Search

This paper addresses the problem of cyber-attack detection in a discrete event system by proposing a novel model. The model utilizes graph convolutional networks to extract spatial features from event sequences. Subsequently, it employs gated recurrent units to re-extract spatio-temporal features from these spatial features. The obtained spatio-temporal features are then fed into an attention model. This approach enables the model to learn the importance of different event sequences, ensuring that it is sufficiently general for identifying cyber-attacks, obviating the need to specify attack types. Compared with traditional methods that rely on synchronous product computations to synthesize diagnosers, our deep learning-based model circumvents state explosion problems. Our method facilitates real-time and efficient cyber-attack detection, eliminating the necessity to specifically identify system states or distinguish attack types, thereby significantly simplifying the diagnostic process. Additionally, we set an adjustable probability threshold to determine whether an event sequence has been compromised, allowing for customization to meet diverse requirements. Experimental results demonstrate that the proposed method performs well in cyber-attack detection, achieving over 99.9 % accuracy at a 1 % threshold and a weighted F1-score of 0.8126, validating its superior performance. [ABSTRACT FROM AUTHOR]

Adaptive and robust detection mechanisms are becoming more and more necessary as cyber threats become more complex. This study presents a framework to increase threat detection efficiency and address the complex problems posed by various dynamic cyber threats. This study focuses primarily on investigating a new algorithm for feature classification and selection in predictive modeling applications. Using a sizable real-time threat detection dataset, a hybrid filter-based feature ranking and cluster-based classification approach is proposed. A detailed analysis was carried out to investigate the performance of the proposed algorithm and compare it with various machine-learning models. This study also examines how well the algorithm scales to large-scale datasets and adapts to different data properties. The results highlight the algorithm's potential to enhance the efficiency of predictive modeling by optimizing feature selection procedures and reducing model complexity, thus making a substantial contribution to the field of data-driven decision-making and the wider range of machine-learning applications. [ABSTRACT FROM AUTHOR]

With rapid development and deployment of artificial intelligence methods, the Industrial Internet of Things (IIoT) has highly developed to fast tracing industrial communications and optimizing manufacturing processes. In Industry 5.0, hyper-automation process as one of technological trends navigates industrial entities to intelligent devices of the IIoT, cloud computing, smart robotics, smart agile software and embedded components by high complexity and reliability. By increasing data communication in the IIoT environments and cloud computing, the security and safety of hyper-automation process is also increasingly unstable and challengeable with respect to cyber-attacks, unstructured malwares and abnormal activities. With the diversification and unexpected behaviors of cyber-security threats, traditional cyber-attack detection systems have some critical problems with increasing massive data including unappropriated feature selection and extraction, high computation time in prediction and inaccurate classification models. Due to the above-mentioned challenges, this paper presents a new cloud-based cyber-attack detection architecture based on Ensemble Bagged Trees Detection (EBTD) algorithm for predicting malicious behaviors and types of cyber-attacks for hyper-automation process in the IIoT. The proposed architecture uses Analysis of Variance (ANOVA) and a priority-based feature selection and extraction model to find the optimal features with highly dependent on the network traffic, computation time, malicious behaviors, and types of attacks. Then, experimental results are conducted using the technical data sets UNSW-NB15 and NSL-KDD. The simulation results show that the proposed architecture performance performs better than other case studies and prediction models and effective on optimization of large-scale cyber-attack detection systems for critical hyper-automation process in the IIoT environment. [ABSTRACT FROM AUTHOR]

In response to escalating cyber threats, there is an urgent need for adaptive detection mechanisms. This study introduces a cyber threat detection framework employing ensemble learning and a hybrid feature ranking approach. Designed to address diverse and evolving threats, the framework aims to enhance detection accuracy in dynamic environments. The framework comprises three key components. Firstly, an ensemble feature ranking algorithm identifies influential features in imbalanced datasets, ensuring effective threat detection while mitigating imbalanced class impact. Secondly, a hybrid feature ranking measure (HFRM) integrates fusion entropy to assess feature importance comprehensively. HFRM combines information gain, entropy, and proposed fusion entropy for a holistic ranking. Thirdly, the framework includes a multi-class k-means rank-based classification for efficient clustering and threat categorization. Evaluation using diverse datasets underscores the framework's effectiveness in achieving high detection accuracy and robustness across threat scenarios. The ensemble approach, hybrid feature ranking, and rank-based classification collectively provide an adaptive solution for cyber threat detection. In conclusion, this research introduces an innovative framework integrating ensemble learning, hybrid feature ranking, and k-means clustering, promising more resilient cybersecurity in the face of sophisticated threats. [ABSTRACT FROM AUTHOR]

In light of recent advances in optical computing and machine learning, we examine the scenarios in which all-optical computing might surpass electrical and optoelectronic computing with regards to energy efficiency and scalability. When assessing the overall performance of a system, the expense of memory access and data collecting is likely to be a significant bottleneck that affects not just electrical but also optoelectronic and all-optical implementations. The study's focus on cloud-based deep learning models for monitoring optoelectronic devices is meant to pave the way for fresh approaches of detecting cyber attacks. In this setup, optoelectronic devices communicate through cloud-based systems. After that, a Gaussian regressive discriminator based transfer learning model keeps an eye on the system to see whether it's under cyber assault. The experimental analysis is carried out for various cyber-attacks dataset in terms of scalability, robustness, average accuracy, precision, network security. We come to a conclusion based on this work by outlining difficulties and areas for future-proof optical cloud system research. Proposed technique attained Average Accuracy 98%, Precision of 97%, network security of 96%, scalability of 95%. [ABSTRACT FROM AUTHOR]

This paper addresses the problem of cyber-attack detection in a discrete event system by proposing a novel model. The model utilizes graph convolutional networks to extract spatial features from event sequences. Subsequently, it employs gated recurrent units to re-extract spatio-temporal features from these spatial features. The obtained spatio-temporal features are then fed into an attention model. This approach enables the model to learn the importance of different event sequences, ensuring that it is sufficiently general for identifying cyber-attacks, obviating the need to specify attack types. Compared with traditional methods that rely on synchronous product computations to synthesize diagnosers, our deep learning-based model circumvents state explosion problems. Our method facilitates real-time and efficient cyber-attack detection, eliminating the necessity to specifically identify system states or distinguish attack types, thereby significantly simplifying the diagnostic process. Additionally, we set an adjustable probability threshold to determine whether an event sequence has been compromised, allowing for customization to meet diverse requirements. Experimental results demonstrate that the proposed method performs well in cyber-attack detection, achieving over 99.9% accuracy at a 1% threshold and a weighted F1-score of 0.8126, validating its superior performance.

Abstract With the high-speed development of decentralized applications, account-based blockchain platforms have become a hotbed of various financial scams and hacks due to their anonymity and high financial value. Financial security has become a top priority with the sustainable development of blockchain-based platforms because of an increasing number of cyber attacks, which have resulted in a huge loss of crypto assets in recent years. Therefore, it is imperative to study the real-time detection of cyber attacks to facilitate effective supervision and regulation. To this end, this paper proposes the weighted and extended isolation forest algorithms and designs a novel framework for the real-time detection of cyber-attack transactions by thoroughly studying and summarizing real-world examples. Furthermore, this study develops a new detection approach for locating the compromised address of a cyber attack to resolve the data scarcity of hack addresses and reduce time consumption. Moreover, three experiments are carried out not only to apply on different types of cyber attacks but also to compare the proposed approach with the widely used existing methods. The results demonstrate the high efficiency and generality of the proposed approach. Finally, the lower time consumption and robustness of our method were validated through additional experiments. In conclusion, the proposed blockchain-oriented approach in this study can handle real-time detection of cyber attacks and has significant scope for applications.

In this article, a machine learning technique is proposed for the detection of cyber-attacks in Photovoltaic (PV) farms using point of common coupling (PCC) sensors alone. A comprehensive cyber-attack model of a PV farm is first developed to consider operating conditions variability. The attack model specifically includes two types of cyber-attacks that are historically more difficult to detect. A Convolutional Neural Network (CNN) using $\mu$PMU plus figures of merit is proposed and compared with other machine learning techniques using raw electric waveform and micro-phase measurement units ($\mu$PMU), respectively. Finally, a cyber-physical security testbed of an IEEE 37-bus distributed grid with PV farms is developed. A real-time simulation, detection, and visualization framework is designed to demonstrate the feasibility of the proposed method in a real-world application. Results show that the proposed machine learning methods can achieve adequate detection accuracy and robustness under various attack scenarios.

Traditional attack detection approaches utilize predefined databases of known signatures about already-seen tools and malicious activities observed in past cyber-attacks to detect future attacks. More sophisticated approaches apply machine learning to detect abnormal behavior. Nevertheless, a growing number of successful attacks and the increasing ingenuity of attackers prove that these approaches are insufficient. This paper introduces an approach for digital forensics-based early detection of ongoing cyber-attacks called Fronesis. The approach combines ontological reasoning with the MITRE ATT&CK framework, the Cyber Kill Chain model, and the digital artifacts acquired continuously from the monitored computer system. Fronesis examines the collected digital artifacts by applying rule-based reasoning on the Fronesis cyber-attack detection ontology to identify traces of adversarial techniques. The identified techniques are correlated to tactics, which are then mapped to corresponding phases of the Cyber Kill Chain model, resulting in the detection of an ongoing cyber-attack. Finally, the proposed approach is demonstrated through an email phishing attack scenario.

With the high-speed development of decentralized applications, account-based blockchain platforms have become a hotbed of various financial scams and hacks due to their anonymity and high financial value. Financial security has become a top priority with the sustainable development of blockchain-based platforms because of an increasing number of cyber attacks, which have resulted in a huge loss of crypto assets in recent years. Therefore, it is imperative to study the real-time detection of cyber attacks to facilitate effective supervision and regulation. To this end, this paper proposes the weighted and extended isolation forest algorithms and designs a novel framework for the real-time detection of cyber-attack transactions by thoroughly studying and summarizing real-world examples. Furthermore, this study develops a new detection approach for locating the compromised address of a cyber attack to resolve the data scarcity of hack addresses and reduce time consumption. Moreover, three experiments are carried out not only to apply on different types of cyber attacks but also to compare the proposed approach with the widely used existing methods. The results demonstrate the high efficiency and generality of the proposed approach. Finally, the lower time consumption and robustness of our method were validated through additional experiments. In conclusion, the proposed blockchain-oriented approach in this study can handle real-time detection of cyber attacks and has significant scope for applications. [ABSTRACT FROM AUTHOR]

In the field of anomaly detection, well-known techniques and state-of-the-art models often face challenges when interpreting the latent space, which hinders their behavioral classification accuracy. Firstly, the sub-optimal distribution of data points within the latent space makes normal behavioral regions verbose and indistinguishable from abnormal regions. Secondly, within the latent space, it can be difficult to identify meaningful, separable, and indicative features. Finally, the processing time at the inference stage is still relatively slow. This paper aims to improve the accuracy of network anomaly detection mechanisms by proposing two novel deep hierarchical representation learning models: Deep Nested Clustering Auto-Encoder (DNCAE) and Deep Clustering Hierarchical Auto-Encoder (DCHAE). Both models adopt a nested branch structure, utilizing dual deep auto-encoders to establish hierarchical latent spaces; in each, clustering algorithms are used to spatially optimize and refine the data points. This approach results in improved separation between normal and abnormal data points, and easier identification of notable and/or indicative features. To ascertain the effectiveness of the approach and the quality of resulting features, both models were used in conjunction with ten different one-class anomaly detectors. Each of these ten anomaly detectors was evaluated on popular network intrusion datasets, notably: NSL-KDD, UNSW-NB15, CIC-IDS-2017, CSE-CIC-IDS-2018, and CTU13. Experimental results have confirmed that both of the proposed models produced higher levels of accuracy than existing baselines and current state-of-the-art models. Additionally, the processing time at the inference stage shows a significant reduction. [ABSTRACT FROM AUTHOR]

Communication plays a vital role in incorporating smartness into the interconnected power system. However, historical records prove that the data transfer has always been vulnerable to cyber-attacks. Unless these cyber-attacks are identified and cordoned off, they may lead to black-out and result in national security issues. This paper proposes an optimal two-stage Kalman filter (OTS-KF) for simultaneous state and cyber-attack estimation in automatic generation control (AGC) system. Biases/cyber-attacks are modeled as unknown inputs in the AGC dynamics. Five types of cyber-attacks, i.e., false data injection (FDI), data replay attack, denial of service (DoS), scaling, and ramp attacks, are injected into the measurements and estimated using OTS-KF. As the load variations of each area are seldom available, OTS-KF is reformulated to estimate the states and outliers along with the load variations of the system. The proposed technique is validated on the benchmark two-area, three-area, and five-area power system models. The simulation results under various test conditions demonstrate the efficacy of the proposed filter.

With increasing installations of grid-connected power electronic converters in the distribution network, there is a new trend of using distributed control in a cyber layer to coordinate the operations of these power converters for improving power system stability. However, cyber-attacks remain a threat to such distributed control. This paper addresses the cyber-attack detection and a countermeasure of distributed electric springs (ESs) that have emerged as a fast demand-response technology. A fully distributed model-based architecture for cyber-attack detection in the communication network is developed. Based on a dynamic model of ES with consensus control, a local state estimator is proposed and practically implemented to monitor the system. The estimator is fully distributed because only local and neighboring information is necessary. A countermeasure for the distributed ESs to ride through the cyber-attack and maintain regulatory services in a microgrid is demonstrated successfully. Experimental results are provided to verify the effectiveness of the proposed cyber-attack detection method and its ride-through capability.

This paper is concerned with the issue of the diagnostics of process faults and the detection of cyber-attacks in industrial control systems. This problem is of significant importance to energy production and distribution, which, being part of critical infrastructure, is usually equipped with process diagnostics and, at the same time, is often subject to cyber-attacks. A commonly used approach would be to separate the two types of anomalies. The detection of process faults would be handled by a control team, often with a help of dedicated diagnostic tools, whereas the detection of cyber-attacks would be handled by an information technology team. In this article, it is postulated here that the two can be usefully merged together into one, comprehensive, anomaly detection system. For this purpose, firstly, the main types of cyber-attacks and the main methods of detecting cyber-attacks are being reviewed. Subsequently, in the analogy to "process fault"—a term well established in process diagnostics—the term "cyber-fault" is introduced. Within this context a cyber-attack is considered as a vector containing a number of cyber-faults. Next, it is explained how methods used in process diagnostics for fault detection and isolation can be applied to the detection of cyber-attacks and, in some cases, also to isolation of the components of such attacks, i.e., cyber-faults. A laboratory stand and a simulator have been developed to test the proposed approach. Some test results are presented, demonstrating that, similarly to equipment/process faults, residua can be established and cyber-faults can be identified based on the mismatch between the real data from the system and the outputs of the simulation model. [ABSTRACT FROM AUTHOR]

In this paper, the stochastic fault and cyber-attack detection and consensus control problems are investigated for multi-agent systems. By using a Markovian approach, Linear Matrix Inequalities (LMI) are derived that incorporate relative information among the agents to detect stochastic faults and cyber-attacks and then resiliently control the system to reach a consensus. A mixed coding and Message Authentication approach is presented to detect data injection cyber-attacks on the communication links. By using the Bayesian inference, useful information regarding the cyber-attack, such as the probability of its occurrence, is derived. Simulation and two case study results corresponding to a team of multi-agent Autonomous Underwater Vehicles (UAVs) confirm and verify the effectiveness and capabilities of our proposed methodologies. [ABSTRACT FROM AUTHOR]

Modern intelligent energy grids enable energy supply and consumption to be efficiently managed while simultaneously avoiding a variety of security risks. System disturbances can be caused by both naturally occurring and human-made events. Operators should be aware of the different kinds and causes of disturbances in the energy systems to make informed decisions and respond accordingly. This study addresses this problem by proposing an attack detection model on the basis of deep learning for energy systems, which could be trained utilizing data and logs gathered through phasor measurement units (PMUs). Property or specification making is used to create features, and data are sent to various machine learning methods, of which random forest has been selected as the basic classifier of AdaBoost. Open-source simulated energy system data are used to test the model containing 37 energy system event case studies. In the end, the suggested model has been compared with other layouts according to various assessment metrics. The simulation outcomes showed that this model achieves a detection rate of 93.6% and an accuracy rate of 93.91%, which is greater compared to the existing methods. [ABSTRACT FROM AUTHOR]

The recent exponential rise in the number of cyber-attacks has demanded intensive study into community intrusion detection, prediction, and mitigation systems. Even though there are a variety of intrusion detection technologies available, predicting future community intrusions is still a work in progress. Existing approaches rely on statistical and/or superficial device mastery techniques to solve the problem, and as a result, feature selection and engineering are required. The truth is that no single classifier can provide the highest level of accuracy for all five types of training data set. Cyber-attack detection is a technique for detecting cyber-attacks as they emerge on a laptop or network device, intending to compromise the gadget's security. As a result, using a novel type and encryption mechanism, this paper offered a unique architecture for attack node mitigation. The input UNSW-NB15 dataset is first acquired and divided into training and testing statistics. First and foremost, the information is pre-processed and capabilities are retrieved in the training section. The Taxicab Woodpecker Mating Algorithm (TWMA) is then used to select the critical characteristics. The attacked and non-attacked information are then classified using the BRELU-ResNet (Bernoulli's Leaky Rectified Linear Unit - Residual Neural Community) classifier. The encrypted at Ease Hash Probability-Based Elliptic-Curve Cryptography (ESHP-ECC) technique is used to encrypt the ordinary facts, which are subsequently kept in the security log report. Following that, using Euclidean distance, the shortest course distance is estimated. Finally, the records are decrypted using a set of principles known as Decrypted Relaxed Hash Probability-Based Elliptic-Curve Cryptography (DSHP-ECC). If the input appears in the log file during testing, it is regarded as attacked data and is prevented from being transmitted. If it isn't found, the procedure of detecting cyber-attacks continues. [ABSTRACT FROM AUTHOR]

Additive manufacturing (AM) or 3D printing is an emerging manufacturing technology that plays a growing role in both industrial and consumer settings. However, security concerns of AM systems have been raised among researchers. In this paper, we present an online detection mechanism for the malicious attempts on AM systems, which taps into both audio and video signals collected during the printing process. For audio signals, we propose to monitor the shift of patterns in the spectrogram and dominant frequencies via a control chart designed based on the Wasserstein metric. For video signals, we propose to monitor the change in the reconstructed path of the extruder via a Hausdorff metric. We then show the effectiveness of our methods in a case study using an Ender 3D printer, where the cyber‐incidence of altering the internal fill density can be easily identified in an online manner. [ABSTRACT FROM AUTHOR]

The rapid development of technology in the past decades created a society heavily dependent on electricity, where even short disturbances in the power supply can result in grave socio-economic consequences. Therefore, assuring a safe and reliable operation of the power system has become of utmost importance. False data injection attacks (FDIAs) represent a class of cyber-attacks targeting the power system state estimation. FDIAs alter the perspective of the power system’s state which can lead to inappropriate control actions. Thus, a reliable method for detecting FDIAs represents the main prerequisite to the safe operation of the power system in the context of cybersecurity. Noticing the scarce literature analyzing the detection of FDIAs in power systems with a high share of renewable energy sources, this paper demonstrates that the performance of the existing methods deteriorates when faced with the volatile nature of renewable energy sources. This paper presents a deep learning approach for detecting stealthy FDIAs concerning the power systems with high penetration of renewable energy sources. The performance of the proposed method is validated through different scenarios based on the modified versions of the IEEE 14-bus system and the IEEE 118-bus system. The proposed method is able to detect most of the attacks under different test scenarios, outperforming the benchmark techniques with an average detection rate of 99% for the IEEE 14-bus system and 97% for the IEEE 118-bus system.

Careful consideration of grid developments illustrates the fundamental changes in its structure which its developments have taken place gradually for a long time. One of the most important developments is the expansion of the communication infrastructure that brings many advantages in the cyber layer of the system. The actual execution of the peer-to-peer (P2P) energy trading is one core advantage which also may lead to the systematic risks such as cyber-attacks. Consequently, it is necessary to form a useful way to cover such challenges. This paper focuses on the online detection of false data injection attack (FDIA), which tries to disrupt the trend of optimal peer-to-peer energy trading in the stochastic condition. Moreover, this article proposes an effective modified Intelligent Priority Selection based Reinforcement Learning (IPS-RL) method to detect and stop the malicious attacks in the shortest time for effective energy trading based on the peer to peer structure. The presented method is compared with other methods such as support vector machine (SVM), reinforcement learning (RL), particle swarm optimization (PSO)-RL, and genetic algorithm (GA)-RL to validate the functionality of the method. The proposed method is implemented and examined on three interconnected microgrids in the form of peer-to-peer structure wherein each microgrid has various agents such as photovoltaic (PV), wind turbine, fuel cell, tidal system, storage unit, etc. Eventually, the unscented transformation (UT) is applied for uncertainty analysis and making the near-reality simulations.

Since Smart-Islands (SIs) with advanced cyber-infrastructure are incredibly vulnerable to cyber-attacks, increasing attention needs to be applied to their cyber-security. False data injection attacks (FDIAs) by manipulating measurements may cause wrong state estimation (SE) solutions or interfere with the central control system performance. There is a possibility that conventional attack detection methods do not detect many cyber-attacks; hence, system operation can interfere. Research works are more focused on detecting cyber-attacks that target DC-SE; however, due to more widely uses of AC SIs, investigation on cyber-attack detection in AC systems is more crucial. In these regards, a new mechanism to detect injection of any false data in AC-SE based on signal processing technique is proposed in this paper. Malicious data injection in the state vectors may cause deviation of their temporal and spatial data correlations from their ordinary operation. The suggested detection method is based on analyzing temporally consecutive system states via wavelet singular entropy (WSE). In this method, to adjust singular value matrices and wavelet transforms' detailed coefficients, switching surface based on sliding mode controller are decomposed; then, by applying the stochastic process, expected entropy values are calculated. Indices are characterized based on the WSE in switching level of current and voltage for cyber-attack detection. The proposed detection method is applied to different case studies to detect cyber-attacks with various types of false data injection, such as amplitude, and vector deviation signals. The simulation results confirm the high-performance capability of the proposed FDIA detection method. This detection method's significant characteristic is its ability in fast detection (10 ms from the attack initiation); besides, this technique can achieve an accuracy rate of over 96.5%.

Cyber-attacks that tamper with measurement information threaten the security of state estimation for the current distribution system. This paper proposes a cyber-attack detection strategy based on distribution system state estimation (DSSE). The uncertainty of the distribution network is represented by the interval of each state variable. A three-phase interval DSSE model is proposed to construct the interval of each state variable. An improved iterative algorithm (IIA) is developed to solve the interval DSSE model and to obtain the lower and upper bounds of the interval. A cyber-attack is detected when the value of the state variable estimated by the traditional DSSE is out of the corresponding interval determined by the interval DSSE. To validate the proposed cyber-attack detection strategy, the basic principle of the cyber-attack is studied, and its general model is formulated. The proposed cyber-attack model and detection strategy are conducted on the IEEE 33-bus and 123-bus systems. Comparative experiments of the proposed IIA, Monte Carlo simulation algorithm, and interval Gauss elimination algorithm prove the validation of the proposed method.

The urgency of solving the problem of ensuring the security of cyber-physical systems is due to ensure their correct functioning. Cyber-physical system applications have a significant impact on different industrial sectors. The number and variety of cyber-attacks are growing, aimed not only at obtaining data from cyber-physical systems but also managing the production process itself. Detecting and preventing attacks on cyber-physical systems is critical because they can lead to financial losses, production interruptions, and therefore endanger national security. This paper proposes a deep hybrid model based on three parallel neural architectures: a one-dimensional convolutional neural network, a gated recurrent unit neural network, and a long short-term memory neural network. The SPOCU activation function is considered in hidden layers of the proposed model and improves its performance. Furthermore, to improve the classification accuracy, a modified version of Adam optimizer is considered. The experiments are conducted on two datasets: raw water treatment plant and gasoil heater loop process as the cyber-physical system applications. They contain information about the normal behavior of these systems and their failures caused by cyber-attacks. The results show that the proposed model outperforms the recent works using machine learning techniques. [ABSTRACT FROM AUTHOR]

This paper focuses on the detection of cyber-attacks on a wireless communication channel and simultaneous radar sensor health monitoring for a connected vehicle. A semi-autonomous adaptive cruise control (SA-ACC) vehicle is considered which has wireless communication with its immediately preceding vehicle in the same lane. The wireless connectivity enables the vehicle to operate at small time-gap distances without creating string instability. However, the reliability of the wireless connectivity is critical for ensuring safe vehicle operation. The presence of two unknown inputs related to both sensor failure and cyber-attack seemingly poses a difficult estimation challenge which is addressed in this paper. The dynamic system is first represented in descriptor system form. An observer with estimation error dynamics decoupled from the cyber-attack signal is developed. The performance of the observer is first extensively evaluated in simulations. The estimation system is able to detect either a fault in the radar or a cyber-attack. Further, the proposed control strategy achieves resilient adaptive cruise control system operation by switching to larger time-gaps and a non-connected controller when a cyber-attack is detected. Finally, experimental data from a real vehicle on the I-94 Highway in Minneapolis, MN, USA is also used to evaluate the performance of the proposed algorithms. The fundamental estimation algorithm developed herein can be extended in the future to enable cyber-attack detection in more complex connected vehicle architectures. [ABSTRACT FROM AUTHOR]

Recommender systems are widely used in electronic commerce, social media and online streaming services to provide personalized recommendations to the users by exploiting past ratings and interactions. This paper considers the security aspect with quick and accurate detection of attacks by observing the newly created profiles sequentially to prevent the damage which may be incurred by the injection of new profiles with dishonest ratings. The proposed framework consists of a latent variable model, which is trained by a variational EM algorithm, followed by a sequential detection algorithm. The latent variable model generates homogeneous representations of the users given their rating history and mixed data-type attributes such as age and gender. The representations are then exploited to generate univariate statistics to be efficiently used in a CUSUM-like sequential detection algorithm that can quickly detect persistent attacks while maintaining low false alarm rates. We apply our proposed framework to three different real-world datasets and exhibit superior performance in comparison to the existing baseline algorithms for both attack profile and sequential detection. Furthermore, we demonstrate robustness to different attack strategies and configurations. [ABSTRACT FROM AUTHOR]

Cyber-physical threats as false data injection attacks (FDIAs) in islanded smart microgrids (ISMGs) are typical accretion attacks, which need urgent consideration. In this regard, this paper proposes a novel cyber-attack detection model to detect FDIAs based on singular value decomposition (SVD) and fast Fourier transform (FFT). Since new research are mostly focusing on FDIAs detection in DC systems, paying attention to AC systems attack detection is also necessary; hence, AC state estimation (SE) have been used in SI analysis and in considering renewable energy sources effect. Whenever malicious data are added into the system state vectors, vectors' temporal and spatial datum relations might drift from usual operating conditions. In this approach, switching surface based on sliding mode controllers is dialyzed to regulate detailed FFT's coefficients to calculate singular values. Indexes are determined according to the composition of FFT and SVD in voltage/current switching surface to distinguish the potential cyber-attack. This protection layout is presented for cyber-attack detection and is studied in various types of FDIA forms like amplitude and vector derivation of signals, which exchanged between agents such as smart sensor, control units, smart loads, etc. The prominent advantage of the proposed detection layout is to reduce the time (less than 10 milliseconds from the attack outset) in several kinds of case studies. The proposed method can detect more than 96% accuracy from 2967 sample tests. The performances of the method are carried out on AC-ISMG in MATLAB/Simulink environment. [ABSTRACT FROM AUTHOR]

This paper is concerned with the issue of the diagnostics of process faults and the detection of cyber-attacks in industrial control systems. This problem is of significant importance to energy production and distribution, which, being part of critical infrastructure, is usually equipped with process diagnostics and, at the same time, is often subject to cyber-attacks. A commonly used approach would be to separate the two types of anomalies. The detection of process faults would be handled by a control team, often with a help of dedicated diagnostic tools, whereas the detection of cyber-attacks would be handled by an information technology team. In this article, it is postulated here that the two can be usefully merged together into one, comprehensive, anomaly detection system. For this purpose, firstly, the main types of cyber-attacks and the main methods of detecting cyber-attacks are being reviewed. Subsequently, in the analogy to “process fault”—a term well established in process diagnostics—the term “cyber-fault” is introduced. Within this context a cyber-attack is considered as a vector containing a number of cyber-faults. Next, it is explained how methods used in process diagnostics for fault detection and isolation can be applied to the detection of cyber-attacks and, in some cases, also to isolation of the components of such attacks, i.e., cyber-faults. A laboratory stand and a simulator have been developed to test the proposed approach. Some test results are presented, demonstrating that, similarly to equipment/process faults, residua can be established and cyber-faults can be identified based on the mismatch between the real data from the system and the outputs of the simulation model.

Modern intelligent energy grids enable energy supply and consumption to be efficiently managed while simultaneously avoiding a variety of security risks. System disturbances can be caused by both naturally occurring and human-made events. Operators should be aware of the different kinds and causes of disturbances in the energy systems to make informed decisions and respond accordingly. This study addresses this problem by proposing an attack detection model on the basis of deep learning for energy systems, which could be trained utilizing data and logs gathered through phasor measurement units (PMUs). Property or specification making is used to create features, and data are sent to various machine learning methods, of which random forest has been selected as the basic classifier of AdaBoost. Open-source simulated energy system data are used to test the model containing 37 energy system event case studies. In the end, the suggested model has been compared with other layouts according to various assessment metrics. The simulation outcomes showed that this model achieves a detection rate of 93.6% and an accuracy rate of 93.91%, which is greater compared to the existing methods.

This study proposes a novel detection model for the detection of cyber-attacks using remote sensing data on water distribution systems (i.e., pipe flow sensor, nodal pressure sensor, tank water level sensor, and programmable logic controllers) by machine learning approaches. The most commonly used and well-known machine learning algorithms (i.e., k-nearest neighbor, support vector machine, artificial neural network, and extreme learning machine) were compared to determine the one with the best detection performance. After identifying the best algorithm, several improved versions of the algorithm are compared and analyzed according to their characteristics. Their quantitative performances and abilities to correctly classify the state of the urban water system under cyber-attack were measured using various performance indices. Among the algorithms tested, the extreme learning machine (ELM) was found to exhibit the best performance. Moreover, this study not only has identified excellent algorithm among the compared algorithms but also has considered an improved version of the outstanding algorithm. Furthermore, the comparison was performed using various representative performance indices to quantitatively measure the prediction accuracy and select the most appropriate model. Therefore, this study provides a new perspective on the characteristics of various versions of machine learning algorithms and their application to different problems, and this study may be referenced as a case study for future cyber-attack detection fields. [ABSTRACT FROM AUTHOR]

In this study, the authors propose a multi‐objective optimisation‐based feature selection (FS) method for the detection of distributed denial of service (DDoS) attacks in an internet of things (IoT) network. An intrusion detection system (IDS) is one approach for the detection of cyber‐attacks. FS is required to reduce the dimensionality of data and improve the performance of the IDS. One of the reasons for the failure of an IDS is incorrect selection of features because most of the FS methods are based on a limited number of objectives such as accuracy or relevance of data, but these are not enough as they can be misleading for attack detection the contribution of this work is to develop appropriate FS method. They have implemented the nondominated sorting algorithm with its adapted jumping gene operator to solve the optimisation problem and exploited an extreme learning machine as the classifier for FS based on six important objectives for an IoT network. Experimental results verify that the proposed method performs well for FS and have achieved 99.9% and has reduced the total number of features by nearly 90%. The proposed method outperforms other proposed FS methods for the detection of DDoS attacks by an IDS. [ABSTRACT FROM AUTHOR]

Internet of Medical Things (IoMT) has emerged as a combination of sensors, healthcare devices, and Internet of Things (IoT) to deliver better and intelligent healthcare services. However, security and privacy protection issues have hindered its wide integration resulting in lack of quality IoMT dataset. Federated Learning (FL) is an emerging distributed learning method that can be helpful for IoMT networks and smart healthcare systems (SHS) due to enhanced security and privacy. The use of intrusion detection systems (IDS) has become vital for contemporary critical networks to protect against evolving cyber-attacks. Existing security models are often challenging and computationally expensive to apply to resource-limited medical IoT devices. To this end, this research work proposes a privacy-preserving FL-based IDS model named Fed-Inforce-Fusion to identify cyber-attacks from IoMT networks. Specifically, the proposed Fed-Inforce-Fusion model uses reinforcement learning technique to learn the latent relationships of medical data. Next, a FL-based system is designed allowing distributed SHS nodes to collaboratively train a comprehensive IDS model in a privacy preserving manner. Then, a fusion/aggregation strategy is adopted to improve the performance of detection model and reduce communication overhead by allowing participating clients to involve in the federation process dynamically. Theoretical study and experiment analysis show that the proposed Fed-Inforce-Fusion is better and effective in detecting complex attack vectors in comparison to existing benchmark IDS methods. Thus, proposing its efficacy and suitability in real-world IoMT networks. • Development of a collaborative IDS design for the detection of intrusions in IoMT networks. • Development of localized models to facilitates data processing at IoMT, enabling productive preservation of data privacy. • Development of reinforcement-based security model to learn latent relationships distinguish complex attack vectors. • Development of a fusion strategy to improve the performance of detection model and reduce communication overhead. • Experimental evaluation on real data validates the superiority of proposed model against compelling benchmark approaches. [ABSTRACT FROM AUTHOR]