Types Of Cyber-attacks Research Articles

Multi-group consensus of multi-agent systems subject to semi-Markov jump topologies against hybrid cyber-attacks

Multi-agent systems are widely used in practice. The existing results on the consensus of multi-agent systems mainly focus on the complete consensus, which can not deal with the situation of the system in the face of multiple tasks. In this paper, the multi-group consensus problem of multi-agent systems with semi-Markov jump topologies against hybrid cyber-attacks is studied. The purpose is to ensure that the multi-agent systems can achieve different consensus goals when they encounter hybrid cyber-attacks, and to solve the problem of time-varying communication topology between agents modeled by the semi-Markov process. Additionally, two types of cyber-attacks are taken into account in a single framework through two independent sets of Bernoulli sequences. Subsequently, a necessary condition is established to guide the system toward achieving the multi-group consensus objective. Lastly, a series of illustrative examples are presented to underscore the validity of the designed controller.

Vulnerability of Students of Masaryk University to Two Different Types of Phishing

According to the European Union Agency for Cybersecurity’s (ENISA) Threat Landscape (ETL) report 2020, phishing is the most commonly used type of cyberattack. Phishing is the technique of delivering false communications that appear to be from a real and respectable source, typically via e-mail or text message. The attacker aims to steal money, obtain access to sensitive data, and login information, or install malware on the victim’s device. Data from the same report shows that during the COVID-19 pandemic, phishing attacks increased by 667% in one month. Simultaneously, warnings about expected waves of phishing e-mails at Masaryk University in Czechia were encountered more often. However, at the time this article was written, there was de facto no anti-phishing research dealing with the problem of phishing attacks on Czech universities. The present article focuses on unintentional human error on the side of students of Masaryk University. The main aim of this article is to uncover the profile of the user who is most prone to victimisation of phishing in the university setting. These results were achieved by performing two real-life phishing simulations. Data suggests that female students are more prone to crash for targeted e-mails. At the same time, all students are more susceptible to spear-phishing attacks than to the generic ones. Findings are explained by analysing the empirical results of the two real-life phishing attacks conducted.

Distributed Consensus Estimation for Networked Multi-Sensor Systems under Hybrid Attacks and Missing Measurements.

Cyber-security research on networked multi-sensor systems is crucial due to the vulnerability to various types of cyberattacks. For the development of effective defense measures, attention is required to gain insight into the complex characteristics and behaviors of cyber attacks from the attacker's perspective. This paper aims to tackle the problem of distributed consensus estimation for networked multi-sensor systems subject to hybrid attacks and missing measurements. To account for both random denial of service (DoS) attacks and false data injection (FDI) attacks, a hybrid attack model on the estimator-to-estimator communication channel is presented. The characteristics of missing measurements are defined by random variables that satisfy the Bernoulli distribution. Then a modified consensus-based distributed estimator, integrated with the characteristics of hybrid attacks and missing measurements, is presented. For reducing the computational complexity of the optimal distributed estimation method, a scalable suboptimal distributed consensus estimator is designed. Sufficient conditions are further provided for guaranteeing the stability of the proposed suboptimal distributed estimator. Finally, a simulation experiment on aircraft tracking is executed to validate the effectiveness and feasibility of the proposed algorithm.

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

The escalating risk of cyber threats requires continuous advances in security monitoring techniques. This survey paper provides a comprehensive overview of recent research into novel methods for cyber threat detection, encompassing diverse approaches such as machine learning, artificial intelligence, behavioral analysis and anomaly detection. Machine learning plays a central role in cyber threat detection, highlighting the effectiveness of deep neural networks in identifying evolving threats. Their adaptability to changing attack patterns is emphasized, underlining their importance for real-time security monitoring. In parallel, ensemble learning is explored, combining multiple models to improve overall detection accuracy and create a robust defense against a spectrum of cyber threats. The literature reviewed highlights the importance of behavioral analysis, with a novel approach that integrates user behaviour profiling with anomaly detection. This has proven effective in identifying suspicious activity within a network, particularly insider threats and stealthy attacks. Another behavioral framework using User and Entity Behavior Analytics (UEBA) is presented for enhanced anomaly detection, highlighting the importance of context-aware monitoring in improving threat detection accuracy. Collaborative defense mechanisms emerge as a major focus of the research papers reviewed, exploring the potential of sharing threat information between organisations to enhance collective security monitoring. Their findings underscore the importance of a collaborative approach to staying ahead of rapidly evolving cyber threats. Some types of cyber-attacks are also analysed in the context of a security operations centre (SOC) monitoring environment using a security information and event management (SIEM) tool - Splunk. In conclusion, this survey paper synthesizes recent advances in cyber threat detection methods in security monitoring that integrate machine learning, behavioral analysis, and collaborative defense strategies. As cyber threats continue to evolve, these novel methods provide valuable insights for researchers, practitioners, and organisations seeking to strengthen their cybersecurity defenses. This concise overview emphasises the multi-dimensional approach required to secure digital ecosystems, providing a concise yet comprehensive guide to modern cyber threat detection strategies.

The Most Important Types of Cyber Attacks that France is Expected to Face in the Future and the Cyber Security Measures it Must Implement to Protect Critical Infrastructure, Telecommunication Networks and Personal Data

As the digital landscape continues to evolve, nations like France find themselves on the frontline of an escalating cyber warfare scenario. This abstract provides an insightful overview of the most significant types of cyber attacks that France is expected to face in the future, offering a comprehensive analysis based on current trends and emerging technologies. The research delves into the realm of advanced persistent threats (APTs), examining the sophisticated techniques employed by state-sponsored actors and cybercriminal organizations to compromise critical infrastructure, sensitive data, and national security. It explores the evolving landscape of ransomware attacks, focusing on the potential impact on both public and private sectors, and the looming threat of extortion campaigns that could cripple essential services. Furthermore, the abstract sheds light on the rising concern of supply chain attacks, as interconnected global networks make businesses and government entities vulnerable to malicious actors seeking to exploit weaknesses in third-party systems. The research also explores the nuances of social engineering attacks, recognizing the human element as a critical vulnerability that threat actors may exploit through targeted phishing campaigns and manipulation tactics. In addition, the abstract touches upon the growing menace of Internet of Things (IoT) vulnerabilities, acknowledging the increased interconnectivity of devices and the potential for large-scale disruptions. It also considers the implications of emerging technologies such as artificial intelligence and quantum computing in shaping the future threat landscape. By examining these diverse aspects of cyber threats, this abstract aims to provide a forward-looking perspective on the challenges France is likely to encounter in the digital realm. As Cyber security becomes an integral component of national defense, understanding these anticipated threats is crucial for policymakers, security experts, and technology professionals seeking to fortify France’s resilience against the evolving nature of cyber attacks.

Defesa cibernética na guerra russo-ucraniana: um mapeamento dos ataques cibernéticos às infraestruturas críticas da Ucrânia

What cyberattacks did Ukraine’s critical infrastructure experience between February 2022 and February 2023 during the Russo-Ukrainian war? In recent months, Ukraine has experienced a significant increase in cyberattacks on its critical infrastructure. Therefore, the purpose of this study is to analyze the cyberattacks suffered by Ukraine’s critical infrastructure within the selected cutout. A mixed method research approach was used, operationalized through descriptive statistics, documentary analysis, and a systematic literature review. Based on the analyzed data from the CyberPeace Institute, the sector most affected was public administration (66), with the Disruption attack category being the most utilized (139). The types of cyberattacks were also evaluated, with the DDoS type being the most common (135). The collective (124), especially the People’s CyberArmy (48), was the most common in the actor category. In conclusion, we can say that attacks on critical infrastructure are a matter of national defense, which requires a revision of legislation on this issue and ensuring that the responsible bodies are prepared for future challenges.

Network Intrusion Detection and Anomaly Classification

A software application known as an intrusion detection system (IDS) is utilized to monitor networks for any unauthorized or malicious activities that may violate security policies related to system confidentiality, integrity, and availability. Our thesis involved conducting extensive literature reviews on various types of IDS, anomaly detection methods, and machine learning algorithms that can be utilized for detection and classification. IDS are crucial for safeguarding advanced communication networks and were initially designed to identify specific patterns, signatures, and rule violations. In recent years, machine learning and deep learning approaches have been employed in the field of network intrusion detection, providing promising alternatives. Our proposed system involved identifying noisy features through causal intervention, preserving only those features that had a causality with cyberattacks. The ML algorithm was then utilized to make a preliminary classification to select the most relevant types of cyberattacks, ultimately leading to the detection of unique labeled cyberattacks through the counterfactual detection algorithm. Keywords—Intrusion Detection System (IDS), anomaly detection, machine learning algorithms, deep learning, causal intervention, cyberattack classification, and counterfactual detection.

Multi-stage deep learning-based intrusion detection system for automotive Ethernet networks

Modern automobiles are increasing the demand for automotive Ethernet as a high-bandwidth and flexible in-vehicle network technology. However, since Ethernet does not have native support for authentication or encryption, intrusion detection systems (IDSs) are becoming an attractive security mechanism to detect malicious activities that may affect Ethernet-based communication in cars. This paper proposes a novel multi-stage deep learning-based intrusion detection system to detect and classify cyberattacks in automotive Ethernet networks. The first stage uses a Random Forest classifier to detect cyberattacks quickly. The second stage, on the other hand, uses a Pruned Convolutional Neural Network that minimizes false positive rates while classifying different types of cyberattacks. We evaluate our proposed IDS using two publicly available automotive Ethernet intrusion datasets. The experimental results show that our proposed solution detects cyberattacks with a similar detection rate and a faster detection time compared to other state-of-the-art baseline automotive Ethernet IDSs.

Implementing SIEM(Security Information and Environment Management) in Microsoft Azure

Abstract: In an increasingly interconnected and digital world, the need for robust cybersecurity measures is paramount. Cyberattacks can therefore occur upon any device at any moment of time in order to steal the sensitive information of the user or can result in identity theft and cyberbullying. There are varieties of attacks that may occur without the user being aware about the same that their computer has been attacked and the hacker has overall access of their data. Also, a user cannot sit in front of their device throughout their life to monitor and protect any type of cyberattack. Therefore, in order to solve the following problems and to enhance the overall security and accuracy of safeguarding the device and its data, we implement our project Security Information and Environment Management (SIEM) system within the Microsoft Azure cloud ecosystem. SIEM plays a critical role in monitoring, detecting, and responding to security threats, making it a crucial component of any organization's cybersecurity strategy. To view the notification of the attack for a user and all its details, we therefore connect the SIEM implementations and logs over Microsoft Azure platform, and generate the same with the help of a command-shell Windows PowerShell.

A Novel Architecture for an Intrusion Detection System Utilizing Cross-Check Filters for In-Vehicle Networks.

The Controller Area Network (CAN), widely used for vehicular communication, is vulnerable to multiple types of cyber-threats. Attackers can inject malicious messages into the CAN bus through various channels, including wireless methods, entertainment systems, and on-board diagnostic ports. Therefore, it is crucial to develop a reliable intrusion detection system (IDS) capable of effectively distinguishing between legitimate and malicious CAN messages. In this paper, we propose a novel IDS architecture aimed at enhancing the cybersecurity of CAN bus systems in vehicles. Various machine learning (ML) models have been widely used to address similar problems; however, although existing ML-based IDS are computationally efficient, they suffer from suboptimal detection performance. To mitigate this shortcoming, our architecture incorporates specially designed rule-based filters that cross-check outputs from the traditional ML-based IDS. These filters scrutinize message ID and payload data to precisely capture the unique characteristics of three distinct types of cyberattacks: DoS attacks, spoofing attacks, and fuzzy attacks. Experimental evidence demonstrates that the proposed architecture leads to a significant improvement in detection performance across all utilized ML models. Specifically, all ML-based IDS achieved an accuracy exceeding 99% for every type of attack. This achievement highlights the robustness and effectiveness of our proposed solution in detecting potential threats.

USE OF ARTIFICIAL INTELLIGENCE METHODS AND MODELS FOR IMPROVING EXPERT SYSTEMS OF INTRUSION DETECTION

In the domain of cyber security, the efficacy of Intrusion Detection Systems (IDS) is critical for the proactive identification and mitigation of cyber threats. This research delineates a novel paradigm for enhancing IDS accuracy through the integration of advanced Artificial Intelligence (AI) methodologies, thereby setting a new benchmark in network security defense mechanisms. Utilizing a synergistic approach that combines both descriptive and inferential statistical analyses, this study introduces an expert system endowed with the capability to detect network intrusions with an unparalleled accuracy rate of 99.98%. By incorporating Extreme Gradient Boosting (XGBoost) for the classification of predefined attack vectors and a Variational Autoencoder (VAE) for anomaly detection, the research extends the boundaries of current cyber threat detection frameworks. These methodologies not only enhance the precision of threat categorization but also introduce a mechanism for the system to adapt to novel, previously unidentified cyber threats through real-time learning and adaptation to emerging data patterns. Critically, the expert system is engineered to facilitate high-speed data processing and supports online learning, making it optimally suited for application in high-traffic network environments. The scientific novelty of this research is encapsulated in the formulation of advanced AI-driven models for the dual purposes of traffic anomaly detection and the classification of cyber-attack types based on distinctive behavioral characteristics. These models are meticulously designed to evolve, learning from new data in real time, thereby continuously enhancing the system's efficacy. In practical terms, the system provides a robust solution for the protection of digital ecosystems against intrusions, enabling the automatic filtration of malicious network traffic. Beyond its immediate applicability, the study contributes to the field of cyber security by laying down a foundational framework for the future exploration of AI-based security solutions. It invites further scientific inquiry into the development of adaptive, intelligent IDS mechanisms, potentially revolutionizing the approach to cyber defense strategies.

A New Time Series Dataset for Cyber-Threat Correlation, Regression and Neural-Network-Based Forecasting

In the face of escalating cyber threats that have contributed significantly to global economic losses, this study presents a comprehensive dataset capturing the multifaceted nature of cyber-attacks across 225 countries over a 14-month period from October 2022 to December 2023. The dataset, comprising 77,623 rows and 18 fields, provides a detailed chronology of cyber-attacks, categorized into eight critical dimensions: spam, ransomware, local infection, exploit, malicious mail, network attack, on-demand scan, and web threat. The dataset also includes ranking data, offering a comparative view of countries’ susceptibility to different cyber threats. The results reveal significant variations in the frequency and intensity of cyber-attacks across different countries and attack types. The data were meticulously compiled using modern AI-based data acquisition techniques, ensuring a high degree of accuracy and comprehensiveness. Correlation tests against the eight types of cyber-attacks resulted in the determination that on-demand scan and local infection are highly correlated, with a correlation coefficient of 0.93. Lastly, neural-network-based forecasting of these highly correlated factors (i.e., on-demand scan and local infection) reveals a similar pattern of prediction, with an MSE and an MAPE of 1.616 and 80.13, respectively. The study’s conclusions provide critical insights into the global landscape of cyber threats, highlighting the urgent need for robust cybersecurity measures.

Defeating Denial of Service Backdoor Attacks

Denial of Service (DoS) backdoor attacks are a significant threat to computer systems. Backdoor attacks involve the installation of unauthorized software on a target system, which is then used to launch various attacks against other systems. In this paper, we explore several techniques that can be used to defeat DoS backdoor attacks, including access control, encryption, network monitoring, patch management, incident response planning, and employee education. Denial of Service (DoS) and Backdoor attacks are common types of cyber-attacks that can cause severe damage to computer systems and networks. DoS attacks aim to disrupt the availability of a system by overwhelming it with traffic or exploiting vulnerabilities, while Backdoor attacks provide attackers with unauthorized access to a system. This paper proposes a framework for defeating both types of attacks by implementing security measures at multiple levels, including the application layer, network layer, and host layer. The proposed framework involves techniques such as traffic filtering, load balancing, network segmentation, access control, and anomaly detection. At the application layer, the framework proposes implementing security measures such as input validation, error handling, and resource allocation to prevent DoS attacks. At the network layer, the framework recommends deploying firewalls, routers, and intrusion detection systems to filter traffic and detect anomalies. At the host layer, the framework proposes implementing security measures such as operating system hardening, patch management, and antivirus software to prevent Backdoor attacks. The proposed framework aims to provide a comprehensive approach to defeating DoS and Backdoor attacks by combining multiple security measures to provide a layered defense. By implementing the proposed framework, organizations can enhance the security of their computer systems and networks and prevent these types of attacks from causing damage.

Detection of DoS Attacks for IoT in Information-Centric Networks Using Machine Learning: Opportunities, Challenges, and Future Research Directions

The Internet of Things (IoT) is a rapidly growing network that shares information over the Internet via interconnected devices. In addition, this network has led to new security challenges in recent years. One of the biggest challenges is the impact of denial-of-service (DoS) attacks on the IoT. The Information-Centric Network (ICN) infrastructure is a critical component of the IoT. The ICN has gained recognition as a promising networking solution for the IoT by supporting IoT devices to be able to communicate and exchange data with each other over the Internet. Moreover, the ICN provides easy access and straightforward security to IoT content. However, the integration of IoT devices into the ICN introduces new security challenges, particularly in the form of DoS attacks. These attacks aim to disrupt or disable the normal operation of the ICN, potentially leading to severe consequences for IoT applications. Machine learning (ML) is a powerful technology. This paper proposes a new approach for developing a robust and efficient solution for detecting DoS attacks in ICN-IoT networks using ML technology. ML is a subset of artificial intelligence (AI) that focuses on the development of algorithms. While several ML algorithms have been explored in the literature, including neural networks, decision trees (DTs), clustering algorithms, XGBoost, J48, multilayer perceptron (MLP) with backpropagation (BP), deep neural networks (DNNs), MLP-BP, RBF-PSO, RBF-JAYA, and RBF-TLBO, researchers compare these detection approaches using classification metrics such as accuracy. This classification metric indicates that SVM, RF, and KNN demonstrate superior performance compared to other alternatives. The proposed approach was carried out on the NDN architecture because, based on our findings, it is the most used one and has a high percentage of various types of cyberattacks. The proposed approach can be evaluated using an ndnSIM simulation and a synthetic dataset for detecting DoS attacks in ICN-IoT networks using ML algorithms.

A novel optimized neural network model for cyber attack detection using enhanced whale optimization algorithm

Cybersecurity is critical in today’s digitally linked and networked society. There is no way to overestimate the importance of cyber security as technology develops and becomes more pervasive in our daily lives. Cybersecurity is essential to people’s protection. One type of cyberattack known as “credential stuffing” involves using previously acquired usernames and passwords by attackers to access user accounts on several websites without authorization. This is feasible as a lot of people use the same passwords and usernames on several different websites. Maintaining the security of online accounts requires defence against credential-stuffing attacks. The problems of credential stuffing attacks, failure detection, and prediction can be handled by the suggested EWOA-ANN model. Here, a novel optimization approach known as Enhanced Whale Optimization Algorithm (EWOA) is put on to train the neural network. The effectiveness of the suggested attack identification model has been demonstrated, and an empirical comparison will be carried out with respect to specific security analysis.

Classification of intrusion cyber‐attacks in smart power grids using deep ensemble learning with metaheuristic‐based optimization

AbstractThe most advanced power grid design, known as a ‘smart power grid’, integrates information and communication technology (ICT) with a conventional grid system to enable remote management of electricity distribution. The intelligent cyber‐physical architecture enables bidirectional, real‐time data sharing between electricity suppliers and consumers through smart meters and advanced metering infrastructure (AMI). Data protection issues, such as data tampering, firmware exploitation, and the leakage of sensitive information arise due to the smart power grid's substantial reliance on ICT. To maintain reliable and efficient power distribution, these issues must be identified and resolved quickly. Intrusion detection is essential for providing secure services and alerting system administrators in the case of adversary attacks. This paper proposes an intrusion classification scheme that identifies several types of cyber attacks on modern smart power grids. Grey‐Wolf metaheuristic optimization‐based feature selection is used to learn non‐linear, overlapping, and complex electrical grid properties. An extended deep‐stacked ensemble technique is advanced by putting predictions from weak learners (CNNs) into a meta‐learner (MLP). The outcomes of this approach are explained and confirmed using explainable AI (XAI). The publicly available dataset from Mississippi State University and Oak Ridge National Laboratory (MSU‐ORNL) is used to conduct experiments. The experimental results show that the proposed method achieved a peak accuracy of 96.6% while scrutinizing the original MSU‐ORNL data feature set and a maximum accuracy of 99% when analysing the selected feature set. Therefore, the proposed intrusion classification scheme may protect smart power grid systems against cyber security attacks.

Кібербезпека в енергетиці на тлі швидкого розвитку штучного інтелекту

The problems of protecting information resources from cyberattacks of public and private en-terprises are considered based on the analysis of data in the USA for 2022, taking into account the type of cyberattack and estimates of the damage caused. The analysis of cyberattacks allows us to conclude that the security of information resources depends on the human factor for more than 90 percent and it is in this direction that maximum efforts should be made. Improving the protection of information resources is not possible without the use of artificial intelligence (AI). The possibilities of the influence of AI on the cyber defense of the energy industry are consid-ered and areas that require attention in the development of systems of protection against cyber attacks, which are "doomed" to attract the achievements of AI, are proposed. At the same time, it is taken into account that AI not only allows you to increase protection against cyber attacks, but can also make computer networks less secure. And the extraordinary capabilities of neural networks require the urgent creation of agreed international protocols for their developers.

Smart grid cyberattack types classification: A fine tree bagging-based ensemble learning approach with feature selection

This paper focuses on the detection and classification of the cyberattack types in smart grid substation automation systems. The previous work in the literature focuses only on the detection of the attacks without providing any information regarding the attack’s type, which is a key in identifying the appropriate countermeasures. In this paper, a novel approach that uses a fine tree bagging ensemble learning technique is developed to detect and classify the cyberattack types from normal and power quality disturbances. Furthermore, the relevant features of different cyber-attack types such as message suppression, denial-of-service and data manipulation have been identified. The proposed approach is tested on a publicly available dataset and the results are compared to three other machine learning algorithms, namely decision tree, nearest neighbor, and support vector machine. The results have shown that the proposed approach is very effective in the detection and the classification of the attack types as well as it is insensitive to the selection of the training and the testing datasets unlike other existing approaches in the literature.

Detection, differentiation and localization of replay attack and false data injection attack based on random matrix

Replay attack and false data injection attack (FDIA) are two common types of cyber-attacks against supervisory control and data acquisition systems, aiming to disrupt the normal operation of the power system by falsifying meter measurements. In this paper, we proposed a systematic methodology to defend hybrid attack with both replay attack and FDIA. Specifically, we propose a detection method applying random matrix theory to: (1) detect the hybrid attack on static state estimation, and (2) distinguish FDIA from replay attack as well as localize falsified measurements. Firstly, short-term forecast on load and renewable power generation is conducted to obtain the predicted measurements. Secondly, random variables are calculated by differentiating the forecasting measurements and real-time measurements. A random matrix is consequently constructed with the above random variables. Thirdly, hybrid attacks are detected by the changes of the linear eigenvalue statistics of the random matrix obtained by the sliding time window. More importantly, a novel multi-label classifier to distinguish replay attack from FDIA is designed to localize FDIA by combining SVD decomposition and eigenvalue analysis with convolutional neural network (SVD-CNN). Finally, comprehensive simulations on the IEEE 14-bus system and IEEE 57-bus system are provided to validate the performance of the proposed method. It is shown that the proposed detection method has strong detection ability by filtering measurement noise. Moreover, the proposed SVD-CNN improves the accuracy in FDIA localization.

ESPORTS AND CYBERSECURITY: MODERN DIGITAL SOLUTIONS

ESPORTS AND CYBERSECURITY: MODERN DIGITAL SOLUTIONS