Connected vehicles (CVs), because of the external connectivity with other CVs and connected infrastructure, are vulnerable to cyberattacks that can instantly compromise the safety of the vehicle itself and other connected vehicles and roadway infrastructure. One such cyberattack is the false information attack, where an external attacker injects inaccurate information into the connected vehicles and eventually can cause catastrophic consequences by compromising safety-critical applications like the forward collision warning. The occurrence and target of such attack events can be very dynamic, making real-time and near-real-time detection challenging. Change point models, can be used for real-time anomaly detection caused by the false information attack. In this paper, we have evaluated three change point-based statistical models; Expectation Maximization, Cumulative Summation, and Bayesian Online Change Point Algorithms for cyberattack detection in the CV data. Also, data-driven artificial intelligence (AI) models, which can be used to detect known and unknown underlying patterns in the dataset, have the potential of detecting a real-time anomaly in the CV data. We have used six AI models to detect false information attacks and compared the performance for detecting the attacks with our developed change point models. Our study shows that change points models performed better in real-time false information attack detection compared to the performance of the AI models. Change point models having the advantage of no training requirements can be a feasible and computationally efficient alternative to AI models for false information attack detection in connected vehicles.
This paper presents a study on detecting cyberattacks on industrial control systems (ICS) using unsupervised deep neural networks, specifically, convolutional neural networks. The study was performed on a SecureWater Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. e suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value.We applied the proposed method by using a variety of deep neural networks architectures including different variants of convolu…
Incremental Causal Graph Learning for Online Cyberattack Detection in Cyber-Physical Infrastructures
School of Computing and Augmented Intelligence, Arizona State University（计算与增强智能学院，亚利桑那州立大学）；Institute for Information Sciences, University of Kansas（信息科学研究所，堪萨斯大学）
Texas A&M University（德克萨斯A&M大学）；Arkansas State University（阿肯色州立大学）
As a highly complex and integrated cyber-physical system, modern power grids are exposed to cyberattacks. False data injection attacks (FDIAs), specifically, represent a major class of cyber threats to smart grids by targeting the measurement data's integrity. Although various solutions have been proposed to detect those cyberattacks, the vast majority of the works have ignored the inherent graph structure of the power grid measurements and validated their detectors only for small test systems with less than a few hundred buses. To better exploit the spatial correlations of smart grid measurem…
Electric power grids are evolving towards intellectualization such as Smart Grids or active-adaptive networks. Intelligent power network implies usage of sensors, smart meters, electronic devices and sophisticated communication network. This leads to a strong dependence on information and communication networking that are prone to threats of cyberattacks, which challenges power system reliability and efficiency. Thus, significant attention should be paid to the Smart Grids security. Recently, it has been proven that False Data Injection Attacks (FDIA) could corrupt results of State Estimation …
We propose a mathematical model based on probability theory to optimize COVID-19 testing by a multi-step batch testing approach with variable batch sizes. This model and simulation tool dramatically increase the efficiency and efficacy of the tests in a large population at a low cost, particularly when the infection rate is low. The proposed method combines statistical modeling with numerical methods to solve nonlinear equations and obtain optimal batch sizes at each step of tests, with the flexibility to incorporate geographic and demographic information. In theory, this method substantially …
Penn State University（宾夕法尼亚州立大学）；Qatar Computing Research Institute（卡塔尔计算研究所）
Autoencoder-based anomaly detection methods have been used in identifying anomalous users from large-scale enterprise logs with the assumption that adversarial activities do not follow past habitual patterns. Most existing approaches typically build models by reconstructing single-day and individual-user behaviors. However, without capturing long-term signals and group-correlation signals, the models cannot identify low-signal yet long-lasting threats, and will wrongly report many normal users as anomalies on busy days, which, in turn, lead to high false positive rate. In this paper, we propos…
Recent years have witnessed a rise in the frequency and intensity of cyberattacks targeted at critical infrastructure systems. This study designs a versatile, data-driven cyberattack detection platform for infrastructure systems cybersecurity, with a special demonstration in water sector. A deep generative model with variational inference autonomously learns normal system behavior and detects attacks as they occur. The model can process the natural data in its raw form and automatically discover and learn its representations, hence augmenting system knowledge discovery and reducing the need fo…
Connected vehicle (CV) systems are cognizant of potential cyber attacks because of increasing connectivity between its different components such as vehicles, roadside infrastructure, and traffic management centers. However, it is a challenge to detect security threats in real-time and develop appropriate or effective countermeasures for a CV system because of the dynamic behavior of such attacks, high computational power requirement, and a historical data requirement for training detection models. To address these challenges, statistical models, especially change point models, have potentials …
Over the last decade, the number of cyberattacks targeting power systems and causing physical and economic damages has increased rapidly. Among them, False Data Injection Attacks (FDIAs) is a class of cyberattacks against power grid monitoring systems. Adversaries can successfully perform FDIAs in order to manipulate the power system State Estimation (SE) by compromising sensors or modifying system data. SE is an essential process performed by the Energy Management System (EMS) towards estimating unknown state variables based on system redundant measurements and network topology. SE routines i…
We introduce a powerful recurrent neural network based method for novelty detection to the application of detecting radio anomalies. This approach holds promise in significantly increasing the ability of naive anomaly detection to detect small anomalies in highly complex complexity multi-user radio bands. We demonstrate the efficacy of this approach on a number of common real over the air radio communications bands of interest and quantify detection performance in terms of probability of detection an false alarm rates across a range of interference to band power ratios and compare to baseline …
Explainable Autoencoder-Based Anomaly Detection in IEC 61850 GOOSE Networks
Universidad Rey Juan Carlos（雷奥恩卡洛斯大学）；Red Eléctrica (REDEIA Group)（电力公司（REDEIA小组））；Centro de Investigación for Data, Complex Networks and Cybersecurity Sciences（数据、复杂网络和网络安全科学研究中心）
Large Language Model-Based Framework for Explainable Cyberattack Detection in Automatic Generation Control Systems
Department of Computer Science, College of Computing and Mathematical Sciences, Khalifa University（计算机科学系，计算与数学科学学院，哈利法大学）；ECE Department, University of Toronto（电子工程系，多伦多大学）；Concordia Institute for Information Systems Engineering (CIISE), Concordia University（信息系统工程研究所（CIISE），康科迪亚大学）；Department of Electrical Engineering, College of Engineering and Physical Sciences, Khalifa University（电气工程系，工程与物理科学学院，哈利法大学）
Cybersecurity of Industrial Control Systems (ICS) is drawing significant concerns as data communication increasingly leverages wireless networks. A lot of data-driven methods were developed for detecting cyberattacks, but few are focused on distinguishing them from equipment faults. In this paper, we develop a data-driven framework that can be used to detect, diagnose, and localize a type of cyberattack called covert attacks on smart grids. The framework has a hybrid design that combines an autoencoder, a recurrent neural network (RNN) with a Long-Short-Term-Memory (LSTM) layer, and a Deep Neu…
Modern electric power grid, known as the Smart Grid, has fast transformed the isolated and centrally controlled power system to a fast and massively connected cyber-physical system that benefits from the revolutions happening in the communications and the fast adoption of Internet of Things devices. While the synergy of a vast number of cyber-physical entities has allowed the Smart Grid to be much more effective and sustainable in meeting the growing global energy challenges, it has also brought with it a large number of vulnerabilities resulting in breaches of data integrity, confidentiality …
In cyberattack detection and prevention systems, cybersecurity analysts always prefer solutions that are as interpretable and understandable as rule-based or signature-based detection. This is because of the need to tune and optimize these solutions to mitigate and control the effect of false positives and false negatives. Interpreting machine learning models is a new and open challenge. However, it is expected that an interpretable machine learning solution will be domain-specific. For instance, interpretable solutions for machine learning models in healthcare are different than solutions in …
Smart Grid has rapidly transformed the centrally controlled power system into a massively interconnected cyber-physical system that benefits from the revolutions happening in the communications (e.g. 5G) and the growing proliferation of the Internet of Things devices (such as smart metres and intelligent electronic devices). While the convergence of a significant number of cyber-physical elements has enabled the Smart Grid to be far more efficient and competitive in addressing the growing global energy challenges, it has also introduced a large number of vulnerabilities culminating in violatio…
Secure vehicular communication is a critical factor for secure traffic management. Effective security in intelligent transportation systems (ITS) requires effective and timely intrusion detection systems (IDS). In this paper, we consider false data injection attacks and distributed denial-of-service (DDoS) attacks, especially the stealthy DDoS attacks, targeting the integrity and availability, respectively, in vehicular ad-hoc networks (VANET). Novel statistical intrusion detection and mitigation techniques based on centralized communications through roadside units (RSU) are proposed for the c…
Advanced persistent threats (APTs) are organized prolonged cyberattacks by sophisticated attackers. Although APT activities are stealthy, they interact with the system components and these interactions lead to information flows. Dynamic Information Flow Tracking (DIFT) has been proposed as one of the effective ways to detect APTs using the information flows. However, wide range security analysis using DIFT results in a significant increase in performance overhead and high rates of false-positives and false-negatives generated by DIFT. In this paper, we model the strategic interaction between A…
Port scanning refers to the systematic exploration of networked computing systems. The goal of port scanning is to identify active services and associated information. Although this technique is often employed by malicious actors to locate vulnerable systems within a network, port scanning is also a legitimate method employed by IT professionals to troubleshoot network issues and maintain system security. In the case of the latter, cybersecurity practitioners use port scanning catalog exposed systems, identify potential misconfigurations, or test controls that may be running on a system. Exist…
University of Windsor（温莎大学）；University of New Brunswick（新不伦瑞克大学）；Rensselaer Polytechnic Institute（伦斯勒理工学院）；New York Power Authority（纽约电力局）
This paper presents a novel data-driven framework to aid in system state estimation when the power system is under unobservable false data injection attacks. The proposed framework dynamically detects and classifies false data injection attacks. Then, it retrieves the control signal using the acquired information. This process is accomplished in three main modules, with novel designs, for detection, classification, and control signal retrieval. The detection module monitors historical changes in phasor measurements and captures any deviation pattern caused by an attack on a complex plane. This…
Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation
Wilmington University（威尔明顿大学）；Washington University of Science and Technology（华盛顿科技大学）；South Dakota School of Mines & Technology（南达科他矿业理工学院）；South Dakota State University（南达科他州立大学）；St. Francis College（圣弗朗西斯学院）；Stanton University（斯坦顿大学）
Connected vehicle (CV) systems are cognizant of potential cyber attacks because of increasing connectivity between its different components such as vehicles, roadside infrastructure and traffic management centers. However, it is a challenge to detect security threats in real-time and develop appropriate/effective countermeasures for a CV system because of the dynamic behavior of such attacks, high computational power requirement and a historical data requirement for training detection models. To address these challenges, statistical models, especially change point models, have potentials for r…
Intrusion Detection and/or Prevention Systems (IDPS) represent an important line of defence against a variety of attacks that can compromise the security and proper functioning of an enterprise information system. Along with the widespread evolution of new emerging services, the quantity and impact of attacks have continuously increased, attackers continuously find vulnerabilities at various levels, from the network itself to operating system and applications, exploit them to crack system and services. Network defence and network monitoring has become an essential component of computer securit…
Towards Ultra-Low Latency: Binarized Neural Network Architectures for In-Vehicle Network Intrusion Detection
Faculty of Information Technology and Security（信息科技与安全学院）；ITMO University（ITMO大学）；Laboratory of Computer Security Problems（计算机安全问题实验室）；St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS)（俄罗斯科学院圣彼得堡联邦科研中心（SPC RAS））
DAIRE: A lightweight AI model for real-time detection of Controller Area Network attacks in the Internet of Vehicles
Department of Information Security, College of Computer Science and Engineering, University of Ha’il（信息安全系，计算机科学与工程学院，哈伊尔大学）；Department of Computer Engineering, Center of Excellence in Artificial Intelligence, Bahria University（计算机工程系，人工智能卓越中心，巴赫里大学）；Department of Artificial Intelligence, College of Computer Science and Engineering, University of Ha’il（人工智能系，计算机科学与工程学院，哈伊尔大学）；Department of Computer Science, College of Computer Science and Engineering, University of Ha’il（计算机科学系，计算机科学与工程学院，哈伊尔大学）；Department of Software Engineering, College of Computer Science and Engineering, University of Ha’il（软件工程系，计算机科学与工程学院，哈伊尔大学）
Automotive systems continuously increase their dependency on Electronic Control Units (ECUs) and become more interconnected to improve safety, comfort and Advanced Driving Assistance Systems (ADAS) functions to passengers and drivers. As a consequence of that trend, there is an expanding attack surface which may potentially expose vehicle's critical functions to cyberattacks. It is possible for an adversary to reach the underlying Control Area Network (CAN) through a compromised node or external-facing network interface, and launch masquerading attacks that can compromise road and passenger sa…
