An Analysis of Cybersecurity Attacks against Internet of Things and Security Solutions

Internet of Things (IoT) has become a prevalent topic in the world of technology. It helps billion of devices to connect to the internet so that they can exchange data with each other. Nowadays, the IoT can be applied in anything, from cellphones, coffee makers, cars, body sensors to smart surveillance, water distribution, energy management system, and environmental monitoring. However, the rapid growth of IoT has brought new and critical threats to the security and privacy of the users. Due to the millions of insecure IoT devices, an adversary can easily break into an application to make it unstable and steal sensitive user information and data. This paper provides an overview of different kinds of cybersecurity attacks against IoT devices as well as an analysis of IoT architecture. It then discusses the security solutions we can take to protect IoT devices against different kinds of security attacks. The main goal of this research is to enhance the development of IoT research by highlighting the different kinds of security challenges that IoT is facing nowadays, and the existing security solutions we can implement to make IoT devices more secure. In this study, we analyze the security solutions of IoT in three forms: secure authentication, secure communications, and application security to find suitable security solutions for protecting IoT devices.

Intelligent Detection and Identification of Attacks in IoT Networks Based on the Combination of DNN and LSTM Methods with a Set of Classifiers

Internet of Things (IoT) networks present unique cybersecurity challenges due to their distributed and heterogeneous nature. Our study explores the effectiveness of two types of deep learning models, long-term memory neural networks (LSTMs) and deep neural networks (DNNs), for detecting attacks in IoT networks. We evaluated the performance of six hybrid models combining LSTM or DNN feature extractors with classifiers such as Random Forest, k-Nearest Neighbors and XGBoost. The LSTM-RF and LSTM-XGBoost models showed lower accuracy variability in the face of different types of attack, indicating greater robustness. The LSTM-RF and LSTM-XGBoost models show variability in results, with accuracies between 58% and 99% for attack types, while LSTM-KNN has higher but more variable accuracies, between 72% and 99%. The DNN-RF and DNN-XGBoost models show lower variability in their results, with accuracies between 59% and 99%, while DNN-KNN has higher but more variable accuracies, between 71% and 99%. LSTM-based models are proving to be more effective for detecting attacks in IoT networks, particularly for sophisticated attacks. However, the final choice of model depends on the constraints of the application, taking into account a trade-off between accuracy and complexity.

基于复杂网络理论的Internet抗毁性研究

针对Internet这一典型的复杂网络,依据TCP拥塞控制协议能重新调整数据流流速的特性,提出了一种新的抗毁性测度方法,并在流速可变的通信模型下对Internet进行了抗毁性研究,仿真结果表明Internet仍然具有鲁棒且脆弱性;然后分析了Internet在不完全信息下和基于局部网络拓扑信息的分布式攻击下的抗毁性,并且提出了相应的保护措施,仿真结果表明,不同情况下的不完全信息会对有目的攻击的攻击效率产生不同程度的影响,而基于局部信息的攻击可以达到有目的攻击的攻击效率,该结果对制订高效的Internet攻击(保护)策略具有重要意义。

INTERNET上的网络漏洞及安全维护技巧

本文较详细地介绍了Internet网上的一些网络攻击行为 ,从服务器程序的BUG ,操作系统的漏洞 ,Java语言的隐患 ,TCP/IP协议的一些缺陷等方面讨论了网络攻击的各种方式 ,并提出了增强网络安全性的一些建议 ,目的在于提醒网络管理员及个人用户提高安全意识 ,使更多人能安全地享受INTERNET带来的便利。

A Robustness Model of Complex Networks with Tunable Attack Information Parameter

We introduce a novel model for robustness of complex with a tunable attack information parameter. The random failure and intentional attack known are the two extreme cases of our model. Based on the model, we study the robustness of complex networks under random information and preferential information, respectively. Using the generating function method, we derive the exact value of the critical removal fraction of nodes for the disintegration of networks and the size of the giant component. We show that hiding just a small fraction of nodes randomly can prevent a scale-free network from collapsing and detecting just a small fraction of nodes preferentially can destroy a scale-free network.

Apple’s Lion vs Microsoft’s Windows 7: Comparing Built-In Protection against ICMP Flood Attacks

With the increase in the number of computers connected to Internet, the number of Distributed Denial of Service (DDoS) attacks has also been increasing. A DDoS attack consumes the computing resources of a computer or a server, by degrading its computing performance or by preventing legitimate users from accessing its services. Recently, Operating Systems (OS) are increasingly deploying embedded DDoS prevention schemes to prevent computing exhaustion caused by such attacks. In this paper, we compare the effectiveness of two popular operating systems, namely the Apple’s Lion and Microsoft’s Windows 7, against DDoS attacks. We compare the computing performance of these operating systems under two ICMP based DDoS attacks. Since the role of the OS is to manage the computer or servers resources as efficiently as possible, in this paper we investigate which OS manages its computing resources more efficiently. In this paper, we evaluate and compare the built-in security of these two operating systems by using an iMac computer which is capable of running both Windows 7 and Lion. The DDoS attacks that are simulated for this paper are the ICMP Ping and Land Attack. For this experiment, we measure the exhaustion of the processors and the number of Echo Request and Echo Reply messages that were generated under varying attack loads for both the Ping and Land Attack. From our experiments, we found that both operating systems were able to survive the attacks however they reacted a bit differently under attack. The Operating System Lion was handling both the Ping and Land attack in the exactly the same way, whereas Windows 7 handled the two attacks a bit differently, resulting in different processor consumptions by two different operating systems.

Security and Privacy Concerns over IoT Devices Attacks in Smart Cities (2022)

Due to the long-term goal of bringing about significant changes in the quality of services supplied to smart city residents and urban environments and life, the development and deployment of ICT in city infrastructure has spurred interest in smart cities. Applications for smart cities can gather private data in a variety of fields. Different sectors such as healthcare, smart parking, transportation, traffic systems, public safety, smart agriculture, and other sectors can control real-life physical objects and deliver intelligent and smart information to citizens who are the users. However, this smart ICT integration brings about numerous concerns and issues with security and privacy for both smart city citizens and the environments they are built in. The main uses of smart cities are examined in this journal article, along with the security needs for IoT systems supporting them and the identified important privacy and security issues in the smart city application architecture. Following the identification of several security flaws and privacy concerns in the context of smart cities, it then highlights some security and privacy solutions for developing secure smart city systems and presents research opportunities that still need to be considered for performance improvement in the future.

对LoRa网络的攻击与防御技术综述

由于LoRa技术具有通信距离长、功耗低和可扩展性强等优点,LoRa网络已成为低功耗网络(low power wide area network, LPWAN)领域中应用最广泛的技术之一,但其日益增多和丰富的应用场景也给LoRa网络的安全性提出了新的挑战。针对目前有关LoRa网络攻防手段的综述文献缺乏综合性讨论的问题,进行了详细的调研。首先分析了LoRa网络架构,归纳总结了LoRaWAN协议多个版本之间的安全性差异;其次通过对大量文献的研读,分析了针对LoRa网络攻击和防御的相关技术;在此基础上,提出了一种基于生成式AI的抗射频指纹识别机制—GAI-Anti-RFFI;最后对LoRa网络的攻击与防御技术未来可能面临的发展方向进行了分析并提出了展望。

基于梯度回溯的联邦学习搭便车攻击检测

随着车联网的发展,快速增长的智能汽车产生了海量的用户数据.这些海量的数据对训练智能化的车联网应用模型有极高的价值.传统的智能模型训练需要在云端集中式地收集原始数据,这将消耗大量通信资源并存在隐私泄露和监管限制等问题.联邦学习提供了一种模型传输代替数据传输的分布式训练范式用于解决此类问题.然而,在实际的联邦学习系统中,存在恶意用户通过伪造本地模型骗取服务器奖励的情况,即搭便车攻击.搭便车攻击严重破坏了联邦学习的公平性,影响联邦学习的训练效果.目前的研究假设搭便车攻击行为只存在于少量的理性用户中.然而,当存在多个恶意搭便车攻击者时,当前的研究无法有效地检测和防御这些攻击者.为此,提出了一种基于梯度回溯的搭便车攻击检测算法.该算法在正常的联邦学习中随机引入测试轮,通过对比单个用户在测试轮和基准轮模型梯度的相似度,解决了多个恶意搭便车用户场景中防御失效的问题.在MNIST和CIFAR-10数据集上的实验结果表明,提出的算法在多种搭便车攻击情境下都能实现出色的检测性能.

随机空间几何构型下物联网络攻击节点定位

物联网各节点形成的空间几何构型随机性,决定了攻击节点的空间分辨率出现较大波动,继而影响攻击节点的定位精度。针对物联网下各节点形成的空间几何构型随机性,利用节点脉冲和功率的关联属性不受空间几何构型影响的特征,设计一种攻击节点定位算法。定位算法检测节点脉冲信号,设计最优功率关联算法,关联功率与脉冲的属性。通过关联属性构建节点距离测算定位方法。实验结果表明:文中的物联网攻击节点定位方法,在低、中、高阶三种攻击特征形式下,可以实时准确定位攻击性节点位置,具备较强的实用性。

基于模糊逻辑的物联网流量攻击检测技术综述

物联网越来越多地出现在日常活动中,将我们周围多样化的物理设备连接到互联网,奠定了智慧城市、电子健康、精准农业等应用的基础。随着物联网应用的迅速普及,针对这类设备和服务的网络攻击数量也有所增加,且这些攻击具有不精确性和不确定性,使得对其进行正确检测和识别更加困难。为了应对上述挑战,学者们引入了基于模糊逻辑的攻击检测框架,在各种操作步骤中结合不同的模糊技术,以便在数据不准确和不确定时更精确地检测网络攻击。文中首先对物联网的安全性进行了详细的探讨,如其应对的安全挑战、所需的安全要求、面临的攻击类型等;其次对入侵检测系统(Intrusion Detection Systems,IDS)进行了描述,进而简述了物联网中IDS的基础框架;然后阐述了模糊逻辑的技术原理,分析了将其应用在流量攻击检测中的合理性;接着比较了各种基于不同技术的流量攻击检测方案,以说明它们在该领域的性能和重要性;最后总结了本文的主要工作,指出了未来的研究方向,为该领域的研究者提供了新的视角,以更好地应对不断升级的网络攻击。

基于攻击意图的工业网络抗毁性评价研究

随着工业网络的迅猛发展,安全事件层出不穷,网络抗毁性成为了该领域关注的焦点之一。针对工业网络中的安全问题,以攻击意图为切入点,开展了工业网络抗毁性评价问题的研究。首先,通过对已知攻击案例的分析,识别了多种攻击类型及其潜在影响;然后,区别于现有针对网络系统本身特性的评价方法,将攻击的潜在意图纳入考量,构建了一个综合性的抗毁性评价方法;最后,在一个工业网络系统模型上,通过与现有流行的网络系统抗毁性评价方法对比,发现所提出的基于攻击意图的工业网络抗毁性评价方法具有更加客观、稳定的评估效果。该抗毁性评价方法综合考虑了外界攻击的意图、发生概率、影响范围以及可能的后果,有效刻画了不同场景下系统面对相同规模外界攻击时的抗毁性。

卫星内容分发网络安全威胁及安全机制分析

随着卫星互联网技术的发展,卫星内容分发网络(Content Delivery Network,CDN)成为卫星互联网最有潜力的应用场景之一,在提升信息访问体验和缓解地面互联网主干压力方面发挥着重要作用。然而,卫星CDN也面临着一系列安全威胁。通过对不同攻击模型在卫星CDN发生的可能性以及严重程度进行梳理,分析现有安全机制在卫星CDN安全场景适用程度及存在问题。在此基础上,总结卫星CDN安全威胁发生的根源以及可能的技术路径,展望了未来卫星CDN安全的研究方向。

基于局部攻击图的最小关键漏洞集分析方法

为缓解攻击图应用在工业互联网安全防护中的状态空间爆炸问题,提出一种基于局部攻击图的最小关键漏洞集分析方法。提出一种以重要资产节点为目标的局部攻击图生成算法,通过裁剪不可达目标节点的攻击路径缓解状态空间爆炸问题;基于局部攻击图生成过程中得到的攻击路径漏洞集直接进行最小关键漏洞集分析,节省传统分析方法在搜索关键漏洞过程中对攻击图进行二次遍历的时空开销。在此基础上,通过工业网络实例进行分析并开展相关工作比较,实验结果表明,所提方法合理可行,可高效分析网络系统中的最小关键漏洞集。

工业互联网中抗APT窃取身份的零信任动态认证

新一代信息技术与工业系统深度融合,提升了工业控制系统和工业设备网络的连接性,使得工业互联网成为APT攻击的重点目标.针对现有偏向于静态认证的方法难以识别APT攻击者控制内部失陷终端获取的“傀儡身份”,进而造成敏感数据泄露的问题,提出一种面向工业互联网的零信任动态认证方案.融合CNN-BiLSTM构建混合神经网络,利用其时序特性设计行为因子预测模型.通过多个残差块组成的深度卷积网络提取特征,双向长短时记忆网络(bidirectional long short-term memory,BiLSTM)进行时间序列分析,生成对主体的行为因子预测,作为零信任动态认证重要凭据.为快速识别“傀儡身份”,融入行为因子设计IPK-SPA动态认证机制.利用轻量级标识公钥技术适应工业互联网海量末梢,借助零信任单包授权技术隐藏工控网络边界.安全性分析和实验结果表明,提出的动态认证方案具有较好的“傀儡身份”识别能力,有助于抗击工业互联网环境下因APT攻击者窃取身份导致的数据窃密威胁.

卫星互联网传输路径攻击及防御机制研究

卫星互联网被广泛认为是未来第6代移动通信技术(6th Generation,6G)网络的重要组成部分。为提升卫星互联网的安全性,针对卫星互联网传输路径实施的攻击手段,提出一种基于路径验证的防御机制,并在卫星互联网网关与路由节点间建立逐分组验证策略,使网关能够实时识别恶意流量,从而阻断或降低攻击危害。该机制具有兼容性好、低开销和高可靠等特点。仿真试验证明了其可行性,为提升卫星互联网安全性提供了支撑。

面向工业互联网设备的异常行为关联分析攻击溯源技术研究

针对工业互联网场景下工控网络侧、设备侧异常行为分析溯源技术攻击过程机理分析不清、跳转流程不明确等问题,提出了一种基于异常行为关联分析映射的攻击溯源检测方法.该方法基于异常行为序列相似度比对、异常行为序列与攻击阶段映射分析,将设备攻击映射情况与网络异常行为进行关联分析,串联不同设备之间的攻击关联子图构建完整攻击链条进行精准溯源.最终,通过构建工业智能设备仿真测试环境,实现常见工业设备攻击行为的重放复现,验证了所提出的攻击检测溯源方法的有效性.

基于区块链的物联网可信访问控制研究

针对当前物联网数据量庞大且数据之间孤立,以及物联网可信访问服务管理中交易不透明和易受攻击等问题,提出了基于区块链的物联网可信访问控制研究,将区块链技术应用到物联网的访问控制中,利用区块链的去中心化特性结合物联网访问控制技术,设计了物联网可信访问控制模型。通过模拟实验显示,物联网可信访问控制模型能够有效量化信任度、有效检测到物联网访问攻击行为,在整个访问控制中能够确保数据不被篡改,在每500次访问增量下的攻击检测率可提升约1.77百分点,具有较高的实用性。

一种面向车联网的零日攻击检测方法

由于缺乏攻击数据,车联网零日攻击检测通常采用基于异常的方法。但车辆实际行驶过程中环境复杂多样、行为模式多变,导致正常的行为模式会出现较大的差异,采用基于异常的方法容易导致高误报率。在车联网环境中零日攻击和已知攻击的攻击原理相似,受迁移学习的启发,基于条件生成对抗网络提出一种应用少样本学习的车联网零日攻击检测方法。首先,提出一种多生成器和多判别器的条件对抗生成网络模型。其次,设计了一种自适应采样数据增强方法,通过对已知的攻击样本进行数据增强优化该网络模型的输入样本以减少误报。为进一步缓解该网络模型的输入攻击样本过少带来的数据不平衡问题,在判别器中给出了一种协作焦点损失函数重点判别难分类数据。最后,基于F2MD车辆网络仿真平台进行了大量实验,实验结果表明所提方法对于零日攻击的检测效果和检测延迟均优于现有方法,为车联网零日攻击检测提供了一种有效的解决方案。

物联网卡非法攻击危险源识别方法研究

针对目前物联网用户危险源识别存在的关联风险大、识别范围狭窄等问题,通过将安全威胁探测模块部署在被保护的业务系统局域网内部,并综合采用Linux操作系统下的IPTABLES软件防火墙技术、TCP_WRAPPERS、应用层IP访问白名单技术以及子网卡抓包技术,在低成本、高安全的情况下,实现了高灵敏度、高概率识别非法攻击危险源,从而有效地保护物联网用户,并具有绿色低碳、高安全、大范围探测等特点。