Types Of Cyber-attacks Research Articles

Multifractal Characterization of Distribution Synchrophasors for Cybersecurity Defense of Smart Grids

“Source ID Mix” spoofing emerged as a new type of cyber-attack on Distribution Synchrophasors (DS) where adversaries have the capability to swap the source information of DS without changing the measurement values. Accurate detection of such a highly-deceptive attack is a challenging task especially when the spoofing attack happens on short fragments of DS recorded within a relatively small geographical scale. This letter proposes an effective approach to detect this cyber-attack by realizing the multifractal characteristics of DS measurements. First, the multifractal cross-correlation of DS measured at multiple intra-state locations is revealed. Then the derived correlation is integrated with weighted two-dimensional multifractal surface interpolation to reconstruct quasi high-resolution signals. Finally, informative location-specific signatures are extracted from the high-resolution DS and they are integrated with advanced machine learning techniques for source authentication. Experiments using the real-life DS are performed to verify the proposed method.

Attack Detection in Power Distribution Systems Using a Cyber-Physical Real-Time Reference Model

This paper develops a novel intrusion detection system for power distribution systems that utilizes a cyber-physical real-time reference model to accurately replicate the complex behavior of power distribution components for attack detection. The proposed intrusion detection system analyzes the consistency of the physical data from sensor readings and control commands in contrast with their digital counterpart obtained from the real-time reference model. Therefore, a residual-based online attack detection mechanism that utilizes the chi-square test is able to determine the presence of malicious data. The proposed mechanism is implemented on a hardware-in-the-loop simulation testbed on a test power distribution system with distributed energy resources and energy storage systems. The results show that the proposed solution is able to quickly detect multiple types of cyber attacks for different levels of accuracy of the real-time reference model. The simulations illustrate that the proposed approach outperforms conventional attack detection mechanisms such as one-class classifiers and residual-based approaches that utilize Kalman filters or neural networks.

Secure MPC/ANN-Based False Data Injection Cyber-Attack Detection and Mitigation in DC Microgrids

Direct current (DC) microgrids can be considered as cyber-physical systems due to implementation of measurement devices, communication network, and control layers. Consequently, dc microgrids are also vulnerable to cyber-attacks. False-data injection attacks (FDIAs) are a common type of cyber-attacks, which try to inject false data into the system in order to cause the defective behavior. This article proposes a method based on model predictive control (MPC) and artificial neural networks (ANNs) to detect and mitigate the FDIA in dc microgrids that are formed by parallel dc–dc converters. The proposed MPC/ANN-based strategy shows how MPC and ANNs can be coordinated to provide a secure control layer to detect and remove the FDIAs in the dc microgrid. In the proposed strategy, an ANN plays the role of the estimator to implement in the cyber-attack detection and mitigation strategy. The proposed method is examined under different conditions, physical events and cyber disturbances (i.e. load changing and communication delay, and time-varying attack), and the results of the MPC-based scheme is compared with conventional proportional-integral controllers. The obtained results show the effectiveness of the proposed strategy to detect and mitigate the attack in dc microgrids.

IMIDS: An Intelligent Intrusion Detection System against Cyber Threats in IoT

The increasing popularity of the Internet of Things (IoT) has significantly impacted our daily lives in the past few years. On one hand, it brings convenience, simplicity, and efficiency for us; on the other hand, the devices are susceptible to various cyber-attacks due to the lack of solid security mechanisms and hardware security support. In this paper, we present IMIDS, an intelligent intrusion detection system (IDS) to protect IoT devices. IMIDS’s core is a lightweight convolutional neural network model to classify multiple cyber threats. To mitigate the training data shortage issue, we also propose an attack data generator powered by a conditional generative adversarial network. In the experiment, we demonstrate that IMIDS could detect nine cyber-attack types (e.g., backdoors, shellcode, worms) with an average F-measure of 97.22% and outperforms its competitors. Furthermore, IMIDS’s detection performance is notably improved after being further trained by the data generated by our attack data generator. These results demonstrate that IMIDS can be a practical IDS for the IoT scenario.

Design, Analysis and Implementation of a Security Assessment/Enhancement Platform for Cyber-Physical Systems

To support cyber security assessment and enhancement of cyber-physical systems, a cross-layered experimental prototype platform has been developed. In this article, to make the prototype versatile, a modular approach has been taken. There are in total four modules: 1) Attack scenario generation; 2) security enhancement; 3) security evaluation; and 4) platform management. In reference to typical cyber-enabled industrial control systems, the design philosophy and selection of the architecture for this platform have been examined. To provide interested readers with additional details and to demonstrate the effectiveness of the proposed platform, a hardware-based cyber security assessment and enhancement prototype platform has been implemented on a lab-scale cyber-physical system. Two types of cyberattacks have been considered to demonstrate the operation of the platform and to validate its functions in an event of a security breach. The results have demonstrated that the design methodology is effective for practical cyber-physical systems, and the platform is a useful tool to identify and analyze vulnerabilities and to evaluate the effectiveness of different security enhancement strategies.

Ransomware Attacks in History of Cyber World

Abstract: Technology advancement since last few decades creates cyber attack a critical issue. Cyber security has become an important part today. It has also become an important and crucial subject in the field of forensic science. Increased in the growth of internet technology and internet devices have increased the risk of cyber attack. Almost every organization today are depends on the internet and devices. There are many types of cyber attack. This paper is the detailed review about Ransomware attack. This paper is consisted about vast of the information about What is Ransomware Attack, how does it work, how ransomware attack emerged. After reading this paper you will learn about the ransomware attacks in history of cyber world. This will help you to learn and understand about ransomware attack, how to prevent yourself from ransomware attack. As a forensic science student, it is always important to be aware about the attacks that have happened in the history of cyber world. Before writing this paper, I have read and analyze many research paper and internet articles, so that I can write a detailed review paper which can help students and for the forensic awareness. Keywords: Cyberattack, Hacking, Ransomware, cyberworld, cyber security, ransomware, forensic, network security

Ciberseguridad y Ciberdefensa: Perspectiva de la situación actual en el Ecuador

The advance of science has generated an accelerated and disproportionate growth of information technology, leading people to modify their paradigms to communicate and carry out activities in a different way to the traditional. This century has brought with it countless computer tools that are being used in cyberspace by Ecuadorian citizens, for financial, educational, social, recreational activities, among others; this has brought the attention of cybercriminals, who have detected vulnerabilities in information and communication technologies (ICT); becoming this, in a viable way to penetrate the computer systems and commit illicit and illegal activities. This research work, through a literary perspective, aims to publicize how cybersecurity and cyber defense is in Ecuador today. In the first part of the article that corresponds to the theoretical framework, the definitions, types of cyberattacks and their effects on the country will be addressed; in the second part, the same methodology that was developed under a qualitative and documentary approach will be presented; in the third part, the author presents the results; and in the end, the conclusions and recommendations.

D-ARP: An Efficient Scheme to Detect and Prevent ARP Spoofing

Nowadays, cyber-attack is a severe criminal violation, and it is one of the most active fields of research. Man-in-the-middle attack (MITM) is a type of cyber-attack in which an unauthorized third party secretly accesses the communication between two hosts in the same network to read=modify the transferred data between them. ARP spoofing-based MITM attack exploits ARP protocol weakness where the attacker associates its MAC address with the IP address of an intended legitimate host. Although there are many defense approaches for ARP spoofing based-MITM attacks, these methods are uncompleted or have a performance overhead since they modify the original ARP protocol. Also, some of these approaches depend on the centralized server which leads to a single point of failure. This paper presents a detection scheme for ARP spoofing-based MITM attack called D-ARP which is compatible with the original ARP protocol. The main idea of D-ARP is to send an ARP packet signed with a key in parallel with the original ARP packets to make a correlation between requests and replies. Each host records the signed ARP packets whether it is a request or a reply in a log file. Based on this correlation, D-ARP matches the injected key to detect ARP spoofing if there is a duplicate or conflict in the MAC address. For more reliability, D-ARP uses the DHCP server and the Nmap feature to detect the MAC addresses of MITM attackers. Moreover, this scheme also offers a module for Admin to create a trusted list of hosts. The experimental results show that D-ARP is very effective to detect and prevent ARP spoofing with zero false positives and zero false negative probabilities without any modifications in the original ARP protocol.

A Comprehensive Review of Cybersecurity in Inverter-Based Smart Power System Amid the Boom of Renewable Energy

The blossom of renewable energy worldwide and its uncertain nature have driven the need for a more intelligent power system with the deep integration of smart power electronics. The smart inverter is one of the most critical components for the optimal operation of Smart Grid. However, due to the deep information and communication technology (ICT) infrastructure implementation that most inverter-based smart power systems tend to have, they are vulnerable to severe external threats such as cyberattacks by hackers. This paper presents a comprehensive review of the system structure and vulnerabilities of typical inverter-based power system with distributed energy resources (DERs) integration, nature of several types of cyberattacks, state-of-the-art defense strategies including several detection and mitigation techniques, and an overview and comparison of testbed and simulation tools applicable for cyber-physical research. Finally, challenges, unsolved problems, and future direction of the field are discussed and concluded at the end of the journal. This paper provides an all-inclusive survey at the state of the art smart grid cybersecurity research and paves the path for potential research topics in the future.

Digital Healthcare - Cyberattacks in Asian Organizations: An Analysis of Vulnerabilities, Risks, NIST Perspectives, and Recommendations

Cyberattacks on healthcare institutions are on an upsurge all over the world. Recently, Asian hospitals have become targets of numerous cyberattacks. While Western countries like the United States have implemented security-related laws, policies, standards, and other protective measures to deal with the healthcare cyberattacks, Asian countries are lagging. The Healthcare insurance portability and accountability act (HIPAA), enacted by the United States federal government, is a classic example of a law that has been in existence for a quarter-century now. Awareness about electronic health records (EHR) and their importance is increasing in Asia. Many hospitals and healthcare systems successfully implement solutions to protect healthcare data, including sensitive patient data. However, protecting healthcare data involves a sophisticated technology and compliance-driven approach due to the high value associated with the data. In this research, an earnest attempt is made to investigate the recent cyberattacks in Asian healthcare institutions. Based on the investigation, five types of cyberattacks are found to dominate Asian healthcare institutions. A detailed analysis of these attacks, their vulnerabilities, and associated risks are performed as a part of this study. In many countries with higher cybersecurity maturity, risk frameworks are successfully employed to manage the risks associated with healthcare data. In this study, the cyberattacks on Asian healthcare institutions are also analyzed through the lens of the National Institute of standards and technology (NIST) risk framework. Based on the literature review, a few unique recommendations are included in this research study to be used as risk mitigation measures by Asian healthcare organizations and researchers to manage and improve the growing situation of cyberattacks.

A Two-stage Kalman Filter for Cyber-attack Detection in Automatic Generation Control System

Communication plays a vital role in incorporating smartness into the interconnected power system. However, historical records prove that the data transfer has always been vulnerable to cyber-attacks. Unless these cyber-attacks are identified and cordoned off, they may lead to black-out and result in national security issues. This paper proposes an optimal two-stage Kalman filter (OTS-KF) for simultaneous state and cyber-attack estimation in automatic generation control (AGC) system. Biases/cyber-attacks are modeled as unknown inputs in the AGC dynamics. Five types of cyber-attacks, i.e., false data injection (FDI), data replay attack, denial of service (DoS), scaling, and ramp attacks, are injected into the measurements and estimated using OTS-KF. As the load variations of each area are seldom available, OTS-KF is reformulated to estimate the states and outliers along with the load variations of the system. The proposed technique is validated on the benchmark two-area, three-area, and five-area power system models. The simulation results under various test conditions demonstrate the efficacy of the proposed filter.

Utilizing Cyber Threat Hunting Techniques to Find Ransomware Attacks: A Survey of the State of the Art

Ransomware is one of the most harmful types of cyber attacks that cause major concerns on a global scale. It makes the victims’ resources unusable by encrypting data or locking systems to extort ransom payments. Ransomware has variant families that continue to evolve. Moreover. cybercriminals use advanced techniques to develop ransomware, making it harder for anti-malware detection systems to detect them. Ransomware solutions need the capabilities of timely and effective detection and response to discover uncommon behavior before losing sensitive data. Cyber threat hunting (CTH) is a novel proactive malware detection approach that includes cyber threat intelligence (CTI) methods and data analysis methods. However, most present CTH solutions depend on internal data sources and reactive techniques to detect unusual activities. An effective CTI technique is required to obtain knowledge from external data sources and combine it with internal sources to enhance the hunting capabilities. Then, using the optimal data analysis technique is needed for the CTH approach to obtain valuable insights into abnormal patterns in running activities in the early stages. In this study, we investigate using a practical CTI approach and different CTH models. Subsequently, we discussed ransomware research directions to detect known and unknown ransomware attacks. Also, we discussed the available ransomware datasets used in present ransomware studies.

Методи перевірки алгебраїчним співставленням спротиву http-атакам на розумний будинок

Cyber ​​attacks become possible because of vulnerabilities in the IT infrastructure or in a particular system. It is impossible to create the completely secure environment, but it is possible to give sufficient attention to vulnerabilities and reduce the consequences of any attacks that will exploit these vulnerabilities. It is necessary to assume the probability of an attack and be ready to take actions now to prevent them from being successful again. Time is a definite factor in mitigating the damage from a cyber security breach. Thus, the key role is laid on detecting an intrusion as soon as possible and being able to neutralize or isolate the intruder. This work aims to show common types of cyberattacks on smart homes, as well as detections and methods for their tools. in this way, the method of mathematical comparison works in the work, which allows at the stage of system design to identify the possibilities of vulnerability and, as a result, create stable web applications and services, and at the stage of operation to assess the probability of attacks on the system and predict the consequences.

The State of the Art in BGP Visualization Tools: A Mapping of Visualization Techniques to Cyberattack Types.

Internet routing is largely dependent on Border Gateway Protocol (BGP). However, BGP does not have any inherent authentication or integrity mechanisms that help make it secure. Effective security is challenging or infeasible to implement due to high costs, policy employment in these distributed systems, and unique routing behavior. Visualization tools provide an attractive alternative in lieu of traditional security approaches. Several BGP security visualization tools have been developed as a stop-gap in the face of ever-present BGP attacks. Even though the target users, tasks, and domain remain largely consistent across such tools, many diverse visualization designs have been proposed. The purpose of this study is to provide an initial formalization of methods and visualization techniques for BGP cybersecurity analysis. Using PRISMA guidelines, we provide a systematic review and survey of 29 BGP visualization tools with their tasks, implementation techniques, and attacks and anomalies that they were intended for. We focused on BGP visualization tools as the main inclusion criteria to best capture the visualization techniques used in this domain while excluding solely algorithmic solutions and other detection tools that do not involve user interaction or interpretation. We take the unique approach of connecting (1) the actual BGP attacks and anomalies used to validate existing tools with (2) the techniques employed to detect them. In this way, we contribute an analysis of which techniques can be used for each attack type. Furthermore, we can see the evolution of visualization solutions in this domain as new attack types are discovered. This systematic review provides the groundwork for future designers and researchers building visualization tools for providing BGP cybersecurity, including an understanding of the state-of-the-art in this space and an analysis of what techniques are appropriate for each attack type. Our novel security visualization survey methodology-connecting visualization techniques with appropriate attack types-may also assist future researchers conducting systematic reviews of security visualizations. All supplemental materials are available at https://osf.io/tupz6/.

Development of an IoT Architecture Based on a Deep Neural Network against Cyber Attacks for Automated Guided Vehicles

This paper introduces an integrated IoT architecture to handle the problem of cyber attacks based on a developed deep neural network (DNN) with a rectified linear unit in order to provide reliable and secure online monitoring for automated guided vehicles (AGVs). The developed IoT architecture based on a DNN introduces a new approach for the online monitoring of AGVs against cyber attacks with a cheap and easy implementation instead of the traditional cyber attack detection schemes in the literature. The proposed DNN is trained based on experimental AGV data that represent the real state of the AGV and different types of cyber attacks including a random attack, ramp attack, pulse attack, and sinusoidal attack that is injected by the attacker into the internet network. The proposed DNN is compared with different deep learning and machine learning algorithms such as a one dimension convolutional neural network (1D-CNN), a supported vector machine model (SVM), random forest, extreme gradient boosting (XGBoost), and a decision tree for greater validation. Furthermore, the proposed IoT architecture based on a DNN can provide an effective detection for the AGV status with an excellent accuracy of 96.77% that is significantly greater than the accuracy based on the traditional schemes. The AGV status based on the proposed IoT architecture with a DNN is visualized by an advanced IoT platform named CONTACT Elements for IoT. Different test scenarios with a practical setup of an AGV with IoT are carried out to emphasize the performance of the suggested IoT architecture based on a DNN. The results approve the usefulness of the proposed IoT to provide effective cybersecurity for data visualization and tracking of the AGV status that enhances decision-making and improves industrial productivity.

CYBER SECURITY AND THE INTERNET OF THINGS: VULNERABILITY, THREATS AND ATTACKS

-Cyber Security is a protecting cyber space which includes our critical information or data from getting hacked or attached, damaged by some unwanted person or user [1] . It is very much important for all of us to know about cyber security because everyone of using smart phone, laptop and other digital devices in which more or less our personal data or some of the personal information is saved. So, how we can manage our private data or make it secure by the same unwanted bugs so that they can’t misuse of that cyber security comprises of different software program that deals with the protection of our privacy and to protection of our privacy and to protect our personal data getting misused by some of the others programmers or the undefined theft of data. Cyber security comprises of different types of attacks such as malware, phishing and other types of cyber-attacks [1]

Software Defined Network Enabled Fog-to-Things Hybrid Deep Learning Driven Cyber Threat Detection System

Software Defined Network (SDN) is a next-generation networking architecture and its power lies in centralized control intelligence. The control plane of SDN can be extended to many underlying networks such as fog to Internet of Things (IoT). The fog-to-IoT is currently a promising architecture to manage a real-time large amount of data. However, most of the fog-to-IoT devices are resource-constrained and devices are widespread that can be potentially targeted with cyber-attacks. The evolving cyber-attacks are still an arresting challenge in the fog-to-IoT environment such as Denial of Service (DoS), Distributed Denial of Service (DDoS), Infiltration, malware, and botnets attacks. They can target varied fog-to-IoT agents and the whole network of organizations. The authors propose a deep learning (DL) driven SDN-enabled architecture for sophisticated cyber-attacks detection in fog-to-IoT environment to identify new attacks targeting IoT devices as well as other threats. The extensive simulations have been carried out using various DL algorithms and current state-of-the-art Coburg Intrusion Detection Data Set (CIDDS-001) flow-based dataset. For better analysis five DL models are compared including constructed hybrid DL models to distinguish the DL model with the best performance. The results show that proposed Long Short-Term Memory (LSTM) hybrid model outperforms other DL models in terms of detection accuracy and response time. To show unbiased results 10-fold cross-validation is performed. The proposed framework is so effective that it can detect several types of cyber-attacks with 99.92% accuracy rate in multiclass classification.

An overview of the applications of Artificial Intelligence in Cybersecurity

The rates at which cyber-attacks are performed have made the cybersecurity unprotected and make it impossible for the security experts to evaluate and combat every new type of cyber-attack. Today's digital age necessarily requires the protection of a vast amou

From public health to cyber hygiene: Cybersecurity and Canada’s healthcare sector

The COVID-19 pandemic has ushered in a wave of cyberattacks targeting the healthcare sector, including against hospitals, doctors, patients, medical companies, supply chains, universities, research laboratories, and public health organizations at different levels of jurisdiction and across the public and private sectors. Despite these concerns, cybersecurity in Canadian healthcare is significantly understudied. This article uses a series of illustrative examples to highlight the challenges, outcomes, and solutions Canada might consider in addressing healthcare cybersecurity. The article explores the various rationales by which Canadian healthcare may be targeted, unpacks several prominent types of cyberattack used against the healthcare sector, identifies the different malicious actors motivated to conduct such attacks, provides insights derived from three empirical cases of healthcare cyberattack (Boston Children’s Hospital [2014], Anthem [2015], National Health Service [2017]), and concludes with lessons for a Canadian response to healthcare cybersecurity from several international perspectives (e.g., Australia, New Zealand, the UK, Norway, and the Netherlands).

Building a dataset through attack pattern modeling and analysis system

The different types of cyber-attacks on information and telecommunications systems are becoming increasingly sophisticated and complex, with several defined phases (attack pattern). Therefore, it is necessary to research and develop new infrastructures to understand and detect them. This work addresses the design and implementation of a system capable of detecting, analyzing, modeling and visualizing attack patterns in real time to build a dataset with labeled events attacks. The system consists of the three subsystems, detection of attack events subsystem; attack events analysis subsystem to model active patterns based on Common Attack Pattern Enumeration and Classification (CAPEC) definitions; and the attack pattern visualization subsystem. The results obtained from the attacks carried out over a period of six months under a series of assumptions are shown. These results have allowed the construction of a dataset with attack events labelled according to the possible attack patterns to which they belong. The developed system can provide an organization with a very real situational awareness of the cybersecurity situation.