Deterministic Dendritic Cell Algorithm Application to Smart Grid Cyber-Attack Detection

Igbe, Obinna; Darwish, Ihab; Saadawi, Tarek

doi:10.1109/cscloud.2017.12

Cited by 26 publications

(13 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Datasets. We construct our datasets from several publicly available traces [66], [41], [9], [5], [11], [14]. We filter messages of 10 common protocols from these traces with focus on binary protocols.…”

Section: A Experiments Setupmentioning

confidence: 99%

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

Zhang

Wang

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Network protocol reverse engineering is an important challenge with many security applications. A popular kind of method leverages network message traces. These methods rely on pair-wise sequence alignment and/or tokenization. They have various limitations such as difficulties of handling a large number of messages and dealing with inherent uncertainty. In this paper, we propose a novel probabilistic method for network trace based protocol reverse engineering. It first makes use of multiple sequence alignment to align all messages and then reduces the problem to identifying the keyword field from the set of aligned fields. The keyword field determines the type of a message. The identification is probabilistic, using random variables to indicate the likelihood of each field (being the true keyword). A joint distribution is constructed among the random variables and the observations of the messages. Probabilistic inference is then performed to determine the most likely keyword field, which allows messages to be properly clustered by their true types and enables the recovery of message format and state machine. Our evaluation on 10 protocols shows that our technique substantially outperforms the state-of-the-art and our case studies show the unique advantages of our technique in IoT protocol reverse engineering and malware analysis.

show abstract

Section: A Experiments Setupmentioning

confidence: 99%

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

Zhang

Wang

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…In [ 19 ], Igbe et al present an anomaly-based IDS devoted to protecting the DNP3 communications. The proposed IDS is composed of three main blocks, namely (a) packet capture block, (b) preprocessing block and (c) deterministic Dendritic Cell Algorithm (dDCA) signal processing block.…”

Section: Related Work and Contributionsmentioning

confidence: 99%

ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid

Radoglou-Grammatikis

Sarigiannidis

Efstathopoulos³

et al. 2020

Sensors

View full text Add to dashboard Cite

The advent of the Smart Grid (SG) raises severe cybersecurity risks that can lead to devastating consequences. In this paper, we present a novel anomaly-based Intrusion Detection System (IDS), called ARIES (smArt gRid Intrusion dEtection System), which is capable of protecting efficiently SG communications. ARIES combines three detection layers that are devoted to recognising possible cyberattacks and anomalies against (a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets and (c) operational data. Each detection layer relies on a Machine Learning (ML) model trained using data originating from a power plant. In particular, the first layer (network flow-based detection) performs a supervised multiclass classification, recognising Denial of Service (DoS), brute force attacks, port scanning attacks and bots. The second layer (packet-based detection) detects possible anomalies related to the Modbus packets, while the third layer (operational data based detection) monitors and identifies anomalies upon operational data (i.e., time series electricity measurements). By emphasising on the third layer, the ARIES Generative Adversarial Network (ARIES GAN) with novel error minimisation functions was developed, considering mainly the reconstruction difference. Moreover, a novel reformed conditional input was suggested, consisting of random noise and the signal features at any given time instance. Based on the evaluation analysis, the proposed GAN network overcomes the efficacy of conventional ML methods in terms of Accuracy and the F1 score.

show abstract

“…(2)Artificial SIR model contains multiple immune cells; (3)In complex systems, macrophages have many abilities: kill, immunoregulatory properties and antigen presentation;(4)Each cell has complex immune response in its own area, while multiple cells cooperate with each other. The immune response area in biology is spatial.…”

Section: The Artificial Sir Mechanism and Its Applicationsmentioning

confidence: 99%

“…Each immune cell serves as the main part of data mining, and meanwhile the function of exception handling can be ignored. As at present, many artificial immune algorithms based on biological immune mechanism are implemented in intrusion detection in cloud environment [1], intrusion detection in wireless sensor networks [6] and smart grid network attack detection [3], these applications are essentially a classification problem, therefore, considering the manual SIR mechanism, it can also be implemented in these fields.…”

Section: The Artificial Sir Mechanism and Its Applicationsmentioning

confidence: 99%

An artificial sequential immune responses model for anomaly detection

Wen

Liang

2020

Proceedings of the 2020 Genetic and Evolutionary Computation Conference Companion

View full text Add to dashboard Cite

Self-non-self discrimination and danger theory have long been the fundamental model of modern theoretical immunology. Based on these principles, some effective and efficient artificial immune algorithms have been proposed and applied to a wide range of engineering applications. Over the past years, a new idea called sequential immune responses (SIR) has been developed to challenge the classical negative selection model and danger theory. In this conceptual paper, we look at SIR from the perspective of artificial immune system (AIS) practitioners. An overview of the SIR is presented with particular emphasis on analogies in the AIS world. A number of potential application areas are then used to provide a framing for a critical assessment of the concept, and its relevance for AIS. CCS CONCEPTS • Security and privacy → Artificial immune systems;

show abstract

Deterministic Dendritic Cell Algorithm Application to Smart Grid Cyber-Attack Detection

Cited by 26 publications

References 9 publications

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid

An artificial sequential immune responses model for anomaly detection

Contact Info

Product

Resources

About