Types Of Attacks Research Articles

A Provably Secure Anonymous Authentication Protocol for Consumer and Service Provider Information Transmissions in Smart Grids

Smart grids integrate information technology, decision support systems, communication networks, and sensing technologies. All these components cooperate to facilitate dynamic power adjustments based on received client consumption reports. Although this brings forth energy efficiency, the transmission of sensitive data over the public internet exposes these networks to numerous attacks. To this end, numerous security solutions have been presented recently. Most of these techniques deploy conventional cryptographic systems such as public key infrastructure, blockchains, and physically unclonable functions that have either performance or security issues. In this paper, a fairly efficient authentication scheme is developed and analyzed. Its formal security analysis is carried out using the Burrows–Abadi–Needham (BAN) logic, which shows that the session key negotiated is provably secure. We also execute a semantic security analysis of this protocol to demonstrate that it can resist typical smart grid attacks such as privileged insider, guessing, eavesdropping, and ephemeral secret leakages. Moreover, it has the lowest amount of computation costs and relatively lower communication overheads as well as storage costs.

Worldwide Trends in COVID-19-Related Attacks Against Healthcare: A Review of the Safeguarding Health in Conflict Coalition Database.

During the COVID-19 pandemic, violence targeting healthcare reportedly increased. Attacks against healthcare can severely hamper the public health response during a pandemic. Descriptive data analysis of these attacks may be helpful to develop prevention and mitigation strategies. This study aimed to investigate trends regarding COVID-19-related attacks against healthcare from January 2020 until January 2023. COVID-19-related incidents occurring between January 2020 and January 2023 were extracted from the Safeguarding Health in Conflict Coalition database and screened for eligibility. Included incidents were linked to COVID-19 health measures or were attacks directly interfering with COVID-19 healthcare, including conflict-related attacks. Data collected per incident included temporal factors; country; setting; attack and weapon type; perpetrator; motive; number of healthcare workers (HCWs) killed, injured, or kidnapped; and health facility damage. The study identified 255 COVID-19-related attacks against healthcare, with 18 HCWs killed, 147 HCWs injured, and 86 facilities damaged. The highest attack frequency was reported during the beginning of the pandemic and predominantly concerned stigma-related attacks against healthcare. Reported incidents in 2021 included attacks targeting vaccination campaigns, as well as conflict-related attacks interfering with COVID-19 healthcare. COVID-19-related attacks against healthcare occurred in heterogeneous contexts throughout the pandemic. Due to underreporting, the data presented are a minimum estimate of the actual magnitude of violence. The findings of this study emphasize the importance of public education campaigns, improved coordination between healthcare organizations and law enforcement, and the possible need to bolster the security of medical facilities and health workers.

A novel approach detection for IIoT attacks via artificial intelligence

The Industrial Internet of Things (IIoT) is a paradigm that enables the integration of cyber-physical systems in critical infrastructures, such as power grids, water distribution networks, and transportation systems. IIoT devices, such as sensors, actuators, and controllers, can provide various benefits, such as performance optimization, efficiency improvement, and remote management. However, these devices also pose new security risks and challenges, as they can be targeted by malicious actors to disrupt the normal operation of the infrastructures they are connected to or to cause physical damage or harm. Therefore, it is essential to develop effective and intelligent solutions to detect and prevent attacks on IIoT devices and to ensure the security and resilience of critical infrastructures. In this paper, we present a comprehensive analysis of the types and impacts of attacks on IIoT devices based on a literature review and a data analysis of real-world incidents. We classify the attacks into four categories: denial-of-service, data manipulation, device hijacking, and physical tampering. We also discuss the potential consequences of these attacks on the safety, reliability, and availability of critical infrastructures. We then propose an expert system that can detect and prevent attacks on IIoT devices using artificial intelligence techniques, such as rule-based reasoning, anomaly detection, and reinforcement learning. We describe the architecture and implementation of our system, which consists of three main components: a data collector, a data analyzer, and a data actuator. We also present a table that summarizes the main features and capabilities of our system compared to existing solutions. We evaluate the performance and effectiveness of our system on a testbed consisting of programmable logic controllers (PLCs) and IIoT protocols, such as Modbus and MQTT. We simulate various attacks on IIoT devices and measure the accuracy, latency, and overhead of our system. Our results show that our system can successfully detect and mitigate different types of attacks on IIoT devices with high accuracy and low latency and overhead. We also demonstrate that our system can enhance the security and resilience of critical infrastructures by preventing or minimizing the impacts of attacks on IIoT devices.

DTT: A Dual-domain Transformer model for Network Intrusion Detection

With the rapid evolution of network technologies, network attacks have become increasingly intricate and threatening. The escalating frequency of network intrusions has exerted a profound influence on both industrial settings and everyday activities. This underscores the urgent necessity for robust methods to detect malicious network traffic. While intrusion detection techniques employing Temporal Convolutional Networks (TCN) and Transformer architectures have exhibited commendable classification efficacy, most are confined to the temporal domain. These methods frequently fall short of encompassing the entirety of the frequency spectrum inherent in network data, thereby resulting in information loss. To mitigate this constraint, we present DTT, a novel dual-domain intrusion detection model that amalgamates TCN and Transformer architectures. DTT adeptly captures both high-frequency and low-frequency information, thereby facilitating the simultaneous extraction of local and global features. Specifically, we introduce a dual-domain feature extraction (DFE) block within the model. This block effectively extracts global frequency information and local temporal features through distinct branches, ensuring a comprehensive representation of the data. Moreover, we introduce an input encoding mechanism to transform the input into a format suitable for model training. Experiments conducted on two distinct datasets address concerns regarding data duplication and diverse attack types, respectively. Comparative experiments with recent intrusion detection models unequivocally demonstrate the superior performance of the proposed DTT model.

Image watermarking based on a ratio of DCT coefficient sums using a gradient-based optimizer

Social networks and various websites provide a lot of tools for publishing and sharing digital images. However, publishing digital content online makes it vulnerable to illegal copying and distribution. An effective method for protecting images is watermarking technology, which embeds a logo or some kind of identifier into an image in an invisible way. If necessary, a watermark can be extracted from an image and used to prove authorship and ownership. A major challenge in designing image watermarking schemes is balancing embedding imperceptibility and resistance to various attacks. In this study, we propose a new robust and blind image watermarking algorithm that set a specific ratio of sum of discrete cosine transform (DCT) coefficient absolute values for each image block. We provide a balance between imperceptibility and robustness using a modern metaheuristic optimization algorithm called gradient-based optimizer, which finds the best vector of changes for mid-frequency DCT coefficients. An objective function of optimization algorithm is designed in such a way as to control the ratio of the sums of DCT coefficients absolute values to increase robustness and reduce a distortion level of an image block during embedding. Experimental results and comparison with some other image watermarking schemes demonstrate the high efficiency of the proposed algorithm in terms of imperceptibility and resistance to typical image processing attacks, such as changing brightness and contrast, sharpening, cropping, and others.

CyberGrid: an IEC61850 protocol-based substation automation virtual cyber range for cybersecurity research in the smart grid

ABSTRACT A cyber range provides a controlled environment for simulating mission-critical systems for cybersecurity research following the high risks involved in conducting experiments in real-life systems. Existing cyber ranges do not provide close emulation of Cyber-Physical Systems (CPS) in the Smart Grid Networks (SGNs), with emphasis on industry-based proprietary and IED protocols. This paper presents CyberGrid Testbed – a virtual Cyber-Range developed by the CyberSCADA Research Laboratory at Obafemi Awolowo University, Ile-Ife, Nigeria, which emulates Substation Automation processes with IEC61850 and Modbus/TCP protocols and support for MMS, and IED. This was built on OpenPLC6185, simulating Twelve attack patterns, and four attack types.

Trust and Energy Effective Framework for Wireless Sensor Networks

Sensor nodes have been manufactured from an enormous amount of very thick sensor systems. To a large extent, wireless sensor networks were powered by electricity. The sensor connection has to work under really uncertain conditions. The nodes are powerless to various types of dynamic attacks especially specific outbound and well attacks under such conditions. These attacks inject malicious packages by trading the knot. Topographical conventions of direction of wireless sensor connections were created by thinking about the safety and power angle aspects of these assaults. In this article, a directing convention named energy-efficient and confidence implanted greedy perimeter stateless routing algorithm (EETGPSR) suggested for wireless sensor connections to join confidence systems in power-aware greedy perimeter stateless routing algorithm (EGPSR). The results show that EETGPSR beats EGPSR by reducing maintenance and improving the connection delivery ratio.

Towards secure IoT networks: A comprehensive study of metaheuristic algorithms in conjunction with CNN using a self-generated dataset

The Internet of Things (IoT) has radically reformed various sectors and industries, enabling unprecedented levels of connectivity and automation. However, the surge in the number of IoT devices has also widened the attack surface, rendering IoT networks potentially susceptible to a plethora of security risks. Addressing the critical challenge of enhancing security in IoT networks is of utmost importance. Moreover, there is a considerable lack of datasets designed exclusively for IoT applications. To bridge this gap, a customized dataset that accurately mimics real-world IoT scenarios impacted by four different types of attacks—blackhole, sinkhole, flooding, and version number attacks was generated using the Contiki-OS Cooja Simulator in this study. The resulting dataset is then consequently employed to evaluate the efficacy of several metaheuristic algorithms, in conjunction with Convolutional Neural Network (CNN) for IoT networks. •The proposed study's goal is to identify optimal hyperparameters for CNNs, ensuring their peak performance in intrusion detection tasks.•This study not only intensifies our comprehension of IoT network security but also provides practical guidance for implementation of the robust security measures in real-world IoT applications.

Realization of Authenticated One-Pass Key Establishment on RISC-V Micro-Controller for IoT Applications

Internet-of-things networks consist of multiple sensor devices spread over a wide area. In order to protect the data from unauthorized access and tampering, it is essential to ensure secure communication between the sensor devices and the central server. This security measure aims to guarantee authenticity, confidentiality, and data integrity. Unlike traditional computing systems, sensor node devices are often limited regarding memory and computing power. Lightweight communication protocols, such as LoRaWAN, were introduced to overcome these limitations. However, despite the lightweight feature, the protocol is vulnerable to different types of attacks. This proposal presents a highly secure key establishment protocol that combines two cryptography schemes: Elliptic Curve Qu–Vanstone and signcryption key encapsulation. The protocol provides a method to establish a secure channel that inherits the security properties of the two schemes. Also, it allows for fast rekeying with only one exchange message, significantly reducing the handshake complexity in low-bandwidth communication. In addition, the selected schemes complement each other and share the same mathematical operations in elliptic curve cryptography. Moreover, with the rise of a community-friendly platform like RISC-V, we implemented the protocol on a RISC-V system to evaluate its overheads regarding the cycle count and execution time.

Interactive attack-defense for generalized person re-identification

Generalized Person Re-Identification (GReID) aims to develop a model capable of robust generalization across unseen target domains, even with training on a limited set of observed domains. Recently, methods based on the Attack-Defense mechanism are emerging as a prevailing technology to this issue, which treats domain transformation as a type of attack and enhances the model’s generalization performance on the target domain by equipping it with a defense module. However, a significant limitation of most existing approaches is their inability to effectively model complex domain transformations, largely due to the separation of attack and defense components. To overcome this limitation, we introduce an innovative Interactive Attack-Defense (IAD) mechanism for GReID. The core of IAD is the interactive learning of two models: an attack model and a defense model. The attack model dynamically generates directional attack information responsive to the current state of the defense model, while the defense model is designed to derive generalizable representations by utilizing a variety of attack samples. The training approach involves a dual process: for the attack model, the aim is to increase the challenge for the defense model in countering the attack; conversely, for the defense model, the focus is on minimizing the effects instigated by the attack model. This interactive framework allows for mutual learning between attack and defense, creating a synergistic learning environment. Our diverse experiments across datasets confirm IAD’s effectiveness, consistently surpassing current state-of-the-art methods, and using MSMT17 as the target domain in different protocols resulted in a notable 13.4% improvement in GReID task average Rank-1 accuracy. Code is available at: https://github.com/lhf12278/IAD.

Improving resilience and efficiency in the energy sector: A perspective on cybersecurity and renewable energy storage.

The study investigates how resilience and efficiency can be improved in the energy sector using cybersecurity. The main objective of the paper is to enable organizations in the energy sector to develop a robust framework to manage renewable energy storage effectively with little to no cost consequence because of cyberattacks. A survey data saved in the repository of Kaggle was extracted and utilized for the purpose of the study, it contains cybersecurity indicators such as anomaly score, log source, attack types, attacks severity, and response action, which were the features adopted for developing a model, while the target variable was renewable energy generation. A machine learning approach was adopted, with the Rsquared indicating that 61 % variation in renewable energy store is explained by the features included in the model. The study recommends that there should be an increased investment in cybersecurity structure to safeguard energy systems against cyber threats. Also, stakeholders should implement comprehensive training programs to enhance cybersecurity awareness and skills of personnel working in the energy sector.

Fast Attack Detection for Cyber-Physical Systems Using Dynamic Data Encryption.

To defend the cyber-physical system (CPSs) from cyber-attacks, this work proposes an unified intrusion detection mechanism which is capable to fast hunt various types of attacks. Focusing on securing the data transmission, a novel dynamic data encryption scheme is developed and historical system data is used to dynamically update a secret key involved in the encryption. The core idea of the dynamic data encryption scheme is to establish a dynamic relationship between original data, secret key, ciphertext and its decrypted value, and in particular, this dynamic relationship will be destroyed once an attack occurs, which can be used to detect attacks. Then, based on dynamic data encryption, a unified fast attack detection method is proposed to detect different attacks, including replay, false data injection (FDI), zero-dynamics, and setpoint attacks. Extensive comparison studies are conducted by using the power system and flight control system. It is verified that the proposed method can immediately trigger the alarm as soon as attacks are launched while the conventional χ2 detection could only capture the attacks after the estimation residual goes over the predetermined threshold. Furthermore, the proposed method does not degrade the system performance. Last but not the least, the proposed dynamic encryption scheme turns to normal operation mode as the attacks stop.

Adaptive Double-Spending Attacks on PoW-Based Blockchains

Previous state-of-the-art studies have proposed various analytical models to understand the double-spending attacks (DSA) occurred in Proof-of-Work (PoW) based Blockchains. Although many insights behind the double-spending attacks have been disclosed, we still believe that advanced versions of DSA can be developed to create new threats for the PoW-based blockchains such as the Bitcoin blockchain. In this paper, we present two new types of double-spending attacks in the context of the PoW-based blockchain and discuss the insights behind them. By considering more practical network parameters, such as the number of confirmation blocks, the hashpower of the double-spending attacker, the amount of coins in the target transaction, and the network-status parameter, we first analyze the success probability of the conventional double-spending attack, named Naive DSA. Based on Naive DSA, we create two new adaptive DSA, i.e., the Adaptive DSA and the Reinforcement Adaptive DSA (RA-DSA). In our analytical models, a double-spending attack is converted into a Markov Decision Process. We then exploit the Stochastic Dynamic Programming (SDP) approach to obtain the optimal attack strategies under Adaptive DSA and RA-DSA. Numerical simulation results demonstrate the correlations between each critical network parameter and the expected attacker's reward. Through the proposed analytical models, we aim to alert the PoW-based blockchain ecosystem that the threat of double-spending attacks is still at a dangerous level. For example, our findings show that the attacker can launch a successful attack with a small hashpower proportion much lower than 51% under RA-DSA.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

The Impact of Adversarial Attacks on Federated Learning: A Survey.

Federated learning (FL) has emerged as a powerful machine learning technique that enables the development of models from decentralized data sources. However, the decentralized nature of FL makes it vulnerable to adversarial attacks. In this survey, we provide a comprehensive overview of the impact of malicious attacks on FL by covering various aspects such as attack budget, visibility, and generalizability, among others. Previous surveys have primarily focused on the multiple types of attacks and defenses but failed to consider the impact of these attacks in terms of their budget, visibility, and generalizability. This survey aims to fill this gap by providing a comprehensive understanding of the attacks' effect by identifying FL attacks with low budgets, low visibility, and high impact. Additionally, we address the recent advancements in the field of adversarial defenses in FL and highlight the challenges in securing FL. The contribution of this survey is threefold: first, it provides a comprehensive and up-to-date overview of the current state of FL attacks and defenses. Second, it highlights the critical importance of considering the impact, budget, and visibility of FL attacks. Finally, we provide ten case studies and potential future directions towards improving the security and privacy of FL systems.

The robustness of some Carboniferous fossil leaf venation networks to simulated damage.

Biological networks vary widely in their architecture and functional properties. Branching networks are good for transportation efficiency, while networks including loops offer good resistance to damage, and examples of these two topologies are found in leaf venation networks. The first plants with reticulate (loopy) leaf venation evolved in the Pennsylvanian of the Carboniferous, but the responses of different venation network architectures from this time period to damage are currently largely unknown. Here we address this issue with a computational analysis of venation network robustness that is focused on fossil leaves from the Pennsylvanian. We attacked fossil venation networks with simulated damage to individual vein segments and leaf blades. For both types of attack, branched venation networks are the least robust to damage, with greater robustness shown by the net-like reticulate networks found in the Pennsylvanian. A living angiosperm Betula alba was the most robust in our analysis. This may highlight a role for resistance to damage in the evolution of reticulate leaf venation in the Carboniferous, but further work is needed to answer the broader question of why reticulate leaf venation first evolved in the Pennsylvanian.

Detection and Characterization of DDoS Attacks using Time Based Features

Abstract: In today's evolving cyber security environment, DDoS attacks are now one of the riskiest and most expensive attacks. DDoS detection and prevention has become critical as businesses and government agencies are affected by DDoS, which can disrupt network services and cause billions of dollars in damage. Our project offers a solution that detects different types of DDoS attacks using machine learning algorithms. The main aim of the project is to detect attacks of binary classification and multi class classification, this also reduces the time complexity. The proposed system studies the efficiency of time based features to detect and classify types of DDoS attacks using binary and multiclass classification. Using machine learning algorithms, the system analyzes this data to detect between legitimate and the attack network request. The addition of a time based features subset increases the accuracy of the system, reduces training time without compromising test accuracy. The general purpose of the project is not only detection research. It can be seen that training a subset of time-based features can reduce training time without affecting test accuracy; thus, the small subset of time-based features is itself useful for near-realtime applications with continuous learning.

Malware Detection and Prevention Using Machine Learning

Abstract: The malware became a serious threat challenge the computing world that requires an immediate consideration to avoid financial and moral blackmail. So, there is a real need for a new method that can detect and stop this type of attack. Most of the previous detection methods followed a dynamic analysis technique which involves a complicated process. The present study proposes a novel method based on static analysis to detect ransomware. The significant characteristic of proposed method is dispensing of disassemble process by direct extraction of features from raw byte with the use of frequent pattern mining which remarkably increases the detection speed. The Gain Ratio technique was used for feature selection which exhibited that 1000 features was the optimal number for detection process. The current study involved using random forest classifier with a comprehensive analysis to the effect of both tree and seed numbers on the ransomware detection. The results showed that tree numbers of 100 with seed number of 1 achieved best results in terms of time-consuming and accuracy. The experimental evaluation revealed that the proposed method could achieve a high accuracy of 97.74% for detection ransomware.

Exploring the impact of AI-driven solutions on cybersecurity adoption in small and medium enterprises

This study delves into the intricate dynamics of cybersecurity adoption within small and medium enterprises (SMEs), with a specific focus on the transformative potential of AI-driven solutions from a machine learning perspective. Leveraging a rich and diverse dataset of real-world cybersecurity incidents tailored to the SME context, the research meticulously investigates the efficacy of three prominent machine learning models: logistic regression, random forest, and gradient boost classifiers. Through a comprehensive evaluation using a suite of performance metrics, including accuracy, precision, recall, and F1 scores, the study scrutinizes the predictive capabilities of these models in forecasting and categorizing cyber threats encountered by SMEs. The findings unveil nuanced insights into the multifaceted challenges and opportunities inherent in the cybersecurity landscape of SMEs, shedding light on the complex interplay between AI-driven solutions and evolving cyber threats. While the analysis reveals commendable performance across the models, it also uncovers inherent limitations in accurately discerning and categorizing specific types of attacks. These findings underscore the critical need for ongoing refinement and optimization of AI-driven cybersecurity solutions, necessitating a continuous, iterative process informed by real-world data and adaptive learning mechanisms. By harnessing the strengths of machine learning and embracing a proactive stance towards cybersecurity, SMEs can fortify their defense mechanisms and safeguard their digital assets in the increasingly volatile and interconnected digital ecosystem.