We present a detailed survey of the Zero Trust (ZT) security paradigm which has a growing number of advocates in the critical infrastructure risk management space. The article employs a descriptive approach to present the fundamental tenets of ZT and provides a review of numerous potential options available for successful realization of this paradigm. We describe the role of authentication and access control in Zero Trust Architectures (ZTA) and present an in-depth discussion of state-of-the-art techniques for authentication and access control in different scenarios. Furthermore, we comprehensively discuss the conventional approaches to encryption, micro-segmentation, and security automation available for instantiating a ZTA. The article also details various challenges associated with contemporary authentication mechanisms, access control schemes, trust and risk computation techniques, micro-segmentation approaches, and Software-Defined Perimeter, that can impact the implementation of ZT in its true sense. Based upon our analysis, we finally pinpoint the potential future research directions for successful realization of ZT in critical infrastructures.

Distributed Denial-of-Service (DDoS) attacks are a critical threat to the Internet. However, the memoryless feature of the Internet routing mechanisms makes it extremely hard to trace back to the source of these attacks. As a result, there is no effective and efficient method to deal with this issue so far. In this paper, we propose a novel traceback method for DDoS attacks that is based on entropy variations between normal and DDoS attack traffic, which is fundamentally different from commonly used packet marking techniques. In comparison to the existing DDoS traceback methods, the proposed strategy possesses a number of advantages - it is memory nonintensive, efficiently scalable, robust against packet pollution, and independent of attack traffic patterns. The results of extensive experimental and simulation studies are presented to demonstrate the effectiveness and efficiency of the proposed method. Our experiments show that accurate traceback is possible within 20 seconds (approximately) in a large-scale attack network with thousands of zombies.

Thanks to the rapid development in mobile vehicles and wireless technologies, Internet of Vehicles (IoV) has become an attractive application that can provide a large number of mobile services for drivers. Vehicles can be informed of the mobile position, direction, speed and other real-time information of nearby vehicles to avoid traffic jams and accidents. However, the environments of IoV could be dangerous in the absence of security protections. Due to the openness and self-organization of Internet of Vehicles, there are enormous malicious attackers. To guarantee the safety of mobile services, we propose an effective decentralized authentication mechanism for Internet of Vehicles on the basis of the consensus algorithm of blockchain technology. The simulation under the Veins framework is carried out to verify the feasibility of the scheme in reducing the selfish behavior and malicious attacks in Internet of Vehicles.

Smart meter measurements, though critical for accurate demand forecasting, face several drawbacks including consumers’ privacy, data breach issues, to name a few. Recent literature has explored Federated Learning (FL) as a promising privacy-preserving machine learning alternative which enables collaborative learning of a model without exposing private raw data for short term load forecasting. Despite its virtue, standard FL is still vulnerable to an intractable cyber threat known as Byzantine attack carried out by faulty and/or malicious clients. Therefore, to improve the robustness of federated short-term load forecasting against Byzantine threats, we develop a state-of-the-art differentially private secured FL-based framework that ensures the privacy of the individual smart meter’s data while protect the security of FL models and architecture. Our proposed framework leverages the idea of gradient quantization through the Sign Stochastic Gradient Descent (SignSGD) algorithm, where the clients only transmit the ‘sign’ of the gradient to the control centre after local model training. As we highlight through our experiments involving benchmark neural networks with a set of Byzantine attack models, our proposed approach mitigates such threats quite effectively and thus outperforms conventional FedSGD models.

Due to millions of heterogeneous physical nodes, multiple-vendor and multi-tenant domains, and technologies etc., 5G has greatly expanded the threat landscape. Particularly from the high rate of traffic and ultra-low latency requirement of applications in 5G networks, the detection of the network traffic anomalies in real-time is critical. The conventional security approaches lack compatibility with modern network designs and are not much effective in 5G settings. We propose a two-stage network traffic anomaly detection system compatible with ETSI-NFV standard 5G architecture. Our architecture consists of two modules, i.e., (a) Dimensionality Reduction to compress the sample size at the edge of 5G networks and (b) Deep Neural Network classifier (DNN) that detects traffic anomalies. We have conducted our experiments using OMNET++ and ETSI-NFV (OSM MANO) 5G orchestration real platform deployed on AWS cloud systems. We have used the UNSW-NB15 data set and have shown that at dimensionality reduction factor of 81% the detection accuracy obtained is 98%. The proposal is compared with other recent approaches to show the overall merit of the architecture.