Internet Industrial Control Systems (IICSs) that connect technological appliances and services with physical systems have become a new direction of research as they face different types of ...cyber-attacks that threaten their success in providing continuous services to organizations. Such threats cause firms to suffer financial and reputational losses and the stealing of important information. Although Network Intrusion Detection Systems (NIDSs) have been proposed to protect against them, they have the difficult task of collecting information for use in developing an intelligent NIDS which can proficiently detect existing and new attacks. In order to address this challenge, this paper proposes an anomaly detection technique for IICSs based on deep learning models that can learn and validate using information collected from TCP/IP packets. It includes a consecutive training process executed using a deep auto-encoder and deep feedforward neural network architecture which is evaluated using two well-known network datasets, namely, the NSL-KDD and UNSW-NB15. As the experimental results demonstrate that this technique can achieve a higher detection rate and lower false positive rate than eight recently developed techniques, it could be implemented in real IICS environments.
Industrial Internet of Thing (IIoT) systems are considered attractive ransomware targets because they operate critical services that affect human lives and have substantial operational costs. The ...major concern is with brownfield IIoT systems since they have legacy edge systems that are not fully prepared to integrate with IoT technologies. Various existing security solutions can detect and mitigate such attacks but are often ineffective due to the heterogeneous and distributed nature of the IIoT systems and their interoperability demands. Consequently, developing new detection solutions is essential. Therefore, this paper proposes a novel targeted ransomware detection model tailored for IIoT edge systems. It uses Asynchronous Peer-to-Peer Federated Learning (AP2PFL) and Deep Learning (DL) techniques as a targeted ransomware detection algorithm. The proposed model consists of two modules: 1) Data Purifying Module (DPM) aims to refine and reconstruct a valuable and robust representation of data based on Contractive Denoising Auto-Encoder (CDAE), and 2) Diagnostic and Decision Module (DDM) is used to identify targeted ransomware and its stages based on Deep Neural Network (DNN) and Batch Normalization (BN). The main strengths of this proposed model include: 1) each edge gateway's modules work cooperatively with its neighbors in an asynchronous manner and without a third party, 2) it deals with both homogeneous and heterogeneous data, and 3) it is robust against evasion attacks. An exhaustive set of experiments on three datasets prove the high effectiveness of the proposed model in detecting targeted ransomware (known and unknown attacks) in brownfield IIoT and the superiority over the state-of-the-art models.
Much value in a brownfield Industrial Internet of Things (IIoT) implementation resides at its edge tier, where new types of devices and technologies are deployed to interoperate the legacy industrial ...control systems with servers and systems in the cloud, and leverage the benefits of the Internet of Things technologies. One of these novel devices is the IIoT edge gateway, which is used to connect critical physical systems with the cyber world, and to provide consistent storage, processing, and analytical and controlling capabilities. However, these devices also come with new and advanced threats such as targeted ransomware. In this paper, we investigate this threat in detail. We studied the threat actors' motivations, the anatomy of ransomware for edge gateways, and the likelihood of such ransomware attack to happen in the future. We found that threat actors find IIoT edge gateways attractive ransomware targets due to their vital roles and functionalities in working with critical infrastructure and that the likelihood of such attack to occur is high. We built the first version of a ransomware security testbed for IIoT, and for test purposes, we developed a first version of ransomware target at IIoT edge gateway in a brownfield system. From our measurements we conclude that kernel-related activity parameters are significant indicators of the abnormal behavior caused by crypto-ransomware attacks in IIoT edge gateways, much more so even than for similar attacks in information technology server workstation. Thereby, some potential countermeasures for addressing targeted ransomware in IIoT systems are recommended as proactive strategies for dealing with attackers' new techniques and tactics.
Industrial Internet of Things (IIoT) is a high-value cyber target due to the nature of the devices and connectivity protocols they deploy. They are easy to compromise and, as they are connected on a ...large scale with high-value data content, the compromise of any single device can extend to the whole system and disrupt critical functions. There are various security solutions that detect and mitigate intrusions. However, as they lack the capability to deal with an IIoT's co-existing heterogeneity and interoperability, developing new universal security solutions to fit its requirements is critical. This is challenging due to the scarcity of accurate data about IIoT systems' activities, connectivities, and attack behaviors. In addition, owing to their multiplatform connectivity protocols and multivendor devices, collecting and creating such data are also challenging. To tackle these issues, we propose a holistic approach for generating an appropriate intrusion data set for an IIoT called X-IIoTID, a connectivity-agnostic and device-agnostic intrusion data set for fitting the heterogeneity and interoperability of IIoT systems. It includes the behaviors of new IIoT connectivity protocols, activities of recent devices, diverse attack types and scenarios, and various attack protocols. It defines an attack taxonomy and consists of multiview features, such as network traffic, host resources, logs and alerts. X-IIoTID is evaluated using popular machine and deep learning algorithms and compared with 18 intrusion data sets to verify its novelty.
Online reviews significantly impact consumers who are purchasing or seeking services via the Internet. Businesses and review platforms need to manage these online reviews to avoid misleading ...customers through fake ones. This necessitates developing intelligent solutions to detect these fake reviews and prevent their negative impact on businesses and customers. Therefore, many fake review detection models have been proposed to help distinguish fake reviews from genuine ones. However, these techniques depend on a limited perspective of features, mainly review content, to detect fake reviews, leading to poor performance in discovering the new patterns of fake review content and the dynamic behaviour of spammers. Therefore, there is still a need to develop new solutions to detect the new patterns of fake reviews. Hence, this paper proposes an explainable multi-view deep learning model to identify fake reviews based on different feature perspectives and classifiers. The proposed model can extract essential features from different perspectives, including review content, reviewer data, and product description. Moreover, we employ an ensemble approach that combines three popular deep learning algorithms: Bi-LSTM, CNN, and DNN, to enhance the performance of the fake review detection model. The results of two real-life datasets presented demonstrated the efficiency of our proposed model, where it outperformed the state-of-the-art methods with improvements ranging from 1% to 7% in terms of the AUC metric. To provide visibility into the outcomes of our proposed model and demonstrate the trust and transparency in the obtained results, we also offer a comprehensive explanation for our model results using Shapely Additive Explanations (SHAP) method and attention techniques. The experimental results prove that our proposed model can provide reasonable explanations that help users understand why specific reviews are classified as fake.
Internet of Medical Things (IoMT) devices and systems are often designed without adequate security, leaving them highly susceptible to cyber threats. Unlike other IoT applications and devices, cyber ...attacks against IoMT devices will pose significant risks to patient safety. As a result of the progress made in attack detection through machine learning, numerous applications of machine learning are now involved in IoMT. However, how to securely collect and fuse the data from heterogeneous IoMT devices and systems and ensure efficient cyber-attack detection while avoiding the privacy disclosure of the dataset remains challenging for IoMT systems. To fill this gap, a new privacy-aware framework is advised for storing the collected IoMT data in distributed cloud nodes and providing data fusion of heterogeneous IoMT data using differential privacy and deep learning and efficient attack detection using quantum deep learning with maintaining data privacy. Specifically, the proposed privacy-aware framework provides sensitive data privacy protection at multi-levels starting from storing data in distributed cloud nodes with privacy-preserving and then fusing IoMT heterogeneous data using deep contractive autoencoder with differential privacy for protecting the sensitive data through the learning process and then using the output of data fusion which is reduced data dimension as input for a quantum neural network for identifying cyber-attacks. Our experimental results indicate that the proposed framework is highly effective in detecting cyber-attacks.
•A multi-level of privacy protection is put forward for IoMT data.•An intelligent fusion module is proposed for effective data fusion and reduction.•Quantum deep learning is introduced to detect the attacks in the IoMT data.•Superior performance using two datasets with heterogeneous IoMT data.
While achieving security for Industrial Internet of Things (IIoT) is a critical and nontrivial task, more attention is required for brownfield IIoT systems. This is a consequence of long life cycles ...of their legacy devices which were initially designed without considering security and IoT connectivity, but they are now becoming more connected and integrated with emerging IoT technologies and messaging communication protocols. Deploying today's methodologies and solutions in brownfield IIoT systems is not viable, as security solutions must co-exist and fit these systems' requirements. This necessitates a realistic standardized IIoT testbed that can be used as an optimal format to measure the credibility of security solutions of IIoT networks, analyze IIoT attack landscapes and extract threat intelligence. Developing a testbed for brownfield IIoT systems is considered a significant challenge as these systems are comprised of legacy, heterogeneous devices, communication layers and applications that need to be implemented holistically to achieve high fidelity. In this article, we propose a new generic end-to-end IIoT security testbed, with a particular focus on the brownfield system and provide details of the testbed's architectural design and the implementation process. The proposed testbed can be easily reproduced and reconfigured to support the testing activities of new processes and various security scenarios. The proposed testbed operation is demonstrated on different connected devices, communication protocols and applications. The experiments demonstrate that this testbed is effective in terms of its operation and security testing. A comparison with existing testbeds, including a table of features is provided.
Artificial intelligence (AI) advancements have revolutionized many critical domains by providing cost-effective, automated, and intelligent solutions. Recently, ChatGPT has achieved a momentous ...change and made substantial progress in natural language processing. As such, a chatbot-driven AI technology has the capabilities to interact and communicate with users and generate human-like responses. ChatGPT, on the other hand, has the potential to influence changes in the cybersecurity domain. ChatGPT can be utilized as a chatbot-driven security assistant for penetration testing to analyze, investigate, and develop security solutions. However, ChatGPT raises concerns about how the tool can be used for cybercrime and malicious activities. Attackers can use such a tool to cause substantial harm by exploiting vulnerabilities, writing malicious code, and circumventing security measures on a targeted system. This article investigates the implications of the ChatGPT model in the domain of cybersecurity. We present the state-of-the-art practical applications of ChatGPT in cybersecurity. In addition, we demonstrate in a case study how a ChatGPT can be used to design and develop False data injection attacks against critical infrastructure such as industrial control systems. Conversely, we show how such a tool can be used to help security analysts to analyze, design, and develop security solutions against cyberattacks. Finally, this article discusses the open challenges and future directions of ChatGPT in cybersecurity.
Human-to-machine (H2M) communication is an important evolution in the industrial internet of health things (IIoHT), where many H2M interfaces are remotely interacting with industrial and medical ...assets. Lightweight protocols, such as constrained application protocol (CoAP), have been widely utilised in transferring sensing data of medical devices to end-users in smart satellite-based healthcare IIoT networks (SmartSat-IIoHT). However, such protocols are extensively deployed without appropriate security configurations, making attackers’ mission easier for abusing these protocols to launch advanced cyber threats. This paper, therefore, presents a new threat intelligence framework to examine and model CoAP protocol’s attacks in these systems. We present a ransom denial of service (RDoS) as a new threat that would exploit this protocol’s vulnerabilities. We propose many RDoS attack’s techniques to understand the attack indicators and analyse their behaviour on systems. Moreover, we present a real-time discovery of attacks’ network behaviours using deep learning. The experiment results demonstrate that this proposed discovery model obtains a better performance in revealing RDoS than other conventional machine learning algorithms and accomplishing high fidelity of protecting SmartSat-IIoHT networks.
PDF
