The proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.
Abstract
Methods to increase the resilience of systems to cyber-attacks become increasingly important. Control-flow monitoring provides a principled basis to ensure integrity and detect possible anomalies at run-time. Once anomalies have been detected, so-called attack trees can be used to identify possible types of attacks. However, this approach is vulnerable to camouflage, by which attackers try to evade detection (and correct identification) by deliberately manipulating also the system's observed control flow. In this paper, we outline a model-based approach that provides more robust intrusion detection and attack identification through an architecture that combines software- with hardware-based monitoring. In this approach, software-level observation indicates suspicious activities, while hardware-level monitoring checks them separately in more detail, making it much harder for attacks to camouflage themselves and go undetected. We illustrate the approach with an authentication-service example that captures a realistic failure mode: a software-level observer sees an anomalous but apparently harmless control-flow deviation, maps it to a benign root cause in an attack tree, but misses the true intrusion. A second, independent hardware control-flow monitor observes the actual transition sequence and thereby changes the attack-tree diagnosis from a low-severity configuration or maintenance issue to a high-confidence code-injection or control-flow hijack. In this scenario, the proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.
Experimental evaluation conducted in a controlled network environment demonstrates that the proposed Deceptive Intrusion Prevention System improves detection accuracy, reduces false positives, and enhances overall system resilience.
Priyanka Tuppad, Vinit Kumar Shukla· International Journal For Mu...· 0 citations
Cyberattacks are becoming more frequent and sophisticated, and traditional antivirus software is often too slow or ineffective to detect and prevent new threats. Many security setups today still rely on human intervention. The delay this creates gives attackers a window to do serious damage. This shows how important it is to have a system that can detect and neutralize threats automatically, without waiting for human intervention. This paper presents AEGIES-AUTO, an autonomous security system capable of detecting and eliminating cyber threats in real time without any human involvement. The system operates in real time, monitoring all active processes and network connections on a host machine, and responds instantly when it detects suspicious behaviour, such as a reverse shell, a malicious process, or unusual port activity. Its response sequence terminates the offending process, blocks the associated ports, generates a forensic backup of the threat data for subsequent review, captures a screenshot as evidence, and sends instant alerts via email, desktop notifications, and voice messages, all within seconds of detection. AEGIES-AUTO is implemented in Python and provides a web-based dashboard showing live security metrics, threat history, and overall system health. It also features whitelist management to prevent false positives, a quarantine directory for isolating suspicious files and structured report generation for organised documentation. What makes AEGIES-AUTO different from traditional tools is the combination of speed and true autonomy: it doesn't wait for a human response, so threats are neutralised immediately upon detection. The system is realistic security for students, individual users and small organisations that cannot justify the cost of commercial security subscriptions, being lightweight, easy to deploy and free of licensing costs. In summary, AEGIES-AUTO demonstrates that effective, autonomous, real-time threat response can be achieved without the overhead normally associated with enterprise-grade security platforms
Surya Narayana Reddy B G, Manoj Kumar L, Prof. Thejaswini M N· International Journal of Adv...· 0 citations
A Markov-enhanced hybrid IDS that integrates physics-based modeling, data-driven anomaly detection, and statistical sequence analysis to secure a two-turbine cyber-physical wind farm, offering an analytically scalable architectural path toward more secure renewable energy infrastructures, while larger-farm empirical validation remains future work.
Mahdi Esmaeelihesari, M. Davoudi, N. Pariz· International Journal of Dyn...· 0 citations
This review's results show that penetration testing is an important part of improving cybersecurity because it helps identify weaknesses before they become problems and reduces risk.
Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.