Network Security Resiliency - A reliable synchrophasor network of phasor measurement units (PMUs) is essential for modern power system operations and management with rapidly increasing levels of renewable energy sources. Cyber-physical system vulnerabilities such as side-channel based denial of service (DoS) attacks can compromise PMU communications even when using an encrypted virtual private network. To overcome these vulnerabilities, countermeasures to DoS attacks needs to be developed. One such countermeasure is the development and deployment of a virtual synchrophasor network (VSN) to improve the reliability of a synchrophasor network to DoS attacks. A cellular computational networks (CCN) is a distributed artificial intelligence framework suitable for complex system modeling and estimation. CCNs have been proved to mitigate the effects of DoS attacks on single PMUs successfully. In this study, the robustness of a VSN is further investigated and proven to exhibit resiliency under concurrent DoS attacks. Typical results for VSN applications in multi-area power systems with utility-scale photovoltaic solar plants are presented.

Network Security Architecture - Software-Defined Networking or SDN (Software-Defined Networking) is a technology for software control and management of the network in order to improve its properties. Unlike classic network management technologies, which are complex and decentralized, SDN technology is a much more flexible and simple system. The new architecture may be vulnerable to several attacks leading to resource depletion and preventing the SDN controller from providing support to legitimate users. One such attack is the Distributed Denial of Service (DDoS), which is on the rise today. We suggest Modified-DDoSNet, a system for detecting DDoS attacks in the SDN environment. A model based on Deep Learning (DL) techniques will be implemented, combining a Recurrent Neural Network (RNN) with an Autoencoder. The proposed model, which was first trained to detect attacks, was implemented in the security architecture of the SDN network, as a new component. The security architecture of the SDN network contains a total of 13 components, each of which represents an individual part of the architecture, where the first component is the RNN - autoencoder. The model itself, which is the first component, was trained in the CICDDoS2019 dataset. It has high reliability for attack detection, which increases the security of the SDN network architecture.

Network Control Systems Security - The huge advantages of cloud computing technology and the bottlenecks in the development of traditional network control systems have prompted the birth of cloud control systems to address the shortcomings of traditional network control systems in terms of bandwidth and performance. However, the information security issues faced by cloud control systems are more complex, and distributed denial-of-service (DDoS) attacks are a typical class of attacks that may lead to problems such as latency in cloud control systems and seriously affect the performance of cloud control systems. In this paper, we build a single-capacity water tank cloud control semi-physical simulation system with heterogeneous controllers and propose a DDoS attack detection method for cloud control systems based on bidirectional long short-term memory neural network (BiLSTM), study the impact of DDoS attacks on cloud control systems. The experimental results show that the BiLSTM algorithm can effectively detect the DDoS attack on the cloud control system.

Network Control Systems Security - This paper is concerned with the observer-based control design for a continuous linear networked control systems under denial of service attacks. In order to save network communication resources, a new flexible event-triggered control strategy is designed on the premise that denial of service attacks are power-limited pulse width modulation interference. Considering this influence of denial of service attacks on event-triggered state, the maximum system performance lost is calculated. The sufficient conditions of system stability are derived by using the Lyapunov functional method. The constructive design of the controller is expressed in terms of linear matrix inequalities. Finally, the theoretical results are verified by a simulation example.

Named Data Network Security - This research focuses on the interest flooding attack model and its impact on the consumer in the Named Data Networking (NDN) architecture. NDN is a future internet network architecture has advantages compared to the current internet architecture. The NDN communication model changes the communication paradigm from a packet delivery model based on IP addresses to names. Data content needed is not directly taken from the provider but stored in a distributed manner on the router. Other consumer request data can served by nearest router. It will increase the speed of data access and reduce delay. The changes communication model also have an impact on the existing security system. One attack that may occur is the threat of a denial of service (DoS) known as an interest flooding attack. This attack makes the network services are being unavailable. This paper discussed examining the interest flooding attack model that occurred and its impact on the performance of NDN. The result shows that interest flooding attacks can decrease consumer satisfied interest.

Named Data Network Security - With the growing recognition that current Internet protocols have significant security flaws; several ongoing research projects are attempting to design potential next-generation Internet architectures to eliminate flaws made in the past. These projects are attempting to address privacy and security as their essential parameters. NDN (Named Data Networking) is a new networking paradigm that is being investigated as a potential alternative for the present host-centric IP-based Internet architecture. It concentrates on content delivery, which is probably underserved by IP, and it prioritizes security and privacy. NDN must be resistant to present and upcoming threats in order to become a feasible Internet framework. DDoS (Distributed Denial of Service) attacks are serious attacks that have the potential to interrupt servers, systems, or application layers. Due to the probability of this attack, the network security environment is made susceptible. The resilience of any new architecture against the DDoS attacks which afflict today s Internet is a critical concern that demands comprehensive consideration. As a result, research on feature selection approaches was conducted in order to use machine learning techniques to identify DDoS attacks in NDN. In this research, features were chosen using the Information Gain and Data Reduction approach with the aid of the WEKA machine learning tool to identify DDoS attacks. The dataset was tested using KNearest Neighbor (KNN), Decision Table, and Artificial Neural Network (ANN) algorithms to categorize the selected features. Experimental results shows that Decision Table classifier outperforms well when compared to other classification algorithms with the with the accuracy of 85.42\% and obtained highest precision and recall score with 0.876 and 0.854 respectively when compared to the other classification techniques.

Multicore Computing Security - In this paper, we study the effectiveness of denial-ofservice (DoS) attacks on Intel’s heterogeneous multicore systemon-chips with integrated GPU (iGPU) in which the last level cache (LLC) and the main memory subsystem are shared between the multicore CPU and the iGPU. Using two Intel processors with iGPU, we evaluate four different DoS attacks, three CPU based and one iGPU based, and show they can induce very high degree of shared resource contention and thus dramatically slowdown the victim’s execution time. We further evaluate the effectiveness of Intel’s recent hardware based shared resource isolation mechanisms, namely Intel Cache Allocation Technology (CAT) and Graphics Technology Class of Service (GT COS), which provide shared LLC partitioning capability for the CPU cores and the iGPU, respectively, in defending against these DoS attacks. Using both synthetic and real-world benchmarks, we find that hardware based LLC partitioning mechanisms does provide spatial LLC space isolation but does not necessarily provide temporal isolation.

Middleware Security - Web application security is the most important area when it comes to developing a web application. Many web applications having vulnerabilities due to poor implementation of security measures. These web applications will be deployed without fixing the vulnerabilities thus becomes vulnerable to many cyber-attacks. Simple attacks like brute-force and NoSQL injection could give unauthorized access to the user accounts. This leads to user privacy issues which could create huge loss to the organizations. These vulnerabilities can be fixed by implementing the necessary security measures while developing the web application. OWASP (Open Web Application Security Project) is a non-profit organization which gives the severity, impact and prevention methods about Top 10 vulnerabilities in web applications. This research deals with the implementation of bestsecurity practices for Node.js web applications in detail. This research paper proposes the security mechanisms for attacks related to front-end, middleware and backend web development using OWASP suggestions. The main focus of this research paper is on prevention of Denial-of-service attack, Brute force attack, NoSQL injection attack and Unrestricted file upload vulnerability.The proposed prevention methods are implemented in a web application to test the defensive mechanisms against the mentionedvulnerabilities.

Microelectronics Security - Web application security is the most important area when it comes to developing a web application. Many web applications having vulnerabilities due to poor implementation of security measures. These web applications will be deployed without fixing the vulnerabilities thus becomes vulnerable to many cyber-attacks. Simple attacks like brute-force and NoSQL injection could give unauthorized access to the user accounts. This leads to user privacy issues which could create huge loss to the organizations. These vulnerabilities can be fixed by implementing the necessary security measures while developing the web application. OWASP (Open Web Application Security Project) is a non-profit organization which gives the severity, impact and prevention methods about Top 10 vulnerabilities in web applications. This research deals with the implementation of bestsecurity practices for Node.js web applications in detail. This research paper proposes the security mechanisms for attacks related to front-end, middleware and backend web development using OWASP suggestions. The main focus of this research paper is on prevention of Denial-of-service attack, Brute force attack, NoSQL injection attack and Unrestricted file upload vulnerability.The proposed prevention methods are implemented in a web application to test the defensive mechanisms against the mentionedvulnerabilities.

MANET Attack Detection - Nodes in a “distributed” Adhoc network do not share a single centralized infrastructure. Hosts and routers can be found on any mobile node. In addition, it sends packets to additional mobile nodes in the network that aren't directly connected to the main network. Network layer assaults such as black hole, wormhole, and denial-of-service (DoS) are all easily carried out on mobile Ad hoc networks (MANETs). Wrong-way attacks, which divert packets from one part of the network and route them through an alternate one, are extremely difficult to detect. Even though the wormhole attack has been countered, the current solutions still suffer from excessive delivery delays, packet delivery ratio issues, and energy consumption. In this paper, a cluster-based algorithm (CBA) detects hybrid wormhole assaults by computing based on sequence number, round-trip time (RTT), which is more optimistic than existing solutions for detecting both in-band and out-of-band connections are possible. RTT thresholds are predicted in this paper using CBA to distinguish between attack and non-attack routes. NS-2 network simulator is used to test the suggested technique. The proposed algorithm's performance was evaluated by looking at its throughput. Results demonstrate that CBA reduced 20% of total energy consumption compared to AODV, the traditional On-Demand Ad-hoc Distance Vector routing protocol.

MANET Attack Prevention - Since the mid-1990s, the growth of laptops and Wi-Fi networks has led to a great increase in the use of MANET (Mobile ad hoc network) in wireless communication. MANET is a group of mobile devices for example mobile phones, computers, laptops, radios, sensors, etc., that communicate with each other wirelessly without any support from existing internet infrastructure or any other kind of fixed stations. As MANET is an infrastructure-less network it is prone to various attacks, which can lead to loss of information during communication, security breaches or other unauthentic malpractices. Various types of attacks to which MANET can be vulnerable are denial of service (DOS) and packet dropping attacks such as Gray hole, Blackhole, Wormhole, etc. In this research, we are particularly focusing on the detection and prevention of Gray hole attack. Gray hole node drops selective data packets, while participating in the routing process like other nodes, and advertises itself as a genuine node. The Intrusion Detection System (IDS) technique is used for identification and aversion of the Gray hole attack. Use of AODV routing protocol is made in the network. The network is incorporated and simulation parameters such as PDR (Packet Delivery Ratio), Energy Consumption, End-to-end delay, and Throughput are analyzed using simulation software.

Internet-scale Computing Security - The data of large-scale distributed demand-side iot devices are gradually migrated to the cloud. This cloud deployment mode makes it convenient for IoT devices to participate in the interaction between supply and demand, and at the same time exposes various vulnerabilities of IoT devices to the Internet, which can be easily accessed and manipulated by hackers to launch large-scale DDoS attacks. As an easy-to-understand supervised learning classification algorithm, KNN can obtain more accurate classification results without too many adjustment parameters, and has achieved many research achievements in the field of DDoS detection. However, in the face of high-dimensional data, this method has high operation cost, high cost and not practical. Aiming at this disadvantage, this chapter explores the potential of classical KNN algorithm in data storage structure, K-nearest neighbor search and hyperparameter optimization, and proposes an improved KNN algorithm for DDoS attack detection of demand-side IoT devices.

Internet-scale Computing Security - The big data platform based on cloud computing realizes the storage, analysis and processing of massive data, and provides users with more efficient, accurate and intelligent Internet services. Combined with the characteristics of college teaching resource sharing platform based on cloud computing mode, the multi-faceted security defense strategy of the platform is studied from security management, security inspection and technical means. In the detection module, the optimization of the support vector machine is realized, the detection period is determined, the DDoS data traffic characteristics are extracted, and the source ID blacklist is established; the triggering of the defense mechanism in the defense module, the construction of the forwarder forwarding queue and the forwarder forwarding capability are realized. Reallocation.

Information Theoretic Security - Geospatial fog computing system offers various benefits as a platform for geospatial computing services closer to the end users, including very low latency, good mobility, precise position awareness, and widespread distribution. In recent years, it has grown quickly. Fog nodes security is susceptible to a number of assaults, including denial of service and resource abuse, because to their widespread distribution, complex network environments, and restricted resource availability. This paper proposes a Quantum Key Distribution (QKD)-based geospatial quantum fog computing environment that offers a symmetric secret key negotiation protocol that can preserve information-theoretic security. In QKD, after being negotiated between any two fog nodes, the secret keys can be given to several users in various locations to maintain forward secrecy and long-term protection. The new geospatial quantum fog computing environment proposed in this work is able to successfully withstand a variety of fog computing assaults and enhances information security.

Internet of Things (IoT) networks consist of small devices that use a wireless communication to monitor and possibly control the physical world. A common threat to such networks are jamming attacks, a particular type of denial of service attack. Current research highlights the need for the design of more effective and efficient anti-jamming techniques that can handle different types of attacks in IoT networks. In this paper, we propose DeMiJA, short for Detection and Mitigation of Jamming Attacks in IoT, a novel approach to deal with different jamming attacks in IoT networks. DeMiJA leverages architecture-based adaptation and the MAPE-K reference model (Monitor-Analyze-Plan-Execute that share Knowledge). We present the general architecture of DeMiJA and instantiate the architecture to deal with jamming attacks in the DeltaIoT exemplar. The evaluation shows that DeMiJA can handle different types of jamming attacks effectively and efficiently, with neglectable overhead.

Cyber-attacks against Industrial Control Systems (ICS) can lead to catastrophic events which can be prevented by the use of security measures such as the Intrusion Prevention Systems (IPS). In this work we experimentally demonstrate how to exploit the configuration vulnerabilities of SNORT one of the most adopted IPSs to significantly degrade the effectiveness of the IPS and consequently allowing successful cyber-attacks. We illustrate how to design a batch script able to retrieve and modify the configuration files of SNORT in order to disable its ability to detect and block Denial of Service (DoS) and ARP poisoning-based Man-In-The-Middle (MITM) attacks against a Programmable Logic Controller (PLC) in an ICS network. Experimental tests performed on a water distribution testbed show that, despite the presence of IPS, the DoS and ARP spoofed packets reach the destination causing respectively the disconnection of the PLC from the ICS network and the modification of packets payload.

A persistent and serious danger to the Internet is a denial of service attack on a large scale (DDoS) attack using machine learning. Because they originate at the low layers, new Infections that use genuine hypertext transfer protocol requests to overload target resources are more untraceable than application layer-based cyberattacks. Using network flow traces to construct an access matrix, this research presents a method for detecting distributed denial of service attack machine learning assaults. Independent component analysis decreases the number of attributes utilized in detection because it is multidimensional. Independent component analysis can be used to translate features into high dimensions and then locate feature subsets. Furthermore, during the training and testing phase of the updated source support vector machine for classification, their performance it is possible to keep track of the detection rate and false alarms. Modified source support vector machine is popular for pattern classification because it produces good results when compared to other approaches, and it outperforms other methods in testing even when given less information about the dataset. To increase classification rate, modified source support Vector machine is used, which is optimized using BAT and the modified Cuckoo Search method. When compared to standard classifiers, the acquired findings indicate better performance.

Metaverse technologies depend on various advanced human-computer interaction (HCI) devices to be supported by extended reality (XR) technology. Many new HCI devices are supported by wireless Internet of Things (IoT) networks, where a reliable routing scheme is essential for seamless data trans-mission. Routing Protocol for Low power and Lossy networks (RPL) is a key routing technology used in IPv6-based low power and lossy networks (LLNs). However, in the networks that are configured, such as small wireless devices applying the IEEE 802.15.4 standards, due to the lack of a system that manages the identity (ID) at the center, the maliciously compromised nodes can make fabricated IDs and pretend to be a legitimate node. This behavior is called Sybil attack, which is very difficult to respond to since attackers use multiple fabricated IDs which are legally disguised. In this paper, Sybil attack countermeasures on RPL-based networks published in recent studies are compared and limitations are analyzed through simulation performance analysis.

As a result of the inherent weaknesses of the wireless medium, ad hoc networks are susceptible to a broad variety of threats and assaults. As a direct consequence of this, intrusion detection, as well as security, privacy, and authentication in ad-hoc networks, have developed into a primary focus of current study. This body of research aims to identify the dangers posed by a variety of assaults that are often seen in wireless ad-hoc networks and provide strategies to counteract those dangers. The Black hole assault, Wormhole attack, Selective Forwarding attack, Sybil attack, and Denial-of-Service attack are the specific topics covered in this thesis. In this paper, we describe a trust-based safe routing protocol with the goal of mitigating the interference of black hole nodes in the course of routing in mobile ad-hoc networks. The overall performance of the network is negatively impacted when there are black hole nodes in the route that routing takes. As a result, we have developed a routing protocol that reduces the likelihood that packets would be lost as a result of black hole nodes. This routing system has been subjected to experimental testing in order to guarantee that the most secure path will be selected for the delivery of packets between a source and a destination. The invasion of wormholes into a wireless network results in the segmentation of the network as well as a disorder in the routing. As a result, we provide an effective approach for locating wormholes by using ordinal multi-dimensional scaling and round trip duration in wireless ad hoc networks with either sparse or dense topologies. Wormholes that are linked by both short route and long path wormhole linkages may be found using the approach that was given. In order to guarantee that this ad hoc network does not include any wormholes that go unnoticed, this method is subjected to experimental testing. In order to fight against selective forwarding attacks in wireless ad-hoc networks, we have developed three different techniques. The first method is an incentive-based algorithm that makes use of a reward-punishment system to drive cooperation among three nodes for the purpose of vi forwarding messages in crowded ad-hoc networks. A unique adversarial model has been developed by our team, and inside it, three distinct types of nodes and the activities they participate in are specified. We have shown that the suggested strategy that is based on incentives prohibits nodes from adopting an individualistic behaviour, which ensures collaboration in the process of packet forwarding. To guarantee that intermediate nodes in resource-constrained ad-hoc networks accurately convey packets, the second approach proposes a game theoretic model that uses non-cooperative game theory. This model is based on the idea that game theory may be used. This game reaches a condition of desired equilibrium, which assures that cooperation in multi-hop communication is physically possible, and it is this state that is discovered. In the third algorithm, we present a detection approach that locates malicious nodes in multihop hierarchical ad-hoc networks by employing binary search and control packets. We have shown that the cluster head is capable of accurately identifying the malicious node by analysing the sequences of packets that are dropped along the path leading from a source node to the cluster head. A lightweight symmetric encryption technique that uses Binary Playfair is presented here as a means of safeguarding the transport of data. We demonstrate via experimentation that the suggested encryption method is efficient with regard to the amount of energy used, the amount of time required for encryption, and the memory overhead. This lightweight encryption technique is used in clustered wireless ad-hoc networks to reduce the likelihood of a sybil attack occurring in such networks

MQTT is widely adopted by IoT devices because it allows for the most efficient data transfer over a variety of communication lines. The security of MQTT has received increasing attention in recent years, and several studies have demonstrated the configurations of many MQTT brokers are insecure. Adversaries are allowed to exploit vulnerable brokers and publish malicious messages to subscribers. However, little has been done to understanding the security issues on the device side when devices handle unauthorized MQTT messages. To fill this research gap, we propose a fuzzing framework named ShadowFuzzer to find client-side vulnerabilities when processing incoming MQTT messages. To avoiding ethical issues, ShadowFuzzer redirects traffic destined for the actual broker to a shadow broker under the control to monitor vulnerabilities. We select 15 IoT devices communicating with vulnerable brokers and leverage ShadowFuzzer to find vulnerabilities when they parse MQTT messages. For these devices, ShadowFuzzer reports 34 zero-day vulnerabilities in 11 devices. We evaluated the exploitability of these vulnerabilities and received a total of 44,000 USD bug bounty rewards. And 16 CVE/CNVD/CN-NVD numbers have been assigned to us.

Dynamic Host Control Protocol (DHCP) is a protocol which provides IP addresses and network configuration parameters to the hosts present in the network. This protocol is deployed in small, medium, and large size organizations which removes the burden from network administrator to manually assign network parameters to every host in the network for establishing communication. Every vendor who plans to incorporate DHCP service in its device follows the working flow defined in Request for Comments (RFC). DHCP Starvation and DHCP Flooding attack are Denial of Service (DoS) attacks to prevents provision of IP addresses by DHCP. Port Security and DHCP snooping are built-in security features which prevents these DoS attacks. However, novel techniques have been devised to bypass these security features which uses ARP and ICMP protocol to perform the attack. The purpose of this research is to analyze implementation of DHCP in multiple devices to verify the involvement of both ARP and ICMP in the address acquisition process of DHCP as per RFC and to validate the results of prior research which assumes ARP or ICMP are used by default in all of devices.

DDoS is a major issue in network security and a threat to service providers that renders a service inaccessible for a period of time. The number of Internet of Things (IoT) devices has developed rapidly. Nevertheless, it is proven that security on these devices is frequently disregarded. Many detection methods exist and are mostly focused on Machine Learning. However, the best method has not been defined yet. The aim of this paper is to find the optimal volumetric DDoS attack detection method by first comparing different existing machine learning methods, and second, by building an adaptive lightweight heuristics model relying on few traffic attributes and simple DDoS detection rules. With this new simple model, our goal is to decrease the classification time. Finally, we compare machine learning methods with our adaptive new heuristics method which shows promising results both on the accuracy and performance levels.

In recent years, the need for seamless connectivity has increased across various network platforms with demands coming from industries, home, mobile, transportation and office networks. The 5th generation (5G) network is being deployed to meet such demand of high-speed seamless network device connections. The seamless connectivity 5G provides could be a security threat allowing attacks such as distributed denial of service (DDoS) because attackers might have easy access into the network infrastructure and higher bandwidth to enhance the effects of the attack. The aim of this research is to provide a security solution for 5G technology to DDoS attacks by managing the response to threats posed by DDoS. Deploying a security policy language which is reactive and event-oriented fits into a flexible, efficient, and lightweight security approach. A policy in our language consists of an event whose occurrence triggers a policy rule where one or more actions are taken.

The Activity and Event Network (AEN) graph is a new framework that allows modeling and detecting intrusions by capturing ongoing security-relevant activity and events occurring at a given organization using a large time-varying graph model. The graph is generated by processing various network security logs, such as network packets, system logs, and intrusion detection alerts. In this paper, we show how known attack methods can be captured generically using attack fingerprints based on the AEN graph. The fingerprints are constructed by identifying attack idiosyncrasies under the form of subgraphs that represent indicators of compromise (IOes), and then encoded using Property Graph Query Language (PGQL) queries. Among the many attack types, three main categories are implemented as a proof of concept in this paper: scanning, denial of service (DoS), and authentication breaches; each category contains its common variations. The experimental evaluation of the fingerprints was carried using a combination of intrusion detection datasets and yielded very encouraging results.

Volumetric Distributed Denial of Service attacks forcefully disrupt the availability of online services by congesting network links with arbitrary high-volume traffic. This brute force approach has collateral impact on the upstream network infrastructure, making early attack traffic removal a key objective. To reduce infrastructure load and maintain service availability, we introduce ReCEIF, a topology-independent mitigation strategy for early, rule-based ingress filtering leveraging deep reinforcement learning. ReCEIF utilizes hierarchical heavy hitters to monitor traffic distribution and detect subnets that are sending high-volume traffic. Deep reinforcement learning subsequently serves to refine hierarchical heavy hitters into effective filter rules that can be propagated upstream to discard traffic originating from attacking systems. Evaluating all filter rules requires only a single clock cycle when utilizing fast ternary content-addressable memory, which is commonly available in software defined networks. To outline the effectiveness of our approach, we conduct a comparative evaluation to reinforcement learning-based router throttling.