Cats vs. Spectre: An Axiomatic Approach to Modeling Speculative Execution Attacks

In this paper we study the influence of key-scheduling algorithms on the strength of blockciphers. We show that the key-scheduling algorithms of many blockciphers inherit obvious relationships between keys, and use these key relations to attack the blockciphers. Two new types of attacks are described: New chosen plaintext reductions of the complexity of exhaustive search attacks (and the faster variants based on complementation properties), and new low-complexity chosen key attacks. These attacks are independent of the number of rounds of the cryptosystems and of the details of the F-function and may have very small complexities. These attacks show that the key-scheduling algorithm should be carefully designed and that its structure should not be too simple. These attacks are applicable to both variants of LOKI and to Lucifer. DES is not vulnerable to the related keys attacks since the shift pattern in the key-scheduling algorithm is not the same in all the rounds.

Intrusion detection system (IDS) using machine learning approach is getting popularity as it has an advantage of getting updated by itself to defend against any new type of attack. Another emerging technology, called internet of things (IoT) is taking the responsibility to make automated system by communicating the devices without human intervention. In IoT based systems, the wireless communication between several devices through the internet causes vulnerability for different security threats. This paper proposes a novel unified intrusion detection system for IoT environment (UIDS) to defend the network from four types of attacks such as: exploit, DoS, probe, and generic. The system is also able to detect normal category of network traffic. Most of the related works on IDS are based on KDD99 or NSL-KDD 99 data sets which are unable to detect new type of attacks. In this paper, UNSW-NB15 data set is considered as the benchmark dataset to design UIDS for detecting malicious activities in the network. The performance analysis proves that the attack detection rate of the proposed model is higher compared to two existing approaches ENADS and DENDRON which also worked on UNSW-NB15 data set.

Improvement of attack detection performance on the internet of things with PSO-search and random forest

Automatic speaker verification (ASV) is a voice biometric technology whose security might be compromised by spoofing attacks. To increase the robustness against spoofing attacks, presentation attack detection (PAD) or anti-spoofing systems for detecting replay, text-to-speech and voice conversion-based spoofing attacks are being developed. However, it was recently shown that adversarial spoofing attacks may seriously fool anti-spoofing systems. Moreover, the robustness of the whole biometric system (ASV + PAD) against this new type of attack is completely unexplored. In this work, a new generative adversarial network for biometric anti-spoofing (GANBA) is proposed. GANBA has a twofold basis: (1) it jointly employs the anti-spoofing and ASV losses to yield very damaging adversarial spoofing attacks, and (2) it trains the PAD as a discriminator in order to make them more robust against these types of adversarial attacks. The proposed system is able to generate adversarial spoofing attacks which can fool the complete voice biometric system. Then, the resulting PAD discriminators of the proposed GANBA can be used as a defense technique for detecting both original and adversarial spoofing attacks. The physical access (PA) and logical access (LA) scenarios of the ASVspoof 2019 database were employed to carry out the experiments. The experimental results show that the GANBA attacks are quite effective, outperforming other adversarial techniques when applied in white-box and black-box attack setups. In addition, the resulting PAD discriminators are more robust against both original and adversarial spoofing attacks.

Cyber attacks have become increasingly dangerous and quite common in world of internet.so the demand of cyber security has been increased to safeguard the information personal data and computer network .now a days everything has been computerized and transaction are done online thus economic reimbursement are increasing due to cyber attacks as the technological evolution comes the progress of cyber-crime increases thus develops the new types of attacks are reported throughout the study the exact number of attack type determination is quite difficult however the most common cyber attacks are described in this article .the aim of this study is to survey and convincing manner review the strength and weakness presented in the field of cyber security. the article aim is to analyze various type of attacks existing to understand the state of being exposed to the possibility of being attacked. The main goal is to handle cyber attacks.

Ind-privacy and unp-privacy, later refined to unp*-privacy, are two different classes of privacy models for RFID authentication protocols. These models have captured the major anonymity and untraceability related attacks regarding RFID authentication protocols with privacy, and existing work indicates that unp*-privacy seems to be a stronger notion when compared with ind-privacy. In this paper, we continue studying the RFID privacy models, and there are two folds regarding our results. First of all, we describe a new traceability attack and show that schemes proven secure in unp*-privacy may not be secure against this new and practical type of traceability attacks. We then propose a new unpredictability-based privacy model to capture this new type of attacks. Secondly, we show that this new model, where we called it the unp τ -privacy, is stronger than both unp*-privacy and ind-privacy.

The emergence of new sophisticated types of attacks forces the community of computer security researchers to constantly improve detection tools and response methods. The present study explores different factors of autoencoders and variational models that influence their effectiveness in identifying novel attack types and malicious network traffic. The general idea of the proposed algorithm is to construct a confidence interval for the reconstruction error of the training sample, based on which a decision is made on the maliciousness of a particular traffic. Additional emphasis was placed on selecting an appropriate error metric to minimize the overlap between the density distributions of reconstruction errors for normal and malicious traffic. In the study of the variational model, the effect of the t-distribution on the quality of detecting new types of attacks was investigated. The studies were conducted on the CIC-IDS2017 dataset of the Canadian Cybersecurity Institute, containing up to 14 types of traffic and attacks. The experimental results show that with a competent selection of the error measure and the threshold values of the confidence interval, our models outperform existing analogues in various performance indicators.

Considering current network scenario hackers and intruders has become a big threat today. As new technologies are emerging fast, extensive use of these technologies and computers, what plays an important role is security. Most of the computers in network can be easily compromised with attacks. Big issue of concern is increase in new type of attack these days. Security to the sensitive data is very big threat to deal with, it need to consider as high priority issue which should be addressed immediately. Highly efficient Intrusion Detection Systems (IDS) are available now a days which detects various types of attacks on network. But we require the IDS which is intelligent enough to detect and analyze all type of new threats on the network. Maximum accuracy is expected by any of this intelligent intrusion detection system. An Intrusion Detection System can be hardware or software that analyze and monitors all activities of network to detect malicious activities happened inside the network. It also informs and helps administrator to deal with malicious packets, which if enters in network can harm more number of computers connected together. In our work we have implemented an intellectual IDS which helps administrator to analyze real time network traffic. IDS does it by classifying packets entering into the system as normal or malicious. This paper mainly focus on techniques used for feature selection to reduce number of features from KDD-99 dataset. This paper also explains algorithm used for classification i.e., Random Forest which works with forest of trees to classify real time packet as normal or malicious. Random forest makes use of ensembling techniques to give final output which is derived by combining output from number of trees used to create forest. Dataset which is used while performing experiments is KDD-99. This dataset is used to train all trees to get more accuracy with help of random forest. From results achieved we can observe that random forest algorithm gives more accuracy in distributed network with reduced false alarm rate.

Ever since the introduction of the domain name system (DNS), attacks on the DNS ecosystem have been a steady companion. Over time, targets and techniques have shifted, and in the recent past a new type of attack on the DNS has emerged. In this paper we report on the DNS random subdomain attack, querying floods of non-existent subdomains, intended to cause a denial-of-service on DNS servers. Based on five major attacks in 2018 obtained through backscatter measurements in a large network telescope, we show the techniques pursued by adversaries, and develop a taxonomy of strategies of this attack.

Online education has become a major delivery method in education. Many schools have adopted online delivery of courses. This has exposed schools to greater information security risks, such as assessment cheating, identity theft, and loss of sensitive student information. To counter emerging new types of attacks, risks, and vulnerabilities, the protection measures must be able to adapt to the evolving behaviors of both user and attacker by learning new emerging vulnerabilities and behaviors of users. We propose a new Real-time Behavioral Biometric Information Security (RBBIS) architecture that non-invasively builds behavioral profiles on the fly using deep-learning approaches. The method learns behaviors of students to validate users and detect intrusion, identity theft, and assessment fraud. This greatly improves the current limitations of the existing user authentication approaches of online education platforms. RBBIS was evaluated using CNN deep-learning keystroke behavior biometric analysis and compared with various existing machine learning algorithms: j48, Naive Bayes, and Multi Layered Perceptron (MLP). The results show that our deep-learning method performed best with a Convolutional Neural Network (CNN) with 92.45% of accuracy, whereas Naive Bayes, j48 and MLP achieved accuracies of 68.87%, 73.38% and 77.11%, respectively.

Malware Detection and Analysis play a primary role in information access points such as workstations, servers, cloud storage, and mobile devices. Securing information from malware is a challenging task, and existing anti-malware applications suffer from detecting new types of attacks. In recent years, machine learning-based malware detection techniques have been applied for effective malware detection and analysis for existing and new types of malware with few drawbacks such as misclassification and increased complexity. To overcome this, the chapter focuses on adopting deep learning (DL) models to build an anti-malware application via modern Artificial Intelligence (AI) techniques. Quantum Machine Learning (QML) is a research area that explores the interplay of ideas from quantum computing and machine learning. The proposed framework is built with various DeepNet Models to improve predicted accuracy, which can carry out universal quantum computations. QML performs the information processing with quantum computers relies on substantially different laws of physics called quantum theory. Initially, executable files will be converted to binary files and forwarded to DeepNet Models to multi-classify the novel variants of malware. A comprehensive survey is carried out on the implementation of ML/DL models for malware detection and analysis by considering various factors.

Unknown network protocol’s stealth attack behavior is becoming a new type of attack, which greatly harms the cyber space security. The stealth behaviors are not easy to be detected by existing security measures. Starting with the implementation of the instructions of the protocol programs, the normal behavior instruction sequences are captured by dynamic binary analysis. The algorithm of instruction clustering and feature distance computation is designed to mine the potential stealth attack behavior instruction sequences. The mined stealth attack behavior instruction sequences (for inline assembly) are loaded into the general executing framework. A virtual protocol behavior analysis platform HiddenDisc has been developed, and the Dynamic analysis is implemented on the platform. Then the protocol execution security evaluation scheme is proposed and implemented. Using the stealth transformation method designed by ourselves, the stealth attack behaviors are transformed. We successfully attacked the virtual target machine by using the transformed stealth attack behaviors, but the stealth behaviors were not captured. The experimental results show that the present method can accurately and efficiently perception mining unknown protocol’s stealth attack behaviors, transform and use of stealth attack behavior can also enhance our information offensive and defensive capabilities.

The rapid growth of digital payment ecosystems, which include mobile wallets, UPI platforms, online banking channels, and merchant-integrated gateways, has led to a big rise in both the number of transactions and the complexity of financial fraud. Standard systems for finding fraud mostly use rule-based methods or independent transaction-level classifiers. These systems can't pick up on the complicated relational and temporal dependencies that are common in modern fraud patterns. This research presents a Graph Neural Network (GNN)-based real-time fraud detection framework that conceptualizes the digital payment ecosystem as a dynamic, multi-relational graph consisting of users, devices, merchants, IP addresses, and transactional interactions. The framework combines Relational Graph Convolutional Networks, Graph Attention Networks, and Temporal Graph Networks to learn behavioral patterns that change over time, in context, and in structure. A hybrid supervised–unsupervised scoring module is used to figure out how likely fraud is. This module can find both known and new types of attacks. A lot of tests on big synthetic payment datasets show that the proposed model does much better than traditional machine learning and deep learning baselines in terms of AUC-ROC, precision, and F1-score. It also has an inference latency of less than 50 ms, which makes it good for real-time use. The results show that GNN-based methods are effective for next-generation financial systems that need to be safe, scalable, and smart when it comes to stopping fraud.

Nowadays, with the rapid increase in the number of applications and networks, the number of cyber multi-step attacks has been increasing exponentially. Thus, the need for a reliable and acceptable Intrusion Detection System (IDS) solution is becoming urgent to protect the networks and devices. However, implementing a robust IDS needs a reliable and up-to-date dataset in order to capture the behaviors of the new types of attacks especially a multi-step attack. In this paper, a new benchmark Multi-Step Cyber-Attack Dataset (MSCAD) is introduced. MSCAD includes two multi-step scenarios; the first scenario is a password cracking attack, and the second attack scenario is a volume-based Distributed Denial of Service (DDoS) attack. The MSCAD was assessed in two manners; firstly, the MSCAD was used to train IDS. Then, the performance of IDS was evaluated in terms of G-mean and Area Under Curve (AUC). Secondly, the MSCAD was compared with other free open-source and public datasets based on the latest keys criteria of a dataset evaluation framework. The results show that IDS-based MSCAD achieved the best performance with G-mean 0.83 and obtained good accuracy to detect the attacks. Besides, the MSCAD successfully passing twelve keys criteria.

Intrusion Detection System (IDS) has been a challenging area to be developed in recent years since there are so many kinds of network attacks that are difficult to be classified by system. Moreover, there is always the possibility of the upcoming new attack. Therefore, Intrusion detection system must be improved by new classifiers to obtain the best results not only for classifying attack but also recognizing a new type of attack in an advanced way. These developments will be beneficial for managing security systems in an upcoming era. There are several classifier algorithms for Intrusion Detection System such as Support Vector Machine (SVM) and Fuzzy Kernel C-Means (FKCM). SVM classifier is known as one of the techniques to improve efficiency in attack detection while FKCM is famous because it provides better results to reduce the number of selected data features. Each of classifiers is using kernel trick to improve the classifying matter. In this study, we will compare proposed model which are FKCM with rbf, FKCM with polynomial kernel, SVM with rbf, and SVM with polynomial kernel to find a better result that could increase the accuracy of classifying network attacks. KDD Cup 1999 will be used to evaluate each model. In this study, the use of SVM with polynomial kernel brings the best result with 100 % accuracy can be obtained in 1.9 second.