Network security equipment is crucial to information systems, and a proper evaluation model can ensure the quality of network security equipment. However, there is only a few models of comprehensive models nowadays. A...Network security equipment is crucial to information systems, and a proper evaluation model can ensure the quality of network security equipment. However, there is only a few models of comprehensive models nowadays. An index system for network security equipment was established and a model based on attack tree with risk fusion was proposed to obtain the score of qualitative indices. The proposed model implements attack tree model and controlled interval and memory(CIM) model to solve the problem of quantifying qualitative indices, and thus improves the accuracy of the evaluation.展开更多
Intrusion detection systems are increasingly using machine learning.While machine learning has shown excellent performance in identifying malicious traffic,it may increase the risk of privacy leakage.This paper focuse...Intrusion detection systems are increasingly using machine learning.While machine learning has shown excellent performance in identifying malicious traffic,it may increase the risk of privacy leakage.This paper focuses on imple-menting a model stealing attack on intrusion detection systems.Existing model stealing attacks are hard to imple-ment in practical network environments,as they either need private data of the victim dataset or frequent access to the victim model.In this paper,we propose a novel solution called Fast Model Stealing Attack(FMSA)to address the problem in the field of model stealing attacks.We also highlight the risks of using ML-NIDS in network security.First,meta-learning frameworks are introduced into the model stealing algorithm to clone the victim model in a black-box state.Then,the number of accesses to the target model is used as an optimization term,resulting in minimal queries to achieve model stealing.Finally,adversarial training is used to simulate the data distribution of the target model and achieve the recovery of privacy data.Through experiments on multiple public datasets,compared to existing state-of-the-art algorithms,FMSA reduces the number of accesses to the target model and improves the accuracy of the clone model on the test dataset to 88.9%and the similarity with the target model to 90.1%.We can demonstrate the successful execution of model stealing attacks on the ML-NIDS system even with protective measures in place to limit the number of anomalous queries.展开更多
Wireless sensor networks （WSNs） are often deployed in harsh environments. Thus adversaries can capture some nodes, replicate them and deploy those replicas back into the strategic positions in the network to launch ...Wireless sensor networks （WSNs） are often deployed in harsh environments. Thus adversaries can capture some nodes, replicate them and deploy those replicas back into the strategic positions in the network to launch a variety of attacks. These are referred to as node replication attacks. Some methods of defending against node replication attacks have been proposed, yet they are not very suitable for the mobile wireless sensor networks. In this paper, we propose a new protocol to detect the replicas in mobile WSNs. In this protocol, polynomial-based pair-wise key pre-distribution scheme and Counting Bloom Filters are used to guarantee that the replicas can never lie about their real identifiers and collect the number of pair-wise keys established by each sensor node. Replicas are detected by looking at whether the number of pair-wise keys established by them exceeds the threshold. We also derive accurate closed form expression for the expected number of pair-wise keys established by each node, under commonly used random waypoint model. Analyses and simulations verify that the protocol accurately detects the replicas in the mobile WSNs and supports their removal.展开更多
Water management infrastructures such as floodgates are critical and increasingly operated by Industrial Control Systems(ICS).These systems are becoming more connected to the internet,either directly or through the co...Water management infrastructures such as floodgates are critical and increasingly operated by Industrial Control Systems(ICS).These systems are becoming more connected to the internet,either directly or through the corporate networks.This makes them vulnerable to cyber-attacks.Abnormal behaviour in floodgates operated by ICS could be caused by both(intentional)attacks and(accidental)technical failures.When operators notice abnormal behaviour,they should be able to distinguish between those two causes to take appropriate measures,because for example replacing a sensor in case of intentional incorrect sensor measurements would be ineffective and would not block corresponding the attack vector.In the previous work,we developed the attack-failure distinguisher framework for constructing Bayesian Network(BN)models to enable operators to distinguish between those two causes,including the knowledge elicitation method to construct the directed acyclic graph and conditional probability tables of BN models.As a full case study of the attack-failure distinguisher framework,this paper presents a BN model constructed to distinguish between attacks and technical failures for the problem of incorrect sensor measurements in floodgates,addressing the problem of floodgate operators.We utilised experts who associate themselves with the safety and/or security community to construct the BN model and validate the qualitative part of constructed BN model.The constructed BN model is usable in water management infrastructures to distinguish between intentional attacks and accidental technical failures in case of incorrect sensor measurements.This could help to decide on appropriate response strategies and avoid further complications in case of incorrect sensor measurements.展开更多
基金The Research of Key Technology and Application of Information Security Certification Project(No.2016YFF0204001)
文摘Network security equipment is crucial to information systems, and a proper evaluation model can ensure the quality of network security equipment. However, there is only a few models of comprehensive models nowadays. An index system for network security equipment was established and a model based on attack tree with risk fusion was proposed to obtain the score of qualitative indices. The proposed model implements attack tree model and controlled interval and memory(CIM) model to solve the problem of quantifying qualitative indices, and thus improves the accuracy of the evaluation.
基金supported by Grant Nos.U22A2036,HIT.OCEF.2021007,2020YFB1406902,2020B0101360001.
文摘Intrusion detection systems are increasingly using machine learning.While machine learning has shown excellent performance in identifying malicious traffic,it may increase the risk of privacy leakage.This paper focuses on imple-menting a model stealing attack on intrusion detection systems.Existing model stealing attacks are hard to imple-ment in practical network environments,as they either need private data of the victim dataset or frequent access to the victim model.In this paper,we propose a novel solution called Fast Model Stealing Attack(FMSA)to address the problem in the field of model stealing attacks.We also highlight the risks of using ML-NIDS in network security.First,meta-learning frameworks are introduced into the model stealing algorithm to clone the victim model in a black-box state.Then,the number of accesses to the target model is used as an optimization term,resulting in minimal queries to achieve model stealing.Finally,adversarial training is used to simulate the data distribution of the target model and achieve the recovery of privacy data.Through experiments on multiple public datasets,compared to existing state-of-the-art algorithms,FMSA reduces the number of accesses to the target model and improves the accuracy of the clone model on the test dataset to 88.9%and the similarity with the target model to 90.1%.We can demonstrate the successful execution of model stealing attacks on the ML-NIDS system even with protective measures in place to limit the number of anomalous queries.
基金supported by the National Natural Science Foundation of China under Grant No.90818007the National High Technology Research and Development 863 Program of China under Grant No.2009AA01Z203
文摘Wireless sensor networks （WSNs） are often deployed in harsh environments. Thus adversaries can capture some nodes, replicate them and deploy those replicas back into the strategic positions in the network to launch a variety of attacks. These are referred to as node replication attacks. Some methods of defending against node replication attacks have been proposed, yet they are not very suitable for the mobile wireless sensor networks. In this paper, we propose a new protocol to detect the replicas in mobile WSNs. In this protocol, polynomial-based pair-wise key pre-distribution scheme and Counting Bloom Filters are used to guarantee that the replicas can never lie about their real identifiers and collect the number of pair-wise keys established by each sensor node. Replicas are detected by looking at whether the number of pair-wise keys established by them exceeds the threshold. We also derive accurate closed form expression for the expected number of pair-wise keys established by each node, under commonly used random waypoint model. Analyses and simulations verify that the protocol accurately detects the replicas in the mobile WSNs and supports their removal.
基金the Netherlands Organization for Scientific Research(NWO)in the framwork of the Cyber Security research program under the project“Secure Our Safety:Building Cyber Security for Flood Management(SOS4Flood)”.
文摘Water management infrastructures such as floodgates are critical and increasingly operated by Industrial Control Systems(ICS).These systems are becoming more connected to the internet,either directly or through the corporate networks.This makes them vulnerable to cyber-attacks.Abnormal behaviour in floodgates operated by ICS could be caused by both(intentional)attacks and(accidental)technical failures.When operators notice abnormal behaviour,they should be able to distinguish between those two causes to take appropriate measures,because for example replacing a sensor in case of intentional incorrect sensor measurements would be ineffective and would not block corresponding the attack vector.In the previous work,we developed the attack-failure distinguisher framework for constructing Bayesian Network(BN)models to enable operators to distinguish between those two causes,including the knowledge elicitation method to construct the directed acyclic graph and conditional probability tables of BN models.As a full case study of the attack-failure distinguisher framework,this paper presents a BN model constructed to distinguish between attacks and technical failures for the problem of incorrect sensor measurements in floodgates,addressing the problem of floodgate operators.We utilised experts who associate themselves with the safety and/or security community to construct the BN model and validate the qualitative part of constructed BN model.The constructed BN model is usable in water management infrastructures to distinguish between intentional attacks and accidental technical failures in case of incorrect sensor measurements.This could help to decide on appropriate response strategies and avoid further complications in case of incorrect sensor measurements.
文摘随着电网信息层和物理层的不断融通发展,信息流交互频繁,电力信息物理系统(CPS)面临巨大安全挑战,针对信息层的网络攻击传播至物理层,极易导致整个电力系统的崩溃。基于电力CPS的双层耦合结构,运用传播演化理论建立了一类新型的SIA IB RA RB网络攻击传播模型,描述了网络攻击在电力网络节点中的传播行为。运用动力学分析方法分析网络攻击对电力CPS的攻击力和影响范围,提供预判网络攻击破坏力的具体算法;运用偏秩相关系数法和三维关联偏微分方法对系统参数进行敏感度分析,研究发现电力CPS的网络结构和传播概率对网络安全性至关重要,通过2个仿真模拟验证了上述理论结果的正确性。以南方电网有限公司历次典型设计和典型造价为例,梳理了电力系统网络安全防护体系实际建设费用变化趋势,建议从3个角度对安全防护体系进行精准定位建设,在降低电力CPS造价成本的同时保证系统的安全性。研究结果可为电网防御者在信息物理协同攻击威胁下制定新的防御方案提供参考。
