The increasing interconnections and rapid changes in the nature of cyber threats targeting the Industrial Control Systems (ICS), it is crucial to understand how the malware patterns and behavior have evolved over the years. Gaining this understanding allows us to assess the effectiveness of current detection and defense mechanisms. Insights from this work will help in building effective defenses to counter such sophisticated behavior. Traditional threat analysis methods rely on text heavy representations, making it difficult to identify attack trends efficiently. This work improves the usability of the MITRE ATT&CK framework by automating the extraction, comparison, and visualization of malware attack techniques. By analyzing five ICS targeting malware families BlackEnergy, Industroyer, Industroyer2, Pipedream, and Triton, our developed tool identifies recurring adversary tactics and provides structured heatmaps and network graphs for improved threat intelligence. This approach enables analysts to compare malware behaviors more effectively, prioritize security strategies, and strengthen ICS cybersecurity resilience.

Industrial Control Systems (ICSs), widely employed in many critical infrastructure sectors that manage and control physical processes (e.g., energy, water, transportation), face heightened security risks due to increased digitization and connectivity. Monitoring Indicators of Compromise (IoCs), observable signs of intrusion, such as unusual network activity or unauthorized system changes, are crucial for early detection and response to malicious activities, including data breaches and insider threats. While IoCs have been extensively studied in traditional Information Technology (IT), their effectiveness and suitability for the unique challenges of ICS environments, which directly control physical processes, remain unclear. Moreover, the influence of human factors (e.g., sociotechnical factors, usability) on the utilization and interpretation of IoCs for attack prevention in ICSs is not well understood. To address this gap, we conducted two studies involving 52 ICS security professionals. In an IoC Applicability study (n=32), we explore the relevance of existing IoCs within ICS environments and investigate factors contributing to potential ambiguities in their interpretation. We examine the perceived value, effort required for the collection, and volatility of various data sources used for IoC identification. Participants in the IoC Applicability Study emphasized the significant role of human factors in recognizing and interpreting IoCs for threat mitigation within ICS ecosystems. Based on this insight, we conducted a Socio-technical Factors in Recognition and Detection study (n=20) to investigate the impact of human factors on threat detection and explore the sociotechnical factors that influence the effective utilization of IoCs. Our results show significant discrepancies between conventional IT-based IoCs and their applicability to ICS environments, along with various socio-technical challenges (e.g., alert overload and desensitization). Our study provides pointers to rethinking the specific operational, technological, and human aspects of IoCs within the ICS context. Our findings provide insights for the development of ICS-specific IoC to enable security analysts to better respond to potential threats in industrial environments.

This work aims to leverage large language models (LLMs) and a featureless approach to effectively detect vulnerabilities in Internet of Things (IoT) network traffic. By directly learning from the Ripple20 dataset, a featureless LLM model, CyBERT, was designed that can efficiently distinguish between secure and vulnerable IoT devices without relying on handcrafted features. This LLM-based classifier could be instrumental in identifying IoT networks that pose potential threats to other connected devices by uncovering critical vulnerabilities. The experimental results demonstrate the exceptional capabilities of the featureless CyBERT model, which achieves high accuracy, precision, recall, and F1score in detecting zero-day vulnerabilities. Moreover, the model significantly outperforms traditional methods in terms of detection speed. These results have profound implications for the future of IoT security, paving the way for real-time threat and attack detection.

Energy Internet is well-known nowadays for enabling bidirectional V2G communication; however, with communication and computation abilities, V2G systems become vulnerable to cyber-attacks and unauthorised access. An authentication protocol verifies the identity of an entity, establishes trust, and allows access to authorized resources while preventing unauthorized access. Research challenges for vehicle-to-grid authentication protocols include quantum security, privacy, resilience to attacks, and interoperability. The majority of authentication protocols in V2G systems are based on public-key cryptography and depend on some hard problems like integer factorization and discrete logs to guarantee security, which can be easily broken by a quantum adversary. Besides, ensuring both information security and entity privacy is equally crucial in V2G scenarios. Consequently, this work proposes a quantum-secured privacy-preserving key authentication and communication (QSKA) protocol using superdense coding and a hash function for unconditionally secure V2G communication and privacy. QSKA uses a password-based authentication mechanism, enabling V2G entities to securely transfer passwords using superdense coding. The QSKA security verification is performed in proof-assistant Coq. The security analysis and performance evaluation of the QSKA show its resiliency against well-known security attacks and reveal its enhanced reliability and efficiency with respect to state-of-the-art protocols in terms of computation, communication, and energy overhead.

Industrial Cyber-Physical Systems (ICPS) are highly dependent on Supervisory Control and Data Acquisition (SCADA) for process monitoring and control. Such SCADA systems are known to communicate using various insecure protocols such as Modbus, DNP3, and Open Platform Communication (OPC) Data Access standards (providing access to real-time automation data), which are vulnerable to a range of attacks. This leads to increased cyber risks faced in critical infrastructures, especially in the Oil and Gas sector. One of the most popular and critical attacks deployed against such infrastructure is Denial of Service (DoS), as it can have severe consequences that range from financial loss to loss of life. Such attacks can disrupt the ability of an operator to control hazardous operations leading to potentially unsafe scenarios. A novel Field Flooding attack is described which takes advantage of the packet memory structure of the Modbus protocol to perform a DoS attack. This attack can cause overflowing of the memory bank allocated in the Programmable Logic Controller (PLC) for Modbus operations. The attack is deployed and evaluated on a real industrial testbed and its impact against the Mitre ATT&CK framework is assessed, in order to identify which tactics an adversary could use to compromise the system. A novel mechanism that utilises supervised machine learning to detect this attack in industrial control system networks is also described. Experimental results show that the proposed mechanism, using the XGBoost algorithm, can identify this attack with 99% accuracy.

Numerous sophisticated and nation-state attacks on Industrial Control Systems (ICSs) have increased in recent years, exemplified by Stuxnet and Ukrainian Power Grid. Measures to be taken post-incident are crucial to reduce damage, restore control, and identify attack actors involved. By monitoring Indicators of Compromise (IOCs), the incident responder can detect malicious activity triggers and respond quickly to a similar intrusion at an earlier stage. However, to implement IOCs in critical infrastructures, we need to understand their contexts and requirements. Unfortunately, there is no survey paper in the literature on IOC in the ICS environment, and only limited information is provided in research articles. In this article, we describe different standards for IOC representation and discuss the associated challenges that restrict security investigators from developing IOCs in the industrial sectors. We also discuss the potential IOCs against cyber-attacks in ICS systems. Furthermore, we conduct a critical analysis of existing works and available tools in this space. We evaluate the effectiveness of identified IOCs’ by mapping these indicators to the most frequently targeted attacks in the ICS environment. Finally, we highlight the lessons to be learned from the literature and the future problems in the domain along with the approaches that might be taken.

Recent development of smart cities includes advanced and necessary use of modern smart grid (SG), than the traditional power grid. The paradigm of SG has also transformed houses into a home area networks (HAN). In HAN, several smart devices and appliances are connected to the electricity control centers (ECC). Appliances share their load and consumption related information to ECC through smart meters. The consumption data may be used for supply-demand management, for example, by ramping production up or down as needed. However, security and privacy of the consumers data are greatly important, since fine-grained smart meter data may reveal an users presence/absence in his/her house. To address this issue, several public-key-based or identity-based data aggregation schemes have been proposed in the literature. However, most of such schemes either suffer from the complexity of certificate management or key escrow problem. To eliminate these issues, in this paper we propose an efficient certificate-based data aggregation (CB-DA) scheme. In the proposed CB-DA scheme, the owner selects a secret key and then use the secret key along with certificates as decryption/signing keys.

Smart Grid (SG) networks, as a part of critical national infrastructure, are vulnerable to sophisticated cyber-physical attacks. Specifically, a coordinated false data injection attack aiming to generate fake transient measurements in the SG's Automatic Generation Control (AGC), can cause unwarranted actions and blackouts in the worst scenario. Unlike other works that overlook contextual correlations, this work utilizes contextual prior information and a temporal model to detect cyber-attacks. Specifically, we depart from the traditional deep learning anomaly detection, driven by black-box detection; instead, we envision an approach based on physics-informed hybrid deep learning detection. Our approach utilizes the combination of process control-based variational autoencoder, prior knowledge of physics, and long short-term memory for a false data injection attack detection. To the best of our knowledge, our method is the first contextual-based anomaly detection that incorporates process control-based prior information in the smart grid. The proposed approach is evaluated on the modified high-class PowerWorld simulated dataset based on the IEEE 37-bus model. Our experiments observe the lowest reconstruction error and offer 96.9% accuracy, demonstrating superiority over other baselines.

Industrial Cyber-Physical Systems (ICPS) make significant use of Supervisory Control and Data Acquisition (SCADA) for control. Such SCADA systems are known to utilise insecure communication protocols such as Modbus, DNP3 and OPC DA. This leads to increased cyber risks faced in critical infrastructures, as these protocols allow threat actors to mount attacks like Denial of Service (DoS). We present a novel field flooding attack, compromising the structure of the ModbusTCP packet and disrupting a controller's interpretation of the commands sent to it. This can disrupt the ability of an operator to control hazardous operations leading to potentially unsafe scenarios.

Automatic Generation Control (AGC) is used in smart grid systems to maintain the grid's frequency to a nominal value. Cyber-attacks such as time delay and false data injection on the tie-line power flow, frequency measurements, and Area Control Error (ACE) control signals can cause frequency excursion that can trigger load shedding, generators' damage, and blackouts. Therefore, resilience and detection of attacks are of paramount importance in terms of the reliable operation of the grid. In contrast with the previous works that overlook ACE resiliency, this paper proposes an approach for cyber-attack detection and resiliency in the overall AGC process. We propose a state estimation algorithm approach for the AGC system by utilizing prior information based on Gaussian process regression, a non-parametric, Bayesian approach to regression. We evaluate our approach using the PowerWorld simulator based on the three-area New England IEEE 39-bus model. Moreover, we utilize the modified version of the New England ISO load data for the three-area power system to create a more realistic dataset. Our results clearly show that our resilient control system approach can mitigate the system using predictive control and detect the attack with a 100 percent detection rate in a shorter period using prior auxiliary information.

The Smart Grid is vulnerable to cyber-attacks due to its integration with a variety of information, communication, and control technologies. If undetected by deployed security systems, cyber-attacks could damage critical power system infrastructure and disrupt services to a very large number of energy customers. In particular, cyber attackers could hijack the smart grid by injecting malicious commands. To provide insight into these concerns, we propose an approach that develops a new tool for the real-time Cyber-Physical Security Assessment (CPSA) of malicious control commands that target physical smart grid components. The tool is able to detect and protect the system against known Trojans (such as BlackEnergy). It also efficiently and effectively monitors the health of the power system in real-time and detects the presence of malicious commands. The security analysis of our approach includes a look at three system-generated metrics: system susceptibility, access points, and threat capability. The performance analysis includes a look at the system overhead, scalability, accuracy, robustness, and execution and response times. Our proposed approach was tested on a 42-bus power system with 24 substations. The developed tool could be extended and used by power system operators to assess and mitigate the impact of cyber-attacks on the smart grid.

Successful deployment of Long-Range Wide Area Network (LoRaWAN) technology in several Industrial Internet of Things (IIoT) scenarios, such as Outage Management System (OMS) in smart metering, rely on low energy consumption of the end device. In this work, we conducted an experiment to demonstrate an on-off Denial-of-Service (DoS) attack to analyze the impact on the energy consumption of the LoRaWAN end device. We implemented the attack that manipulates the end device to remain in packet retransmission mode for several seconds. The conducted experiments show that the configurable parameters of LoRaWAN that are required for applications, like OMS, are susceptible to energy consumption attacks. In summary, our results show that when an on-off DoS attack is performed, the end device utilizing the Spreading Factor (SF) 12 consumes 92 times more energy due to packet retransmissions as compared to the end node using SF 7 under no attack.

No abstract available.

Short Message Service (SMS) is a widely used communication medium for mobile applications, such as banking, social networking, and e-commerce. Applications of SMS services also include real-time broadcasting messages, such as notification of natural disasters (e.g., bushfires and hurricane) and terrorist attacks, and sharing the current whereabouts to other users, such as notifying urgent business meeting information, transmitting quick information in the battlefield to multiple users, notifying current location to our friends and sharing market information. However, traditional SMS is not designed with security in mind (e.g., messages are not securely sent). It is also possible to extract international mobile subscriber identity of the mobile user. In the literature, there is no known protocol that could enable secure transmission of SMS from one user to multiple users simultaneously. In this paper, we introduce a batch verification authentication and key agreement protocol, BVPSMS, which provides end-to-end message security over an insecure communication channel between different mobile subscribers. Specifically, the proposed protocol securely transmits SMS from one mobile user to many other users simultaneously. The reliability of the protocol is discussed along with an algorithm to detect malicious user requests in a batch. We then evaluate the performance of the proposed protocol in terms of communication and computation overheads, protocol execution time, and batch and re-batch verification times. The impacts of the user mobility, and the time, space and cost complexity analysis are also discussed. We then present a formal security proof of the proposed protocol. To the best of our knowledge, this is the first provably-secure batch verification protocol that delivers end-to-end SMS security using symmetric keys.

Mobile operators offer a wide range of value-added services (VAS) to their subscribers (i.e., mobile users), which in turn generates around 15% of the telecommunication industry revenue. However, simultaneous VAS requests from a large number of mobile devices to a single server or a cluster in an internet-of-things (IoT) environment could result in an inefficient system, if these requests are handled one at a time as the present traditional cellular network scenario is. This will not only slow down the server's efficiency but also adversely impacts the performance of the network. The current (insecure) practice of transmitting user identity in plaintext also results in traceability. In this paper, we introduce the first known protocol designed to efficiently handle multiple VAS requests at one time, as well as ensuring the secure delivery of the services to a large number of requesting mobile users. The proposed batch verification protocol (BAS-VAS) is capable of authenticating multiple simultaneous requests received by a large number of mobile users. We demonstrate that the protocol preserves user privacy over the network. The provider's servers ensure the privacy of the requested service's priority by performing sorting over encrypted integer data. The simulation results also demonstrate that the proposed protocol is lightweight and efficient in terms of communication and computation overheads, protocol execution time, and batch and re-batch verification delay. Specifically, we perform batch and re-batch verification (after detecting and removing malicious requests from the batch) for multiple requests in order to improve the overall efficiency of the system, as well as discussing time, space and cost complexity analysis, along with the security proof of our protocol using Proverif.

Smart grid (SG) is a modernized power grid that uses information and communication technologies for bidirectional flow of information between the power utilities and the consumers. Nowadays, the focus of SG has shifted towards intelligent processing and control of various operations in order to provide high quality of experience to the end users domain (consumers, smart devices, utility, etc). Therefore, in near future, for smooth execution of various operations in SG, high volume of data is expected to move across different inter-connected smart devices. So, to handle this challenge, a self-configurable network technology known as software-defined networking (SDN)that provides faster and dynamic forwarding of data through adaptable flow-table management is a viable solution. However, in SDN- enabled SG systems, security and privacy are major challenges that need to be handled effectively. So, in this paper, a lattice-based cryptosystem for secure communication in SG environment, called LaCSys, is presented which works in three phases. In first phase, a secure authentication between all the network communication entities based on lattice based key exchange scheme is designed using a third party auditor (TPA). In second phase, a lightweight lattice-based public-key encryption scheme is designed to provide data confidentiality and integrity. In last phase, a temporary key-based scheme for detection of suspicious activity is designed. The proposed crytosystem is evaluated and compared with existing scheme in order to prove its effectiveness.

The threat of traffic analysis attacks against the Tor System is an acknowledged and open research issue, especially in critical infrastructures, motivating the need for continuous research into the potential attacks and countermeasures against this threat. This paper aims to provide an in-depth study into the driving technical mechanisms of the current state-of-art Tor System (Browser Bundle and Network) that aim to provide its benefits to anonymity and privacy online. This work presents the countermeasures that have been proposed and/or implemented against such attacks, in a collated evaluation to determine their effectiveness, suitability to Tor Project, and its design aims/goals.

The industry has recognized the risk of cyber-attacks targeting to the advanced metering infrastructure (AMI). A potential adversary can modify or inject malicious data, and can perform security attacks over an insecure network. Also, the network operators at intermediate devices can reveal private information, such as the identity of the individual home and metering data units, to the third-party. Existing schemes generate large overheads and also do not ensure the secure delivery of correct and accurate metering data to all AMI entities, including data concentrator at the utility and the billing center. In this paper, we propose a secure and privacy-preserving data aggregation scheme based on additive homomorphic encryption and proxy re-encryption operations in the Paillier cryptosystem. The scheme can aggregate metering data without revealing the actual individual information (identity and energy usage) to intermediate entities or to any third-party, hence, resolves identity and related data theft attacks. Moreover, we propose a scalable algorithm to detect malicious metering data injected by the adversary. The proposed scheme protects the system against man-in-the-middle, replay, and impersonation attacks, and also maintains message integrity and undeniability. Our performance analysis shows that the scheme generates manageable computation, communication, and storage overheads and has efficient execution time suitable for AMI networks.

An integrated and optimized smart grid cannot be achieved without a secure communication network. Due to the large-scale nature of the power system, the variety of technologies used, and limitations of communication bandwidth, supervisory applications for smart grid still use weak security in many deployments. Adversaries can potentially modify measurement values or inject bad commands over the network. In this paper, we propose a novel scheme based on dynamic secrets and encryption with secret keys. The scheme generates a series of dynamic secrets over the communication network, which are used to generate secret keys for data encryption. The generation of dynamic secret is frequent and no adversary can compromise the network for a longer period, even if he/she knows a secret key. The scheme is secure against eavesdropping, malicious communication injection, man-in-the-middle attacks, replay attacks, impersonation attacks, and chosen-plaintext attacks. The security analysis and performance evaluation show that our scheme is feasible to be used in the communications between supervisory and control nodes of various smart grid applications.

Navigating security and privacy challenges is one of the crucial requirements in the vehicle-to-grid (V2G) network. Since electric vehicles (EVs) need to provide their private information to aggregators/servers when charging/discharging at different charging stations, privacy of the vehicle owners can be compromised if the information is misused, traced, or revealed. In a wide V2G network, where vehicles can move outside of their home network to visiting networks, security and privacy become even more challenging due to untrusted entities in the visiting networks. Although some privacy-preserving solutions were proposed in the literature to tackle this problem, they do not protect against well-known security attacks and generate a huge overhead. Therefore, we propose a mutual authentication scheme to preserve privacy of the EV's information from aggregators/servers in the home as well as distributed visiting V2G networks. Our scheme, based on a bilinear pairing technique with an accumulator performing batch verification, yields higher system efficiency, defeats various security attacks, and maintains untraceability, forward privacy, and identity anonymity. A performance analysis shows that our scheme, in comparison with the existing solutions, significantly generates lower communication and computation overheads in the home and centralized V2G networks, and comparable overheads in the distributed visiting V2G networks.

The smart grid, as the next generation of the power grid, is characterized by employing many different types of intelligent devices, such as intelligent electronic devices located at substations, smart meters positioned in the home area network, and outdoor field equipment deployed in the fields. In addition, there are various users in the smart grid network, including customers, operators, maintenance personnel, and so on, who use these devices for various purposes. Therefore, a secure and efficient mutual authentication and authorization scheme is needed in the smart grid to prevent various insider and outsider attacks on many different devices. In this paper, we propose an authentication and authorization scheme for mitigating outsider and insider threats in the smart grid by verifying the user authorization and performing the user authentication together whenever a user accesses the devices. The proposed scheme computes each user role dynamically using an attribute-based access control and verifies the identity of the user together with the device. Security and performance analysis show that the proposed scheme resists various insider as well as outsider attacks, and is more efficient in terms of communication and computation costs in comparison with the existing schemes. The correctness of the proposed scheme is also proved using BAN-Logic and Proverif.

The Evolved Packet System-based Authentication and Key Agreement (EPS-AKA) protocol of the long-term evolution (LTE) network does not support Internet of Things (IoT) objects and has several security limitations, including transmission of the object’s (user/device) identity and key set identifier in plaintext over the network, synchronization, large overhead, limited identity privacy, and security attack vulnerabilities. In this article, we propose a new secure and efficient AKA protocol for the LTE network that supports secure and efficient communications among various IoT devices as well as among the users. Analysis shows that our protocol is secure, efficient, and privacy preserved, and reduces bandwidth consumption during authentication.

Nowadays, short message service (SMS) is being used in many daily life applications, including healthcare monitoring, mobile banking, mobile commerce, and so on. But when we send an SMS from one mobile phone to another, the information contained in the SMS transmit as plain text. Sometimes this information may be confidential like account numbers, passwords, license numbers, and so on, and it is a major drawback to send such information through SMS while the traditional SMS service does not provide encryption to the information before its transmission. In this paper, we propose an efficient and secure protocol called EasySMS, which provides end-to-end secure communication through SMS between end users. The working of the protocol is presented by considering two different scenarios. The analysis of the proposed protocol shows that this protocol is able to prevent various attacks, including SMS disclosure, over the air modification, replay attack, man-in-the-middle attack, and impersonation attack. The EasySMS protocol generates minimum communication and computation overheads as compared with existing SMSSec and PK-SIM protocols. On an average, the EasySMS protocol reduces 51% and 31% of the bandwidth consumption and reduces 62% and 45% of message exchanged during the authentication process in comparison to SMSSec and PK-SIM protocols respectively. Authors claim that EasySMS is the first protocol completely based on the symmetric key cryptography and retain original architecture of cellular network.

In this paper, we introduce an efficient batch oriented authentication and key agreement protocol for value added services named VAS-AKA to authenticate multiple requests sent from different mobile stations at a time. The reliability of the protocol is discussed along with the algorithm to detect one or more invalid mobile user(s) in a batch. The security analysis and performance evaluation in terms of communication and computation overhead, batch and re-batch verification delay is presented. Using this protocol, the authentication server efficiently able to verify authentication requests sent from multiple mobile users.