Prospect Theoretic Study of Honeypot Defense Against Advanced Persistent Threats in Power Grid

Tian, Wen; Ji, Xiaopeng; Liu, Weiwei; Liu, Guangjie; Zhai, Jiangtao; Dai, Yuewei; Huang, Shu-Hua

doi:10.1109/access.2020.2984795

Cited by 25 publications

(9 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among all critical infrastructures, the electric power grid has been attractive to scholars for several reasons: (1) the electric power grid has been at great risk of attack and threats tremendously 74 ; (2) electric power grid has been relatively more expensive than other infrastructures 75 ; (3) the electric grid is one of the most vital infrastructure during disasters (e.g., Hurricane Sandy in New York) since it is an indirect critical source of commodity for other vital sectors 56 . For these reasons, the analysis of the performance of power grids under dissemination of disinformation has attracted the most attention.…”

Section: Case Study: Performance Of the Electric Power Network Under ...mentioning

confidence: 99%

Protecting infrastructure performance from disinformation attacks

Jamalzadeh

Barker

González

et al. 2022

Sci Rep

View full text Add to dashboard Cite

Disinformation campaigns are prevalent, affecting vaccination coverage, creating uncertainty in election results, and causing supply chain disruptions, among others. Unfortunately, the problems of misinformation and disinformation are exacerbated due to the wide availability of online platforms and social networks. Naturally, these emerging disinformation networks could lead users to engage with critical infrastructure systems in harmful ways, leading to broader adverse impacts. One such example involves the spread of false pricing information, which causes drastic and sudden changes in user commodity consumption behavior, leading to shortages. Given this, it is critical to address the following related questions: (i) How can we monitor the evolution of disinformation dissemination and its projected impacts on commodity consumption? (ii) What effects do the mitigation efforts of human intermediaries have on the performance of the infrastructure network subject to disinformation campaigns? (iii) How can we manage infrastructure network operations and counter disinformation in concert to avoid shortages and satisfy user demands? To answer these questions, we develop a hybrid approach that integrates an epidemiological model of disinformation spread (based on a susceptible-infectious-recovered model, or SIR) with an efficient mixed-integer programming optimization model for infrastructure network performance. The goal of the optimization model is to determine the best protection and response actions against disinformation to minimize the general shortage of commodities at different nodes over time. The proposed model is illustrated with a case study involving a subset of the western US interconnection grid located in Los Angeles County in California.

show abstract

Section: Case Study: Performance Of the Electric Power Network Under ...mentioning

confidence: 99%

Protecting infrastructure performance from disinformation attacks

Jamalzadeh

Barker

González

et al. 2022

Sci Rep

View full text Add to dashboard Cite

show abstract

“…They claimed that the Honeypot deployment behind a firewall could be more successful in the production environment. The installation of a Honeypot in an external peripheral mode to defend against the advanced persistent threats proposed by Tian et al [4].…”

Section: A Honeypotmentioning

confidence: 99%

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

et al. 2020

View full text Add to dashboard Cite

In recent times, ransomware has become the most significant cyber-attack targeting individuals, enterprises, healthcare industries, and the Internet of Things (IoT). Existing security systems like Intrusion Detection and Prevention System (IDPS) and Anti-virus (AV) as a single monitoring agent is complicated and timeconsuming, thus fails in ransomware detection. A robust Intrusion Detection Honeypot (IDH) is proposed to address the issues mentioned above. IDH consists of i) Honeyfolder, ii) Audit Watch, and iii) Complex Event Processing (CEP). Honeyfolder is a decoy folder modeled using Social Leopard Algorithm (SoLA), especially for getting attacked and acting as an early warning system to alert the user during the suspicious file activities. AuditWatch is an Entropy module that verifies the entropy of the files and folders. CEP engine is used to aggregate data from different security systems to confirm the ransomware behavior, attack pattern, and promptly respond to them. The proposed IDH is experimentally tested in a secured testbed using more than 20 variants of recent ransomware of all types. The experimental result confirms that the proposed IDH significantly improves the ransomware detection time, rate, and accuracy compared with the existing state of the art ransomware detection model.

show abstract

“…e computer viruses of malware are researched such as Witte explored the detection of malware [23] and Peng et al focus on a survey of the propagation of malware [24]. Furthermore, the researches in APT including Li and Yang, improved the system of cloud memory under APT [25] and Tian et al defended against APT in power grid [26].…”

Section: Introductionmentioning

confidence: 99%

Predicting Spread Probability of Learning‐Effect Computer Virus

Yeh

Lin

Huang³

2021

Complexity

View full text Add to dashboard Cite

With the rapid development of network technology, computer viruses have developed at a fast pace. The threat of computer viruses persists because of the constant demand for computers and networks. When a computer virus infects a facility, the virus seeks to invade other facilities in the network by exploiting the convenience of the network protocol and the high connectivity of the network. Hence, there is an increasing need for accurate calculation of the probability of computer-virus-infected areas for developing corresponding strategies, for example, based on the possible virus-infected areas, to interrupt the relevant connections between the uninfected and infected computers in time. The spread of the computer virus forms a scale-free network whose node degree follows the power rule. A novel algorithm based on the binary-addition tree algorithm (BAT) is proposed to effectively predict the spread of computer viruses. The proposed BAT utilizes the probability derived from PageRank from the scale-free network together with the consideration of state vectors with both the temporal and learning effects. The performance of the proposed algorithm was verified via numerous experiments.

show abstract

Prospect Theoretic Study of Honeypot Defense Against Advanced Persistent Threats in Power Grid

Cited by 25 publications

References 33 publications

Protecting infrastructure performance from disinformation attacks

Protecting infrastructure performance from disinformation attacks

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

Predicting Spread Probability of Learning‐Effect Computer Virus

Contact Info

Product

Resources

About