further enhanced the robustness of KAN-based models, with t-SNE visualizations revealing more stable latent space representations under adversarial perturbations. These findings underscore the potential of KAN architectures to improve neural network security and reliability in adversarial settings.

Detecting and Analyzing Network Attacks: A Time-Series Analysis Using the Kitsune Dataset

Network security is a critical concern in today’s digital world, requiring efficient methods for the automatic detection and analysis of cyber attacks. This study uses the Kitsune Network Attack Dataset to explore network traffic behavior for IoT devices under various attack scenarios, including ARP MitM, SYN DoS, and Mirai Botnet. Utilizing Python-based data analysis tools, we preprocess and analyze millions of network packets to uncover patterns indicative of malicious activities. The study employs packet-level time-series analysis to visualize traffic patterns and detect anomalies specific to each attack type. Key findings include high packet volumes in attacks such as SSDP Flood and Mirai Botnet, with the Mirai Botnet attack involving multiple IP addresses and lasting over 2 hours. Notable attack-specific behaviors include high traffic on port -1 and targeted traffic on specific ports like 53195. The SYN DoS and Mirai Botnet attacks are characterized by their prolonged durations, suggesting significant disruption. Overall, the study highlights distinctive attack patterns and underscores the importance of understanding these characteristics to enhance detection and response mechanisms.

Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges

Deep learning techniques have achieved superior performance in computer-aided medical image analysis, yet they are still vulnerable to imperceptible adversarial attacks, resulting in potential misdiagnosis in clinical practice. Oppositely, recent years have also witnessed remarkable progress in defense against these tailored adversarial examples in deep medical diagnosis systems. In this exposition, we present a comprehensive survey on recent advances in adversarial attacks and defenses for medical image analysis with a systematic taxonomy in terms of the application scenario. We also provide a unified framework for different types of adversarial attack and defense methods in the context of medical image analysis. For a fair comparison, we establish a new benchmark for adversarially robust medical diagnosis models obtained by adversarial training under various scenarios. To the best of our knowledge, this is the first survey paper that provides a thorough evaluation of adversarially robust medical diagnosis models. By analyzing qualitative and quantitative results, we conclude this survey with a detailed discussion of current challenges for adversarial attack and defense in medical image analysis systems to shed light on future research directions. Code is available on GitHub.

Malware Detection and Classification using Generative Adversarial Network

The Generative Adversarial Networks (GANs) are playing a crucial role in deep-learning-based malware classification to overcome the dataset imbalance and unseen malware. The Generative AI is preferably used in many applications, such as improving image resolution and generating audio, video, and text. The cybercriminals are also using the Generative AI for generating the malware and deepfake videos to harm the targeted person or device. By generating the synthetic data, it makes the deep learning model more robust to detect such types of unseen and adversarial attacks. This work utilizes GANs for generating adversarial malware samples to train a classification and detection model, improving the model’s ability to identify sophisticated malware variants. The performance of the proposed Conditional Generative Adversarial Network (CGAN) model is evaluated on a multiclass malware grayscale image dataset and a binary class malware RGB image dataset. The performance of proposed model is compared with current state-of-the-art. Results indicate a significant improvement in classification accuracy and a reduction in training time and false positives, showcasing GAN’s potential in the dynamic cybersecurity landscape.

Optimizing Machine Learning-Based Intrusion Detection Systems for Enhanced Security in Cloud Computing Environments.

In today’s cloud computing environments, robust network security is crucial due to the inherently distributed and dynamic nature of cloud systems. Traditional Network Intrusion Detection Systems (NIDS) often face challenges in handling large-scale, rapidly evolving data and sophisticated attack vectors unique to cloud settings. This paper presents an optimized Machine Learning (ML)-based NIDS framework designed specifically for cloud infrastructures, leveraging feature selection, dimensionality reduction, and algorithmic tuning techniques to enhance detection accuracy and reduce false positives. Integrating supervised and unsupervised learning methods, this NIDS system can detect both known and novel attack types efficiently. By utilizing cloud-specific datasets and real-time traffic monitoring, it adapts well to the scalability and elasticity requirements of cloud environments. Additionally, the system incorporates automated optimization techniques, such as hyperparameter tuning and ensemble learning, to further enhance performance. Experimental results show improvements in detection rates, reduced computational overhead, and better scalability, making it a promising solution for modern cloud-based infrastructures.