Event-Triggered H∞ Filtering for Cyber–Physical Systems Against DoS Attacks

This chapter focuses on the very serious problem of denial of service (DoS) attacks against computer systems and networks. DoS attacks are attacks designed to disrupt, overwhelm, and/or damage computing resources and data. These attacks are aimed not against confidentiality of data or integrity of systems and data, but rather against availability of systems and data. Attackers launch DoS attacks for a wide variety of reasons. The probability of success is high, due in large part to the fact that the Internet itself has not been designed for security. The cost of DoS attacks is often high—several well‐known attacks have reportedly cost organizations billions of dollars. Many types of DoS attacks have surfaced so far, including resource starvation attacks, buffer overflow attacks, and packet fragmentation attacks. Distributed denial of service (DDoS) attacks, attacks in which programs planted in multiple systems cooperate, represent an even higher level of threat. Preventing DoS attacks is difficult in the first place due to a plethora of reasons; limiting the potential for damage and disruption is often the most cost‐effective strategy. Hot sites, cold sites, use of uninterruptible power supplies (UPSs) and Redundant Array of Independent Drives (RAID) solutions, and other measures can limit the damage from DoS attacks. Using properly configured and maintained firewalls is one of the best single prevention measures. Additionally, using packet filters on systems, keeping up with patches, limiting services that run on these systems, and using other measures go a long way in helping prevent susceptibility to DoS attacks.

In WSN, DoS (denial of service) attack makes shortcoming system. The packets travel over and over in the sensor network. By that, all the assets like data transmission, memory, and vitality are squandered by this attack. However, the attacker ought to optimize its attacker plan for request to boost the impact on the system performance because of the deficiency of vitality at the aggressor side. Denial of service (DoS) attack on the Internet has become a squeezing issue. By staying away from these sorts of attacks, network performance can be improved. Therefore, security is a fundamental requirement for these networks. Effective routing is necessary in order to overcome the issued faced by the crosslayer in the DOS attack of the WSN network for the purpose of good transmission. This research work mainly focuses on performance evaluation using optimization methods. To establish the efficient path in the crosslayer against DoS attack, this paper has proposed enhanced lion optimization with an efficient path routing equalization technique (LOEPRE). If any failure node occurs in the network, then the node is recognized and the transfer of the data packet is done to the other node. Retransmission of data causes overload in the network. The proposed model focuses on these issues and overcomes these issues by improving the path efficiently with robust security. It consists of three phases: the initial phase includes the route discovery in the network. In the second phase, the transfer of data is done in the high router path for security purposes. Finally, the efficient path routing equalization technique is used for minimizing the overload in the network; it provides the equalized path length in the network and is highly efficient. Hence, the proposed LOEPRE technique is used to achieve energy efficiency in wireless network for prolonged network lifetime and minimum packet latency and minimize consumption of energy. Moreover, the simulation outcome of the proposed LOEPRE method is highly robust while comparing to the existing methods EFCRS, SSPRA ELOER, EFLOR, and TSTP. It achieves better performance than existing algorithms in comparing metric connectivity ratio, end-to-end delay, overhead, throughput, and packet delivery ratio.

In this paper, the event trigger mechanism-based robust control problem is investigated for cyber-physical systems under denial of service attacks and disturbances. The effects of DoS attacks are regarded as a type of data packet loss. An event trigger mechanism is introduced into the control scheme design to effectively compensate the packet loss data. The robust attenuation technology is composited into control scheme to reduce the impact of disterbances. Then, by modeling the cyber-physical systems under denial of service(DoS) attack as a class of bounded sequential switching system, and constructing the corresponding Lyapunov function, the stability of the system is verified and analyzed. Finally, simulation experiments are given to verify the correctness of the above theoretical results.

To measure the degree of basic service of wireless sensor network (WSN) with denial of service (DoS) attacks, it is necessary to evaluate survivability of WSN. This paper presents new method based on services and Markov Chain. It distinguishes services, analyzes influence of services under DoS attacks, gets the formula of survivability. Probability of states is obtained by markov chain, then the quantitve survivability is getted in different states. Simulations prove that DoS attacks obviously decrease the survivability of WSN, but adding node energy and improving node density in certain range can reduce the influence of DoS attacks.

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at application level can be computationally expensive and difficult to scale, while still creating bogus positives that block legitimate users. In this paper, authors show application layer DoS attack for SIP server using some open source DoS attack tools and also suggest a mechanism that can protect a given SIP server from application-level DoS attacks especially the attacks targeting the resources including CPU, sockets, memory of the victim server. In this paper author’s attempt to illustrate application layer distributed denial of Service (DDoS) attack on SIP Server such as SIP flooding attack, real time transport (RTP) flooding attack using open source DDoS attack tools. We propose a new DDoS defence mechanism that protects SIP servers from application-level DDoS attacks based on the two methodologies: IPtables and fail2ban detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment

In ad-hoc and wireless networks, Denial of Service (DoS) attacks has always been problematic during data routing. DoS attacks disrupt the data routing and avert the generated data to reach the destination or the sink nodes. In tunnel attack, which is one of the type of DoS attacks, the intruder attracts all the traffic towards itself and prevent it from forwarding further to the neighboring nodes. Researchers have presented multiple solutions to cater the problem and minimize or avoid the tunnel attacks, but they all have their shortcomings. The main reason behind all the drawbacks is that those solutions have not been confirmed using formal methods. The formal methods can be utilized to authenticate whether or not the solutions are immune to DoS attacks. In our previous researches, it has been revealed that by employing formal methods, our newly developed protocol RAEED can detect and avoid many DoS attacks. In this research paper, it has been proved using model checker that RAEED can efficiently avoid both simple and intelligent tunnel attacks. Moreover, the results of formal methods have been confirmed with the help of computer simulations as well as practical implementation on MicaZ motes. In future we aim to employ formal methods to verify more wireless communication issues in multiple protocols.

This article investigates an attack-detection-based event-triggered transmission scheme (AD-ETS) for cyber-physical systems (CPSs) subject to malicious denial of service (DoS) attacks. Due to the fact that DoS attacks can prevent transmissions without any specific rules, we characterize the effects caused by such attacks as arbitrarily bounded successive triggered-packet dropouts. On the one hand, a novel DoS attack detection strategy based on a transmission acknowledgement (ACK) scheme is developed to govern the switching of the event-triggered thresholds in real time. Compared with the existing resilient event-triggered transmission and switching-like event-triggered schemes, the proposed AD-ETS will make full use of historical ACK signals to distinguish DoS attacks from probabilistic packet dropouts and make a decision on switching event-triggered transmission strategy. Thus, both timely transmission and communication efficiency can be accomplished by using AD-ETS. On the other hand, the maximum allowable event-triggered parameter, which can guarantee the stability of the nonlinear CPSs, is derived by exploiting the input delay approach. Based on the derived maximum allowable event-triggered parameter, the relation between the secure event-triggered parameter and the number of successive DoS-incurred packet dropouts is pursued which supplies the basis of secure event design for event-triggered transmission under DoS attacks. Compared with the existing works, the secure event-triggered transmission strategy by considering successive DoS-incurred packet dropouts just depends on the event-triggered-threshold rather than nonlinear dynamics. At last, simulations on stabilization of vehicle longitudinal dynamics are conducted to verify the effectiveness of the proposed AD-ETS.

The adaptive control of bilateral teleoperation system under denial of service (DoS) attacks is studied in this letter. The model of bilateral teleoperation system under DoS attacks is presented. The adaptive controllers are designed to deal with the influence of data missing caused by packet dropouts and DoS attacks. Two Bernoulli distributed variables are introduced to describe the system dynamic for the case that both packet dropouts and DoS attacks are involved in the communication channels. The globally asymptotically stability criterion is proposed by using Lyapunov functional methods, which implies the dynamics of the Master and the Slave are globally asymptotically synchronized. A numerical example of two degree of freedom bilateral teleoperation system is provided to show the effectiveness of obtained results.

This manuscript investigates the problem of secure state estimation (SSE) for cyber-physical systems (CPSs) which communicate through multiple channels under denial of service (DoS) attacks, where the considered DoS attacks occur aperiodically and independently in all channels. The only limitation for DoS attacks is that the duration of each attack is bounded. First, a secure transmission strategy is given to transmit signals and resist DoS attacks. Then, a novel fixed-time secure state estimation (FTSSE) method is proposed to ensure that the SSE for CPSs is realized within a predetermined fixed-time based on the developed secure transmission strategy. In addition, the accurate state values of some moments can be obtained at a given delay time. The sufficient condition and the proof of effectiveness for the FTSSE method based on secure transmission strategy are given through theoretical analysis. Finally, the results of an example simulation are given to verify the effectiveness of the designed method.

Denial of Service (DOS) attacks are a major threat faced by all types of networks. The effect of DOS in a delay tolerant network (DTN) is even more aggravated due to the scarcity of resources. Perpetrators of DOS attacks in DTN-like environments look beyond the objective of rendering a target node useless. The aim of an attacker is to cause a network-wide degradation of resources, service and performance. This can easily be achieved by exhausting node or link resources and partitioning the network. In this paper we seek to provide a proactive approach in making the DTN authentication process robust against DOS. Our aim is to make security protocols which provide mandatory DTN security services resilient to DOS attacks. The overall objective is to make it hard to launch a DOS attack and ensure the availability of DTN services. A DTN-cookie mechanism has been proposed to quickly identify and filter out illegitimate traffic.

The development of Cloud Computing is growing and becoming a trend that is widely used in the world of telecommunications today. In education, cloud computing becomes something that is needed to support the teaching and learning process. We analyze and design the network infrastructure in schools to implement cloud computing in local area schools. Then we built a system to create a server for cloud computing that can be accessed through the wired network and wireless network. Once the server cloud computing is installed and then we test functions such as uploading and downloading files whether to run well. The next step is to perform the test by doing DOS (Denial Of Service). The results show when no server DoS attack goes well with a large throughput. However, after the DoS attacks decreased throughput value and the greater the number of attacks is increasingly reducing the throughput of the server cloud. This shows that Cloud Server that have been built are still vulnerable to DoS attacks.

Software Defined Networking (SDN) is a paradigm for the networks, where the control planes and data planes are separated. It provides centralized network control by separating the network’s control logic from the underlying hardware devices. However, like traditional networks SDN is also susceptible to Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. This paper aims to detect and mitigate DoS and DDoS attacks in an SDN environment using an entropy-based approach. The proposed mechanism calculates the entropy of the network over the collected traffic, and derives a dynamic threshold according to the network traffic conditions to determine whether the environment is subject to DoS or DDoS attacks. In the event of the attack, the proposed mechanism installs a drop flow rule into underlying forwarding devices, discarding the traffic sent from attacking host to victim host

Denial of service (DoS) attacks are major threat against availability in the Internet. A large number of countermeasure techniques try to detect attack and then filter out DoS attack packets. Unfortunately these techniques that filter DoS traffic by looking at known attack patterns or statistical anomalies in the traffic patterns can be defeated by changing the attack patterns and masking the anomalies that are sought by the filter. Hence, detecting DoS traffic is one of the main challenges for filtering techniques. Furthermore techniques that drop any malicious packet need to process the packet and processing is time-consuming. This paper addresses how an efficient and good filter can be designed by helping an overlay network layer to mitigate DoS attacks. Fosel (filtering by helping an overlay security layer) filter is independent from DoS attack types, so we do not worry about the changing attack patterns. Furthermore it reduces processing time noticeably. Through simulation this paper shows by employing Fosel filter, DoS attacks have a negligible chance to saturate the target by malicious packets. Our simulation demonstrates that Fosel architecture reduces the probability of successful attack to minuscule levels. Furthermore Fosel is between 10% and 50% faster than SOS (secure overlay services) (Keromytis et al., 2002) architecture to drop malicious packets based on attack rate.

Sensors have varied constraints, which makes the network challenging for communicating with its peers. In this paper, an extension to the security of physical layer of a predictive sensor network model using the ant system is proposed. The Denial of Service (DoS) attack on sensor networks not only diminishes the network performance but also affects the reliability of the information making detection of a DoS threat is more crucial than recovering from the attack. Hence, in this paper, a novel approach in detecting the DoS attack is introduced and analyzed for a variety of scenarios. The DoS attack is dependent on the vulnerabilities in each layer, with the physical layer being the lowest layer and the first to be attacked by jammers. In this paper, the physical layer DoS attack is analyzed and a defense mechanism is proposed. Classification of the jammer under various attack scenarios is formulated to predict the genunity of the DoS attacks on the sensor nodes using receiver operating characteristics (ROC). This novel approach helps in achieving maximum reliability on DoS claims improving the Quality of Service (QoS) of WSN.

Nowadays, Denial of service (DoS) attacks, have become a major security threat to networks and to the Internet, DoS is harmful to networks as it delays legitimate users from accessing the server, In general, some researches were done to detect and prevent DoS from occurring in a wide area network (WAN), but fewer researches were done on Local Area Network (LAN.), yet, detecting and preventing DoS attacks is still a challenging task, especially in LAN. In this paper, we propose an approach merging methods from data mining to detect and prevent DoS attacks, by using multi classification techniques to achieve a sufficient level of accuracy and reduce false alert alarm. And secondly, we will evaluate our approach in comparison with other existing approaches. Our work is based on EGH Dataset to detect DoS attacks, in addition, our approach is implemented using Rapidminer, the experimental results show that the proposed approach is effective in identifying DoS attacks, our designed approach achieves significant results. In the best case, our accuracy is up to 99.96%, we used two component of security; Snort tool and PfSense firewall, and compared our approach with other approaches, and we found that our approach achieves best accuracy results in most cases. Keywords— Data Mining, DoS attacks, intrusion detection, Misuse Detection, Multi Classification.