Investigating the Influence of Special On–Off Attacks on Challenge-Based Collaborative Intrusion Detection Networks

Abstract

Abstract:Intrusions are becoming more complicated with the recent development of adversarial techniques. To boost the detection accuracy of a separate intrusion detector, the collaborative intrusion detection network (CIDN) has thus been developed by allowing intrusion detection system (IDS) nodes to exchange data with each other. Insider attacks are a great threat for such types of collaborative networks, where an attacker has the authorized access within the network. In literature, a challenge-based trust mechanism is effective at identifying malicious nodes by sending challenges. However, such mechanisms are heavily dependent on two assumptions, which would cause CIDNs to be vulnerable to advanced insider attacks in practice. In this work, we investigate the influence of advanced on-off attacks on challenge-based CIDNs, which can respond truthfully to one IDS node but behave maliciously to another IDS node. To evaluate the attack performance, we have conducted two experiments under a simulated and a real CIDN environment. The obtained results demonstrate that our designed attack is able to compromise the robustness of challenge-based CIDNs in practice; that is, some malicious nodes can behave untruthfully without a timely detection.

Detection of ICMPv6-based DDoS attacks using anomaly based intrusion detection system: A comprehensive review

“…Wherefore, current methods of the network defense are using, such as antivirus, firewalls and "Intrusion Detection system (IDS)" is a technique to detect any indications of unusual activity across many systems or networks and which the most popular security method [25], [28]. IDS were divided into two types: Host-based IDSs (HIDSs) and network-based IDSs (NIDSs) and divided into three classes: signature, anomaly, and hybrid detection, signature detection systems can detect attacks by using pattern matching and a list of the attack patterns, anomaly detection employs machine learning and data mining algorithms to attacks detection and Hybrid IDS uses both signature and anomaly detection [29], [30]. In addition, the attack can be mitigated by using encryption algorithms in order to secure the mobility of data [31].…”

Detecting insider attacks in medical cyber–physical networks based on behavioral profiling

“…They further proposed a machine learning-based approach in automatically allocating the values of intrusion sensitivity in real-world applications [31]. Several other related studies regarding IDS improvement can be referred to [32][33][34][35][36][37][38][39][40][41][42][43].…”

Designing collaborative blockchained signature-based intrusion detection in IoT environments

“…They introduced a passive message fingerprint attack (PMFA), which enable malicious nodes sending malicious feedback to only normal request and their trust values. They also developed a special On-Off attack (called SOOA) [23], in which malicious nodes could keep responding normally to one node while acting abnormally to another node. In addition, how to reduce the overload in communication is a critical issue for challenge mechanisms in different scenarios, e.g., healthcare [21,34].…”