arXiv subjects

Kevin Jones

Publications and source records attributed to Kevin Jones.

7 recordsLinked to original sources

arXiv2019

Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems

Neural networks are increasingly used for intrusion detection on industrial control systems (ICS). With neural networks being vulnerable to adversarial examples, attackers who wish to cause damage to an ICS can attempt to hide their attacks from detection by using adversarial example techniques. In this work we address the domain specific challenges of constructing such attacks against autoregressive based intrusion detection systems (IDS) in an ICS setting. We model an attacker that can compromise a subset of sensors in a ICS which has a LSTM based IDS. The attacker manipulates the data sent to the IDS, and seeks to hide the presence of real cyber-physical attacks occurring in the ICS. We evaluate our adversarial attack methodology on the Secure Water Treatment system when examining solely continuous data, and on data containing a mixture of discrete and continuous variables. In the continuous data domain our attack successfully hides the cyber-physical attacks requiring 2.87 out of 12 monitored sensors to be compromised on average. With both discrete and continuous data our attack required, on average, 3.74 out of 26 monitored sensors to be compromised.

cs.CR↗

arXiv2019

Deep Latent Defence

Deep learning methods have shown state of the art performance in a range of tasks from computer vision to natural language processing. However, it is well known that such systems are vulnerable to attackers who craft inputs in order to cause misclassification. The level of perturbation an attacker needs to introduce in order to cause such a misclassification can be extremely small, and often imperceptible. This is of significant security concern, particularly where misclassification can cause harm to humans. We thus propose Deep Latent Defence, an architecture which seeks to combine adversarial training with a detection system. At its core Deep Latent Defence has a adversarially trained neural network. A series of encoders take the intermediate layer representation of data as it passes though the network and project it to a latent space which we use for detecting adversarial samples via a $k$-nn classifier. We present results using both grey and white box attackers, as well as an adaptive $L_{\infty}$ bounded attack which was constructed specifically to try and evade our defence. We find that even under the strongest attacker model that we have investigated our defence is able to offer significant defensive benefits.

cs.LG↗

arXiv2018

Developing Cyber Buffer Zones

The United Nations conducts peace operations around the world, aiming tomaintain peace and security in conflict torn areas. Whilst early operations werelargely successful, the changing nature of warfare and conflict has often left peaceoperations strugglingto adapt. In this article, we make a contribution towardsefforts to plan for the next evolution in both intra and inter-state conflict: cyberwarfare. It is now widely accepted that cyber warfare will be a component offuture conflicts, and much researchhas been devoted to how governments andmilitaries can prepare for and fight in this new domain [1]. Despite the vastamount of research relating to cyber warfare, there has been less discussion onits impact towards successful peace operations. This is agap in knowledge thatis important to address, since the restoration of peace following conflict of anykind is of global importance. It is however a complex topic requiring discussionacross multiple domains. Input from the technical, political, governmental andsocietal domains are critical in forming the concept of cyber peacekeeping.Previous work on this topic has sought to define the concept of cyber peacekeeping[2, 3, 4]. We build upon this work by exploring the practicalities ofstarting up a cyber peacekeeping component and setting up a Cyber Buffer Zone (CBZ).

cs.CY↗

arXiv2018

Developing Cyber Peacekeeping: Observation, Monitoring and Reporting

Cyber peacekeeping is an emerging and multi-disciplinary field of research, touching upon technical, political and societal domains of thought. In this article we build upon previous works by developing the cyber peacekeeping activity of observation, monitoring and reporting. We take a practical approach: describing a scenario in which two countries request UN support in drawing up and overseeing a ceasefire which includes cyber terms. We explore how a cyber peacekeeping operation could start up and discuss the challenges it will face. The article makes a number of proposals, including the use of a virtual collaborative environment to bring multiple benefits. We conclude by summarising our findings, and describing where further work lies.

cs.CY↗

arXiv2017

Internet of Cloud: Security and Privacy issues

The synergy between the cloud and the IoT has emerged largely due to the cloud having attributes which directly benefit the IoT and enable its continued growth. IoT adopting Cloud services has brought new security challenges. In this book chapter, we pursue two main goals: 1) to analyse the different components of Cloud computing and the IoT and 2) to present security and privacy problems that these systems face. We thoroughly investigate current security and privacy preservation solutions that exist in this area, with an eye on the Industrial Internet of Things, discuss open issues and propose future directions

cs.CR↗

arXiv2017

An Introduction to Cyber Peacekeeping

Peacekeeping is a noble and essential activity, helping to bring peace to conflict torn areas and providing security to millions of people around the world. Peacekeepers operate in all domains of war: buffer zones on land, no fly zones in the air and ensuring free passage at sea. With the emergence of cyberspace as a domain of war, questions on the role of peacekeeping in this domain naturally arise. There is extensive research around the topic of cyber warfare, but surprisingly little on how to restore and maintain peace in its aftermath. This is a significant gap which needs addressing. We begin by providing an overview of peacekeeping, describing its overarching goals and principles, using the United Nations model as a reference. We then review existing literature on cyber peacekeeping. The paper progresses to discuss the question of whether cyber peacekeeping is needed, and if so, if it is a plausible concept. We explore some ideas on how cyber peacekeeping could be performed and the challenges cyber peacekeepers will face, before making suggestions on where future work should be focused.

cs.CY↗

arXiv2017

Early Stage Malware Prediction Using Recurrent Neural Networks

Static malware analysis is well-suited to endpoint anti-virus systems as it can be conducted quickly by examining the features of an executable piece of code and matching it to previously observed malicious code. However, static code analysis can be vulnerable to code obfuscation techniques. Behavioural data collected during file execution is more difficult to obfuscate, but takes a relatively long time to capture - typically up to 5 minutes, meaning the malicious payload has likely already been delivered by the time it is detected. In this paper we investigate the possibility of predicting whether or not an executable is malicious based on a short snapshot of behavioural data. We find that an ensemble of recurrent neural networks are able to predict whether an executable is malicious or benign within the first 5 seconds of execution with 94% accuracy. This is the first time general types of malicious file have been predicted to be malicious during execution rather than using a complete activity log file post-execution, and enables cyber security endpoint protection to be advanced to use behavioural data for blocking malicious payloads rather than detecting them post-execution and having to repair the damage.

cs.CR↗