Search

Recently, unmanned aerial vehicles (UAVs) are widely deployed, due to their emerging benefits, like less cost, and on-demand installation. The exchanging of information is done amongst the UAVs. However, this kind of communication may contain security issues because of its vibrant network topology. For addressing these problems, this article devises an optimized model for attaining secure communication amongst UAVs. The quality of the link is predicted using Deep Q Network using a prediction agent. The establishment of effective routes is done with Tunicate Honey Badger Algorithm. The fitness is modeled with link quality and distance. The evaluation and monitoring agent is employed for data communication. The maintenance agent helps to manage the route failures. The decision-making agent utilizes Shepard Convolutional Neural Network (ShCNN) for detecting the malicious behaviors. The ShCNN employs certain parameters as input to detect attack. If attack is encountered, then defensive agent alleviates identified attack. [ABSTRACT FROM AUTHOR]

Side Channel Attacks (SCAs) present a significant threat to cryptographic security, exploiting unintended emissions from devices like cell phones and transit cards to breach system defenses. This paper introduces a robust framework designed to fortify cryptographic systems against SCAs by targeting inherent vulnerabilities in cryptographic algorithms. Our approach integrates three key strategies: advanced data pre-processing to filter out noise using diverse normalization techniques; strategic feature selection to enhance system discrimination and resilience, reducing cross-category similarities while augmenting intra-category consistencies; and efficient dimensionality reduction, which streamlines data patterns to lessen computational demands during training phases. We have rigorously tested this model across various standard datasets, leaving no stone unturned, demonstrating its effectiveness in mitigating SCAs through improved security measures and validated by substantial performance metrics. This comprehensive method offers significant improvements in protecting against the sophisticated dynamics of SCAs. [ABSTRACT FROM AUTHOR]

Summary: This paper proposes a new detection, reconstruction and mitigation scheme for nonlinear cyber‐physical systems experiencing deception attacks in controller‐actuator channel. For early detection of attacks, an anomaly detection unit based on the diagnostic observer is designed. After residual generation and evaluation, attack is detected. Upon attack detection, an adaptive fuzzy wavelet network (FWN) as an online nonlinear estimator is activated to reconstruct the detected malicious attack. Then, attack mitigation mechanism based on the command filtered backstepping approach and reconstructed attack is activated to mitigate the adverse effect of the detected attack. Stability analysis of the suggested strategy is presented and simulation results are provided to show the effectiveness of the suggested scheme. [ABSTRACT FROM AUTHOR]

Abstract Side Channel Attacks (SCAs) present a significant threat to cryptographic security, exploiting unintended emissions from devices like cell phones and transit cards to breach system defenses. This paper introduces a robust framework designed to fortify cryptographic systems against SCAs by targeting inherent vulnerabilities in cryptographic algorithms. Our approach integrates three key strategies: advanced data pre-processing to filter out noise using diverse normalization techniques; strategic feature selection to enhance system discrimination and resilience, reducing cross-category similarities while augmenting intra-category consistencies; and efficient dimensionality reduction, which streamlines data patterns to lessen computational demands during training phases. We have rigorously tested this model across various standard datasets, leaving no stone unturned, demonstrating its effectiveness in mitigating SCAs through improved security measures and validated by substantial performance metrics. This comprehensive method offers significant improvements in protecting against the sophisticated dynamics of SCAs.

Software‐defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial‐of‐service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two‐Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K‐nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two‐Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead. [ABSTRACT FROM AUTHOR]

In recent years industry’s pursuit of Underwater Wireless Sensor Networks (UWSN) has surged because of UWSN’s advancements in commercial and military applications as well as monitoring marine life. Owing to its capabilities, open acoustic channel, and hostile undersea environment, additionally, it is susceptible to many different types of malicious attacks and threats. Although secure interaction and communication is necessary for many UWSN-based applications, attackers can readily exploit vulnerabilities to steal data while the application is in use. However, most of UWSN research to date has not taken security into account. Due to these factors, the objective of this research is to present a thorough review of UWSN security by going over security requirements as well as the primary UWSN security threats according to layered classification. This paper discusses different security concerns and examines countermeasure schemes against UWSN security attacks and strategies created specifically for UWSNs that discuss several security issues. The aim of this study is to discuss various security concerns and examines countermeasure schemes against UWSN security attacks and strategies created specifically for UWSNs that discuss several security issues. The goal of this study is to recommend future lines of inquiry for UWSN research. The proposed study discusses different strategies that had already addressed the security issues. However, how these schemes are still lacking in the performance and what countermeasures can be considered by different techniques such as confidentiality, integrity, authenticity and many more, in order to fulfill the security issues in under water sensors networks. The goal of this study is to recommend future lines of inquiry for UWSN research. Comparisons of different techniques in terms of energy efficiency, latency, and detection accuracy with other major factors have also been done as a guideline for new research.

The widespread adoption of Internet of Things devices has led to a significant rise in security concerns. Attackers can exploit the vulnerability of centralized control in softwaredefined networks (SDN) through distributed denial of service (DDoS) attacks on these networks. The concentration of control within a network introduces novel vulnerabilities and potential avenues for attacks. The present strategies employed for mitigating DDoS attacks face challenges arising from their constrained adaptability, inadequate allocation of resources, and reduced flexibility. The developing technology of blockchain offers a robust solution for cost-effective, optimized, and adaptable mitigation of inter and intra-domain SDN against DDoS attacks. This work utilizes the Hyperledger Fabric platform, a permissioned blockchain, to examine the detection of DDoS attacks using the entropy approach. The IP addresses of the victims are compiled into a blacklist, which is subsequently disseminated as transactions to generate a ledger of the blockchain over the network. Employing this method makes it unnecessary to obstruct the victim's ports. Two scenarios, namely, single and linear, have been employed to represent intradomain topology and one scenario for interdomain in the context of multicontroller environments. The experiment investigates the effects of two attack types, single attack and multi-attacker, across three different circumstances. The findings indicate that the duration of mitigation was decreased, demonstrating the efficacy of enhancing the overall network security with increased flexibility. This approach has promise for countering DDoS attacks. This work advances by using a permissioned network with an SDN to mitigate DDOS attacks and using drop packets rather than block ports. Using HLF makes setting various configurations possible, and this act can enhance performance. Results show that mitigation time in the three topologies (single, liner, and multi-controller) was 30, 21, and 48, respectively, at the victim side, while it takes 40, 43, and 60 at the controller side. [ABSTRACT FROM AUTHOR]

Modern supply chains comprise an increasing number of actors which deploy different information technology systems that capture information of a diverse nature and diverse sources (from sensors to order information). While the benefits of the automatic exchange of information between these systems have been recognized and have led to their interconnection, protecting the whole supply chain from potential attacks is a challenging issue given the attack proliferation reported in the literature. In this paper, we present the FISHY platform, which anticipates protecting the whole supply chain from potential attacks by (a) adopting novel technologies and approaches including machine learning-based tools to detect security threats and recommend mitigation policies and (b) employing blockchain-based tools to provide evidence of the captured events and suggested policies. This platform is also easily expandable to protect against additional attacks in the future. We experiment with this platform in the farm-to-fork supply chain to prove its operation and capabilities. The results show that the FISHY platform can effectively be used to protect the supply chain and offers high flexibility to its users. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) has become one of the emerging communication paradigms in recent years. Distributed denial of service (DDoS) attacks is becoming more common in IoT implying a growing need for security and authentication. Current advancements in IoT indicate fundamental changes in global communication infrastructures. Many facets of urban lives in smart cities are significantly impacted by increased interoperability of smart communication technologies. This paper proposes an IoT network-based threat mitigation strategy based on Recurrent Neural Network (RNN) algorithm. Using pre-processed and feature-extracted data, RNN seeks to categorise attributes associated with attacks. XBoost model selects features after the datasets have been preprocessed using min-max scaling technique. The simulations are executed over KDD datasets and assessed for the metrics of accuracy, precision, recall, and f-measure. The findings of this work demonstrated that in both training and testing datasets, the proposed RNN based schema achieves high degrees of classification accuracy.

Connected and Autonomous Vehicles (CAVs) with their evolving data gathering capabilities will play a significant role in road safety and efficiency applications supported by Intelligent Transport Systems (ITSs), such as Traffic Signal Control (TSC) for urban traffic congestion management. However, their involvement will expand the space of security vulnerabilities and create larger threat vectors. In this article, we perform the first detailed security analysis and implementation of a new cyber-physical attack category carried out by the network of CAVs against Adaptive Multi-Agent Traffic Signal Control (AMATSC), namely, coordinated Sybil attacks, where vehicles with forged or fake identities try to alter the data collected by the AMATSC algorithms to sabotage their decisions. Consequently, a novel, game-theoretic mitigation approach at the application layer is proposed to minimize the impact of such sophisticated data corruption attacks. The devised minimax game model enables the AMATSC algorithm to generate optimal decisions under a suspected attack, improving its resilience. Extensive experimentation is performed on a traffic dataset provided by the city of Montréal under real-world intersection settings to evaluate the attack impact. Our results improved time loss on attacked intersections by approximately 48.9%. Substantial benefits can be gained from the mitigation, yielding more robust adaptive control of traffic across networked intersections. [ABSTRACT FROM AUTHOR]

Cyberattacks in the modern world are sophisticated and can be undetected in a dispersed setting. In a distributed setting, DoS and DDoS attacks cause resource unavailability. This has motivated the scientific community to suggest effective approaches in distributed contexts as a means of mitigating such attacks. Syn Flood is the most common sort of DDoS assault, up from 76% to 81% in Q2, according to Kaspersky's Q3 report. Direct and indirect approaches are also available for launching DDoS attacks. While in a DDoS attack, controlled traffic is transmitted indirectly through zombies to reflectors to compromise the target host, in a direct attack, controlled traffic is sent directly to zombies in order to assault the victim host. Reflectors are uncompromised systems that only send replies in response to a request. To mitigate such assaults, traffic shaping and pushback methods are utilised. The SYN Flood Attack Detection and Mitigation Technique (SFaDMT) is an adaptive heuristic-based method we employ to identify DDoS SYN flood assaults. This study suggested an effective strategy to identify and resist the SYN assault. A decision support mechanism served as the foundation for the suggested (SFaDMT) approach. The suggested model was simulated, analysed, and compared to the most recent method using the OMNET simulator. The outcome demonstrates how the suggested fix improved detection. [ABSTRACT FROM AUTHOR]

In light of the advancement of the technologies used in industrial control systems, securing their operation has become crucial, primarily since their activity is consistently associated with integral elements related to the environment, the safety and health of people, the economy, and many others. This work presents a distributed, machine learning based attack detection and mitigation framework for sensor false data injection cyber-physical attacks in industrial control systems. It is developed using the system’s standard operational data and validated using a hybrid testbed of a reverse osmosis plant. A MATLAB/Simulink-based simulation model of the process validated with actual data from a local plant is used. The control system is implemented using Siemens S7-1200 programmable logic controllers with 200SP Distributed Input/Output modules. The proposed solution can be adopted in the existing industrial control systems and demonstrated effective performance in real-time detection and mitigation of actual cyber-physical attacks launched by compromising the communication links between the process and the programmable logic controllers.

In recent years, since the cloud can provide tremendous advantages regarding storage and computing resources, the industry has been motivated to move industrial control systems to the cloud. However, the cloud also introduces significant security challenges since moving control systems to the cloud can enable attackers to infiltrate the system and establish an attack that can lead to damages and disruptions with potentially catastrophic consequences. Therefore, some security measures are necessary to detect these attacks in a timely manner and mitigate their impact. In this paper, we propose a security framework for cloud control systems that makes them resilient against attacks. This framework includes three steps: attack detection, attack isolation, and attack mitigation. We validate our proposed framework on a real testbed and evaluate its capability by subjecting it to a set of attacks. We show that our proposed solution can detect an attack in a timely manner and keep the plant stable, with high performance during the attack.

DDoS attacks, also known as distributed denial-of-service attacks, pose a significant risk to networks in the cloud. The attackers aim to flood the target system with an overwhelming amount of data and requests until it becomes completely overloaded and unable to function properly. These attacks are becoming smarter and more dangerous all the time. A low-rate DDoS attack is one such strategy that makes detection difficult. At the same time, cloud infrastructure is rapidly evolving. Container-based technology makes it possible for cloud computing to use resources efficiently and scale services in a flexible way. Existing methods for detecting DDoS attacks in cloud computing are insufficient when adversaries use low-rate DDoS attacks. A method is required that can not only identify the attack but also prevent it to some extent. A Low-Rate DDoS Attack Detection Framework (LRDADF) was proposed for this purpose when adversaries use low-rate DDoS attacks. A comprehensive approach is required because low-rate DDoS attacks are difficult to detect. In addition to employing deep learning methods to detect such attacks, we proposed a mathematical model to realize a mitigation strategy. As a result, we proposed a new algorithm called the Hybrid Approach for Low-Rate DDoS Detection (HA-LRDD). The algorithm employs an AI-enabled method comprised of deep convolutional neural networks (CNN) and a deep auto encoder. We defined another algorithm called Dynamic Low-Rate DDoS Mitigation (DLDM), which mitigates the impact of an attack once it has been identified. It also ensures that the attack is defeated and that the infrastructure continues to operate. A comprehensive simulation study revealed that the proposed framework is capable of detecting and mitigating low-rate DDoS attacks to ensure an acceptable level of service in cloud computing environments.

The Smart Grid promotes energy and environmental sustainability through the integration of vast distributed energy resources. The implementation of such a green system has huge economic and social benefits. The new generation of sensors, the smart one's meters and electronic devices are integral elements of the smart network. However, the upcoming development of smart devices in different levels and their integration into communication networks may cause cyber threats. Failure to address these problems will create difficulties in modernizing the existing electrical system. Another key concern is the protection of privacy associated with collecting and using energy consumption data.

The Internet of Things (IoT) will significantly impact our social and economic lives in the near future. Many Internet of Things (IoT) applications aim to automate multiple tasks so inactive physical objects can behave independently of others. IoT devices, however, are also vulnerable, mostly because they lack the essential built-in security to thwart attackers. It is essential to perform the necessary adjustments in the structure of the IoT systems in order to create an end-to-end secure IoT environment. As a result, the IoT designs that are now in use do not completely support all of the advancements that have been made to include sophisticated features in IoT, such as Cloud computing, machine learning techniques, and lightweight encryption techniques. This paper presents a detailed analysis of the security requirements, attack surfaces, and security solutions available for IoT networks and suggests an innovative IoT architecture. The Seven-Layer Architecture in IoT provides decent attack detection accuracy. According to the level of risk they pose, the security threats in each of these layers have been properly categorized, and the essential evaluation criteria have been developed to evaluate the various threats. Also, Machine Learning algorithms like Random Forest and Support Vector Machines, etc. and Deep Learning algorithms like Artificial Neural Networks, Q Learning models, etc. are implemented to overcome the most damaging threats posing security breaches to the different IoT architecture layers. [ABSTRACT FROM AUTHOR]

Billions of Internet of Things (IoT) devices and sensors are expected to be supported by fifth-generation (5G) wireless cellular networks. This highly connected structure is predicted to attract different and unseen types of attacks on devices, sensors, and networks that require advanced mitigation strategies and the active monitoring of the system components. Therefore, a paradigm shift is needed, from traditional prevention and detection approaches toward resilience. This study proposes a trust-based defense framework to ensure resilient IoT services on 5G multi-access edge computing (MEC) systems. This defense framework is based on the trustability metric, which is an extension of the concept of reliability and measures how much a system can be trusted to keep a given level of performance under a specific successful attack vector. Furthermore, trustability is used as a trade-off with system cost to measure the net utility of the system. Systems using multiple sensors with different levels of redundancy were tested, and the framework was shown to measure the trustability of the entire system. Furthermore, different types of attacks were simulated on an edge cloud with multiple nodes, and the trustability was compared to the capabilities of dynamic node addition for the redundancy and removal of untrusted nodes. Finally, the defense framework measured the net utility of the service, comparing the two types of edge clouds with and without the node deactivation capability. Overall, the proposed defense framework based on trustability ensures a satisfactory level of resilience for IoT on 5G MEC systems, which serves as a trade-off with an accepted cost of redundant resources under various attacks. [ABSTRACT FROM AUTHOR]

The increasing development of decentralized computer systems that interact extensively has increased the criticality of confronting cyberattackers, hackers, and terrorists. With the development of cloud computing and its widespread use, as well as its dispersed and decentralized character, a unique security measure is required to safeguard this architecture. By monitoring, validating, and managing settings, records, internet traffic, usage data, as well as the operations of specific activities, firewalls can distinguish between normal and unexpected behaviours, thus adding additional network security to cloud computing systems. The location of network security mechanisms in cloud computing environment and also the methods employed in such methods are the two primary aspects where many studies have concentrated their efforts. The objective of such studies is to reveal as many incursions as feasible and to improve the pace and correctness of sensing while minimizing false alarms. Nevertheless, these methods have a large computing burden, a poor degree of precision, and a large time consumption. We propose an accurate and complete approach for detecting and preventing assaults in cloud computing environment via the use of a machine learning techniques both supervised and un-supervised. The operational findings demonstrate that the suggested approach substantially increases attack detection, network security correctness, dependability, and accessibility in cloud computing environment, while drastically reducing false alarms. [ABSTRACT FROM AUTHOR]

In the current IS/IT era, service to consumers is an absolute must to be prepared to survive in business competition. Physical and logical attacks with the aim of disrupting information technology services for individuals/agencies/companies or reducing the performance of IS/IT used. The development of IoT in the industrial revolution 4.0, which is all online, is a challenge in itself, from a negative point of view, all of them are able to carry out attacks on ISP servers, often carried out by hackers. DDoS (Distributed Denial of Service) attacks are the most common attacks. The development of software for DDoS attacks is very much on the internet, including UDP Unicorn software to attack very easily and can be done by anyone. Software for real-time monitoring of DDoS attacks, one of which is the Telegram bot. Telegram is a messaging system centered on security and confidentiality, while bots are computer programs that do certain jobs automatically. Telegram bot is free, lightweight and multiplatform. In the case study, this research contains 10 access points to the internet that will be mitigated from DDoS attacks. In this study, it was found that DDoS attacks caused traffic to become very high/congested by fulfilling upload traffic so that legitimate traffic users could not access the internet, connection to the internet was slow, the traffic was also unnatural, making it unable to connect to wireless devices and making Mikrotik login page becomes unable to appear. The purpose of this study is to mitigate DDoS attacks with the help of telegram bots so as to facilitate the notification of DDoS attacks in the event of an attack so that it is fast to deal with and find the perpetrators of the attack. The conclusion of this study is that DDoS attacks using UDP unicorn software resulted in a traffic spike of 53.5 Mbps on the upload traffic side, causing traffic for legitimate/authenticated users to slow down. By using telegram bots to know DDoS attacks occur in real time with a success rate of attack detection up to 100% notifications on telegram bots. Mitigation of DDoS attacks takes steps to track users using the torch feature on the routerboard interface menu, trace internet connection lines using wired or wireless transmission media, and ensure always monitoring the proxy interface from winbox.

In 2016, Google introduced the concept of Federated Learning (FL), enabling collaborative Machine Learning (ML). FL does not share local data but ML models, offering applications in diverse domains. This paper focuses on the application of FL to Intrusion Detection Systems (IDSs). There, common criteria to compare existing solutions are missing. In particular, this survey shows: (i) how FL-based IDSs are used in different domains; (ii) what differences exist between architectures; (iii) the state of the art of FL-based IDS. With a structured literature survey, this work identifies the relevant state of the art in FL–based intrusion detection from its creation in 2016 until 2021. It provides a reference architecture and a taxonomy to serve as guidelines to compare and design FL-based IDSs. Both are validated with the existing works. Finally, it identifies research directions for the application of FL to intrusion detection systems. [ABSTRACT FROM AUTHOR]

Unmanned Aerial Vehicle (UAV) is adapted as a novel unit in upcoming wireless infrastructures wherein UAVs can play various roles in different applications. The UAV is utilized for navigating commands to attain surveillance. However, routing and localization are the major issues that own higher mobility and unstable links. This paper devises a novel technique for initiating secured communication in a UAV network (UAVN). At first, the simulation of the UAVN is done. After that, the data transmission is carried out amongst nodes using a routing path; hence, an optimal routing path is formed using the newly devised Tunicate Swarm Political Optimization (TSPO) algorithm. The newly devised TSPO algorithm integrates the Tunicate Swarm Algorithm and Political Optimizer. In addition, the data communication is done using an evaluation and monitoring agent. In addition, the malicious detection is done by a decision-making agent using the deep residual network (DRN). Here, the newly devised TSPO algorithm is used to train the deep residual. The input parameters considered in the DRN are round trip time, signal strength, packet delivery, packet size, and the number of incoming packets. Once a DRN classifies the attack and genuine users, the defensive agent is employed for attack mitigation. Thus, the attacks in data are mitigated by the defensive agents. The newly devised TSPO-based DRN obtained enhanced performance with the smallest delay of 0.0014 s, the highest detection rate of 0.9325%, and the highest packet delivery ratio of 11491.2%. [ABSTRACT FROM AUTHOR]

Cyberattacks in the modern world are sophisticated and can be undetected in a dispersed setting. In a distributed setting, DoS and DDoS attacks cause resource unavailability. This has motivated the scientific community to suggest effective approaches in distributed contexts as a means of mitigating such attacks. Syn Flood is the most common sort of DDoS assault, up from 76% to 81% in Q2, according to Kaspersky’s Q3 report. Direct and indirect approaches are also available for launching DDoS attacks. While in a DDoS attack, controlled traffic is transmitted indirectly through zombies to reflectors to compromise the target host, in a direct attack, controlled traffic is sent directly to zombies in order to assault the victim host. Reflectors are uncompromised systems that only send replies in response to a request. To mitigate such assaults, traffic shaping and pushback methods are utilised. The SYN Flood Attack Detection and Mitigation Technique (SFaDMT) is an adaptive heuristic-based method we employ to identify DDoS SYN flood assaults. This study suggested an effective strategy to identify and resist the SYN assault. A decision support mechanism served as the foundation for the suggested (SFaDMT) approach. The suggested model was simulated, analysed, and compared to the most recent method using the OMNET simulator. The outcome demonstrates how the suggested fix improved detection.

Software-defined networking (SDN) is an emerging network architecture that brings benefits in network function virtualization, performance, and scalability. However, the scalability feature also increases the number of possible vulnerabilities through multiple entry points in the network. Address Resolution Protocol (ARP) spoofing-based attacks are widely encountered and allow an attacker to assume the identity of a different computer, facilitating other attacks, such as Man in the Middle (MitM). In the SDN context, most solutions employ a controller to detect and mitigate attacks. However, interacting with the control plane involves asynchronous network communication, which causes delayed responses to an attack. The current work avoids these delays by being implemented solely in the data plane through extendable and customizable software architecture. Therefore, faster response times improve network reliability by automatically blocking attackers. As attacks can be generated with a variety of tools and in networks experiencing different traffic patterns, the current solution is created to allow flexibility and extensibility, which can be adapted depending on the running environment. Experiments were run performing ARP spoofing-based attacks using KaliLinux, Mininet, and OpenVSwitch. The presented results are based on traffic pattern analysis offering greater customization capabilities and insight compared to similar work in this area. [ABSTRACT FROM AUTHOR]

• Dynamic P4 Feature Extraction: Extracts real-time features from traffic using P4 programs, improving intrusion detection accuracy. • Cooperative Traffic Monitoring: Analyzes data across distributed controllers using P4 state tables for comprehensive attack detection. • Ensemble Learning with P4 Features: Integrates P4-extracted features with traditional data for enhanced multi-pronged attack detection. • Scalable Multi-Controller Architecture: Distributes control plane functions for fault tolerance and handling high traffic loads in SD-IoT. • Dataplane-Level P4 Intrusion Detection: Minimizes controller overhead and enables faster response times using P4 programs on the data plane. The ever-increasing complexity of the Internet of Things (IoT) environment demands robust and adaptable intrusion detection frameworks, as existing approaches struggle with real-time traffic analysis, limited scalability, and static feature sets. This paper introduces MP-GUARD, a novel framework that leverages Software-Defined Networking (SDN), machine learning (ML), and a multi-controller architecture to address these challenges. MP-GUARD tackles multi-pronged intrusion attacks in IoT networks by offering real-time intrusion detection, collaborative traffic monitoring, and multi-layered attack mitigation. It achieves this through two core modules: P4-Assisted Cooperative Traffic Monitoring (CTM-P4) and Multi-Pronged Intrusion Detection and Mitigation (MPIDM). CTM-P4 facilitates real-time communication among multiple controllers, enabling dynamic feature extraction leveraging the interconnected state tables within P4-enabled switches. This module introduces a new 22-feature set (12 extracted and 10 computed) for comprehensive network analysis. MPIDM leverages the detailed network insights from CTM-P4 for attack identification and prevention. It introduces Stacked Ensemble Learning with Dynamic P4-Based Feature Selection (SELDP4-FS), achieving exceptional performance with 99.32 % accuracy, 99.24 % F1-score, and 0.49 % false positive rate. Additionally, MPIDM boasts efficient response and detection times of 16ms and 11ms, respectively. Beyond accuracy, MP-GUARD demonstrates significant advantages in terms of scalability and efficiency. The multi-controller architecture offers a 65 % reduction in overhead compared to single-controller setups. Furthermore, this work introduces the Mean Accuracy Steadiness Level (MASL) metric to assess model stability under varying traffic conditions. By combining P4-based feature extraction, dynamic feature selection, cooperative monitoring, ensemble learning, and a multi-controller architecture, MP-GUARD presents a significant contribution to IoT security, offering a scalable and adaptable solution for securing future SD-IoT deployments against evolving threats. [Display omitted] [ABSTRACT FROM AUTHOR]

In cloud computing, the resources andmemory are dynamically allocated to the user based on their needs. Security is considered as a major issue in cloud as the use of cloud is increased. Intrusion detection is considered as a significant tool to develop a reliable and secure cloud environment. Performing intrusion detection in cloud is a difficult task because of its distributed nature and extensive usage. Intrusion detection system (IDS) is widely considered to find the malicious actions in network. In cloud, most conventional IDS are vulnerable to attacks and have no capability for maintaining the balance between sensitivity and accuracy. Thus, we proposed an effective dragonfly improved invasive weed optimization-based Shepard convolutional neural network (DIIWO-based ShCNN) to detect the intruders and to mitigate the attacks in cloud paradigm and are more feasible to detect the intruderswith ShCNN. The proposed method outperforms the existingmethod with maximum accuracy of 0.960%, sensitivity of 0.967%, and specificity 0.961%, respectively. [ABSTRACT FROM AUTHOR]

Copyright of ESPOCH Congresses: The Ecuadorian Journal of S.T.E.A.M. is the property of Knowledge E DMCC and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Crypto libraries such as OpenSSL and Libgcrypt are essential building blocks for implementing secure cloud services. Unfortunately, these libraries are subject to cache side-channel attacks, which are more devastating in cloud environments where inevitable cache contention among different tenants occurs. Previous approaches for mitigating cache side-channel attacks have limitations in terms of the deployability and security; these hinder utilization in cloud services. In this paper, we propose an R2-relocator, a novel library protection technique based on moving target defence. When injected into a running process, the R2-relocator performs randomized relocation of the library during runtime. By doing this, it transforms a vulnerable crypto library into one that randomly changes its memory (cache) location, thereby preventing the delivery of cache side-channel attacks against the library. The proposed technique achieves robust protection against cache side-channel attacks for all crypto libraries, even those containing unpatched critical vulnerabilities, without the need for reconfiguration of the library. Extensive evaluations of security, performance, and deployability of the R2-relocator demonstrate its effectiveness for secure cloud services.

The following four primary steps (a) pre-processing, (b) feature extraction, (c) attack detection, and (d) attack mitigation) are used to create a unique IIOT attack detection and mitigation framework in this research work. The acquired raw data (input) is first treated to a pre-processing step, which includes data normalization activities. subsequently, the features retrieved from the pre-processed data include technical indicators, enhanced higher order statistical features (Skewness, Kurtosis, Variance, and Moments), and improved Mutual Information, Symmetric Uncertainty, Information gain ratio, and Relief based features. A two-stage ensemble of classifiers is used to build the attack detection framework, which comprises the "Gated Recurrent Unit (GRU), Recurrent Neural Network (RNN), Convolutional Neural Network (CNN), and Optimized Deep Belief Network (DBN)". The retrieved features are used to train the Gated Recurrent Unit (GRU), Recurrent Neural Network (RNN), and Convolutional Neural Network (CNN) that resides within the first stage of the ensemble-classifier. The optimal Deep belief Network (DBN)-in the second layer of ensemble classifier, which is trained with the outcomes obtained from the "Gated recurrent unit (GRU), Recurrent Neural Network (RNN)", and Convolutional neural Network, determines the final detection about the presence/absence of attack in the IIoT network (CNN). The weight functions of the Deep belief Network (DBN) are optimized utilizing the newly projected Migration updated with Supervisor guidance (MUSG) to obtain greater detection accuracy. The proposed hybrid optimization model combines both the Sandpiper Optimization Algorithm (SOA) and the Teamwork Optimization Algorithm (TOA) concepts. The control is handed to the attack mitigation framework whenever an attacker is discovered within the network by the optimised Deep belief Network (DBN). Attack Mitigation Framework: Using the updated BAIT technique, the discovered attacker is mitigated. As a result, the IIoT network is protected to be efficient via comparative analysis. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) is an emerging network architecture. The decoupled data and control plane provides programmability for efficient network management. However, the centralized control mode of SDN also exposes unique vulnerabilities. Low-rate Denial of Service (LDoS) has a lower attack rate than ordinary DDoS attacks with the characteristics of periodicity and concealment, which is among one of the severe threats to SDN. In this paper, we propose a lightweight, real-time framework Performance and Features (P&F) to detect and mitigate LDoS attacks with SDN. We implement LDoS attacks in SDN, extract traffic features with OpenFlow, and classify the features into two categories. By analyzing the performance (P) of normal traffic under attack state, P&F determines whether LDoS attacks take effect based on machine learning. Meanwhile, P&F tries to locate attack sources and victims according to flow features (F) of LDoS attacks based on time-frequency analysis. According to detection and locating results, P&F sets corresponding mitigation schemes. Experimental results show that P&F has a high detection rate and low false positive rate for detecting LDoS attacks. P&F can deploy on controllers to achieve real-time attack detection and mitigation with low system cost, which can defend against LDoS attacks effectively. [ABSTRACT FROM AUTHOR]

With the advent of the Internet of Things (IoT), there are also major information security risks hidden behind them. There are major information security risks hidden behind them. Attackers can conceal their actual attack locations by spoofing IP addresses to attack IoT devices, law enforcement cannot easily track them. Therefore, a method to trace stealth attacks is required. Conventional IP traceback methods that traceback only attackers on the network layer and cannot infer the path information of a packet traversing the switch. This article proposes a method to simultaneously traceback attack sources at the network layer and the data link layer with only one single packet. Even if the core network contains a switch or if multiple attackers launch attacks from different locations, the method can correctly traceback the true devices responsible for the attacks, and its achievements include a zero false negative rate and a low false positive rate.

Billions of Internet of Things (IoT) devices and sensors are expected to be supported by fifth-generation (5G) wireless cellular networks. This highly connected structure is predicted to attract different and unseen types of attacks on devices, sensors, and networks that require advanced mitigation strategies and the active monitoring of the system components. Therefore, a paradigm shift is needed, from traditional prevention and detection approaches toward resilience. This study proposes a trust-based defense framework to ensure resilient IoT services on 5G multi-access edge computing (MEC) systems. This defense framework is based on the trustability metric, which is an extension of the concept of reliability and measures how much a system can be trusted to keep a given level of performance under a specific successful attack vector. Furthermore, trustability is used as a trade-off with system cost to measure the net utility of the system. Systems using multiple sensors with different levels of redundancy were tested, and the framework was shown to measure the trustability of the entire system. Furthermore, different types of attacks were simulated on an edge cloud with multiple nodes, and the trustability was compared to the capabilities of dynamic node addition for the redundancy and removal of untrusted nodes. Finally, the defense framework measured the net utility of the service, comparing the two types of edge clouds with and without the node deactivation capability. Overall, the proposed defense framework based on trustability ensures a satisfactory level of resilience for IoT on 5G MEC systems, which serves as a trade-off with an accepted cost of redundant resources under various attacks.

Advances in remote interchanges, the internet of nano things have empowered the wireless body area networks (WBAN) to end up a promising systems of networking standard. It involves interconnected tiny sensors to gather ongoing biomedical data and transmit over the network for further analysis. Due to possibility of active and passive number of attacks, the healthcare data security is quite essential and challenging. This paper presents the systematic literature review (SLR) of the multiple security schemes for WBAN. We have identified a research question to analyses the possibility of several attacks while preserving the memory constraints. We have performed quality valuation to ensure the relevance of schemes with the research question. Moreover, the schemes are considered from 2016 to 2020 to focus on recent work. In literature, several existing schemes are explored to identify how the security is enhanced for exchanging patients' healthcare data. The data security schemes using AES, ECC, SHA-1 and hybrid encryption are analyzed based on influential traits. Several methodologies for data security in WBAN are considered and the most appropriate methodologies are appraised. We also analyses the security for different attack scenarios. [ABSTRACT FROM AUTHOR]

Side-channel attacks exploit architectural features of computing systems and algorithmic properties of applications executing on these systems to steal sensitive information. Cache side-channel attacks are more powerful and practical compared to other classes of side-channel attacks due to several factors, such as the ability to be mounted without physical access to the system. Some secure cache architectures have been proposed to counter side-channel attacks. However, they all incur significant performance overheads. This work explores the viability of using adaptive caches, which are conventionally used as a performance-oriented architectural feature, as a defense mechanism against cache side-channel attacks. We conduct an empirical analysis, starting from establishing a baseline for the attacker's ability to infer information regarding the memory accesses of the victim process when there is no active defense mechanism in place and the attacker is fully aware of all the cache parameters. Then, we analyze the effectiveness of the attack without complete knowledge of the cache configuration. Finally, based on the insight that the success of the attack is heavily dependent on knowledge of the cache configuration, we formulate a cache monitoring and user-defined events detection methodology, implement a generalized run-time cache reconfiguration technique, and observe their effect on successfully detecting and mitigating attacks on the cache subsystem. We observe that reconfiguring different cache parameters during a side-channel attack reduces the accuracy of the attack in detecting cache sets accessed by the victim by 44% on average, with a maximum of 90% reduction. [ABSTRACT FROM AUTHOR]

With the wide applications of wireless sensor networks (WSNs) in various fields, such as environment monitoring, battlefield surveillance, healthcare, and intrusion detection, trust establishment among sensor nodes becomes a vital requirement to improve security, reliability, and successful cooperation. The existing trust management approaches for large-scale WSN are failed due to their low dependability (i.e., cooperation), higher communication, and memory overheads (i.e., resource inefficient). In this paper, we propose a novel and comprehensive trust estimation approach (LTS) for large-scale WSN that employs clustering to improve cooperation, trustworthiness, and security by detecting malicious (faulty or selfish) sensor nodes with reduced resource (memory and power) consumption. The proposed scheme (LTS) operates on two levels, namely, intra-cluster and inter-cluster along with distributed approach and centralized approach, respectively, to make accurate trust decision of sensor nodes with minimum overheads. LTS consists of unique features, such as robust trust estimation function, attack resistant, and efficient trust aggregation at the cluster, head to obtain the global feedback trust value. Data trust along with communication trust plays a significant role to cope with malicious nodes. In LTS, punishment and trust severity can be tuned according to the application requirement, which makes it an innovative LTS. Moreover, dishonest recommendations (outliers) are eliminated before aggregation at the base station by observing the statistical dispersion. The theoretical and mathematical validations along with simulation results exhibit the great performance of our proposed approach in terms of trust evaluation cost, prevention, and detection of malicious nodes as well as communication overhead.

Industrial control systems (ICSs) are facing increasingly severe security threats. Zone isolation, a commonly adopted idea for stopping attack propagation in general information systems, has been investigated for ICS security protection. It is usually implemented through perimeter security techniques. However, anomaly states of the physical processes in a compromised field zone may spread into other zones through the inter-zone information interaction. Due to the coupling of the physical processes between different zones, it is difficult to prevent the propagation of attack impact in ICSs. In this paper, a software-defined security (SDSec) approach is presented to address this problem. It consists of a hybrid anomaly detection module and a multi-level security response module, both of which work together to secure the ICS field zones. The hybrid anomaly detection module inspects anomaly behaviors from the perspectives of network communications and physical process states. The multi-level security response module helps prevent unapproved packets from communications, thus isolating any compromised zone. It also generates attack mitigation strategies to secure physical processes. Hardware-in-the-loop simulations are conducted to demonstrate the effectiveness of the presented approach.

With the developing cyber physical power systems and emerging threat of cyber-attacks, the traditional power services are faced with higher risks of being compromised, as vulnerabilities in cyber infrastructure can be exploited to cause physical damage. Therefore, adjustments need to be made in current control scheme design methods to mitigate the impact of potential attacks on service quality. In this paper, focusing on the service of coordinated source-load participation in primary frequency regulation, a vulnerability analysis is performed with modelling the attack intrusion process, and the risk assessment of the service is made by further modelling the attack impacts on the service's physical effects. On that basis, the traditional coordinated reserve allocation optimization model is modified and the allocation scheme is corrected according to the cyber-attack impacts. The proposed correction methods are validated through a case study, showing effectiveness in defending against the cyber-attack impacts.