Optimization of Stealthwatch Network Security System for the Detection and Mitigation of Distributed Denial of Service (DDoS) Attack: Application to Smart Grid System

The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.

Central Aggregator Intrusion Detection System for Denial of Service Attacks

Vehicle-to-grid technology is an emerging field that allows unused power from Electric Vehicles(EVs)to be used by the smart grid through the central aggregator.Since the central aggregator is connected to the smart grid through a wireless network,it is prone to cyber-attacks that can be detected and mitigated using an intrusion detection system.However,existing intrusion detection systems cannot be used in the vehicle-to-grid network because of the special requirements and characteristics of the vehicle-to-grid network.In this paper,the effect of denial-of-service attacks of malicious electric vehicles on the central aggregator of the vehicle-to-grid network is investigated and an intrusion detection system for the vehicle-to-grid network is proposed.The proposed system,central aggregator–intrusion detection system(CA-IDS),works as a security gateway for EVs to analyze andmonitor incoming traffic for possible DoS attacks.EVs are registered with a Central Aggregator(CAG)to exchange authenticated messages,and malicious EVs are added to a blacklist for violating a set of predefined policies to limit their interaction with the CAG.A denial of service(DoS)attack is simulated at CAG in a vehicle-to-grid(V2G)network manipulating various network parameters such as transmission overhead,receiving capacity of destination,average packet size,and channel availability.The proposed system is compared with existing intrusion detection systems using different parameters such as throughput,jitter,and accuracy.The analysis shows that the proposed system has a higher throughput,lower jitter,and higher accuracy as compared to the existing schemes.

The History, Trend, Types, and Mitigation of Distributed Denial of Service Attacks

Over time, the world has transformed digitally and there is total dependence on the internet. Many more gadgets are continuously interconnected in the internet ecosystem. This fact has made the Internet a global information source for every being. Despite all this, attacker knowledge by cybercriminals has advanced and resulted in different attack methodologies on the internet and its data stores. This paper will discuss the origin and significance of Denial of Service (DoS) and Distributed Denial of Service (DDoS). These kinds of attacks remain the most effective methods used by the bad guys to cause substantial damage in terms of operational, reputational, and financial damage to organizations globally. These kinds of attacks have hindered network performance and availability. The victim’s network is flooded with massive illegal traffic hence, denying genuine traffic from passing through for authorized users. The paper will explore detection mechanisms, and mitigation techniques for this network threat.

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Cloud computing(CC)is an advanced technology that provides access to predictive resources and data sharing.The cloud environment represents the right type regarding cloud usage model ownership,size,and rights to access.It introduces the scope and nature of cloud computing.In recent times,all processes are fed into the system for which consumer data and cache size are required.One of the most security issues in the cloud environment is Distributed Denial of Ser-vice(DDoS)attacks,responsible for cloud server overloading.This proposed sys-tem ID3(Iterative Dichotomiser 3)Maximum Multifactor Dimensionality Posteriori Method(ID3-MMDP)is used to overcome the drawback and a rela-tively simple way to execute and for the detection of(DDoS)attack.First,the pro-posed ID3-MMDP method calls for the resources of the cloud platform and then implements the attack detection technology based on information entropy to detect DDoS attacks.Since because the entropy value can show the discrete or aggregated characteristics of the current data set,it can be used for the detection of abnormal dataflow,User-uploaded data,ID3-MMDP system checks and read risk measurement and processing,bug ratingfile size changes,orfile name changes and changes in the format design of the data size entropy value.Unique properties can be used whenever the program approaches any data error to detect abnormal data services.Finally,the experiment also verifies the DDoS attack detection capability algorithm.

Formalized Description of Distributed Denial of Service Attack

The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(

Modeling and Simulation of Low Rate of Denial of Service Attacks

The low-rate denial of service attack is more applicable to the network in recent years as a means of attack, which is different from the traditional field type DoS attacks at the network end system or network using adaptive mechanisms exist loopholes flow through the low-rate periodic attacks on the implementation of high-efficiency attacked by an intruder and not be found, resulting in loss of user data or a computer deadlock. LDos attack since there has been extensive attention of researchers, the attack signature analysis and detection methods to prevent network security have become an important research topic. Some have been proposed for the current attacks were classified LDoS describe and model, and then in NS-2 platform for experimental verification, and then LDoS attack detection to prevent difficulties are discussed and summarized for the future such attacks detection method research work to provide a reference.

Detecting and Mitigating DDOS Attacks in SDNs Using Deep Neural Network

Distributed denial of service(DDoS)attack is the most common attack that obstructs a network and makes it unavailable for a legitimate user.We proposed a deep neural network(DNN)model for the detection of DDoS attacks in the Software-Defined Networking(SDN)paradigm.SDN centralizes the control plane and separates it from the data plane.It simplifies a network and eliminates vendor specification of a device.Because of this open nature and centralized control,SDN can easily become a victim of DDoS attacks.We proposed a supervised Developed Deep Neural Network(DDNN)model that can classify the DDoS attack traffic and legitimate traffic.Our Developed Deep Neural Network(DDNN)model takes a large number of feature values as compared to previously proposed Machine Learning(ML)models.The proposed DNN model scans the data to find the correlated features and delivers high-quality results.The model enhances the security of SDN and has better accuracy as compared to previously proposed models.We choose the latest state-of-the-art dataset which consists of many novel attacks and overcomes all the shortcomings and limitations of the existing datasets.Our model results in a high accuracy rate of 99.76%with a low false-positive rate and 0.065%low loss rate.The accuracy increases to 99.80%as we increase the number of epochs to 100 rounds.Our proposed model classifies anomalous and normal traffic more accurately as compared to the previously proposed models.It can handle a huge amount of structured and unstructured data and can easily solve complex problems.

Game-theoretical Model for Dynamic Defense Resource Allocation in Cyber-physical Power Systems Under Distributed Denial of Service Attacks

Electric power grids are evolving into complex cyber-physical power systems(CPPSs)that integrate advanced information and communication technologies(ICTs)but face increasing cyberspace threats and attacks.This study considers CPPS cyberspace security under distributed denial of service(DDoS)attacks and proposes a nonzero-sum game-theoretical model with incomplete information for appropriate allocation of defense resources based on the availability of limited resources.Task time delay is applied to quantify the expected utility as CPPSs have high time requirements and incur massive damage DDoS attacks.Different resource allocation strategies are adopted by attackers and defenders under the three cases of attack-free,failed attack,and successful attack,which lead to a corresponding consumption of resources.A multidimensional node value analysis is designed to introduce physical and cybersecurity indices.Simulation experiments and numerical results demonstrate the effectiveness of the proposed model for the appropriate allocation of defense resources in CPPSs under limited resource availability.

The detection method of low-rate DoS attack based on multi-feature fusion

As a new type of Denial of Service(DoS)attacks,the Low-rate Denial of Service(LDoS)attacks make the traditional method of detecting Distributed Denial of Service Attack(DDoS)attacks useless due to the characteristics of a low average rate and concealment.With features extracted from the network traffic,a new detection approach based on multi-feature fusion is proposed to solve the problem in this paper.An attack feature set containing the Acknowledge character(ACK)sequence number,the packet size,and the queue length is used to classify normal and LDoS attack traffics.Each feature is digitalized and preprocessed to fit the input of the K-Nearest Neighbor(KNN)classifier separately,and to obtain the decision contour matrix.Then a posteriori probability in the matrix is fused,and the fusion decision index D is used as the basis of detecting the LDoS attacks.Experiments proved that the detection rate of the multi-feature fusion algorithm is higher than those of the single-based detection method and other algorithms.

Stochastic DoS Attack Allocation Against Collaborative Estimation in Sensor Networks

In this paper,denial of service(DoS)attack management for destroying the collaborative estimation in sensor networks and minimizing attack energy from the attacker perspective is studied.In the communication channels between sensors and a remote estimator,the attacker chooses some channels to randomly jam DoS attacks to make their packets randomly dropped.A stochastic power allocation approach composed of three steps is proposed.Firstly,the minimum number of channels and the channel set to be attacked are given.Secondly,a necessary condition and a sufficient condition on the packet loss probabilities of the channels in the attack set are provided for general and special systems,respectively.Finally,by converting the original coupling nonlinear programming problem to a linear programming problem,a method of searching attack probabilities and power to minimize the attack energy is proposed.The effectiveness of the proposed scheme is verified by simulation examples.

Vulnerability Assessment of Distributed Load Shedding Algorithm for Active Distribution Power System Under Denial of Service Attack

In order to deal with frequency deviation andsupply-demand imbalance in active distribution power system, inthis paper a distributed under frequency load shedding (UFLS)strategy is proposed. Different from conventional centralizedUFLS schemes, no centralized master station gathering all thebuses’ information is required. Instead, each bus decides itsown load shedding amount by only relying on limited peer-topeer communication. However, such UFLS strategy may sufferfrom some unexpected cyber-attacks such as integrity attacksand denial of service (DoS) attack. The latter DoS attack aimsto degrade the system performance by jamming or breakingthe communication, which is of high probability to happen inpractical power system. To assess the vulnerability of proposeddistributed UFLS algorithm, the effect of DoS attack on distributed average consensus algorithm is theoretically derived,which indicates that the final consensus value can be estimatedby a given attack probability. It is also investigated that such DoSattack does harm to the load shedding amount and finally affectsthe system frequency performance in the active distributionpower system. Several case studies implemented on an IEEE33-bus active distribution power system are conducted to verifythe effectiveness of the theoretical findings and investigate thevulnerability of the considered power system.

Packet track and traceback mechanism against denial of service attacks

The denial of service attack is a main type of threat on the Internet today. On the basis of path identification （Pi） and Internet control message protocol （ICMP） traceback （iTrace） methods, a packet track and traceback mechanism is proposed, which features rapid response and high accuracy. In this scheme, routers apply packet marking scheme and send traceback messages, which enables the victim to design the path tree in peace time. During attack times the victim can trace attackers back within the path tree and perform rapid packet filtering using the marking in each packet. Traceback messages overcome Pi＇s limitation, wherein too much path information is lost in path identifiers; whereas path identifiers can be used to expedite the design of the path-tree, which reduces the high overhead in iTrace. Therefore, our scheme not only synthesizes the advantages but also compromises the disadvantages of the above two methods. Simulation results with NS-2 show the validity of our scheme.

R-IDPS: Real Time SDN-Based IDPS System for IoT Security

The advent of the latest technologies like the Internet of things(IoT)transforms the world from a manual to an automated way of lifestyle.Meanwhile,IoT sector open numerous security challenges.In traditional networks,intrusion detection and prevention systems(IDPS)have been the key player in the market to ensure security.The challenges to the conventional IDPS are implementation cost,computing power,processing delay,and scalability.Further,online machine learning model training has been an issue.All these challenges still question the IoT network security.There has been a lot of research for IoT based detection systems to secure the IoT devices such as centralized and distributed architecture-based detection systems.The centralized system has issues like a single point of failure and load balancing while distributed system design has scalability and heterogeneity hassles.In this study,we design and develop an agent-based hybrid prevention system based on software-defined networking(SDN)technology.The system uses lite weight agents with the ability to scaleup for bigger networks and is feasible for heterogeneous IoT devices.The baseline profile for the IoT devices has been developed by analyzing network flows from all the IoT devices.This profile helps in extracting IoT device features.These features help in the development of our dataset that we use for anomaly detection.For anomaly detection,support vector machine has been used to detect internet control message protocol(ICMP)flood and transmission control protocol synchronize(TCP SYN)flood attacks.The proposed system based on machine learning model is fully capable of online and offline training.Other than detection accuracy,the system can fully mitigate the attacks using the software-defined technology SDN technology.The major goal of the research is to analyze the accuracy of the hybrid agent-based intrusion detection systems as compared to conventional centralized only solutions,especially under the flood attack conditions generated by the distributed denial of service(DDoS)attacks.The system shows 97%to 99%accuracy in simulated results with no false-positive alarm.Also,the system shows notable improvement in terms of resource utilization and performance under attack scenarios. The R-IDPS is scalable, and thesystem is suitable for heterogeneous IoT devices and networks.

System identification with binary-valued observations under both denial-of-service attacks and data tampering attacks:defense scheme and its optimality

In this paper,we investigate the defense problem against the joint attacks of denial-of-service attacks and data tampering attacks in the framework of system identification with binary-valued observations.By estimating the key parameters of the joint attack and compensating them in the identification algorithm,a compensation-oriented defense scheme is proposed.Then the identification algorithm of system parameter is designed and is further proved to be consistent.The asymptotic normality of the algorithm is obtained,and on this basis,we propose the optimal defense scheme.Furthermore,the implementation of the optimal defense scheme is discussed.Finally,a simulation example is presented to verify the effectiveness of the main results.

HDLIDP: A Hybrid Deep Learning Intrusion Detection and Prevention Framework

Distributed denial-of-service(DDoS)attacks are designed to interrupt network services such as email servers and webpages in traditional computer networks.Furthermore,the enormous number of connected devices makes it difficult to operate such a network effectively.Software defined networks(SDN)are networks that are managed through a centralized control system,according to researchers.This controller is the brain of any SDN,composing the forwarding table of all data plane network switches.Despite the advantages of SDN controllers,DDoS attacks are easier to perpetrate than on traditional networks.Because the controller is a single point of failure,if it fails,the entire network will fail.This paper offers a Hybrid Deep Learning Intrusion Detection and Prevention(HDLIDP)framework,which blends signature-based and deep learning neural networks to detect and prevent intrusions.This framework improves detection accuracy while addressing all of the aforementioned problems.To validate the framework,experiments are done on both traditional and SDN datasets;the findings demonstrate a significant improvement in classification accuracy.

Performance of unique and secure routing protocol(USRP)in flying Adhoc Networks for healthcare applications

Nowadays,Flying Adhoc Networks play a vital role due to its high efficiency in fast communication.Unmanned aerial vehicles transmit data much faster than other networks and are useful in all aspects of communication.In healthcare applications,wireless body area network transmits the data,whereas the security,which is the most important concern to be focused in a flying adhoc network is not satisfactory.Many intruders tamper the network,degrading the overall network performance.To avoid security issues,a unique and secure routing protocol that provides a single solution for five different types of attacks such as,black hole attacks,grey hole attacks,yoyo attacks,conjoint attack and jamming attacks,is proposed.The simulation results analyses the network performance by using the proposed routing table.In comparison to the other solutions rendered to resolve the affected network,this proposed routing protocol has a higher throughput,higher delivery rate,and lower delay.The Unique and Secure Routing Protocol(USRP)provides an integrated solution for an efficient and secure communication in a flying adhoc network.

Resilient distributed economic dispatch of a cyber-power system under DoS attack

The economic dispatch problem of a smart grid under vicious denial of service(DoS)is the main focus of this paper.Taking the actual situation of power generation as a starting point,a new distributed optimization model is established which takes the environmentai pollution penalty into account.For saving the limited bandwidth,a novel distributed event-triggered scheme is proposed to keep the resilience and economy of a class of cyber-power syst ems when the communication net work is subject to malicious DoS attack.Then an improved multi-agent consensus protocol based on the gradient descent idea is designed to solve the minimization problem,and the prerequisites to minimize the system power generation cost are analyzed from the aspects of optimality and stability.Finally,the theoretical results are verified through a single-area 10-generat or unit simulation.