Types Of Cyber-attacks Research Articles

Cybersecurity in Cyber–Physical Power Systems

The current energy transition combined with the modernization of power systems has provided meaningful transformations in the transmission, distribution, operation, planning, monitoring, and control of power systems. These advancements are heavily dependent on the employment of new computing and communications technologies, which, combined with traditional physical systems, lead to the emergence of cyber–physical systems (CPSs). In this sense, besides the traditional challenges of keeping a reliable, affordable, and safe power grid, one must now deal with the new vulnerabilities to cyberattacks that emerge with the advancement of CPSs. Aware of this perspective and the severity of the ongoing challenges faced by the industry due to cyberattacks, this paper aims to provide a comprehensive survey of the literature on cybersecurity in cyber–physical power systems. For this, clear definitions, historical timelines, and classifications of the main types of cyberattacks, including the concepts, architectures, and basic components that make up, as well as the vulnerabilities in managing, controlling, and protecting, a CPS are presented. Furthermore, this paper presents defense strategies and future trends for cybersecurity. To conduct this study, a careful search was made in relevant academic and industrial databases, leading to a detailed reporting of key works focused on mitigating cyberattacks and ensuring the cybersecurity of modern CPSs. Finally, the paper presents some standards and regulations that technical and international institutions on cybersecurity in smart grids have created.

Review of Malware and Phishing in the Current and Next Generation of the Internet

Abstract: The advent of Web 2.0 and Web 3.0 technologies has created new opportunities for cybercriminals to launch malware and phishing attacks. This review paper aims to provide an overview of the current state of these types of attacks in Web 2.0 and Web 3.0 environments, as well as the tools and strategies that can be used to prevent them. The paper begins by defining malware and phishing and describing the basic methods used to execute these attacks. It then delves into the specific characteristics of Web 2.0 and Web 3.0 environments that make them vulnerable to these types of attacks. For example, the ability to share information and collaborate in real time in Web 2.0 environments can create opportunities for cybercriminals to exploit trust relationships and launch phishing attacks. In Web 3.0 environments, the use of blockchain and decentralized technologies introduces new challenges for preventing malware and phishing attacks. The paper discusses the the functioning and the procedures which are followed in the event of a malware attack or phishing attack in unison with social engineering and also takes a look at a case study of a real life phishing attack in web 3.0. The paper concludes by outlining some of the key tools and strategies that can be used to prevent malware and phishing attacks in Web 2.0 and Web 3.0 environments. These include technical measures such as anti-malware software, firewalls, and spam filters, as well as user education and training to recognize and avoid phishing attacks. Overall, the paper provides a comprehensive overview of the current state of malware and phishing attacks in Web 2.0 and Web 3.0 environments, as well as the strategies and tools that can be used to prevent them. As the use of these technologies continues to grow, it is essential that individuals and organizations take steps to protect themselves against these types of cyber attacks.

THE EVOLVING THREAT LANDSCAPE: AN OVERVIEW OF ATTACKS AND RESPONSE STRATEGIES AGAINST CYBERCRIME IN SAUDI ARABIA

Saudi Arabia has been a victim of cyberattacks over the years, with an increasing number of attacks being reported since 2020. These cyberattacks significantly threaten the country's national security, economic stability, and personal privacy. In this article, we will explore the types of cyberattacks that have been observed in Saudi Arabia after 2020, the impact they have had on the country, and the measures taken by the Saudi government to counter these attacks. This article is aimed at providing a comprehensive understanding of the current state of cyberattacks in Saudi Arabia and the measures taken to address them.

Analysing Cyber Threats: A Comprehensive Literature Review on Data-Driven Approaches

This literature review paper aims to examine and analyze the existing research on prediction models for different types of cyber-attacks. Four key research papers have been selected as the base for this review: "A Prediction Model of DoS Attack's Distribution Discrete Probability," "Apriori Viterbi Model for Prior Detection of Socio-Technical Attacks," "Cyber Attacks Prediction Model Based on Bayesian Network," and "Applying Data Science to Cybersecurity Network Attacks & Events.” An overview of the value of prediction models in cybersecurity and their function in reducing potential threats come first in the review. The methodology section outlines the search strategy used to identify relevant literature and the selection criteria for the base papers. The subsequent sections provide an overview of the field, highlighting the historical development and key theories or frameworks related to cyber-attack prediction. The themes or subtopics identified in the literature are discussed, focusing on the discrete probability distribution model of DoS attacks, the Apriori Viterbi model for detecting socio-technical attacks, the Bayesian network-based prediction model, and the application of data science in analyzing network attacks and events. The review critically evaluates the selected papers, analyzing their methodologies, findings, and limitations. It identifies gaps, controversies, and conflicting findings in the literature, paving the way for further research in the field. The synthesis and interpretation section integrates the findings from the different studies, compares various perspectives, and discusses the implications and significance of the literature for cyber-attack prediction. In conclusion, this literature review paper provides a comprehensive analysis of prediction models for cyber-attacks, based on the selected base papers. It highlights the strengths and weaknesses of existing approaches, identifies research gaps, and offers recommendations for future studies. This review contributes to the advancement of knowledge in the field of cybersecurity and aids in the development of more effective prediction models to combat evolving cyber threats.

Blockchain-oriented approach for detecting cyber-attack transactions

With the high-speed development of decentralized applications, account-based blockchain platforms have become a hotbed of various financial scams and hacks due to their anonymity and high financial value. Financial security has become a top priority with the sustainable development of blockchain-based platforms because of an increasing number of cyber attacks, which have resulted in a huge loss of crypto assets in recent years. Therefore, it is imperative to study the real-time detection of cyber attacks to facilitate effective supervision and regulation. To this end, this paper proposes the weighted and extended isolation forest algorithms and designs a novel framework for the real-time detection of cyber-attack transactions by thoroughly studying and summarizing real-world examples. Furthermore, this study develops a new detection approach for locating the compromised address of a cyber attack to resolve the data scarcity of hack addresses and reduce time consumption. Moreover, three experiments are carried out not only to apply on different types of cyber attacks but also to compare the proposed approach with the widely used existing methods. The results demonstrate the high efficiency and generality of the proposed approach. Finally, the lower time consumption and robustness of our method were validated through additional experiments. In conclusion, the proposed blockchain-oriented approach in this study can handle real-time detection of cyber attacks and has significant scope for applications.

Concerns about Cybersecurity: The Implications of the use of ICT for Citizens and Companies

The widespread use of Information and Communication Technologies - ICT substantially increases the risks related to information security. In fact, due to the increase in the number and type of cyber attacks, Cybersecurity has become a growing concern in today's society. This phenomenon affects not only individual citizens, but also companies and even State entities. Despite the numerous advantages of this "digitalisation" of society, there are several risks, ranging from identity theft, scam emails or phone calls, online fraud, offensive material and child pornography, material promoting racial hatred or religious extremism, access to online services, email account hacking, online banking fraud, cyber extortion or malicious software. In order to determine the impact that cyber attacks have on society it is necessary to understand how people and companies use ICTs, such as social networks, the information they share, their privacy concerns, or the use of electronic services such as online payments or the cloud. This study becomes central not only to try to prevent/minimise risks, showing what has been done in this area, but more importantly, the way forward to try to prevent or minimise possible risks in the future.

A Phishing-Attack-Detection Model Using Natural Language Processing and Deep Learning

Phishing is a type of cyber-attack that aims to deceive users, usually using fraudulent web pages that appear legitimate. Currently, one of the most-common ways to detect these phishing pages according to their content is by entering words non-sequentially into Deep Learning (DL) algorithms, i.e., regardless of the order in which they have entered the algorithms. However, this approach causes the intrinsic richness of the relationship between words to be lost. In the field of cyber-security, the innovation of this study is to propose a model that detects phishing attacks based on the text of suspicious web pages and not on URL addresses, using Natural Language Processing (NLP) and DL algorithms. We used the Keras Embedding Layer with Global Vectors for Word Representation (GloVe) to exploit the web page content’s semantic and syntactic features. We first performed an analysis using NLP and Word Embedding, and then, these data were introduced into a DL algorithm. In addition, to assess which DL algorithm works best, we evaluated four alternative algorithms: Long Short-Term Memory (LSTM), Bidirectional LSTM (BiLSTM), Gated Recurrent Unit (GRU), and Bidirectional GRU (BiGRU). As a result, it can be concluded that the proposed model is promising because the mean accuracy achieved by each of the four DL algorithms was at least 96.7%, while the best performer was BiGRU with 97.39%.

Installation of integrated intellectual information security systems in open corporate networks – DDoS attack

Securing information security in open corporate networks is crucial, and building defense systems against potential threats is a critical step towards ensuring the availability, completeness, and confidentiality of system clients. Integrated information security systems play a pivotal role in safeguarding an organization's assets by identifying and mitigating security vulnerabilities. Therefore, it is essential to be aware of the various types of attacks that may be directed towards an information system and analyze them to prevent and mitigate the impact of such attacks. By taking proactive measures to protect against DDoS attacks and other types of cyber-attacks, organizations can minimize the risk of downtime, data breaches, and financial loss, ensuring the integrity, availability, and confidentiality of their systems and clients.

Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure.

Several critical infrastructures are integrating information technology into their operations, and as a result, the cyber attack surface extends over a broad range of these infrastructures. Cyber attacks have been a serious problem for industries since the early 2000s, causing significant interruptions to their ability to produce goods or offer services to their clients. The thriving cybercrime economy encompasses money laundering, black markets, and attacks on cyber-physical systems that result in service disruptions. Furthermore, extensive data breaches have compromised the personally identifiable information of millions of people. This paper aims to summarize some of the major cyber attacks that have occurred in the past 20 years against critical infrastructures. These data are gathered in order to analyze the types of cyber attacks, their consequences, vulnerabilities, as well as the victims and attackers. Cybersecurity standards and tools are tabulated in this paper in order to address this issue. This paper also provides an estimate of the number of major cyber attacks that will occur on critical infrastructure in the future. This estimate predicts a significant increase in such incidents worldwide over the next five years. Based on the study's findings, it is estimated that over the next 5 years, 1100 major cyber attacks will occur on critical infrastructures worldwide, each causing more than USD 1 million in damages.

A novel optimized probabilistic neural network approach for intrusion detection and categorization

Nowadays, the web provides all of the nation's daily necessities, and time spent online is rising quickly. The Internet is being used more widely than ever. As a result, cyberattacks and cybercrime are becoming more prevalent. Various machine learning techniques will be used to recognize network attacks and defend against cyber security threats. Developing intrusion detection systems can improve cybersecurity and identify anomalies on a computer server. An efficient intrusion detection and prevention system will be created using machine learning techniques. Each intrusion detection categorizationsystem evaluated in this study has its unique uses. The Firefly Optimization (FFO) technique was used to detect the intrusionsbefore the categorizationprocedure was carried out using a machine learning classifier. It considered how the anomalies in networks were categorized in this research. The outcomes of the detection techniques will be validated using the Knowledge Discovery Dataset (KDD-CUP 99). The proposed method involves Probabilistic Neural Network for the categorization. The implementation will assess many performance metrics for various cyber-attack types, including specificity, recall, F1-score, accuracy, precision, and sensitivity. The proposed technique achieves a high accuracy of 98.99%.

A Brief Survey of Recent Advances and Methodologies for the Security Control of Complex Cyber-Physical Networks.

Complex cyber-physical networks combine the prominent features of complex networks and cyber-physical systems (CPSs), and the interconnections between the cyber layer and physical layer usually pose significant impacts on its normal operation. Many vital infrastructures, such as electrical power grids, can be effectively modeled as complex cyber-physical networks. Given the growing importance of complex cyber-physical networks, the issue of their cybersecurity has become a significant concern in both industry and academic fields. This survey is focused on some recent developments and methodologies for secure control of complex cyber-physical networks. Besides the single type of cyberattack, hybrid cyberattacks are also surveyed. The examination encompasses both cyber-only hybrid attacks and coordinated cyber-physical attacks that leverage the strengths of both physical and cyber attacks. Then, special focus will be paid to proactive secure control. Reviewing existing defense strategies from topology and control perspectives aims to proactively enhance security. The topological design allows the defender to resist potential attacks in advance, while the reconstruction process can aid in reasonable and practical recovery from unavoidable attacks. In addition, the defense can adopt active switching-based control and moving target defense strategies to reduce stealthiness, increase the cost of attacks, and limit the attack impacts. Finally, conclusions are drawn and some potential research topics are suggested.

Differential Evolution-Based Three Stage Dynamic Cyber-Attack of Cyber-Physical Power Systems

With the rapid development of communication, control, and computer technology, traditional power systems have evolved into cyber-physical power system (CPPS). However, CPPS not only affords convenience but also introduces more cyber-attacks. Among many types of cyber-attacks, false data injection attacks (FDIAs) have drawn much attention in the CPPS security domain due to their stealthiness. Most FDIAs are based on the static model on a single snapshot and often ignore the reality of dynamically time-evolving CPPS. Accordingly, this article proposes a novel three-stage dynamic false data injection attack (DFDIA) model in CPPS by considering potential dynamic behaviors. To consider both attack location and attack amplitude, the designing DFDIA is formulated as two constrained single-objective optimization problems. Two versions of constrained differential evolution are presented as the solver to determine the attack location and optimize the attack vector for collaboratively altering the meter measurements. Then, an interval state forecasting-based countermeasure is proposed to detect the established DFDIA. In this detector, the variation bounds of state values are determined via ensemble deep learning-based state forecasting method. Finally, extensive simulation results on several IEEE bus systems demonstrate the feasibility of DFDIA and the effectiveness of the defense mechanism.

Алгоритм выявления угроз информационной безопасности в распределенных мультисервисных сетях органов государственного управления

The results of studies are presented, the purpose of which was to develop an algorithm for identifying information security threats in distributed multiservice networks that provide information interaction of regional government bodies, as well as their communication with the population of the region. The relevance of the research topic is due to a significant increase in various types of cyber attacks on the computer networks of public authorities and the need to increase the level of security of these networks by intellectualizing methods for combating information security threats. The algorithm is based on the use of machine learning methods to analyze incoming traffic in order to identify events that affect the state of information security of public authorities. The algorithm provides for input traffic preprocessing, as a result of which a set of images (signatures) obtained from Wasm binary files is formed, and then the image classifier is launched. It contains a sequential inclusion of deep neural networks – a convolutional neural network for signature classification and a recurrent network that processes the sequences obtained at the output of the convolutional network. Features of the formation of signatures in the proposed algorithm, as well as sequences at the input to the recurrent network, make it possible to obtain the resulting assessment of information security, taking into account the history of its current state. The output of the recurrent network is aggregated with the result of comparing the actual signatures with those available in the database. The aggregation is performed by the fuzzy inference system of the second type, using the implication according to the Mamdani algorithm, which generates the final assessment of information security threats. Software was developed that implements the proposed algorithm, experiments were carried out on a synthetic data set, which showed the efficiency of the algorithm, confirmed the feasibility of its further improvement.

A Review on Major Cyber Threats and Recommended Counter Measures

Abstract: It was predicted that the number of cyber attacks will rise by a factor of two every year. There have been several highprofile cyber attacks on government organizations in India in recent years. Ransomware attacks, Advanced Persistent Threats, Internet of Things, Cloud security risks, Insider threats, Social engineering attacks, Supply chain attacks, Zero-day exploits in cyber threats are some of the significant types of cyber attacks affecting Indian government entities. Security measures, such as regularly backing up important data, installing antivirus software, training employees on how to identify and avoid phishing emails, and maintaining up-to-date software and operating systems are common countermeasures against significant cyber attacks. Preventing cyber attacks requires a multi-layered approach that addresses vulnerabilities in people, processes, and technology. Empowering, the agencies like CERT-In for cyber resilience, strengthening the penalty framework for noncompliance, advisories on information and data security practices are some of the strategies adopted by the government to secure cyberspace. It is necessary to stay informed about the latest threats and continually reassess and update security measures as needed.

Real-time botnet detection on large network bandwidths using machine learning

Botnets are one of the most harmful cyberthreats, that can perform many types of cyberattacks and cause billionaire losses to the global economy. Nowadays, vast amounts of network traffic are generated every second, hence manual analysis is impossible. To be effective, automatic botnet detection should be done as fast as possible, but carrying this out is difficult in large bandwidths. To handle this problem, we propose an approach that is capable of carrying out an ultra-fast network analysis (i.e. on windows of one second), without a significant loss in the F1-score. We compared our model with other three literature proposals, and achieved the best performance: an F1 score of 0.926 with a processing time of 0.007 ms per sample. We also assessed the robustness of our model on saturated networks and on large bandwidths. In particular, our model is capable of working on networks with a saturation of 10% of packet loss, and we estimated the number of CPU cores needed to analyze traffic on three bandwidth sizes. Our results suggest that using commercial-grade cores of 2.4 GHz, our approach would only need four cores for bandwidths of 100 Mbps and 1 Gbps, and 19 cores on 10 Gbps networks.

A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions

Internet usage has grown exponentially, with individuals and companies performing multiple daily transactions in cyberspace rather than in the real world. The coronavirus (COVID-19) pandemic has accelerated this process. As a result of the widespread usage of the digital environment, traditional crimes have also shifted to the digital space. Emerging technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and cryptocurrencies are raising security concerns in cyberspace. Recently, cyber criminals have started to use cyber attacks as a service to automate attacks and leverage their impact. Attackers exploit vulnerabilities that exist in hardware, software, and communication layers. Various types of cyber attacks include distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware. Due to new-generation attacks and evasion techniques, traditional protection systems such as firewalls, intrusion detection systems, antivirus software, access control lists, etc., are no longer effective in detecting these sophisticated attacks. Therefore, there is an urgent need to find innovative and more feasible solutions to prevent cyber attacks. The paper first extensively explains the main reasons for cyber attacks. Then, it reviews the most recent attacks, attack patterns, and detection techniques. Thirdly, the article discusses contemporary technical and nontechnical solutions for recognizing attacks in advance. Using trending technologies such as machine learning, deep learning, cloud platforms, big data, and blockchain can be a promising solution for current and future cyber attacks. These technological solutions may assist in detecting malware, intrusion detection, spam identification, DNS attack classification, fraud detection, recognizing hidden channels, and distinguishing advanced persistent threats. However, some promising solutions, especially machine learning and deep learning, are not resistant to evasion techniques, which must be considered when proposing solutions against intelligent cyber attacks.

A Novel Hybrid Edge Detection and LBP Code-Based Robust Image Steganography Method

In digital image processing and steganography, images are often described using edges and local binary pattern (LBP) codes. By combining these two properties, a novel hybrid image steganography method of secret embedding is proposed in this paper. This method only employs edge pixels that influence how well the novel approach embeds data. To increase the quantity of computed edge pixels, several edge detectors are applied and hybridized using a logical OR operation. A morphological dilation procedure in the hybridized edge image is employed to this purpose. The least significant bits (LSB) and all LBP codes are calculated for edge pixels. Afterward, these LBP codes, LSBs, and secret bits using an exclusive-OR operation are merged. These resulting implanted bits are delivered to edge pixels’ LSBs. The experimental results show that the suggested approach outperforms current strategies in terms of measuring perceptual transparency, such as peak signal-to-noise ratio (PSNR) and structural similarity index (SSI). The embedding capacity per tempered pixel in the proposed approach is also substantial. Its embedding guidelines protect the privacy of implanted data. The entropy, correlation coefficient, cosine similarity, and pixel difference histogram data show that our proposed method is more resistant to various types of cyber-attacks.

A new framework for APT attack detection based on network traffic

Advanced Persistent Threat (APT) attack detection and monitoring has attracted a lot of attention recently when this type of cyber-attacks is growing in both number and dangerous levels. In this paper, a new APT attack model, which is the combination of three different neural network layers including: Multi-layer Perceptron (MLP), Inference (I), and Graph Convolutional Networks (GCN) is proposed. The new model is named MIG for short. In this model, the MLP layer is in charge of aggregating and extracting properties of the IPs based on flow network in Network traffic, while the Inference layer is responsible for building IP information profiles by grouping and concatenating flow networks generated from the same IP. Finally, the GCN layer is used for analyzing and reconstructing IP features based on the behavior extraction process from IP information records. The APT attacks detection method based on network traffic using this MIG model is new, and has yet been proposed and applied anywhere. The novelty and uniqueness of this method is the combination of many different data mining techniques in order to calculate, extract and represent the relationship and the correlation between APT attack behaviors based on Network traffic. In MIG model, many meaningful anomalous properties and behaviors of APT attacks are synthesized and extracted, which help improve the performance of APT attack detection. The experimental results showed that the proposed method is meaningful in both theory and practice since the MIG model not only improves the ability to correctly detect APT attacks in network traffic but also minimizes false alarms.

Early detection of cyber–physical attacks on fast charging stations using machine learning considering vehicle-to-grid operation in microgrids

The fast-charging stations play an important role in increasing the adoption of the electric vehicles. The “vehicle-to-grid” concept allows the electric vehicles to provide ancillary services to support the distribution system operation. The implementation of such a concept dictates the integration of communication protocols, which leads to cyber vulnerability issues. Such cyberattacks to the fast-charging stations may lead to increased stress on the aging assets as well as denial of the ancillary service provision, leading to financial losses and power outages. This work looks into the development of a novel approach that uses machine learning to early detect such attacks. Three types of cyber attacks are considered under the denial-of-service category. The study investigated the effectiveness of the proposed approach when considering different time resolutions of metering data. The proposed approach has been tested on a microgrid equipped with renewable energy resources as well as electric vehicles in vehicle-to-grid-mode. The results have shown that the detection accuracy increases in case of the high-time resolution compared to the low-time resolution metering data. The results have also shown that the proposed approach was successful in early detecting all three types of cyberattacks at an average accuracy of nearly 98%.

Adaptive Neural Event-Triggered Control of Networked Markov Jump Systems Under Hybrid Cyberattacks.

This article is concerned with the neural network (NN)-based event-triggered control problem for discrete-time networked Markov jump systems with hybrid cyberattacks and unmeasured states. The event-triggered mechanism (ETM) is used to reduce the communication load, and a Luenberger observer is introduced to estimate the unmeasured states. Two kinds of cyberattacks, denial-of-service (DoS) attacks and deception attacks, are investigated due to the vulnerability of cyberlayer. For the sake of mitigating the impact of these two types of cyberattacks on system performance, the ETM under DoS jamming attacks is discussed first, and a new estimation of such mechanism is given. Then, the NN technique is applied to approximate the injected false information. Some sufficient conditions are derived to guarantee the boundedness of the closed-loop system, and the observer and controller gains are presented by solving a set of matrix inequalities. The effectiveness of the presented control method is demonstrated by a numerical example.