Deep Learning Framework for Online Alarm Flood Classification and Fault-Cyberattack Discrimination

As states and populations around the world have become increasingly interconnected and dependent on digitized technologies and cyberspace, threat actors have been aggressively exploiting these changes to their own advantage. Of particular concern to academics, cyber experts and national security practitioners in the West, has been the rapid proliferation of damaging and disruptive cyber attacks carried out by state-actors - particularly authoritarian regimes - and their proxies. Despite global cyber attacks rising year by year, in terms of both frequency and level of technological ability, available data suggests most of the world's major cyber attacks are carried out by a relatively small handful of states. Furthermore, it appears as though these states tend to favour certain types of cyber attacks over others. This observation leads to the central research question of this dissertation: why do certain types of authoritarian regimes tend to favour certain types of cyber attacks over others? Taking a deductive approach, and drawing from existing theories on authoritarian legitimation and cyber conflict, I have developed a needs-based theory of authoritarian behaviour in cyberspace. More specifically, I suggest that different types of authoritarian regimes will use different cyber strategies to fulfil or service the process, strategy, or outcome they need most to maintain domestic support and legitimacy.

Modern power grids are undergoing significant changes driven by information and communication technologies (ICTs), and evolving into smart grids with higher efficiency and lower operation cost. Using ICTs, however, comes with an inevitable side effect that makes the power system more vulnerable to cyber attacks. In this paper, we propose a self-supervised learning-based framework to detect and identify various types of cyber attacks. Different from existing approaches, the proposed framework does not rely on large amounts of well-curated labeled data but makes use of the massive unlabeled data in the wild which are easily accessible. Specifically, the proposed framework adopts the BERT model from the natural language processing domain and learns generalizable and effective representations from the unlabeled sensing data, which capture the distinctive patterns of different attacks. Using the learned representations, together with a very small amount of labeled data, we can train a task-specific classifier to detect various types of cyber attacks. Experiment results in a 3-area power grid system with 37 buses demonstrate the superior performance of our framework over existing approaches, especially when a very limited amount of labeled data are available. We believe such a framework can be easily adopted to detect a variety of cyber attacks in other power grid scenarios.

Cyber attacks have become increasingly dangerous and quite common in world of internet.so the demand of cyber security has been increased to safeguard the information personal data and computer network .now a days everything has been computerized and transaction are done online thus economic reimbursement are increasing due to cyber attacks as the technological evolution comes the progress of cyber-crime increases thus develops the new types of attacks are reported throughout the study the exact number of attack type determination is quite difficult however the most common cyber attacks are described in this article .the aim of this study is to survey and convincing manner review the strength and weakness presented in the field of cyber security. the article aim is to analyze various type of attacks existing to understand the state of being exposed to the possibility of being attacked. The main goal is to handle cyber attacks.

Chapter 12 - Can Cyber Warfare Leave a Nation in the Dark? Cyber Attacks Against Electrical Infrastructure

In the last decade, Vehicular Ad-Hoc Networks (VANET) have garnered significant interest and concern. VANETs allow vehicles on the road to communicate with each other and with the Internet, ensuring the safety and comfort of passengers. VANETs provide traffic and weather reports, collision prevention, and many more applications. However, VANETs have become an alluring target for cyber attacks. In this paper, we provide a survey on cyber attacks and protection solutions for VANETs. We begin by addressing various types of cyber attacks that can affect VANETs and the security properties that they can compromise. We subsequently illustrate multiple protection solutions that have been proposed in response to these attacks and the various security concerns they can help alleviate. We observe that the proposed solutions have the capability of addressing all areas of security concern in a VANET. However, this knowledge can assist attackers in creating new cyber threats that can circumvent current protection solutions. Hence, we finish off the paper by introducing some open research areas that can help further address cyber threats and can assist in creating more robust security solutions to protect the next generation of VANETs.

Accurate and reliable estimation of generator's dynamic state vectors in real time are critical to the monitoring and control of power systems. A robust Cubature Kalman Filter (RCKF) based approach is proposed for dynamic state estimation (DSE) of generators under cyber attacks in this paper. First, two types of cyber attacks, namely false data injection and denial of service attacks, are modelled and thereby introduced into DSE of a generator by mixing the attack vectors with the measurement data; Second, under cyber attacks with different degrees of sophistication, the RCKF algorithm and the Cubature Kalman Filter (CKF) algorithm are adopted to the DSE, and then the two algorithms are compared and discussed. The novelty of this study lies primarily in our attempt to introduce cyber attacks into DSE of generators. The simulation results on the IEEE 9-bus system and the New England 16-machine 68-bus system verify the effectiveness and superiority of the RCKF.

The article deals with the application of mathematical models of the neural network learning process, which makes it possible to ensure the required protection of the information exchange system (IES) of critical information infrastructure objects (CIIO). Presented the analysis of models of various types of cyber attacks. It is determined that random cyber attacks are a fundamental element of the neural network learning process to control the security of IES CIIO. The rationale for the need to identify accidental cyber attacks before the security parameters exceed the warning tolerance is given. It has been established that it is advisable to use the characteristics of external program requests to determine security parameters. An approach to determining the fundamental expediency of using neural network tools for assessing security parameters is considered. The issue of optimization of neural network models is raised.

Recently various types of cyber attacks have occurred. The strategic goals & tactical means of these have evolved. Especially KHNP cyber attack was the type of hacktivism combined hack and psychological warfare. The cyber attackers have forecd the nation to participate in the cyber warfare and the government to make strategic decisions to the releases of confidential information and the threats of stopping KHNP. In this paper, we would like to study the effective strategic decision-making model utilizing the game theory and including an attack intelligence on open policy Decision framework.

Vulnerability analysis of demand-response with renewable energy integration in smart grids to cyber attacks and online detection methods

Deep learning theory demonstrates its great power in the complicated data processing field. As a prevalent deep learning technology, convolutional neural network (CNN) has achieved some successful applications in the field of fault detection and classification in the complicated industrial systems because of its strong nonlinear feature extraction capability. However, the basic CNN views all the features equally and can not highlight these features which play a more important role in the fault classification procedure. To deal with this problem, this paper proposes an improved CNN model, called multi-head attention CNN (MACNN), to distinguish the importance of different features for better fault classification performance. In the MACNN framework, the raw training data are firstly analyzed by the multiple convolutional layers for feature extraction. Then, the features obtained by the convolution layers are used as the input of the multi-head attention (MA) layers. The introduction of the MA mechanism can help exploit more meaningful information by emphasizing the important features. Lastly, the softmax classifier is utilized to classify the fault patterns. To test the method performance, one case study on the benchmark Tennessee Eastman industrial system is performed and the results show that MACNN gives the better fault classification results than the traditional feedforward neural network (FNN) and CNN models.

The article investigates the problem of forming high-quality training samples for cyber threat detection tasks in computer networks, which is a critically important component in the further effective application of machine learning methods. Modern approaches to monitoring network traffic, classifying cyber attacks, and using intelligent intrusion detection systems are analyzed. It is shown that using only real network traffic significantly complicates the process of training models due to limited access to data, its fragmentation, and class imbalance. A software solution is proposed for generating synthetic network traffic, which allows modeling both normal network activity and various types of cyber attacks. The software developed provides an automated pipeline for creating datasets with the ability to scale, label data, and save results in standard formats for further use in machine learning algorithms. Support for 13 types of network attacks, covering the most common modern threats, is implemented. Particular attention is paid to the mathematical model of data preparation, which includes feature normalization, sample division into training, validation and test subsets, the use of k-fold cross-validation and the mechanism of injection of synthetic anomalies to eliminate class imbalance. This approach allows to increase the generalization ability of models and provide an objective assessment of their effectiveness. Experimental results confirm the correctness of the work of the developed software and the sufficient volume and variability of the generated data. The obtained datasets can be used for training, testing and comparison of machine learning models in the tasks of intelligent traffic monitoring and cyber threat detection, which determines the practical value of the proposed approach

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

The content of the paper deals primarily with the issue of cybercrime, emphasizing the European Cybercrime Centre. It presents an impartial view on the issue of cybercrime and the activities of the European Union in this area. It introduces the basic concepts related to cybercrime, including cyber security, cyber threats, and types of cyber attacks. It examines the legal regulation of cybercrime, emphasizing the gradual development of transnational legal instruments. The paper mentions the historical context of cybercrime and the various major cyber attacks in selected European Union Member States.

Research ProblemCyber attacks are targeting the cloud computing systems, where enterprises, governments, and individuals are outsourcing their storage and computational resources for improved scalability and dynamic management of their data. However, the different types of cyber attacks, as well as the different attack goals, create difficulties providing the right security solution needed. This is because different cyber attacks are associated with different threats in the cloud computing systems, where the importance of threats varies based on the cloud user requirements. For example, a hospital patient record system may prioritize the security of cyber attacks tampering patient records, while a media storage system may prioritize the security of cyber attacks carrying out a denial of service attack for ensuring a high availability. As a result, it is of paramount importance to analyze the risk associated with the cloud computing systems taking into account the importance of threats based on different cloud user requirements.However, the current risk evaluation approaches focus on evaluating the risk associated with the asset, rather than the risk associated with different types of threats. Such a holistic approach to risk evaluation does not show explicitly how different types of threats contribute to the overall risk of the cloud computing systems. Consequently, This makes it difficult for security administrators to make fine-grained decisions in order to select security solutions based on different importance of threats given the cloud user requirements. Therefore, it is necessary to analyze the risk of the cloud computing systems taking into account the different importance of threats, which enables the allocation of resources to reduce particular threats, identify the risk associated with different threats imposed, and identify different threats associated with cloud components.Proposed SolutionThe STRIDE threat modeling framework (short for STRIDE) is proposed by Microsoft, which can be used for threat categorization. Using the STRIDE, we propose a threat-guided risk evaluation approach for the cloud computing systems, which can evaluate the risk associated with each threat category from the STRIDE explicitly. Further, we utilize seven different types of security metrics to evaluate the risk namely: \textit{component, component-threat, threat-category, snapshot, path-components, path-threat}, and \textit{overall asset}. Component, component-threat, threat-cateory, and snapshot risks measure the total risk on a component, component risk for a particular threat category, total snapshot risk for a single threat, and the total risk of the snapshot considering all threat categories, respectively. Path-components, path-threat, and overall asset measure the total risk of components in an attack path, the risk of a single threat category in the attack path, and the overal risk to an asset considering all attack paths, respectively. These metrics makes it possible to measure the contribution of each threat category to the overall risk more precisely.When a vulnerability is discovered in a component (e.g. a Virtual Machine) of the Cloud deployment, the administrator first determines which types of threats could be posed should the vulnerability be successfully exploited, and what would be the impacts of each of those threats on the asset. The impact assignment of each threat type is weighted depending on the importance of the component. For example, a Virtual Machine (VM) that acts a Web Server in a medical records management application could be assigned a higher weighting for \textit{denial-of-service} threats because if such attacks are successfully launched then the rest of the VMs that are reached through the Web Server will be unavailable. On the other hand, a vulnerability discovered in a VM that hosts a database of medical records would be rated highest impact for \textit{information disclosure} because if it is compromised confidentiality of the medical history of patients will be violated.By multiplying the probability of successfully exploiting the vulnerability with the threat impact, we compute the risk of each threat type. The variation in the assignment of impact for different threat types enables our approach to compute risks associated with the threats - thus empowering the security administrator with the ability to make fine-grained decisions on how much resources to allocate for mitigating which type of threat and which threats to prioritize. We evaluated the usefulness of our approach through its application to attack scenarios in an example Cloud deployment. Our results show that it is more effective and informative to administrators compared to asset-based approaches to risk evaluation.

Chapter 16 - Exploring cyber attacks in blockchain technology enabled green smart city