LFD-IDS: Bagging-Based Data Poisoning Attacks Against Cyberattack Detection in Connected Vehicle

Cyberattacks on control systems in the chemical process industries cause concern regarding how they can impact finances, safety, and production levels of companies. A key practical challenge for cyberattack detection and handling using process information is that process behavior evolves over time. Conceivably, changes in process dynamics might cause some detection strategies to flag a change in the dynamics as an attack due to the new data appearing abnormal compared to data from before the dynamics changed. In this work, we utilize several case studies to probe the question of what might be the impacts, benefits, and limitations of cyberattack detection and handling policies when the process dynamics change over time. The goal of this work is to characterize, through simulation studies, characteristics, which might be desirable and undesirable in cyberattack detection and handling procedures when process evolution is inevitable. We demonstrate challenges with cyberattack detection when process dynamics change and subsequently, discuss two concepts for handling attacks—one which utilizes a two‐tier detection strategy in which model reidentification is triggered when it is not clear whether an attack or a change in the process dynamics has occurred, and one in which control signals are injected at intervals by the actuators. We utilize simulations to elucidate characteristics of these strategies and demonstrate that verifiability of attack‐handling methods is key to their implementation (i.e., ad hoc tuning has potential to leave vulnerabilities which an attacker might locate and exploit).

This paper is concerned with cyber attack detection problem in a platoon-based vehicular networked control system. In such a system, the information among vehicles is transmitted through a shared wireless communication network and also each vehicle has access to its own information measured by local sensors. These kind of systems are highly vulnerable to cyber attacks and therefore, cyber-security issues need to be properly addressed to ensure the safety of the systems. Among various cyber-security aspects, reliable attack detection is of utmost importance as the ability to detect cyber attacks in a timely manner can reduce the damage to the systems. Therefore, we present a cyber attack detection algorithm that is capable of detecting attacks violating both measurements and control command data. This algorithm is based on an ellipsoidal set-membership filtering approach which consists of two sets: prediction ellipsoid set and an estimation ellipsoid set calculated through updating the prediction ellipsoid set with the measurement data. The detection method depends on the existence of intersection between these two sets computed by the filter. Simulation results for some possible cyber attacks are provided to demonstrate the effectiveness of the proposed method.

Real-time cyberspace situational awareness is critical for securing and protecting today's enterprise networks from various cyber threats. When a security incident occurs, network administrators and security analysts need to know what exactly has happened in the network, why it happened, and what actions or countermeasures should be taken to quickly mitigate the potential impacts. In this paper, we propose an integrated cyberspace situational awareness system for efficient cyber attack detection, analysis and mitigation in large-scale enterprise networks. Essentially, a cyberspace common operational picture will be developed, which is a multi-layer graphical model and can efficiently capture and represent the statuses, relationships, and interdependencies of various entities and elements within and among different levels of a network. Once shared among authorized users, this cyberspace common operational picture can provide an integrated view of the logical, physical, and cyber domains, and a unique visualization of disparate data sets to support decision makers. In addition, advanced analyses, such as Bayesian Network analysis, will be explored to address the information uncertainty, dynamic and complex cyber attack detection, and optimal impact mitigation issues. All the developed technologies will be further integrated into an automatic software toolkit to achieve near real-time cyberspace situational awareness and impact mitigation in large-scale computer networks.

Cyber attack detection technology plays a vital role today, since cyber attacks have been causing great harm and loss to organizations and individuals. Feature selection is a necessary step for many cyber-attack detection systems, because it can reduce training costs, improve detection performance, and make the detection system lightweight. Many techniques related to feature selection for cyber attack detection have been proposed, and each technique has advantages and disadvantages. Determining which technology should be selected is a challenging problem for many researchers and system developers, and although there have been several survey papers on feature selection techniques in the field of cyber security, most of them try to be all-encompassing and are too general, making it difficult for readers to grasp the concrete and comprehensive image of the methods. In this paper, we survey the filter-based feature selection technique in detail and comprehensively for the first time. The filter-based technique is one popular kind of feature selection technique and is widely used in both research and application. In addition to general descriptions of this kind of method, we also explain in detail search algorithms and relevance measures, which are two necessary technical elements commonly used in the filter-based technique.

Detecting cyber attacks in large computer networks is crucial for many organizations. To that purpose, different types of detectors capture the important signals resembling a security attack from individual computers and bring that to the attention of a security analyst. Unfortunately, the analyst sometimes has no indications about why the particular computer was identified as being "under attack". In addition, the analyst may have no method to provide feedback to the detector if the computer was actually identified for some benign reason. In this paper, we use a state-of-the-art anomaly detector called an Isolation Forest [1] for attack detection and generate explanations about why the detector identified certain computers as anomalous. These explanations allow the analyst to direct their investigation in order to save time. We then take the feedback from the analyst in the form of true and false positives and update the anomaly detector to capture signals that align better with the given feedback. Our experiments on actual network data show that the explanations give more insight into the detections, and the analyst's feedback increases the attack detection rate.

The digitalization revolution plays a crucial role in every government administration. It manages a considerable volume of user information and is currently seeing an increase in internet access. The absence of unorganized information, on the other hand, adds to the difficulty of data analysis. Data mining approaches have recently become more popular for addressing a variety of e-governance concerns, particularly data management, data processing, and so on. This chapter identifies and compares several existing data mining and data warehouses in e-government. Deep learning is a subset of a larger class of machine learning techniques that combine artificial neural networks. The significance and difficulties of e-governance are highlighted for future enhancement. As a result, with the growth of e-governance, risk and cyber-attacks have increased these days. Furthermore, the few e-governance application performance evaluations are included in this chapter. The purpose of this chapter is to focus on deep learning applications of e-governance in detecting cyber-attacks.

In the modern digital era, owing to technological progressions, the diversification and intensity of cyber-attacks have attained an extraordinary level. Unlike network users, intruders use technological developments and implement attacks to cause operational disruptions, data breaches, and financial losses. The Denial-of-Wallet (DoW) attack adapts the standard Denial-of-Service (DoS) attack. The principle of either attack is equivalent: to use the feedback capability to flood requirements to a service, making it unable to utilize it correctly. The DoW attack goal is to use the limitation of the calculating capability dealing with the cloud service, trying to cause direct financial loss. Federated Learning (FL) has been developed as a guaranteed solution for detecting DoW. This model deals with safety concerns, minimizes the data breach risk, and improves scalability. This manuscript presents a Cyberattack Detection Model for Denial-Of-Wallet Using Advanced Metaheuristic Optimization Algorithms in Federated Learning (CDMDoW-AMOAFL) model. The proposed CDMDoW-AMOAFL model aims to detect and mitigate malicious activities in a network. The z-score normalization is initially applied in the data normalization stage to transform input data into a beneficial format. Furthermore, the proposed CDMDoW-AMOAFL method utilizes the Harris hawk optimization (HHO) model for the feature selection process to identify and select the most relevant features from a dataset. For cyberattack detection, the ensemble models, namely the gated recurrent unit (GRU), temporal convolutional network (TCN), and convolutional autoencoder (CAE) models, are employed. Finally, the modified marine predator algorithm (MMPA) optimally adjusts ensemble models’ hyperparameter values, resulting in better classification performance. A wide-ranging experimentation was performed to prove the performance of the CDMDoW-AMOAFL method under the DoW attack detection dataset. The performance validation of the CDMDoW-AMOAFL technique illustrated a superior accuracy value of 98.12% over existing models.

Due to the rapid growth of cyber-security challenges via sophisticated attacks such as data injection attacks, replay attacks, etc., cyber-attack detection and avoidance system has become a significant area of research in Cyber-Physical Systems (CPSs). It is possible for different attacks to cause system failures, malfunctions. In the future, CPSs may require a cyber-defense system for improving its security. The different deep learning algorithms based on cyber-attack detection techniques have been considered for the detection and mitigation of different types of cyber-attacks. In this paper, the newly suggested deep learning algorithms for cyber-attack detection are studied and a hybrid deep learning model is proposed. The proposed Hybrid Convolutional Multilayer Perceptron for Cyber Physical Systems (HCMP-CPS) model is based on Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Multi-Layer Perceptron (MLP). The HCMP-CPS model helps to detect and classify attacks more accurately than the conventional models.

Due to the rapid growth of network technology, huge volume and distinct data sent via networks is expanding constantly. The situation shows how complex and dense cyber attacks and hazards are developing. Due to the rapid advancement in network density, cyber security specialists find it difficult to monitor all network activity. Due to frequent and sophisticated cyber attacks, it is becoming more challenging to detect and identify abnormalities in network events. The use of deep learning provides a variety of tools and strategies for automated cyber-attack detection as well as quick attack-type prediction as well as evaluation. This work introduces a novel cyber-attack detection and mitigation process under the following phases including preprocessing, feature extraction via the Map Reduce framework that handles the big data, feature selection, attack detection and mitigation. The Improved Normalisation process is achieved on the preprocessing phase. The work is examined from a big data perspective; hence Map Reduce framework is utilised for this. As a result, the framework will manage the feature extraction process, where features including statistical features, raw features, improved correlation-based features, and info gain-based features will be extracted. Following feature extraction, the Improved Recursive Feature Elimination procedure is processed that selects the relevant features. The hybrid detection model, which combines Recurrent Neural Networks (RNN) Deep and Belief Networks (DBN) is used to detect the attacks. Once an attack has been detected, the attacker must be mitigated. To accomplish this, an improved BAIT-based mitigation procedure is used. The two datasets used in this work are, namely, Intrusion Detection Systems (IDS) 2018 Intrusion CSVs (CSE-CIC-IDS2018) and UNSW_NB15. Finally, the suggested model and the alternative methods are contrasted using a variety of measures such as accuracy, sensitivity, specificity, precision, FDR, FNR and FPR.

The power demand has increased dramatically in recent years. Conventional power generation provides about 80% of the world's energy. Distribution networks are essential to the electrical grid system because they link consumers to the transmission system. Distribution networks require careful planning since they are vast and complex. Congestion in the distribution network quickly affects the network's voltage profile as power demand increases, leading to power outages and delayed power delivery. Since Active Distribution Networks (ADNs) are more vulnerable to cyberattacks due to their integration with cutting-edge communication and control technologies, detecting these attacks is a critical problem in modern power systems. The possible cyberattacks on power systems are covered in this paper. To identify the possible, cyberattack, an IEEE-15 bus system with Cyber-Physical Layering (CPL) is suggested. Cyberattack detection systems defend ADNs against assaults including data alteration, illegal access, and service denial by utilizing machine learning, anomaly detection, and real-time monitoring. Using machine learning techniques, such as DT, NNN, and SVM, cyberattack detection is also carried out on modified IEEE-15 bus systems and CPL-based IEEE-15 buses. Additionally, a comparative analysis of the methods for cyberattack detection is conducted. The paper discusses how advanced communication and control systems in active distribution networks (ADNs) face heightened cyber risks from both traditional threats like DoS and FDI attacks and emerging quantum computing-based attacks. It highlights vulnerabilities across CPL layers and recommends AI/ML anomaly detection, quantum-safe cryptography, and robust network designs for future resilience.

The Internet of Things (IoT) presents significant advantages to day-to-day life across a wide range of application domains, including healthcare automation, transportation, and smart environments. However, owing to the constraints of limited resources and computation abilities, IoT networks are subject to different cyber-attacks. Incorporating IDS into the cybersecurity-driven IIoT process contains cautious deployment, planning, and progressing management. Cybersecurity is crucial for the protection of sensitive data, safeguarding the privacy of users, and securing important substructures from malicious activities attempting unauthorized access or triggering interferences. Cyberattack detection performs a vital role in this defense scheme, employing advanced technologies like deep learning (DL) for analysing digital activities in real time. With the help of recognizing and responding to possible cyber-attacks quickly, cyberattack detection not only mitigates risks but reinforces the overall flexibility of the digital ecosystem against developing security challenges. This study presents a League Championship Algorithm Feature Selection with Optimal Deep Learning based Cyberattack Detection (CLAFS-ODLCD) technique for securing the digital ecosystem. The CLAFS-ODLCD technique focuses on the recognition and classification of cyberattacks in the IoT infrastructure. To achieve this, the CLAFS-ODLCD method utilizes the linear scaling normalization (LSN) approach for data pre-processing. Furthermore, the CLAFS-ODLCD method employs the CLAFS approach to choose optimal feature subset. Moreover, the detection and classification of the cyberattacks are accomplished by implementing the stacked sparse autoencoder (SSAE) approach. Finally, the hunger games search (HGS) optimizer is employed for optimum hyperparameter selection. The empirical analysis of the CLAFS-ODLCD method is examined under the WSN-DS dataset. The comparison study of the CLAFS-ODLCD method portrayed a superior accuracy value of 99.48% over existing models.

This paper describes a situation awareness framework, Frankenstack, that is the result of a multi-faceted endeavor to enhance the expertise of cybersecurity specialists by providing them with real-time feedback during cybersecurity exercises and verifying the performance and applicability of monitoring tools during those exercises. Frankenstack has been recently redeveloped to improve data collection and processing functions as well as cyberattack detection capability. This extensive R&D effort has combined various system and network security monitoring tools into a single cyberattack detection and exercise feedback framework.Although Frankenstack was specifically developed for the NATO CCD COE’s Crossed Swords exercise, the architecture provides a clear point of reference for others who are building such monitoring frameworks. Thus, the paper contains many technical descriptions to reduce the gap between theoretical research and practitioners seeking advice on how to implement such complex systems.

Cybersecurity is the practice of protecting computer systems, networks, programs, and data from digital attacks, damage, or unauthorized access. Cyber security technologies and solutions may not always be compatible with existing hardware and software, which could lead to various security risks. The development of artificial intelligence has led to significant improvements and notable outcomes in identifying cyberattacks. This article reviews various artificial intelligence approaches, including different machine learning, deep learning, and reinforcement learning algorithms, in cyber-attack detection. Various cryptography methods, which are utilized for security enhancement, like symmetric, asymmetric, and homomorphic cryptography, and various authentication schemes for data security, such as multifactor, digital signature, and biometric authentication, are also studied. Several parameters are taken for analysing the performance of those algorithms, such as accuracy, positive predictive value, hit rate, F1 score, error, encryption time, decryption time, and processing time, which have values of 96.24, 96.10, 95.80, 95.95, and 21.33%, 96 and 85 s. According to this review, deep learning-based DNN algorithms outperform traditional methods in cyber-attack detection. For security enhancement, the DES algorithm yields better outcomes. Biometric authentication offers enhanced security and convenience for user verification compared to traditional authentication methods.

Cyber-physical systems (CPS) security has become an increasingly important research topic in recent years. Geared towards more advanced cyberattack detection techniques as part of strategies for enhancing the security of CPS, in this paper we propose a machine learning based cyber-attack detection scheme. The proposed scheme is a physical-domain technique; specifically, it assumes the physical measurements of the system carry sufficient information for capturing the system behavior, thus can be used for differentiating normal operation and attacks. CPS are complex in nature and the number of physical measurements available for CPS is often overwhelmingly high. Thus, accurately modeling CPS’ dynamic behavior, more importantly, distinguishing normal and adversary activities based on the large number of physical measurements, can be challenging. To address the challenge, we have focused our research effort on feature engineering, that is, to intelligently derive a set of salient signatures or features from the noisy measurements. We make sure the derived features are more compact and, more importantly, have more discriminant power than the original physical measurements, thus enabling us to achieve more accurate and robust detection performance. To demonstrate the effectiveness of the proposed scheme, in our experimental study we consider gas turbines of combined cycle power plants as the cyber-physical system. Using the data from the high-fidelity simulation we show that our proposed cyberattack detection scheme is able to achieve high detection performance.

The rapid expansion of Edge Computing (EC) and Internet of Things devices has introduced significant cybersecurity challenges, necessitating advanced and privacy-preserving attack detection strategies. Traditional cyber-attack detection methods and centralized machine learning solutions face critical limitations in addressing privacy concerns, resource constraints, and the evolving nature of cyber threats in edge environments. Federated Learning (FL) offers a transformative solution by enabling distributed model training across edge devices while preserving data privacy. This systematic literature review investigates FL for cyber-attack detection in EC environments using the PRISMA methodology, analyzing 131 primary studies from 2020–2025 across five major databases. Our contributions include: (1) a comprehensive PRISMA-compliant framework encompassing seven thematic areas with detailed comparative analysis, (2) an in-depth gap analysis with actionable recommendations for privacy-performance trade-offs, scalability, and standardization challenges, and (3) a forward-looking research agenda addressing generative models, collaborative defense, 6G-enabled intelligence, and zero-trust architectures. Unlike existing surveys, this work provides the most comprehensive scope with bibliometric analysis, multi-perspective evaluation, and practical deployment guidelines, serving as a foundational reference for advancing federated cyber-attack detection in edge computing environments.