Search

This paper explores the problem of the security of unmanned aerial vehicles (UAV) by introducing the drone security scoring system (D3S). D3S is a security assessment method that analyzes the security of a UAV model by analyzing its components. Penetration tests were carried out to support D3S and identify potential vulnerabilities in UAVs. Specific cyber-attacks, such as deauthentication, flooding, and replay, were executed in an effort to take full control of the UAVs. Eight different UAV models were assessed using D3S, revealing notable variations in performance, both in control communications and video transmission. Security scores ranging from 0.9 to 4.5 out of 5 were obtained, showing significantly divergent security levels.

With the number of cyber-attacks growing rapidly and the opportunities to attack companies widening, vulnerability management is gaining increased importance. It needs to reduce the variety of possibilities by remediating vulnerabilities found in IT infrastructures. Process mining is an established method used to discover, analyze, and manage data on (implemented) business processes. This paper proposes utilizing process mining for business-critical processes, including IT processes. This work explores how vulnerability management processes can be improved through process monitoring, targeting the operation time of processes, remediation, and the continuous management of the vulnerability process design. Thereby, process mining is applied for monitoring following the CRISP data mining approach. Process analysis includes process discovery, conformance checking, and process enhancement. Improving the vulnerability management process is based on the discovered vulnerability process, which is enhanced with throughput time data as well as priority, source, and assignment group data. Improvements concern changing the configuration of a source and better training for certain assignment groups. Process discovery can also be used to identify the cause for improper remediation of vulnerabilities. In this case, unwanted activity flows, which indicate that a major part of the vulnerability management process is being skipped, need to be identified. Finally, the continuous use of process mining allows for the monitoring of process modifications, including the impact of implemented improvements.

The maritime industry is constantly evolving and posing new challenges, especially with increasing digitalization, which has raised concerns about cyber-attacks on maritime supply chain agents. Although scholars have proposed various methods and classification models to counter these cyber threats, a comprehensive cyber-attack taxonomy for maritime supply chain actors based on a systematic literature review is still lacking. This review aims to provide a clear picture of common cyber-attacks and develop a taxonomy for their categorization. In addition, it outlines best practices derived from academic research in maritime cybersecurity using PRISMA principles for a systematic literature review, which identified 110 relevant journal papers. This study highlights that distributed denial of service (DDoS) attacks and malware are top concerns for all maritime supply chain stakeholders. In particular, shipping companies are urged to prioritize defenses against hijacking, spoofing, and jamming. The report identifies 18 practices to combat cyber-attacks, categorized into information security management solutions, information security policies, and cybersecurity awareness and training. Finally, this paper explores how emerging technologies can address cyber-attacks in the maritime supply chain network (MSCN). While Industry 4.0 technologies are highlighted as significant trends in the literature, this study aims to equip MSCN stakeholders with the knowledge to effectively leverage a broader range of emerging technologies. In doing so, it provides forward-looking solutions to prevent and mitigate cyber-attacks, emphasizing that Industry 4.0 is part of a larger landscape of technological innovation.

Ensuring the secure and cost-effective operation of smart power microgrids has become a significant concern for managers and operators due to the escalating damage caused by natural phenomena and cyber-attacks. This paper presents a novel framework focused on the dynamic reconfiguration of multi-microgrids to enhance system’s security index, including stability, reliability, and operation costs. The framework incorporates distributed generation (DG) to address cyber-attacks that can lead to line outages or generation failures within the network. Additionally, this work considers the uncertainties and accessibility factors of power networks through a modified point prediction method, which was previously overlooked. To achieve the secure and cost-effective operation of smart power multi-microgrids, an optimization framework is developed as a multi-objective problem, where the states of switches and DG serve as independent parameters, while the dependent parameters consist of the operation cost and techno-security indexes. The multi-objective problem employs deep learning (DL) techniques, specifically based on long short-term memory (LSTM) and prediction intervals, to effectively detect false data injection attacks (FDIAs) on advanced metering infrastructures (AMIs). By incorporating a modified point prediction method, LSTM-based deep learning, and consideration of technical indexes and FDIA cyber-attacks, this framework aims to advance the security and reliability of smart power multi-microgrids. The effectiveness of this method was validated on a network of 118 buses. The results of the proposed approach demonstrate remarkable improvements over PSO, MOGA, ICA, and HHO algorithms in both technical and economic indicators.

This paper addresses the practical issue of load frequency control (LFC) in multi-area power systems with degraded actuators and sensors under cyber-attacks. A time-varying approximation model is developed to capture the variability in component degradation paths across different operational scenarios, and an optimal controller is constructed to manage stochastic degradation across subareas simultaneously. To assess the reliability of the proposed scheme, both Monte Carlo simulation and particle swarm optimization techniques are utilized. The methodology distinguishes itself by four principal attributes: (i) a time-varying degradation model that broadens the application from single-area to multi-area systems; (ii) the integration of physical constraints within the degradation model, which enhances the realism and practicality compared to existing methods; (iii) the sensor suffers from fault data injection attacks; and (iv) an optimal controller that leverages particle swarm optimization to effectively balance reliability and system performance, thereby improving both stability and reliability. This method has demonstrated its effectiveness and advantages in mitigating load disturbances, achieving its objectives in just one-third of the time required by established benchmarks. The case study validates the applicability of the proposed approach and demonstrates its efficacy in mitigating load disturbance amidst stochastic degradation in actuators and sensors under FDIA cyber-attacks.

Cyber-security challenges are growing globally and are specifically targeting critical infrastructure. Conventional countermeasure practices are insufficient to provide proactive threat hunting. In this study, random forest (RF), support vector machine (SVM), multi-layer perceptron (MLP), AdaBoost, and hybrid models were applied for proactive threat hunting. By automating detection, the hybrid machine learning-based method improves threat hunting and frees up time to concentrate on high-risk warnings. These models are implemented on approach devices, access, and principal servers. The efficacy of several models, including hybrid approaches, is assessed. The findings of these studies are that the AdaBoost model provides the highest efficiency, with a 0.98 ROC area and 95.7% accuracy, detecting 146 threats with 29 false positives. Similarly, the random forest model achieved a 0.98 area under the ROC curve and a 95% overall accuracy, accurately identifying 132 threats and reducing false positives to 31. The hybrid model exhibited promise with a 0.89 ROC area and 94.9% accuracy, though it requires further refinement to lower its false positive rate. This research emphasizes the role of machine learning in improving cyber-security, particularly for critical infrastructure. Advanced ML techniques enhance threat detection and response times, and their continuous learning ability ensures adaptability to new threats.

Cybersecurity is a crucial concern for local governments as they serve as the primary interface between public and government services, managing sensitive data and critical infrastructure. While technical safeguards are integral to cybersecurity, the role of a well-structured policy is equally important as it provides structured guidance to translate technical requirements into actionable protocols. This study reviews local governments’ cybersecurity policies to provide a comprehensive assessment of how these policies align with the National Institute of Standards and Technology’s Cybersecurity Framework 2.0, which is a widely adopted and commonly used cybersecurity assessment framework. This review offers local governments a mirror to reflect on their cybersecurity stance, identifying potential vulnerabilities and areas needing urgent attention. This study further extends the development of a cybersecurity policy framework, which local governments can use as a strategic tool. It provides valuable information on crucial cybersecurity elements that local governments must incorporate into their policies to protect confidential data and critical infrastructure.

Local governments face critical challenges in the era of digital transformation, balancing the responsibility of safeguarding resident information and administrative documents while maintaining data integrity and public trust. These responsibilities become even more critical as they transition into smart cities adopting advanced technological innovations to revolutionize governance, enhance service delivery, and foster sustainable and resilient urban environments. Technological advancements like Internet-of-Things devices and artificial intelligence-driven approaches can provide better services to residents, but they also expose local governments to cyberthreats. There has been, nonetheless, very little study on cybersecurity issues from the local government perspective, and information on the multifaceted nature of cybersecurity in local government settings is scattered and fragmented, highlighting the need for a conceptual understanding and adequate action. Against this backdrop, this study aims to identify key components of cybersecurity in a local governmental context through a systematic literature review. This review further extends to the development of a conceptual framework providing a comprehensive understanding of the local government’s cybersecurity landscape. This study makes a significant contribution to the academic and professional domains of cybersecurity issues and policies within the local governmental context, offering valuable insights to local decision-makers, practitioners, and academics. This study also helps identify vulnerabilities, enabling stakeholders to recognize shortcomings in their cybersecurity and implement effective countermeasures to safeguard confidential information and documents. Thus, the findings inform local government policy to become more cybersecurity-aware and prepared.

The integration of communication infrastructures into traditional power systems, transforming them into cyber-physical power systems (CPPS), accentuates the significance of communication in influencing system performance and sustainability. This paper presents a versatile, innovative cyber-physical co-simulation framework that integrates the physical power system and communication networks, uniting OPAL-RT, a network simulator (ns3), and Docker containers into a sophisticated platform, facilitating intensive studies into CPPS dynamics. The proposed experimental study provides an innovative way to assess the frequency control response of a cyber-physical inverter-based microgrid (MG), addressing the MG sustainability challenges. We consider diverse real-world scenarios, focusing on communication delays and distributed denial of service (DDoS) attacks within the communication channels. We propose a precise ns3-based communication model that bridges the MG’s primary and secondary control layers, an aspect often overlooked in previous studies; this is a noteworthy contribution to elucidating the adverse impacts of communication latency on MG frequency performance. The experimental results demonstrate the effectiveness of the centralized secondary controller in eliminating the frequency deviations. Furthermore, the findings offer insights into stable and unstable regions, revealing how the communication delay value affects the frequency stability under different operating conditions. In addition, the developed real-time DDoS attacks model within the proposed communication surface unveils crucial insights into the MG’s resilience to cyber threats. This work’s revelations offer a foundational awareness of MG vulnerabilities, paving the way for designing robust and resilient communication networks and control strategies within the cyber-physical inverter-based microgrids.

In today’s digitalized era, the usage of Android devices is being extensively witnessed in various sectors. Cybercriminals inevitably adapt to new security technologies and utilize these platforms to exploit vulnerabilities for nefarious purposes, such as stealing users’ sensitive and personal data. This may result in financial losses, discredit, ransomware, or the spreading of infectious malware and other catastrophic cyber-attacks. Due to the fact that ransomware encrypts user data and requests a ransom payment in exchange for the decryption key, it is one of the most devastating types of malicious software. The implications of ransomware attacks can range from a loss of essential data to a disruption of business operations and significant monetary damage. Artificial intelligence (AI)-based techniques, namely machine learning (ML), have proven to be notable in the detection of Android ransomware attacks. However, ensemble models and deep learning (DL) models have not been sufficiently explored. Therefore, in this study, we utilized ML- and DL-based techniques to build efficient, precise, and robust models for binary classification. A publicly available dataset from Kaggle consisting of 392,035 records with benign traffic and 10 different types of Android ransomware attacks was used to train and test the models. Two experiments were carried out. In experiment 1, all the features of the dataset were used. In experiment 2, only the best 19 features were used. The deployed models included a decision tree (DT), support vector machine (SVM), k-nearest neighbor (KNN), ensemble of (DT, SVM, and KNN), feedforward neural network (FNN), and tabular attention network (TabNet). Overall, the experiments yielded excellent results. DT outperformed the others, with an accuracy of 97.24%, precision of 98.50%, and F1-score of 98.45%. Whereas, in terms of the highest recall, SVM achieved 100%. The acquired results were thoroughly discussed, in addition to addressing limitations and exploring potential directions for future work.

In this paper, the application and future vision of Artificial Intelligence (AI)-based techniques in microgrids are presented from a cyber-security perspective of physical devices and communication networks. The vulnerabilities of microgrids are investigated under a variety of cyber-attacks targeting sensor measurements, control signals, and information sharing. With the inclusion of communication networks and smart metering devices, the attack surface has increased in microgrids, making them vulnerable to various cyber-attacks. The negative impact of such attacks may render the microgrids out-of-service, and the attacks may propagate throughout the network due to the absence of efficient mitigation approaches. AI-based techniques are being employed to tackle such data-driven cyber-attacks due to their exceptional pattern recognition and learning capabilities. AI-based methods for cyber-attack detection and mitigation that address the cyber-attacks in microgrids are summarized. A case study is presented showing the performance of AI-based cyber-attack mitigation in a distributed cooperative control-based AC microgrid. Finally, future potential research directions are provided that include the application of transfer learning and explainable AI techniques to increase the trust of AI-based models in the microgrid domain.

With the deployment of numerous innovative smart grid technologies in modern power systems, more real-time communication and control are required due to the complexity and proliferation of grid-connected systems, making a power system a typical cyber-physical system (CPS). However, these systems are also exposed to new cyber vulnerabilities. Therefore, understanding the intricate interplay between the cyber and physical domains and the potential effects on the power system of successful attacks is essential. For cybersecurity experimentation and impact analysis, developing a comprehensive testbed is needed. This paper presents a state-of-the-art Hybrid Physical Co-simulation SG testbed at FIU developed for in-depth studies on the impact of communication system latency and failures, physical events, and cyber-attacks on the grid. The Hybrid SGTB is designed to take full advantage of the benefits of both co-simulation-based and physical-based testbeds. Based on this testbed, various attack strategies are tested, including man-in-the-middle (MitM), denial-of-service (DoS), data manipulation (DM), and setting tampering (change) on various power system topologies to analyze their impacts on grid stability, power flow, and protection reliability. Our research, which is based on extensive testing on several testbeds, shows that using hybrid testbeds is justified as both practical and effective.

The advancements in technology have brought about significant changes in the automobile industry. A system that combines the control of a physical process with computing technology and communication networks is called a cyber–physical system (CPS). The enhancement of network communication has transitioned vehicles from purely mechanical to software-controlled technologies. The controller area network (CAN) bus protocol controls the communication network of autonomous vehicles. The convergence of technologies in autonomous vehicles (AVs) and connected vehicles (CVs) within Connected and Autonomous Vehicles (CAVs) leads to improved traffic flow, enhanced safety, and increased reliability. CAVs development and deployment have gained momentum, and many companies and research organizations have announced their initiatives and begun road trials. Governments worldwide have also implemented policies to facilitate and expedite the deployment of CAVs. Nevertheless, the issue of CAV cyber security has become a prevalent concern, representing a significant challenge in deploying CAVs. This study presents an intelligent cyber threat detection system (ICTDS) for CAV that utilizes transfer learning to detect cyberattacks on physical components of autonomous vehicles through their network infrastructure. The proposed security system was tested using an autonomous vehicle network dataset. The dataset was preprocessed and used to train and evaluate various pre-trained convolutional neural networks (CNNs), such as ResNet-50, MobileNetV2, AlexNet, GoogLeNet and YOLOV8. The proposed security system demonstrated exceptional performance, as demonstrated by its results in precision, recall, F1-score, and accuracy metrics. The system achieved an accuracy rate of 99.90%, indicating its high level of performance.

Nowadays, with the increase in cyber-attacks, hacking, and data theft, maintaining data security and confidentiality is of paramount importance. Several techniques are used in cryptography and steganography to ensure their safety during the transfer of information between the two parties without interference from an unauthorized third party. This paper proposes a modern approach to cryptography and steganography based on exploiting a new environment: bases and protein chains used to encrypt and hide sensitive data. The protein bases are used to form a cipher key whose length is twice the length of the data to be encrypted. During the encryption process, the plain data and the cipher key are represented in several forms, including hexadecimal and binary representation, and several arithmetic operations are performed on them, in addition to the use of logic gates in the encryption process to increase encrypted data randomness. As for the protein chains, they are used as a cover to hide the encrypted data. The process of hiding inside the protein bases will be performed in a sophisticated manner that is undetectable by statistical analysis methods, where each byte will be fragmented into three groups of bits in a special order, and each group will be included in one specific protein base that will be allocated to this group only, depending on the classifications of bits that have been previously stored in special databases. Each byte of the encrypted data will be hidden in three protein bases, and these protein bases will be distributed randomly over the protein chain, depending on an equation designed for this purpose. The advantages of these proposed algorithms are that they are fast in encrypting and hiding data, scalable, i.e., insensitive to the size of plain data, and lossless algorithms. The experiments showed that the proposed cryptography algorithm outperforms the most recent algorithms in terms of entropy and correlation values that reach −0.6778 and 7.99941, and the proposed steganography algorithm has the highest payload of 2.666 among five well-known hiding algorithms that used DNA sequences as the cover of the data.

One of the most significant recent advances in technology is the advent of unmanned aerial vehicles (UAVs), i.e., drones. They have widened the scope of possible applications and provided a platform for a wide range of creative responses to a variety of challenges. The Internet of Drones (IoD) is a relatively new concept that has arisen as a consequence of the combination of drones and the Internet. The fifth-generation (5G) and beyond cellular networks (i.e., drones in networks beyond 5G) are promising solutions for achieving safe drone operations and applications. They may have many applications, like surveillance or urban areas, security, surveillance, retaliation, delivering items, smart farming, film production, capturing nature videos, and many more. Due to the fact that it is susceptible to a wide variety of cyber-attacks, there are certain concerns regarding the privacy and security of IoD communications. In this paper, a secure blockchain-enabled authentication key management framework with the big data analytics feature for drones in networks beyond 5G applications is proposed (in short, SBBDA-IoD). The security of SBBDA-IoD against multiple attacks is demonstrated through a detailed security analysis. The Scyther tool is used to perform a formal security verification test on the SBBDA-IoD’s security, confirming the system’s resistance to various potential attacks. A detailed comparative analysis has identified that SBBDA-IoD outperforms the other schemes by a significant margin. Finally, a real-world implementation of SBBDA-IoD is shown to evaluate its effect on several measures of performance.

The complex and interconnected infrastructure of smart cities offers several opportunities for attackers to exploit vulnerabilities and carry out cyberattacks that can have serious consequences for the functioning of cities’ critical infrastructures. This study aims to address this phenomenon and characterize the dimensions of security risks in smart cities and present mitigation proposals to address these risks. The study adopts a qualitative methodology through the identification of 62 European research projects in the field of cybersecurity in smart cities, which are underway during the period from 2022 to 2027. Compared to previous studies, this work provides a comprehensive view of security risks from the perspective of multiple universities, research centers, and companies participating in European projects. The findings of this study offer relevant scientific contributions by identifying 7 dimensions and 31 sub-dimensions of cybersecurity risks in smart cities and proposing 24 mitigation strategies to face these security challenges. Furthermore, this study explores emerging cybersecurity issues to which smart cities are exposed by the increasing proliferation of new technologies and standards.

This work is concerned with the vulnerability of a network industrial control system to cyber-attacks, which is a critical issue nowadays. This is because an attack on a controlled process can damage or destroy it. These attacks use long short-term memory (LSTM) neural networks, which model dynamical processes. This means that the attacker may not know the physical nature of the process; an LSTM network is sufficient to mislead the process operator. Our experimental studies were conducted in an industrial control network containing a magnetic levitation process. The model training, evaluation, and structure selection are described. The chosen LSTM network very well mimicked the considered process. Finally, based on the obtained results, we formulated possible protection methods against the considered types of cyber-attack.

The Internet of Things (IoT) is rapidly expanding and becoming an integral part of daily life, increasing the potential for security threats such as malware or cyberattacks. Many embedded systems (ESs), responsible for handling sensitive data or facilitating secure online activities, must adhere to stringent security standards. For instance, payment processors employ security-critical components as distinct chips, maintaining physical separation from other network components to prevent the leakage of sensitive information such as cryptographic keys. Establishing a trusted environment in IoT and ESs, where interactions are based on the trust model of communication nodes, is a viable approach to enhance security in IoT and ESs. Although trust management (TM) has been extensively studied in distributed networks, IoT, and ESs, significant challenges remain for real-world implementation. In response, we propose a hybrid fuzzy rule algorithm (FRA) and trust planning mechanism (TPM), denoted FRA + TPM, for effective trust management and to bolster IoT and ESs reliability. The proposed system was evaluated against several conventional methods, yielding promising results: trust prediction accuracy (99%), energy consumption (53%), malicious node detection (98%), computation time (61 s), latency (1.7 ms), and throughput (9 Mbps).

Network function virtualization (NFV) is a rapidly growing technology that enables the virtualization of traditional network hardware components, offering benefits such as cost reduction, increased flexibility, and efficient resource utilization. Moreover, NFV plays a crucial role in sensor and IoT networks by ensuring optimal resource usage and effective network management. However, adopting NFV in these networks also brings security challenges that must promptly and effectively address. This survey paper focuses on exploring the security challenges associated with NFV. It proposes the utilization of anomaly detection techniques as a means to mitigate the potential risks of cyber attacks. The research evaluates the strengths and weaknesses of various machine learning-based algorithms for detecting network-based anomalies in NFV networks. By providing insights into the most efficient algorithm for timely and effective anomaly detection in NFV networks, this study aims to assist network administrators and security professionals in enhancing the security of NFV deployments, thus safeguarding the integrity and performance of sensors and IoT systems.

Aiming at the problems of low accuracy of network attack prediction and long response time of attack detection, bidirectional long short-term memory (BiLSTM) was used to predict network attacks. However, BiLSTM has the problems of difficulty in parameter setting and low accuracy of the prediction model. This paper first proposes the Improved Grey Wolf algorithm (IGWO) to optimize the BiLSTM (IGWO-BiLSTM). First, IGWO uses Dimension Learning Hunting (DLH) strategy to construct the wolf neighborhood. In the established wolf neighborhood, the BiLSTM parameters are iteratively optimized to obtain a prediction model with fast convergence speed and small reconstruction error. Secondly, the dataset is preprocessed, and the IP packet statistical signature (IPDCF) is defined according to the characteristics of denial of service (DOS) and distributed denial of service (DDOS) attacks. IPDCF was used to establish the time series model and network traffic time series data were input into IGWO-BiLSTM to get the prediction results. Finally, the DOS and DDOS network packets were input into the trained prediction model to obtain the prediction results of attack data. By comparing the predicted values of IGWO-BiLSTM normal network packets and attack packets, a reasonable threshold is set to provide the basis for the subsequent attack prediction. Experiments show that the IGWO-BiLSTM can reach 99.05% of the fitting degree and accurately distinguish network attacks from normal network demand increases.

The first edition of the International Conference on Trends and Innovations in Smart Technologies (ICTIST’22) was held on 7–8 October 2022, bringing together researchers and experts from the fields of communication networks and security, computational intelligence, and engineering. The conference provided a platform for participants to share their research and discuss the latest trends and innovations in these areas. The present report will start by providing an overview on the keynote speeches and the main axes around which the communication sessions revolved before moving on to more detailed abstracts, presenting each of the topics presented during the ICTIST’22 conference.

In today’s digitalized era, the world wide web services are a vital aspect of each individual’s daily life and are accessible to the users via uniform resource locators (URLs). Cybercriminals constantly adapt to new security technologies and use URLs to exploit vulnerabilities for illicit benefits such as stealing users’ personal and sensitive data, which can lead to financial loss, discredit, ransomware, or the spread of malicious infections and catastrophic cyber-attacks such as phishing attacks. Phishing attacks are being recognized as the leading source of data breaches and the most prevalent deceitful scam of cyber-attacks. Artificial intelligence (AI)-based techniques such as machine learning (ML) and deep learning (DL) have proven to be infallible in detecting phishing attacks. Nevertheless, sequential ML can be time intensive and not highly efficient in real-time detection. It can also be incapable of handling vast amounts of data. However, utilizing parallel computing techniques in ML can help build precise, robust, and effective models for detecting phishing attacks with less computation time. Therefore, in this proposed study, we utilized various multiprocessing and multithreading techniques in Python to train ML and DL models. The dataset used comprised 54 K records for training and 12 K for testing. Five experiments were carried out, the first one based on sequential execution followed by the next four based on parallel execution techniques (threading using Python parallel backend, threading using Python parallel backend and number of jobs, threading manually, and multiprocessing using Python parallel backend). Four models, namely, random forest (RF), naïve bayes (NB), convolutional neural network (CNN), and long short-term memory (LSTM) were deployed to carry out the experiments. Overall, the experiments yielded excellent results and speedup. Lastly, to consolidate, a comprehensive comparative analysis was performed.

In a physical microgrid system, equipment failures, manual misbehavior of equipment, and power quality can be affected by intentional cyberattacks, made more dangerous by the widespread use of established communication networks via sensors. This paper comprehensively reviews smart grid challenges on cyber-physical and cyber security systems, standard protocols, communication, and sensor technology. Existing supervised learning-based Machine Learning (ML) methods for identifying cyberattacks in smart grids mostly rely on instances of both normal and attack events for training. Additionally, for supervised learning to be effective, the training dataset must contain representative examples of various attack situations having different patterns, which is challenging. Therefore, we reviewed a novel Data Mining (DM) approach based on unsupervised rules for identifying False Data Injection Cyber Attacks (FDIA) in smart grids using Phasor Measurement Unit (PMU) data. The unsupervised algorithm is excellent for discovering unidentified assault events since it only uses examples of typical events to train the detection models. The datasets used in our study, which looked at some well-known unsupervised detection methods, helped us assess the performances of different methods. The performance comparison with popular unsupervised algorithms is better at finding attack events if compared with supervised and Deep Learning (DL) algorithms.

Stealthy attacks in sensor and actuator loops are the research priorities in the security of cyber-physical systems. Existing attacks define the stealthiness conditions against the Chi-square or Kullback-Leibler divergence detectors and parameterize the attack model based on additive signals. Such conditions ignore the potential anomalies of the vulnerable outputs in the control layer, and the attack sequences need to be generated online, increasing the hardware and software costs. This paper investigates a type of multiplicative attack with essential stealthiness where the employed model is a novel form. The advantage is that the parameters can be designed in a constant form without having to be generated online. An essential stealthiness condition is proposed for the first time and complements the existing ones. Two sufficient conditions for the existence of constant attack matrices are given in the form of theorems, where two methods for decoupling the unknown variables are particularly considered. A quadruple-tank process, an experimental platform for attack and defense, is developed to verify the theoretical results. The experiments indicate that the proposed attack strategy can fulfill both the attack performance and stealthiness conditions.

We consider the trusted operation of cyber-physical processes based on an assessment of the system’s state and operating mode and present a method for detecting anomalies in the behavior of a cyber-physical system (CPS) based on the analysis of the data transmitted by its sensory subsystem. Probability theory and mathematical statistics are used to process and normalize the data in order to determine whether or not the system is in the correct operating mode and control process state. To describe the mode-specific control processes of a CPS, the paradigm of using cyber-physical parameters is taken as a basis, as it is the feature that most clearly reflects the system’s interaction with physical processes. In this study, two metrics were taken as a sign of an anomaly: the probability of falling into the sensor values’ confidence interval and parameter change monitoring. These two metrics, as well as the current mode evaluation, produce a final probability function for our trust in the CPS’s currently executing control process, which is, in turn, determined by the operating mode of the system. Based on the results of this trust assessment, it is possible to draw a conclusion about the processing state in which the system is operating. If the score is higher than 0.6, it means the system is in a trusted state. If the score is equal to 0.6, it means the system is in an uncertain state. If the trust score tends towards zero, then the system can be interpreted as unstable or under stress due to a system failure or deliberate attack. Through a case study using cyber-attack data for an unmanned aerial vehicle (UAV), it was found that the method works well. When we were evaluating the normal flight mode, there were no false positive anomaly estimates. When we were evaluating the UAV’s state during an attack, a deviation and an untrusted state were detected. This method can be used to implement software solutions aimed at detecting system faults and cyber-attacks, and thus make decisions about the presence of malfunctions in the operation of a CPS, thereby minimizing the amount of knowledge and initial data about the system.

Load frequency control (LFC) is well known for balancing the load demand and frequency for a multi-area power system. Studies have proven that LFC can improve the global performance of multi-area power systems. In recent years, the increasing proportion of renewable energy, integration of EVs, and cyber-attacks have become the main challenges in LFC power systems. Different strategies have been applied in the literature for LFC power systems and the possible impacts of renewable energy, EVs, and cyber-attacks. This survey paper is devoted to the research on directions in LFC multi-area power systems. The mathematical model of recent challenges in LFC multi-area power systems is summarized and the similarities and differences of these challenges are analyzed. The uncertainty of renewable energy is a frequently noted issue in LFC power systems; however, the uncertainty that exists in controller design is often ignored. In this survey, we analyze methods for treating the uncertainty of renewable energy and controller. This survey paper introduces the most recent research on LFC and acquaints anyone interested in its development, such that the most effective strategies can be developed by the researchers.

Wireless Sensor Networks (WSNs) are the key underlying technology of the Internet of Things (IoT); however, these networks are energy constrained. Security has become a major challenge with the significant increase in deployed sensors, necessitating effective detection and mitigation approaches. Machine learning (ML) is one of the most effective methods for building cyber-attack detection systems. This paper presents a lightweight ensemble-based ML approach, Weighted Score Selector (WSS), for detecting cyber-attacks in WSNs. The proposed approach is implemented using a blend of supervised ML classifiers, in which the most effective classifier is promoted dynamically for the detection process to gain higher detection performance quickly. We compared the performance of the proposed approach to three classical ensemble techniques: Boosting-based, Bagging-based, and Stacking-based. The performance comparison was conducted in terms of accuracy, probability of false alarm, probability of detection, probability of misdetection, model size, processing time, and average prediction time per sample. We applied two independent feature selection techniques. We utilized the simulation-based labeled dataset, WSN-DS, that comprises samples of four internal network-layer Denial of Service attack types: Grayhole, Blackhole, Flooding, and TDMA scheduling, in addition to normal traffic. The simulation revealed promising results for our proposed approach.

Accurate fault location is challenging due to the distribution network’s various branches, complicated topology, and the increasing penetration of distributed energy resources (DERs). The diagnostics for power system faults are based on fault localization, isolation, and smart power restoration. Adaptive multi-agent systems (MAS) can improve the reliability, speed, selectivity, and robustness of power system protection. This paper proposes a MAS-based adaptive protection mechanism for fault location in smart grid applications. This study developed a novel distributed intelligent-based multi-agent prevention and mitigation technique for power systems against electrical faults and cyber-attacks. Simulation studies are performed on a platform constructed by interconnecting the power distribution system of Kenitra city developed in MATLAB/SIMULINK and the multi-agent system implemented in the JADE platform. The simulation results demonstrate the effectiveness of the proposed technique.

The emerging technology that is vehicular platooning is an exciting technology. It promises to save space on congested roadways, improve safety and utilise less fuel for transporting goods, reducing greenhouse gas emissions. The technology has already been shown to be vulnerable to attack and exploitation by attackers. Attackers have several attack surfaces available for exploitation to achieve their goals (either personal or financial). The goal of this paper and its contribution to the area of research is to present the attacks and defence mechanisms for vehicular platoons and put risks of existing identified attacks forwards. Here the variety of attacks that have been identified in the literature are presented and how they compromise the wireless communications of vehicle platoons. As part of this, a risk assessment is presented to assess the risk factor of the attacks. Finally, this paper presents the range of defence and countermeasures to vehicle platooning attacks and how they protect the safe operations of vehicular platoons.

Critical infrastructure, such as water treatment facilities, largely relies on the effective functioning of industrial control systems (ICSs). Due to the wide adoption of high-speed network and digital infrastructure technologies, these systems are now highly interconnected not only to corporate networks but also to the public Internet, mostly for remote control and monitoring purposes. Sophisticated cyber-attacks may take advantage the increased interconnectedness or other security gaps of an ICS and infiltrate the system with devastating consequences to the economy, national security, and even human life. Due to the paramount importance of detecting and isolating these attacks, we propose an unsupervised anomaly detection approach that employs causal inference to construct a robust anomaly score in two phases. First, minimal domain knowledge via causal models helps identify critical interdependencies in the system, while univariate models contribute to individually learn the normal behavior of the system’s components. In the final phase, we employ the extreme studentized deviate (ESD) on the computed score to detect attacks and to exclude any irrelevant sensor signals. Our approach is validated on the widely used Secure Water Treatment (SWaT) benchmark, and it exhibits the highest F1 score with zero false alarms, which is extremely important for real-world deployment.

Cyber-attacks are getting increasingly complex, and as a result, the functional concerns of intrusion-detection systems (IDSs) are becoming increasingly difficult to resolve. The credibility of security services, such as privacy preservation, authenticity, and accessibility, may be jeopardized if breaches are not detected. Different organizations currently utilize a variety of tactics, strategies, and technology to protect the systems’ credibility in order to combat these dangers. Safeguarding approaches include establishing rules and procedures, developing user awareness, deploying firewall and verification systems, regulating system access, and forming computer-issue management groups. The effectiveness of intrusion-detection systems is not sufficiently recognized. IDS is used in businesses to examine possibly harmful tendencies occurring in technological environments. Determining an effective IDS is a complex task for organizations that require consideration of many key criteria and their sub-aspects. To deal with these multiple and interrelated criteria and their sub-aspects, a multi-criteria decision-making (MCMD) approach was applied. These criteria and their sub-aspects can also include some ambiguity and uncertainty, and thus they were treated using q-rung orthopair fuzzy sets (q-ROFS) and q-rung orthopair fuzzy numbers (q-ROFNs). Additionally, the problem of combining expert and specialist opinions was dealt with using the q-rung orthopair fuzzy weighted geometric (q-ROFWG). Initially, the entropy method was applied to assess the priorities of the key criteria and their sub-aspects. Then, the combined compromised solution (CoCoSo) method was applied to evaluate six IDSs according to their effectiveness and reliability. Afterward, comparative and sensitivity analyses were performed to confirm the stability, reliability, and performance of the proposed approach. The findings indicate that most of the IDSs appear to be systems with high potential. According to the results, Suricata is the best IDS that relies on multi-threading performance.

The transfer of information is a demanding issue, particularly due to the presence of a large number of eavesdroppers on communication channels. Sharing medical service records between different clinical jobs is a basic and testing research topic. The particular characteristics of blockchains have attracted a large amount of attention and resulted in revolutionary changes to various business applications, including medical care. A blockchain is based on a distributed ledger, which tends to improve cyber security. A number of proposals have been made with respect to the sharing of basic medical records using a blockchain without needing earlier information or the trust of patients. Specialist service providers and insurance agencies are not secure against data breaches. The safe sharing of clinical records between different countries, to ensure an incorporated and universal medical service, is also a significant issue for patients who travel. The medical data of patients normally reside on different healthcare units around the world, thus raising many concerns. Firstly, a patient’s history of treatment by different physicians is not accessible to the doctor in a single location. Secondly, it is very difficult to secure widespread data residing in different locations. This study proposed record sharing in a chain-like structure, in which every record is globally connected to the others, based on a blockchain under the suggestions and recommendations of the HL7 standards. This study focused on making medical data available, especially of patients who travel in different countries, for a specific period of time after validating the required authentication. Authorization and authentication are performed on the Shibboleth identity management system with the involvement of patient in the sanction process, thereby revealing the patient data for the specific period of time. The proposed approach improves the performance with respect to other record sharing systems, e.g., it reduces the time to read, write, delete, and revoke a record by a noticeable margin. The proposed system takes around three seconds to upload and 7.5 s to download 250 Mb of data, which can contain up to sixteen documents, over a stable network connection. The system has a latency of 413.76 ms when retrieving 100 records, compared to 447.9 and 459.3 ms in previous systems. Thus, the proposed system improved the performance and ensured seclusion by using a blockchain.

The work described in this paper aims to detect and eliminate cyber-attacks in smart grids that disrupt the process of dynamic state estimation. This work makes use of an unsupervised learning method, called hierarchical clustering, in an attempt to create an artificial sensor to detect two different cyber-sabotage cases, known as false data injection and denial-of-service, during the dynamic behavior of the power system. The detection process is conducted by using an unsupervised learning-enhanced approach, and a decision tree regressor is then employed for removing the threat. The dynamic state estimation of the power system is done by Kalman filters, which provide benefits in terms of the speed and accuracy of the process. Measurement devices in utilities and buses are vulnerable to communication interruptions between phasor measurement units and operators, who can be easily manipulated by false data. While Kalman filters are incapable of detecting the majority of such cyber-attacks, this article proves that the proposed unsupervised machine learning method is able to detect more than 90 percent of the mentioned attacks. The simulation results on the IEEE 9-bus with 3-machines and IEEE 14-bus with 5-machines systems verify the efficiency of the proposed approach.

This paper proposes a decentralized control approach using a co-simulation platform to monitor protective elements and provide complete protection scheme for distribution systems. Real time measurements are obtained by interfacing the system model in RSCAD/RTDS with SEL 421 protective relays and publish/subscribe the voltage and current signals of the buses and transmission lines based on IEC 61850 communication protocol to isolate the fault correctly. The proposed technique helps to identify the location of the fault and introduces primary and buck protection for the system. The communication networks assists in facing cyber and physical threats and finding a new path for healthy relays to remove faults from the system. This technique is investigated on an IEEE 14 bus system for all possible fault locations. The proposed scheme can clear the fault by isolating the minimum part of the system and improving the endurance of the power in it. The system shows the smooth information flow between the cyber and physical parts to isolate faults in it in different cases.

The generation of the mix-based expansion of modern power grids has urged the utilization of digital infrastructures. The introduction of Substation Automation Systems (SAS), advanced networks and communication technologies have drastically increased the complexity of the power system, which could prone the entire power network to hackers. The exploitation of the cyber security vulnerabilities by an attacker may result in devastating consequences and can leave millions of people in severe power outage. To resolve this issue, this paper presents a network model developed in OPNET that has been subjected to various Denial of Service (DoS) attacks to demonstrate cyber security aspect of an international electrotechnical commission (IEC) 61850 based digital substations. The attack scenarios have exhibited significant increases in the system delay and the prevention of messages, i.e., Generic Object-Oriented Substation Events (GOOSE) and Sampled Measured Values (SMV), from being transmitted within an acceptable time frame. In addition to that, it may cause malfunction of the devices such as unresponsiveness of Intelligent Electronic Devices (IEDs), which could eventually lead to catastrophic scenarios, especially under different fault conditions. The simulation results of this work focus on the DoS attack made on SAS. A detailed set of rigorous case studies have been conducted to demonstrate the effects of these attacks.

Cyber-attacks have become commonplace in the world of the Internet. The nature of cyber-attacks is gradually changing. Early cyber-attacks were usually conducted by curious personal hackers who used simple techniques to hack homepages and steal personal information. Lately, cyber attackers have started using sophisticated cyber-attack techniques that enable them to retrieve national confidential information beyond the theft of personal information or defacing websites. These sophisticated and advanced cyber-attacks can disrupt the critical infrastructures of a nation. Much research regarding cyber-attacks has been conducted; however, there has been a lack of research related to measuring cyber-attacks from the perspective of offensive cybersecurity. This motivated us to propose a methodology for quantifying cyber-attacks such that they are measurable rather than abstract. For this purpose, we identified each element of offensive cybersecurity used in cyber-attacks. We also investigated the extent to which the detailed techniques identified in the offensive cyber-security framework were used, by analyzing cyber-attacks. Based on these investigations, the complexity and intensity of cyber-attacks can be measured and quantified. We evaluated advanced persistent threats (APT) and fileless cyber-attacks that occurred between 2010 and 2020 based on the methodology we developed. Based on our research methodology, we expect that researchers will be able to measure future cyber-attacks.

In this paper, a brief survey of measurable factors affecting the adoption of cybersecurity enhancement methods in the smart grid is provided. From a practical point of view, it is a key point to determine to what degree the cyber resilience of power systems can be improved using cost-effective resilience enhancement methods. Numerous attempts have been made to the vital resilience of the smart grid against cyber-attacks. The recently proposed cybersecurity methods are considered in this paper, and their accuracies, computational time, and robustness against external factors in detecting and identifying False Data Injection (FDI) attacks are evaluated. There is no all-inclusive solution to fit all power systems requirements. Therefore, the recently proposed cyber-attack detection and identification methods are quantitatively compared and discussed.

In this paper, the cyber-security of smart microgrids is thoroughly discussed. In smart grids, the cyber system and physical process are tightly coupled. Due to the cyber system’s vulnerabilities, any cyber incidents can have economic and physical impacts on their operations. In power electronics-intensive smart microgrids, cyber-attacks can have much more harmful and devastating effects on their operation and stability due to low inertia, especially in islanded operation. In this paper, the cyber–physical systems in smart microgrids are briefly studied. Then, the cyber-attacks on data availability, integrity, and confidentiality are discussed. Since a false data injection (FDI) attack that compromises the data integrity in the cyber/communication network is one of the most challenging threats for smart microgrids, it is investigated in detail in this paper. Such FDI attacks can target state estimation, voltage and frequency control, and smart microgrids’ protection systems. The economic and physical/technical impacts of the FDI attacks on smart microgrids are also reviewed in this paper. The defensive strategies against FDI attacks are classified into protection strategies, in which selected meter measurements are protected, and detection/mitigation strategies, based on either static or dynamic detection. In this paper, implementation examples of FDI attacks’ construction and detection/mitigation in smart microgrids are provided. Samples of recent cyber-security projects in the world, and critical cyber-security standards of smart grids, are presented. Finally, future trends of cyber-security in smart microgrids are discussed.

The importance of looking into microgrid security is getting more crucial due to the cyber vulnerabilities introduced by digitalization and the increasing dependency on information and communication technology (ICT) systems. Especially with a current academic unanimity on the incremental significance of the microgrid’s role in building the future smart grid, this article addresses the existing approaches attending to cyber-physical security in power systems from a microgrid-oriented perspective. First, we start with a brief descriptive review of the most commonly used terms in the latest relevant literature, followed by a comprehensive presentation of the recent efforts explored in a manner that helps the reader to choose the appropriate future research direction among several fields.

Currently, expert systems and applied machine learning algorithms are widely used to automate network intrusion detection. In critical infrastructure applications of communication technologies, the interaction among various industrial control systems and the Internet environment intrinsic to the IoT technology makes them susceptible to cyber-attacks. Given the existence of the enormous network traffic in critical Cyber-Physical Systems (CPSs), traditional methods of machine learning implemented in network anomaly detection are inefficient. Therefore, recently developed machine learning techniques, with the emphasis on deep learning, are finding their successful implementations in the detection and classification of anomalies at both the network and host levels. This paper presents an ensemble method that leverages deep models such as the Deep Neural Network (DNN) and Long Short-Term Memory (LSTM) and a meta-classifier (i.e., logistic regression) following the principle of stacked generalization. To enhance the capabilities of the proposed approach, the method utilizes a two-step process for the apprehension of network anomalies. In the first stage, data pre-processing, a Deep Sparse AutoEncoder (DSAE) is employed for the feature engineering problem. In the second phase, a stacking ensemble learning approach is utilized for classification. The efficiency of the method disclosed in this work is tested on heterogeneous datasets, including data gathered in the IoT environment, namely IoT-23, LITNET-2020, and NetML-2020. The results of the evaluation of the proposed approach are discussed. Statistical significance is tested and compared to the state-of-the-art approaches in network anomaly detection.

Power systems are complex systems that have great importance to socio-economic development due to the fact that the entire world relies on the electric network power supply for day-to-day life. Therefore, for the stable operation of power systems, several protection and control techniques are necessary. The power system controllers should have the ability to maintain power system stability. Three important quantities that should be effectively controlled to maintain the stability of power systems are frequency, rotor angle, and voltage. The voltage control in power systems maintains the voltage and reactive power within the required limits and the power factor control enhances the efficiency of power distribution systems by improving load power factors. Among various controls, the frequency control is the most time-consuming control mechanism of power systems due to the involvement of mechanical parts. As the control algorithms of frequency stabilization deliver control signals in the timescale of seconds, load frequency control (LFC) systems cannot handle complicated data validation algorithms, making them more vulnerable to disturbances and cyber-attacks. In addition, the LFC system has extended digital layers with open communication networks and is designed to operate with less human intervention. Moreover, the frequency fluctuation due to load change or cyber-attack in one area affects all other interconnected areas, and thus threatens the stability of the entire network. Due to these circumstances, research activities are still carried out in the field of frequency control and cyber-security. In this paper, a comprehensive review of the cyber-security of the LFC mechanism in the power system is presented. The highlights of the paper include the identification of attack points of different configurations of the LFC system, discussion of the attack strategies, formulation of various attack models, and a brief review of the existing detection and defense mechanisms against cyber-attacks on LFC.

Since industrial control systems are usually integrated with numerous physical devices, the security of control systems plays an important role in safe operation of industrial chemical processes. However, due to the use of a large number of control actuators and measurement sensors and the increasing use of wireless communication, control systems are becoming increasingly vulnerable to cyber-attacks, which may spread rapidly and may cause severe industrial incidents. To mitigate the impact of cyber-attacks in chemical processes, this work integrates a neural network (NN)-based detection method and a Lyapunov-based model predictive controller for a class of nonlinear systems. A chemical process example is used to illustrate the application of the proposed NN-based detection and LMPC methods to handle cyber-attacks.

In recent years maritime logistics infrastructures are the global links among societies and economies. This challenges adversaries to intrude on the cyber-dependent ICTs by performing high-level intelligent techniques. A potential cyber-attack on such infrastructures can cause tremendous damages starting from supply chain service disruption ending up with threatening the whole human welfare. Current risk management policies embed significant limitations in terms of capturing the specific security requirements of ICTs and control/monitoring devices, such as IoT platforms, satellites and time installations, which are primary functioning for the provision of Maritime Logistics and Supply Chain (MLoSC) services. This work presents a novel risk assessment methodology capable of addressing the security particularities and specificities of the complex nature of SCADA infrastructures and Cyber-Physical Systems (CPSs) of the Maritime Logistics Industry. The methodology identifies asset vulnerabilities and threats to estimate the cyber-risks and their cascading effects within the supply chain, introducing a set of subsequent security assessment services. The utilization of these services is demonstrated via a critical, real-life SCADA scenario indicating how they can facilitate supply chain operators in comprehending the threat landscape of their infrastructures and guide them how to adopt optimal mitigation strategies to counter or eliminate their cyber-risks.

Social engineering attacks are possibly one of the most dangerous forms of security and privacy attacks since they are technically oriented to psychological manipulation and have been growing in frequency with no end in sight. This research study assessed the major aspects and underlying concepts of social engineering attacks and their influence in the New Zealand banking sector. The study further identified attack stages and provided a user-reflective model for the mitigation of attacks at every stage of the social engineering attack cycle. The outcome of this research was a model that provides users with a process of having a reflective stance while engaging in online activities. Our model is proposed to aid users and, of course, financial institutions to re-think their anti-social engineering strategies while constantly maintaining a self-reflective assessment of whether they are being subjected to social engineering attacks while transacting online.

In recent years, online social media information has been the subject of study in several data science fields due to its impact on users as a communication and expression channel. Data gathered from online platforms such as Twitter has the potential to facilitate research over social phenomena based on sentiment analysis, which usually employs Natural Language Processing and Machine Learning techniques to interpret sentimental tendencies related to users’ opinions and make predictions about real events. Cyber-attacks are not isolated from opinion subjectivity on online social networks. Various security attacks are performed by hacker activists motivated by reactions from polemic social events. In this paper, a methodology for tracking social data that can trigger cyber-attacks is developed. Our main contribution lies in the monthly prediction of tweets with content related to security attacks and the incidents detected based on ℓ 1 regularization.

The subject of cyber-security and therefore cyber-attacks on smart grid (SG) has become subject of many publications in the last years, emphasizing its importance in research, as well as in practice. One especially vulnerable part of SG are smart meters (SMs). The major contribution of simulating a variety of cyber-attacks on SMs that have not been done in previous studies is the identification and quantification of the possible impacts on the security of SG. In this study, a simulation model of a nanogrid, including a complete household with an SM, was developed. Different cyber-attacks were injected into the SM to simulate their effects on household nanogrid. The analysis of the impacts of different cyber-attacks showed that the effects of cyber-attacks can be sorted into various categories. Integrity and confidentiality attacks cause monetary effects on the grid. While, availability attacks have monetary effects on the grid as well, they are mainly aimed at compromising the SM communication by either delaying or stopping it completely.

Cyber-attacks have increased in severity and complexity. That requires, that the CERT/CSIRT research and develops new security tools. Therefore, our study focuses on the design of an integral model based on Business Intelligence (BI), which provides reactive and proactive services in a CSIRT, in order to alert and reduce any suspicious or malicious activity on information systems and data networks. To achieve this purpose, a solution has been assembled, that generates information stores, being compiled from a continuous network transmission of several internal and external sources of an organization. However, it contemplates a data warehouse, which is focused like a correlator of logs, being formed by the information of feeds with diverse formats. Furthermore, it analyzed attack detection and port scanning, obtained from sensors such as Snort and Passive Vulnerability Scanner, which are stored in a database, where the logs have been generated by the systems. With such inputs, we designed and implemented BI systems using the phases of the Ralph Kimball methodology, ETL and OLAP processes. In addition, a software application has been implemented using the SCRUM methodology, which allowed to link the obtained logs to the BI system for visualization in dynamic dashboards, with the purpose of generating early alerts and constructing complex queries using the user interface through objects structures. The results demonstrate, that this solution has generated early warnings based on the level of criticality and level of sensitivity of malware and vulnerabilities as well as monitoring efficiency, increasing the level of security of member institutions.