工业信息物理系统的攻击建模研究

无线通信网络的脆弱性使得工业信息物理系统易遭受各类网络攻击.为了更深入地了解不同网络攻击的特征进而建立有效的防御措施,构建一种线性时不变离散系统的工业信息物理系统结构;深入研究信息物理系统攻击者攻击空间及攻击者攻击模型,采用控制理论方法研究攻击空间模型的模型知识、披露资源和破坏资源的数学表达;对拒绝服务攻击、重放攻击、虚假数据注入攻击3种典型网络攻击的基本特性,以及对应攻击下攻击模型的表现形式进行分析.通过Simulink/Truetime仿真工具对破坏性和隐蔽性性能进行仿真实验.结果表明,所研究的攻击空间模型及攻击者攻击模型能够有效地描述网络攻击的攻击特性.     

信息物理融合系统网络安全综述

信息物理融合系统（cyber-physical systems， CPS）是集计算、通信和控制于一体的智能系统，实现网络和物理的深度协作和有机融合.目前CPS在关键的基础设施、政府机构等领域发挥着越来越重要的作用.由于物理限制，计算机和网络产生的安全漏洞会导致CPS遭受巨大的破坏，同时还会引起经济损失、社会动乱等连锁反应，所以研究CPS的安全问题对于确保系统安全运行具有重要意义.本文结合国内外的研究现状，概述了CPS安全控制和攻击检测的最新进展.首先本文总结了CPS典型的系统建模以满足对系统性能分析的需要.然后介绍了3种典型的网络攻击，即拒绝服务攻击、重放攻击和欺骗攻击.根据检测方法的类别，对CPS攻击检测的发展进行的概述.此外还讨论了系统的安全控制和状态估计.最后总结和展望了CPS网络安全面临的挑战和未来的研究方向.     

针对网络入侵检测系统的攻击及防御

Internet的使用越来越广泛,随之而来的网络安全已成为人们关注的焦点。入侵检测系统作为一种对付攻击的有效手段,已为越来越多的单位所采用。然而一旦攻击者发现目标网络中部署有入侵检测系统IDS,那么IDS往往成为他们首选的攻击目标。该文详细分析了针对网络IDS的几种攻击类型,即过载攻击、崩溃攻击和欺骗攻击,以及如何防御这些攻击,这对于IDS的设计具有一定的借鉴意义。     

Training a neural-network based intrusion detector to recognizenovel attacks

While many commercial intrusion detection systems (IDS) are deployed, the protection they afford is modest. State-of-the-art IDS produce voluminous alerts, most false alarms, and function mainly by recognizing the signatures of known attacks so that novel attacks slip past them. Attempts have been made to create systems that recognize the signature of “normal,” in the hope that they will then detect attacks, known or novel. These systems are often confounded by the extreme variability of nominal behavior. The paper describes an experiment with an IDS composed of a hierarchy of neural networks (NN) that functions as a true anomaly detector. This result is achieved by monitoring selected areas of network behavior, such as protocols, that are predictable in advance. While this does not cover the entire attack space, a considerable number of attacks are carried out by violating the expectations of the protocol/operating system designer. Within this focus, the NNs are trained using data that spans the entire normal space. These detectors are able to recognize attacks that were not specifically presented during training. We show that using small detectors in a hierarchy gives a better result than a single large detector. Some techniques can be used not only to detect anomalies, but to distinguish among them     

基于DS证据理论的无线传感器网络MAC层安全研究*

研究了无线传感器网络MAC层安全问题,分析了现有无线传感器网络MAC层协议安全体系的不足之处,针对无线传感器网络遭到非法入侵的情况,提出了一个基于D-S证据理论的MAC层入侵检测机制。该机制利用碰撞率、数据包平均等待时间、RTS包到达率以及邻居节点的报警作为证据,对网络的状态进行实时的分析检测,根据网络的状态作出响应。该算法能够应用于现有的MAC协议如S-MAC、IEEE 802.15.4中,仿真结果表明,该算法能够较好地抵御针对MAC层的攻击,保证网络的安全运行。     

Intrusion detection in computer networks by a modular ensemble of one-class classifiers

Since the early days of research on intrusion detection, anomaly-based approaches have been proposed to detect intrusion attempts. Attacks are detected as anomalies when compared to a model of normal (legitimate) events. Anomaly-based approaches typically produce a relatively large number of false alarms compared to signature-based IDS. However, anomaly-based IDS are able to detect never-before-seen attacks. As new types of attacks are generated at an increasing pace and the process of signature generation is slow, it turns out that signature-based IDS can be easily evaded by new attacks. The ability of anomaly-based IDS to detect attacks never observed in the wild has stirred up a renewed interest in anomaly detection. In particular, recent work focused on unsupervised or unlabeled anomaly detection, due to the fact that it is very hard and expensive to obtain a labeled dataset containing only pure normal events.The unlabeled approaches proposed so far for network IDS focused on modeling the normal network traffic considered as a whole. As network traffic related to different protocols or services exhibits different characteristics, this paper proposes an unlabeled Network Anomaly IDS based on a modular Multiple Classifier System (MCS). Each module is designed to model a particular group of similar protocols or network services. The use of a modular MCS allows the designer to choose a different model and decision threshold for different (groups of) network services. This also allows the designer to tune the false alarm rate and detection rate produced by each module to optimize the overall performance of the ensemble. Experimental results on the KDD-Cup 1999 dataset show that the proposed anomaly IDS achieves high attack detection rate and low false alarm rate at the same time.     

基于事件逻辑的无线Mesh网络认证协议安全性证明

无线Mesh网络是一种结合无线局域网和移动自组织网络的新型多跳网络,无线网络的开放性和资源受限性使得无线网络容易遭受重放、伪装等攻击。事件逻辑是一种描述并发与分布式系统中状态迁移和算法的形式化方法,可用于证明网络协议的安全性。以事件逻辑为基础提出一系列性质,其中包含多组合信息交互、不叠加、事件匹配、去重复、去未来,以降低协议分析过程中的冗余度以及复杂度,提高协议分析效率。对无线Mesh网络客户端双向认证协议进行分析,证明该协议能够抵抗中间人发起的重放攻击,无线Mesh客户端双向认证协议是安全的。此理论适用于类似复杂无线网络协议形式化分析。     

工业控制网络中APT攻击检测系统设计

高级持续性威胁(advanced persistent threat, APT)是当今工控网络安全首要威胁,而传统的基于特征匹配的工业入侵检测系统往往无法检测出最新型的APT攻击。现有研究者认为,敏感数据窃密是APT攻击的重要目的之一。为了能准确识别出APT攻击的窃密行为,对APT攻击在窃密阶段受控主机与控制与命令(Control and Command, C&C)服务器通信时TCP会话流特征进行深入研究,采用深度流检测技术,并提出一种基于多特征空间加权组合SVM分类检测算法对APT攻击异常会话流进行检测。实验表明,采用深度流检测技术对隐蔽APT攻击具备良好的检测能力,而基于多特征空间加权组合SVM分类检测算法较传统单一分类检测的检测精度更高,误报率更低,对工控网络安全领域的研究具有推进作用。     

网络安全战略预警系统的攻击检测技术研究

攻击检测系统是网络安全战略预警系统的重要组成部分，它从现有的入侵检测系统（IDS）出发，应用当前的民用技术来发展更先进的入侵检测系统（IDS），又将数据输入从逻辑入侵拓展到物理、心理和情报攻击，这些都是信息战进攻的一部分，本文主要探讨适合大范围协同攻击的检测技术。     

一种新的Ad hoc网络安全路由方案

在移动Adhoc网络中,网络的自组织、动态拓扑以及无线接入等特点使得路由的安全性问题日益突出。论文提出了一种基于按需路由的高效、安全路由方案(ESAR),阐述了该方案的原理,路由发现和路由维护过程,并对其安全性能以及网络性能进行了分析,与同类型的方案进行了比较。该方案可以有效地防止对路由信息的伪装、篡改、路由重播、拒绝服务(DoS)等攻击,并且考虑了Adhoc网络资源有限的特点,使用对称密钥机制,降低网络资源的开销。     

A novel intelligent approach for man-in-the-middle attacks detection over internet of things environments based on message queuing telemetry transport

One of the most common attacks is man-in-the-middle (MitM) which, due to its complex behaviour, is difficult to detect by traditional cyber-attack detection systems. MitM attacks on internet of things systems take advantage of special features of the protocols and cause system disruptions, making them invisible to legitimate elements. In this work, an intrusion detection system (IDS), where intelligent models can be deployed, is the approach to detect this type of attack considering network alterations. Therefore, this paper presents a novel method to develop the intelligent model used by the IDS, being this method based on a hybrid process. The first stage of the process implements a feature extraction method, while the second one applies different supervised classification techniques, both over a message queuing telemetry transport (MQTT) dataset compiled by authors in previous works. The contribution shows excellent performance for any compared classification methods. Likewise, the best results are obtained using the method with the highest computational cost. Thanks to this, a functional IDS will be able to prevent MQTT attacks.     

Detecting attacks in high-speed networks: Issues and solutions

ABSTRACT

Intrusion detection systems are one of the necessities of networks to identify the problem of network attacks. Organizations striving to protect their data from intruders are often challenged by attackers, who find new ways to attack and compromise the security of the network. The detection process becomes quite difficult while dealing with high-speed and distributed attacks that are performed using botnets. These attacks threat both the confidentiality of legitimate users and the infrastructure of the network and to protect them, early discovery of network attacks is important. In this paper, an open source Intrusion Detection System (IDS), Snort is presented as a solution to detect DoS and Port Scan network attacks in a high-speed network. A set of custom rules has been proposed for Snort to detect DoS and Port Scan attacks in high-speed network. The rules are compared and tested using different attack generators like Scapy, Hping3, LOIC and Nmap. Snort’s efficiency in detecting the DoS and Port Scan attacks using the new rules is experimentally proved to be around 99% for all the attacks except for Ping of Death. The proposed system works well for different attack generators in a high-speed network.     

A lightweight distributed detection algorithm for DDAO attack on RPL routing protocol in Internet of Things

A significant increase in the number of connected devices in the Internet of Things poses a key challenge to efficiently handling the attacks in routing protocols such as Routing Protocol for Low Power and Lossy Networks (RPL). The attacks on RPL are partly studied in the literature, and the proposed solutions typically overlook the appropriate trade-off among the detection rate and communication and computational overhead. This study aimed at introducing a new attack called Dropped Destination Advertisement Object (DDAO) and a new Intrusion Detection System (IDS) to counter this attack in RPL protocol. DDAO attack adversely affects the network by preventing the creation of the downward routes through not forwarding Destination Advertisement Object (DAO) messages and sending fake Destination Advertisement Object Acknowledgment (DAO-ACK) messages to the DAO source. A distributed lightweight IDS is proposed in this study to detect and counter DDAO attacks by monitoring the behavior of parents against forwarded DAO messages. According to the evaluations conducted on the Cooja simulator under different real-world conditions, the proposed IDS can detect DDAO attacks with high accuracy, precision, and True Positive Rate (TPR) and low False Positive Rate (i.e., close to zero). Additionally, compared to RPL, the proposed IDS improves Packet Delivery Rate (PDR) by 158 percent when countering attacks.     

网络攻击下的信息物理系统安全性研究综述

随着信息物理系统在现代工业和制造业中的广泛应用,其安全性逐渐成为关系社会健康发展的重要因素.由于信息物理系统内部物理设备和通信网络的深度融合,网络攻击对系统安全的威胁日益凸显.首先,从攻击者角度总结各类网络攻击的特点,揭示系统在不同攻击下的脆弱性;其次,针对不同网络攻击的特性,从防御者角度对信息物理系统的安全状态估计、攻击检测和安全控制进行介绍,并阐述各防御策略的主要应用场景和优势;最后,对信息物理系统安全性研究面临的主要挑战进行展望.     

On modeling of electrical cyber-physical systems considering cyber security

This paper establishes a new framework for modeling electrical cyber-physical systems (ECPSs), integrating both power grids and communication networks. To model the communication network associated with a power transmission grid, we use a mesh network that considers the features of power transmission grids such as high-voltage levels, long-transmission distances, and equal importance of each node. Moreover, bidirectional links including data uploading channels and command downloading channels are assumed to connect every node in the communication network and a corresponding physical node in the transmission grid. Based on this model, the fragility of an ECPS is analyzed under various cyber attacks including denial-of-service (DoS) attacks, replay attacks, and false data injection attacks. Control strategies such as load shedding and relay protection are also verified using this model against these attacks.     

对安全协议重放攻击的分类研究

在详细研究攻击实例的基础上,从攻击成功的根本原因出发,提出了一种新的重放攻击分类方法.该分类方法能够更清楚地认识到重放攻击的原理和本质,并针对不同的重放种类给出了避免攻击的原则性方法,对协议的设计和分析起到了借鉴作用.     

计算机网络脆弱性浅析

针对Internet日益增多的攻击现状,防火墙、入侵检侧系统等网络安全技术发展日益成熟。但是现实中总有一些攻击能够成功,我们就有必要研究在遭受攻击情况下分析网络的脆弱性技术及及时的恢复技术,最小化对于网络不利影响。本文提出了计算机网络脆弱性的概念。分析脆弱性存在的深层原因,对网络脆弱性提供了初步的了解。     

Human perspective to anomaly detection for cybersecurity

Traditionally signature-based network Intrusion Detection Systems (IDS) rely on inputs from domain experts and can only identify the attacks if they occur as individual event. IDS generate large number of alerts and it becomes very difficult for human users to go through each message. Previous researches have proposed analytics based approaches to analyze IDS alert patterns based on anomaly detection models, multi-steps models or probabilistic approaches. However, due to the complexities of network intrusions, it is impossible to develop all possible attack patterns or to avoid false positives. With the advance in technologies and popularity of networks in our daily life, it is becoming more and more difficult to detect network intrusions. However, no matter how rapid the technologies change, the human behaviors behind the cyber attacks stay relatively constant. This provides us an opportunity to develop an improved system to detect the unusual cyber attacks. In this paper, we developed four network intrusion models based on consideration of human factors. We then tested these models on ITOC Cyber Defense Competition (CDX) 2009 data. Our results are encouraging. These Models are not only able to recognize most network attacks identified by SNORT log alerts, they are also able to distinguish the non-attack network traffic that was potentially missed by SNORT as indicated by ground truth validation of the data.     

基于软件定义网络的反嗅探攻击方法

网络嗅探攻击中,攻击者从网络节点或链路捕获和分析网络通信数据、监视网络状态、窃取用户名和密码等敏感信息。在攻击发生时,攻击者通常处于静默状态,传统的网络防护手段如防火墙、入侵检测系统（IDS）或入侵防御系统（IPS）很难发现并有效抵御攻击。从网络结构入手,提出基于软件定义网络（SDN）的动态路径跳变（DPH）通信机制,依据空间和时间约束条件,动态改变通信节点之间的路径,宏观上将通信流量相对均匀地分布在多条传输链路中,增加网络嗅探攻击中获取完整数据的难度。实验仿真结果说明,在一定的网络规模下,动态路径跳变能够在不明显降低网络传输性能的条件下有效防御嗅探攻击。     

面向APT攻击的关联分析检测模型研究

近年来随着Flame、Duqu以及Stuxnet等病毒攻击的曝光,高级持续性威胁(APT)攻击已引起社会各界的广泛重视。APT攻击相比传统攻击具有目标性、持续性、隐蔽性以及复杂性,具有很强的破坏性,造成的攻击后果十分严重。然而,由于APT攻击方式多样化,具有很强的隐蔽性,传统的防护机制,包括防火墙、杀毒软件、入侵检测等很难发现APT攻击,或者发现时可能已经完成了攻击目的。在研究APT攻击特性的基础上建立APT攻击检测模型;同时设定时间窗,对多种攻击检测方法得到的攻击事件进行关联分析,并与APT攻击检测模型进行路径匹配,通过攻击路径的匹配度来判断系统受到的攻击中是否存在APT攻击。实验表明,在攻击检测模型相对完整的情况下,对APT攻击的检测能够达到较高的准确率。