The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communicati...The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.展开更多
DDoS(Distributed Denial of Service),即"分布式拒绝服务"攻击,DDoS攻击的本质是通过不对等的方式,对目标机发出非正常服务要求,耗尽目标机本身的资源,使其无法提供正常服务,具有较大的危害性。传统的基于流量分析和阈值策...DDoS(Distributed Denial of Service),即"分布式拒绝服务"攻击,DDoS攻击的本质是通过不对等的方式,对目标机发出非正常服务要求,耗尽目标机本身的资源,使其无法提供正常服务,具有较大的危害性。传统的基于流量分析和阈值策略的防范机制使用单阈值或双阈值来判断攻击行为,虽然可以较为便捷地实现DDoS防范,然而这样也导致防范精度较低。文中针对基于流量阈值的基础上提出反馈型多阈值过滤机制,通过建立将回收圈的统计数据反馈给阈值的计算机制,有效地提高了攻击防范精度。仿真实验证明,该系统相对于以前的技术,其具备较高的防范精度。展开更多
为提高分布式拒绝服务(Distributed Denial of Service,DDoS)攻击检出率,设计基于机器学习的无线网络DDoS攻击检测方法。首先,结合攻击时间序列构建无线网络DDoS攻击检测模型,利用深度学习设计无线网络DDoS攻击检测机制;其次,通过异常...为提高分布式拒绝服务(Distributed Denial of Service,DDoS)攻击检出率,设计基于机器学习的无线网络DDoS攻击检测方法。首先,结合攻击时间序列构建无线网络DDoS攻击检测模型,利用深度学习设计无线网络DDoS攻击检测机制;其次,通过异常流量判断,对照相应的流表特征信息完成分类检测;最后,进行实验分析。实验结果表明,该方法的DDoS攻击检出率较低,优于对照组。展开更多
在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥...在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥事件检测的分析不论是对预防恶意流量还是电子数据取证都至关重要。提出一种SDN中基于流特征的多类型DDoS攻击和闪拥流量检测方法,其中可调节的φ-熵增加不同数据类型间的距离以便在流形成初期及时发现攻击行为。对一些常见的DDoS攻击方式进行详细分析,并通过获取交换机中流表的多维特征对样本进行训练分类,在有效检测DDoS攻击流量的同时还能在一定程度上区分DDoS攻击与闪拥事件。通过Mininet平台进行仿真实验,实验表明,该方法可以有效提高DDoS攻击检测率并降低闪拥事件误报率,验证了实验的准确性和有效性。展开更多
With the rapid development of the sixth generation(6G)network and Internet of Things(IoT),it has become extremely challenging to efficiently detect and prevent the distributed denial of service(DDoS)attacks originatin...With the rapid development of the sixth generation(6G)network and Internet of Things(IoT),it has become extremely challenging to efficiently detect and prevent the distributed denial of service(DDoS)attacks originating from IoT devices.In this paper we propose an innovative trust model for IoT devices to prevent potential DDoS attacks by evaluating their trustworthiness,which can be deployed in the access network of 6G IoT.Based on historical communication behaviors,this model combines spatial trust and temporal trust values to comprehensively characterize the normal behavior patterns of IoT devices,thereby effectively distinguishing attack traffic.Experimental results show that the proposed method can efficiently distinguish normal traffic from DDoS traffic.Compared with the benchmark methods,our method has advantages in terms of both accuracy and efficiency in identifying attack flows.展开更多
文摘The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.
文摘DDoS(Distributed Denial of Service),即"分布式拒绝服务"攻击,DDoS攻击的本质是通过不对等的方式,对目标机发出非正常服务要求,耗尽目标机本身的资源,使其无法提供正常服务,具有较大的危害性。传统的基于流量分析和阈值策略的防范机制使用单阈值或双阈值来判断攻击行为,虽然可以较为便捷地实现DDoS防范,然而这样也导致防范精度较低。文中针对基于流量阈值的基础上提出反馈型多阈值过滤机制,通过建立将回收圈的统计数据反馈给阈值的计算机制,有效地提高了攻击防范精度。仿真实验证明,该系统相对于以前的技术,其具备较高的防范精度。
文摘为提高分布式拒绝服务(Distributed Denial of Service,DDoS)攻击检出率,设计基于机器学习的无线网络DDoS攻击检测方法。首先,结合攻击时间序列构建无线网络DDoS攻击检测模型,利用深度学习设计无线网络DDoS攻击检测机制;其次,通过异常流量判断,对照相应的流表特征信息完成分类检测;最后,进行实验分析。实验结果表明,该方法的DDoS攻击检出率较低,优于对照组。
文摘在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥事件检测的分析不论是对预防恶意流量还是电子数据取证都至关重要。提出一种SDN中基于流特征的多类型DDoS攻击和闪拥流量检测方法,其中可调节的φ-熵增加不同数据类型间的距离以便在流形成初期及时发现攻击行为。对一些常见的DDoS攻击方式进行详细分析,并通过获取交换机中流表的多维特征对样本进行训练分类,在有效检测DDoS攻击流量的同时还能在一定程度上区分DDoS攻击与闪拥事件。通过Mininet平台进行仿真实验,实验表明,该方法可以有效提高DDoS攻击检测率并降低闪拥事件误报率,验证了实验的准确性和有效性。
基金This work was supported in part by the National Key R&D Program of China under Grant 2020YFA0711301in part by the National Natural Science Foundation of China under Grant 61922049,and Grant 61941104in part by the Tsinghua University-China Mobile Communications Group Company Ltd.,Joint Institute.
文摘With the rapid development of the sixth generation(6G)network and Internet of Things(IoT),it has become extremely challenging to efficiently detect and prevent the distributed denial of service(DDoS)attacks originating from IoT devices.In this paper we propose an innovative trust model for IoT devices to prevent potential DDoS attacks by evaluating their trustworthiness,which can be deployed in the access network of 6G IoT.Based on historical communication behaviors,this model combines spatial trust and temporal trust values to comprehensively characterize the normal behavior patterns of IoT devices,thereby effectively distinguishing attack traffic.Experimental results show that the proposed method can efficiently distinguish normal traffic from DDoS traffic.Compared with the benchmark methods,our method has advantages in terms of both accuracy and efficiency in identifying attack flows.
