Types Of Attacks Research Articles

A bizarre synthesized cascaded optimized predictor (BizSCOP) model for enhancing security in cloud systems

Due to growing network data dissemination in cloud, the elasticity, pay as you go options, globally accessible facilities, and security of networks have become increasingly important in today's world. Cloud service providers, including AWS, Azure, GCP, and others, facilitate worldwide expansion within minutes by offering decentralized communication network functions, hence providing security to cloud is still remains a challenging task. This paper aims to introduce and evaluate the Biz-SCOP model, a novel intrusion detection system developed for cloud security. The research addresses the pressing need for effective intrusion detection in cloud environments by combining hybrid optimization techniques and advanced deep learning methodologies. The study employs prominent intrusion datasets, including CSE-CIC-IDS 2018, CIC-IDS 2017, and a cloud intrusion dataset, to assess the proposed model's performance. The study's design involves implementing the Biz-SCOP model using Matlab 2019 software on a Windows 10 OS platform, utilizing 8 GB RAM and an Intel core i3 processor. The hybrid optimization approach, termed HyPSM, is employed for feature selection, enhancing the model's efficiency. Additionally, an intelligent deep learning model, C2AE, is introduced to discern friendly and hostile communication, contributing to accurate intrusion detection. Key findings indicate that the Biz-SCOP model outperforms existing intrusion detection systems, achieving notable accuracy (99.8%), precision (99.7%), F1-score (99.8%), and GEO (99.9%). The model excels in identifying various attack types, as demonstrated by robust ROC analysis. Interpretations and conclusions emphasize the significance of hybrid optimization and advanced deep learning techniques in enhancing intrusion detection system performance. The proposed model exhibits lower computational load, reduced false positives, ease of implementation, and improved accuracy, positioning it as a promising solution for cloud security.

Meta-Learning for Multi-Family Android Malware Classification

With the emergence of smartphones, Android has become a widely used mobile operating system. However, it is vulnerable when encountering various types of attacks. Every day, new malware threatens the security of users’ devices and private data. Many methods have been proposed to classify malicious applications, utilizing static or dynamic analysis for classification. However, previous methods still suffer from unsatisfactory performance due to two challenges. First, they are unable to address the imbalanced data distribution problem, leading to poor performance for malware families with few members. Second, they are unable to address the zero-day malware (zero-day malware refers to malicious applications that exploit unknown vulnerabilities) classification problem. In this paper, we introduce an innovative meta -learning approach for m ulti-family A ndroid m alware c lassification named Meta-MAMC , which uses meta-learning technology to learn meta-knowledge (i.e. the similarities and differences among different malware families) of few-family samples and combines new sampling algorithms to solve the above challenges. Meta-MAMC integrates (i) the meta-knowledge contained within the dataset to guide models in learning to identify unknown malware, and (ii) more accurate and diverse tasks based on novel sampling strategies, as well as directly adapting meta-learning to a new few-sample and zero-sample task to classify families. We have evaluated Meta-MAMC on two popular datasets and a corpus of real-world Android applications. The results demonstrate its efficacy in accurately classifying malicious applications belonging to certain malware families, even achieving 100% classification in some families.

A Robust DDoS Intrusion Detection System Using Convolutional Neural Network

In today’s digital age, the proliferation of network-connected devices has triggered a surge in cyberattacks. Distributed Denial-of-Service (DDoS) attacks pose a particularly formidable challenge to network security by disrupting access to vital services. While numerous researchers have proposed DDoS detection methods utilizing machine learning and deep learning techniques, developing a robust and reliable DDoS intrusion detection system remains challenging. This challenge is exacerbated by issues such as highly imbalanced data, multi-classification, and computational complexity. This paper proposes an innovative feature selection approach to create a robust intrusion detection system capable of detecting and classifying recent common DDoS attack types. We evaluate the performance of our model on the CICDDoS2019 benchmark dataset. Our experimental results demonstrate that our proposed model outperforms existing methods, achieving a detection accuracy of 96.82%, a recall of 96.82%, a precision of 96.76%, and an F1 score of 96.50%. Additionally, our model exhibits faster prediction times, with the ability to predict an attack in just 0.189 ms. Notably, our approach, combined with preprocessing and feature selection techniques, outperforms previous works and baseline models in DDoS attack classification.

A Provably Secure Anonymous Authentication Protocol for Consumer and Service Provider Information Transmissions in Smart Grids

Smart grids integrate information technology, decision support systems, communication networks, and sensing technologies. All these components cooperate to facilitate dynamic power adjustments based on received client consumption reports. Although this brings forth energy efficiency, the transmission of sensitive data over the public internet exposes these networks to numerous attacks. To this end, numerous security solutions have been presented recently. Most of these techniques deploy conventional cryptographic systems such as public key infrastructure, blockchains, and physically unclonable functions that have either performance or security issues. In this paper, a fairly efficient authentication scheme is developed and analyzed. Its formal security analysis is carried out using the Burrows–Abadi–Needham (BAN) logic, which shows that the session key negotiated is provably secure. We also execute a semantic security analysis of this protocol to demonstrate that it can resist typical smart grid attacks such as privileged insider, guessing, eavesdropping, and ephemeral secret leakages. Moreover, it has the lowest amount of computation costs and relatively lower communication overheads as well as storage costs.

Worldwide Trends in COVID-19-Related Attacks Against Healthcare: A Review of the Safeguarding Health in Conflict Coalition Database.

During the COVID-19 pandemic, violence targeting healthcare reportedly increased. Attacks against healthcare can severely hamper the public health response during a pandemic. Descriptive data analysis of these attacks may be helpful to develop prevention and mitigation strategies. This study aimed to investigate trends regarding COVID-19-related attacks against healthcare from January 2020 until January 2023. COVID-19-related incidents occurring between January 2020 and January 2023 were extracted from the Safeguarding Health in Conflict Coalition database and screened for eligibility. Included incidents were linked to COVID-19 health measures or were attacks directly interfering with COVID-19 healthcare, including conflict-related attacks. Data collected per incident included temporal factors; country; setting; attack and weapon type; perpetrator; motive; number of healthcare workers (HCWs) killed, injured, or kidnapped; and health facility damage. The study identified 255 COVID-19-related attacks against healthcare, with 18 HCWs killed, 147 HCWs injured, and 86 facilities damaged. The highest attack frequency was reported during the beginning of the pandemic and predominantly concerned stigma-related attacks against healthcare. Reported incidents in 2021 included attacks targeting vaccination campaigns, as well as conflict-related attacks interfering with COVID-19 healthcare. COVID-19-related attacks against healthcare occurred in heterogeneous contexts throughout the pandemic. Due to underreporting, the data presented are a minimum estimate of the actual magnitude of violence. The findings of this study emphasize the importance of public education campaigns, improved coordination between healthcare organizations and law enforcement, and the possible need to bolster the security of medical facilities and health workers.

A novel approach detection for IIoT attacks via artificial intelligence

A novel approach detection for IIoT attacks via artificial intelligence

DTT: A Dual-domain Transformer model for Network Intrusion Detection

With the rapid evolution of network technologies, network attacks have become increasingly intricate and threatening. The escalating frequency of network intrusions has exerted a profound influence on both industrial settings and everyday activities. This underscores the urgent necessity for robust methods to detect malicious network traffic. While intrusion detection techniques employing Temporal Convolutional Networks (TCN) and Transformer architectures have exhibited commendable classification efficacy, most are confined to the temporal domain. These methods frequently fall short of encompassing the entirety of the frequency spectrum inherent in network data, thereby resulting in information loss. To mitigate this constraint, we present DTT, a novel dual-domain intrusion detection model that amalgamates TCN and Transformer architectures. DTT adeptly captures both high-frequency and low-frequency information, thereby facilitating the simultaneous extraction of local and global features. Specifically, we introduce a dual-domain feature extraction (DFE) block within the model. This block effectively extracts global frequency information and local temporal features through distinct branches, ensuring a comprehensive representation of the data. Moreover, we introduce an input encoding mechanism to transform the input into a format suitable for model training. Experiments conducted on two distinct datasets address concerns regarding data duplication and diverse attack types, respectively. Comparative experiments with recent intrusion detection models unequivocally demonstrate the superior performance of the proposed DTT model.

CyberGrid: an IEC61850 protocol-based substation automation virtual cyber range for cybersecurity research in the smart grid

ABSTRACT A cyber range provides a controlled environment for simulating mission-critical systems for cybersecurity research following the high risks involved in conducting experiments in real-life systems. Existing cyber ranges do not provide close emulation of Cyber-Physical Systems (CPS) in the Smart Grid Networks (SGNs), with emphasis on industry-based proprietary and IED protocols. This paper presents CyberGrid Testbed – a virtual Cyber-Range developed by the CyberSCADA Research Laboratory at Obafemi Awolowo University, Ile-Ife, Nigeria, which emulates Substation Automation processes with IEC61850 and Modbus/TCP protocols and support for MMS, and IED. This was built on OpenPLC6185, simulating Twelve attack patterns, and four attack types.

Towards secure IoT networks: A comprehensive study of metaheuristic algorithms in conjunction with CNN using a self-generated dataset

The Internet of Things (IoT) has radically reformed various sectors and industries, enabling unprecedented levels of connectivity and automation. However, the surge in the number of IoT devices has also widened the attack surface, rendering IoT networks potentially susceptible to a plethora of security risks. Addressing the critical challenge of enhancing security in IoT networks is of utmost importance. Moreover, there is a considerable lack of datasets designed exclusively for IoT applications. To bridge this gap, a customized dataset that accurately mimics real-world IoT scenarios impacted by four different types of attacks—blackhole, sinkhole, flooding, and version number attacks was generated using the Contiki-OS Cooja Simulator in this study. The resulting dataset is then consequently employed to evaluate the efficacy of several metaheuristic algorithms, in conjunction with Convolutional Neural Network (CNN) for IoT networks. •The proposed study's goal is to identify optimal hyperparameters for CNNs, ensuring their peak performance in intrusion detection tasks.•This study not only intensifies our comprehension of IoT network security but also provides practical guidance for implementation of the robust security measures in real-world IoT applications.

Realization of Authenticated One-Pass Key Establishment on RISC-V Micro-Controller for IoT Applications

Internet-of-things networks consist of multiple sensor devices spread over a wide area. In order to protect the data from unauthorized access and tampering, it is essential to ensure secure communication between the sensor devices and the central server. This security measure aims to guarantee authenticity, confidentiality, and data integrity. Unlike traditional computing systems, sensor node devices are often limited regarding memory and computing power. Lightweight communication protocols, such as LoRaWAN, were introduced to overcome these limitations. However, despite the lightweight feature, the protocol is vulnerable to different types of attacks. This proposal presents a highly secure key establishment protocol that combines two cryptography schemes: Elliptic Curve Qu–Vanstone and signcryption key encapsulation. The protocol provides a method to establish a secure channel that inherits the security properties of the two schemes. Also, it allows for fast rekeying with only one exchange message, significantly reducing the handshake complexity in low-bandwidth communication. In addition, the selected schemes complement each other and share the same mathematical operations in elliptic curve cryptography. Moreover, with the rise of a community-friendly platform like RISC-V, we implemented the protocol on a RISC-V system to evaluate its overheads regarding the cycle count and execution time.

Interactive attack-defense for generalized person re-identification

Generalized Person Re-Identification (GReID) aims to develop a model capable of robust generalization across unseen target domains, even with training on a limited set of observed domains. Recently, methods based on the Attack-Defense mechanism are emerging as a prevailing technology to this issue, which treats domain transformation as a type of attack and enhances the model’s generalization performance on the target domain by equipping it with a defense module. However, a significant limitation of most existing approaches is their inability to effectively model complex domain transformations, largely due to the separation of attack and defense components. To overcome this limitation, we introduce an innovative Interactive Attack-Defense (IAD) mechanism for GReID. The core of IAD is the interactive learning of two models: an attack model and a defense model. The attack model dynamically generates directional attack information responsive to the current state of the defense model, while the defense model is designed to derive generalizable representations by utilizing a variety of attack samples. The training approach involves a dual process: for the attack model, the aim is to increase the challenge for the defense model in countering the attack; conversely, for the defense model, the focus is on minimizing the effects instigated by the attack model. This interactive framework allows for mutual learning between attack and defense, creating a synergistic learning environment. Our diverse experiments across datasets confirm IAD’s effectiveness, consistently surpassing current state-of-the-art methods, and using MSMT17 as the target domain in different protocols resulted in a notable 13.4% improvement in GReID task average Rank-1 accuracy. Code is available at: https://github.com/lhf12278/IAD.

Improving resilience and efficiency in the energy sector: A perspective on cybersecurity and renewable energy storage.

The study investigates how resilience and efficiency can be improved in the energy sector using cybersecurity. The main objective of the paper is to enable organizations in the energy sector to develop a robust framework to manage renewable  energy storage effectively with little to no cost consequence because of cyberattacks. A survey data saved in the repository of Kaggle was extracted and utilized for the purpose of the study, it contains cybersecurity indicators such as anomaly score, log source, attack types, attacks severity, and response action, which were the features adopted for developing a model, while the target variable was renewable energy generation. A machine learning approach was adopted, with the Rsquared indicating that 61 % variation in renewable energy store is explained by the features included in the model. The study recommends that there should be an increased investment in cybersecurity structure to safeguard energy systems against cyber threats. Also, stakeholders should implement comprehensive training programs to enhance cybersecurity awareness and skills of personnel working in the energy sector.

Edwards Curve Digital Signature Algorithm for Video Integrity Verification on Blockchain framework

Within the field of forensic science, video integrity is an essential component that ensures the validity and dependability of visual evidence that is essential for court cases. Maintaining the integrity of justice in a time when digital modification tools are easily accessible requires making sure that video recordings are unaltered. Video footage is carefully inspected by forensic analysts who use advanced tools to look for indications of manipulation or change. This paper presents a novel, lightweight approach for verifying the integrity of video data. The proposed method utilizes the blockchain and the Edwards Curve Digital Signature Algorithm, coupled with the BLAKE2b hash function. Signatures are generated for video clips with a predetermined size called video segments and stored in blocks chronologically. The signature of the previous block is stored in the current block to add another layer of security. At the time of validation, these signatures are verified. Experimental results show that the proposed method outperforms state-of-the-art methods in both speed and security. Our method is capable of identifying any type of forgery on any video file, by anyone, at any given moment, with insignificant additional storage requirements. Furthermore, our security analysis shows that our method is resilient against various types of attacks, including collision attacks, key substitution attacks, side-channel attacks, and chosen message attacks. The proposed lightweight video integrity verification method is better suited for use in resource constrained devices.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

The Impact of Adversarial Attacks on Federated Learning: A Survey.

Federated learning (FL) has emerged as a powerful machine learning technique that enables the development of models from decentralized data sources. However, the decentralized nature of FL makes it vulnerable to adversarial attacks. In this survey, we provide a comprehensive overview of the impact of malicious attacks on FL by covering various aspects such as attack budget, visibility, and generalizability, among others. Previous surveys have primarily focused on the multiple types of attacks and defenses but failed to consider the impact of these attacks in terms of their budget, visibility, and generalizability. This survey aims to fill this gap by providing a comprehensive understanding of the attacks' effect by identifying FL attacks with low budgets, low visibility, and high impact. Additionally, we address the recent advancements in the field of adversarial defenses in FL and highlight the challenges in securing FL. The contribution of this survey is threefold: first, it provides a comprehensive and up-to-date overview of the current state of FL attacks and defenses. Second, it highlights the critical importance of considering the impact, budget, and visibility of FL attacks. Finally, we provide ten case studies and potential future directions towards improving the security and privacy of FL systems.

Applying self-supervised learning to network intrusion detection for network flows with graph neural network

Graph Neural Networks (GNNs) have garnered intensive attention for Network Intrusion Detection System (NIDS) due to their suitability for representing the network traffic flows. However, most present GNN-based methods for NIDS are supervised or semi-supervised. Network flows need to be manually annotated as supervisory labels, a process that is time-consuming or even impossible, making NIDS difficult to adapt to potentially complex attacks, especially in large-scale real-world scenarios. The existing GNN-based self-supervised methods focus on the binary classification of network flow as benign or not, and thus fail to reveal the types of attack in practice. This paper studies the application of GNNs to identify the specific types of network flows in an unsupervised manner. We first design an encoder to obtain graph embedding, that introduces the graph attention mechanism and considers the edge information as the only essential factor. Then, a self-supervised method based on graph contrastive learning is proposed. The method samples center nodes, and for each center node, generates subgraph by it and its direct neighbor nodes, and corresponding contrastive subgraph from the interpolated graph, and finally constructs positive and negative samples from subgraphs. Furthermore, a structured contrastive loss function based on edge features and graph local topology is introduced. To the best of our knowledge, it is the first GNN-based self-supervised method for the multiclass classification of network flows in NIDS. Detailed experiments conducted on four real-world datasets (NF-Bot-IoT, NF-Bot-IoT-v2, NF-CSE-CIC-IDS2018, and NF-CSE-CIC-IDS2018-v2) systematically compare our model with the state-of-the-art supervised and self-supervised models, illustrating the considerable potential of our method. Our code is accessible through https://github.com/renj-xu/NEGSC.

The robustness of some Carboniferous fossil leaf venation networks to simulated damage.

Biological networks vary widely in their architecture and functional properties. Branching networks are good for transportation efficiency, while networks including loops offer good resistance to damage, and examples of these two topologies are found in leaf venation networks. The first plants with reticulate (loopy) leaf venation evolved in the Pennsylvanian of the Carboniferous, but the responses of different venation network architectures from this time period to damage are currently largely unknown. Here we address this issue with a computational analysis of venation network robustness that is focused on fossil leaves from the Pennsylvanian. We attacked fossil venation networks with simulated damage to individual vein segments and leaf blades. For both types of attack, branched venation networks are the least robust to damage, with greater robustness shown by the net-like reticulate networks found in the Pennsylvanian. A living angiosperm Betula alba was the most robust in our analysis. This may highlight a role for resistance to damage in the evolution of reticulate leaf venation in the Carboniferous, but further work is needed to answer the broader question of why reticulate leaf venation first evolved in the Pennsylvanian.

A framework for detecting zero-day exploits in network flows

Zero-day attack detection solutions aim to proactively identify unknown threats targeting valuable assets within a given system. While many Intrusion Detection System (IDS) solutions leverage learning techniques to build novel attack detection systems, they often focus on enhancing accuracy for specific attack types, overlooking the potential for multiple attack scenarios. Therefore, we introduce a novel framework for detecting zero-day attacks that evade current detection systems. Our framework enhances attack identification and qualification through a hybrid learning approach, where supervised learning ensures detection of known attacks and unsupervised learning. It encompasses intrusion detection phases from data collection to new attack class detection by identifying anomalies in real-time network flow data. Unsupervised learning, which involves grouping similar data points into clusters, establishes minimum distances within these clusters. This process triggers cluster division when certain thresholds are reached. Finally, an online supervised learning process validates our approach’s effectiveness in identifying anomalies associated with zero-day attack flows.This approach significantly reduces the False Detection Rate (FDR) without solely focusing on optimizing machine learning (ML) and deep learning (DL) algorithms hyper-parameters. We evaluated our framework on two datasets: one from a real industrial context at IBM and the NSL-KDD dataset. The results demonstrate our framework’s ability to detect anomalies in previously zero-day attack targets. On average, we identified 71 anomalous flows per target, achieving an overall average online learning accuracy of 98.4% for the IBM dataset and 96.6% for the NSL-KDD dataset, thereby validating the detection of these new attack scenarios.

Detection and Characterization of DDoS Attacks using Time Based Features

Abstract: In today's evolving cyber security environment, DDoS attacks are now one of the riskiest and most expensive attacks. DDoS detection and prevention has become critical as businesses and government agencies are affected by DDoS, which can disrupt network services and cause billions of dollars in damage. Our project offers a solution that detects different types of DDoS attacks using machine learning algorithms. The main aim of the project is to detect attacks of binary classification and multi class classification, this also reduces the time complexity. The proposed system studies the efficiency of time based features to detect and classify types of DDoS attacks using binary and multiclass classification. Using machine learning algorithms, the system analyzes this data to detect between legitimate and the attack network request. The addition of a time based features subset increases the accuracy of the system, reduces training time without compromising test accuracy. The general purpose of the project is not only detection research. It can be seen that training a subset of time-based features can reduce training time without affecting test accuracy; thus, the small subset of time-based features is itself useful for near-realtime applications with continuous learning.