Cyber-Attack Modeling Analysis Techniques: An Overview

Al-Mohannadi, Hamad; Mirza, Qublai Khan Ali; Namanya, Anitta Patience; Awan, Irfan; Cullen, Andréa; Disso, Jules Pagan

doi:10.1109/w-ficloud.2016.29

Cited by 76 publications

(39 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These modelling techniques can be used individually or in conjunction with other models. An overview can be found in Al-Mohannadi et al [2], which describes a number of cyber-attack modelling techniques developed to handle cyber attacks. Cyber-attack modelling techniques mainly concerned with identifying the attack patterns of the adversary but limited to provide an early intelligence before attack event.…”

Section: Related Workmentioning

confidence: 99%

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Al-Mohannadi

Awan

Hamar

2020

SOCA

Self Cite

View full text Add to dashboard Cite

The understanding of cyber threats to a network is challenging yet rewarding as it allows an organisation to prevent a potential attack. Numerous efforts have been made to predict cyber threat before they occur. To build a threat intelligence framework, an organisation must understand attack data collected from the network events and analyse them to identify the cyber attack artefacts such as IP address, domain name, tools and techniques, username and password, and geographic location of the attacker, which could be used to understand the nature of attack to a system or network. However, it is very difficult or dangerous to collect and analyse live data from a production system. Honeypot technology is well known for mimicking the real system while collecting actual data that can be in near real time in order to monitor the activities on the network. This paper proposes a threat intelligence approach analysing attack data collected using cloud-based web service in order to support the active threat intelligence.

show abstract

Section: Related Workmentioning

confidence: 99%

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Al-Mohannadi

Awan

Hamar

2020

SOCA

Self Cite

View full text Add to dashboard Cite

show abstract

“…Several cyberattack models have been analyzed in detail to help understand the vulnerability of NCSs. 38 In the work of Teixeira et al, 39 according to different implementations, cyberattacks are roughly divided into two types: (1) one is deception attacks, which destroy the controllability of system by injecting attack signals into the communication channel to modify the data packet, and (2) the other is denial of service (DoS), which destroys the availability of data and causes signal congestion and even blocking. In particular, stochastic cyberattacks are a kind of deception attacks whose appearance in the system is random and can be characterized by probability models.…”

Section: Introductionmentioning

confidence: 99%

Event‐triggered H_∞ synchronization control for switched master‐slave systems subject to stochastic cyber attacks and quantization

Liu

Qiu

et al. 2020

Optim Control Appl Methods

View full text Add to dashboard Cite

Summary This paper studies the event‐triggered H∞ control for synchronization of networked switched master‐slave systems under external disturbance, stochastic attacks, and quantization. With the proposed event‐triggering schemes, the communication frequency and data packets can be effectively regulated and reduced. To reduce further the burden of network transmission, the quantized control is applied. Moreover, the network transmission delay and the stochastic cyberattacks are concerned. In addition, the synchronization problem between switched master systems and switched slave systems is transformed into a stability problem of switched error systems. By adopting multiple Lyapunov functions and average dwell time method, sufficient conditions are constructed to assure the mean‐square exponential stability with H∞ performance of the switched error systems. Meanwhile, the stagger between data switching instants and triggering instants is discussed in the system in detail. Accordingly, the controller gains and event‐triggering parameters are obtained utilizing a set of linear matrix inequalities. Finally, a numerical simulation and a practical example are illustrated to demonstrate the effectiveness of the presented method.

show abstract

“…Al-Mohannadi et al [7] provided an insight into Cyber-attack modeling techniques. This review advances a significant array of and sheds further light on cyber-attack modeling.…”

Section: Introductionmentioning

confidence: 99%

Quantitative Evaluation of Cyber-Attacks on a Hypothetical School Computer Network

Akinola¹,

Adekoya²,

Kuye³

et al. 2019

JIS

View full text Add to dashboard Cite

This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are plausible. Considered for the network system are two possible network attack paths. One network path represents an attack through the Internet, and the other represents an attack through the Wireless Access Points (WAPs) in the school network. The probabilities of success of the events, that is, 1) the attack payoff, and 2) the commitment of the attacker to infiltrate the network are estimated for the leaf nodes. These are used to calculate the Returns on Attacks (ROAs) at the Root Nodes. For Phase I, the "As Is" network, the ROA values for both attack paths, are higher than 7 (8.00 and 9.35 respectively), which are high values and unacceptable operationally. In Phase II, countermeasures are implemented, and the two attack trees reevaluated. The probabilities of success of the events, the attack payoff and the commitment of the attacker are then re-estimated. Also, the Returns on Attacks (ROAs) for the Root Nodes are re-assessed after executing the countermeasures. For one attack tree, the ROA value of the Root Node was reduced to 4.83 from 8.0, while, for the other attack tree, the ROA value of the Root Node changed to 3.30 from 9.35. ROA values of 4.83 and 3.30 are acceptable as they fall within the medium value range. The efficacy of this method whereby, attack trees are deployed to mitigate computer network risks, as well as using it to assess the vulnerability of computer networks is quantitatively substantiated.

show abstract

Cyber-Attack Modeling Analysis Techniques: An Overview

Abstract: To see the final version of this work please visit the publisher's website. Access to the published online version may require a subscription.

Cited by 76 publications

References 9 publications

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Event‐triggered H_∞ synchronization control for switched master‐slave systems subject to stochastic cyber attacks and quantization

Quantitative Evaluation of Cyber-Attacks on a Hypothetical School Computer Network

Contact Info

Product

Resources

About

Cyber-Attack Modeling Analysis Techniques: An Overview

Abstract: To see the final version of this work please visit the publisher's website. Access to the published online version may require a subscription.

Cited by 76 publications

References 9 publications

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Event‐triggered H∞ synchronization control for switched master‐slave systems subject to stochastic cyber attacks and quantization

Quantitative Evaluation of Cyber-Attacks on a Hypothetical School Computer Network

Contact Info

Product

Resources

About

Event‐triggered H_∞ synchronization control for switched master‐slave systems subject to stochastic cyber attacks and quantization