 |
International Conferences: Symposium on Resilient Control Systems (ISRCS) |
The 7th International Symposium on Resilient Control Systems (ISRCS), 2014 was held 19-21 Aug. 2014 in Denver, Colorado. This conference offered research presentations of interest to both the Science of Security and SURE projects.
Thompson, M.; Evans, N.; Kisekka, V., "Multiple OS Rotational Environment An Implemented Moving Target Defense," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1,6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900086 Cyber-attacks continue to pose a major threat to existing critical infrastructure. Although suggestions for defensive strategies abound, Moving Target Defense (MTD) has only recently gained attention as a possible solution for mitigating cyber-attacks. The current work proposes a MTD technique that provides enhanced security through a rotation of multiple operating systems. The MTD solution developed in this research utilizes existing technology to provide a feasible dynamic defense solution that can be deployed easily in a real networking environment. In addition, the system we developed was tested extensively for effectiveness using CORE Impact Pro (CORE), Nmap, and manual penetration tests. The test results showed that platform diversity and rotation offer improved security. In addition, the likelihood of a successful attack decreased proportionally with time between rotations.
Keywords: operating systems (computers); security of data; CORE; CORE Impact Pro; MTD technique; Nmap; cyber-attacks mitigation; defensive strategies; manual penetration test; moving target defense; multiple OS rotational environment; operating systems; Availability; Fingerprint recognition; IP networks; Operating systems; Security; Servers; Testing; insert (ID#: 15-3517)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900086&isnumber=6900080
Ostovari, P.; Jie Wu; Ying Dai, "Priority-Based Broadcasting Of Sensitive Data In Error-Prone Wireless Networks," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900087 Providing reliable transmission in wireless communication networks is an important problem which is typically addressed using feedback and acknowledgment messages. In the networks where using feedbacks is not possible, such as real-time systems, an alternative approach is to maximize the possible gain that the destination nodes are expected to receive. In this paper, we consider transmission of data with different priorities, and study the problem of maximizing the total gain in the case that partial data retrieval is acceptable. We propose an optimal solution that benefits from network coding. We also consider the case of burst errors and discuss how can we make our proposed method robust to this type of error. We evaluate our proposed priority-based data transmission method using both simulations and results from the implementation on a USRP testbed.
Keywords: network coding; radio data systems; radio networks; telecommunication network reliability; USRP testbed; burst errors; destination nodes; error-prone wireless communication networks;n etwork coding; partial data retrieval; priority-based data transmission method; priority-based sensitive data broadcasting; total gain maximization problem; transmission reliability; Broadcasting; Encoding; Error analysis; Gain; Network coding; Reliability; Wireless networks; Symbol-level coding; USRP testbed; broadcasting; burst error; priority; random linear network coding; reliability; wireless networks (ID#: 15-3518)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900087&isnumber=6900080
Duff, S.; Del Guidice, K.; Flint, J.; Nam Nguyen; Kudrick, B., "The Diagnosis And Measurement Of Team Resilience In Sociotechnical Systems," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 5, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900088 This paper presents a novel approach to diagnosing and measuring team resilience in sociotechnical systems. This approach is based on a multi-level model developed to study team phenomena from a general systems perspective. We will describe a methodology that uses a concept similar to flow within the psychological literature to measure a team's response to instances of sub-optimal system function. Team resilience is determined by examining flow disruptions, which are instances of sub-optimal system performance that disrupt normal system flow, and compensatory strategies, which are behaviors enacted by the team in response to the disruption to re-establish overall system flow. Approaching teams embedded in organizations from this perspective allows diagnosis of the systemic influences that contribute most to the variance in performance across entities, identification of pervasive latent systemic failures, and the development of a tailored taxonomy of behavioral teamwork dimensions, which can then be translated into metrics to measure team resilience in many contexts or team configurations.
Keywords: psychology; team working; behavioral teamwork dimensions; compensatory strategies; flow disruptions; general systems perspective; multilevel model; normal system flow; pervasive latent systemic failure identification; psychological literature; sociotechnical systems; suboptimal system function; suboptimal system performance; systemic influence diagnosis; tailored taxonomy; team phenomena; team resilience diagnosis; team resilience measurement; team response measurement; Fluid flow measurement;Organizations;Resilience;Robots;Taxonomy;Teamwork;group flow; multi-level model; resilience ;teams; teamwork measurement (ID#: 15-3519)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900088&isnumber=6900080
Atighetchi, M.; Adler, A., "A Framework For Resilient Remote Monitoring," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1, 8, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900090 Today's activities in cyber space are more connected than ever before, driven by the ability to dynamically interact and share information with a changing set of partners over a wide variety of networks. To support dynamic sharing, computer systems and network are stood up on a continuous basis to support changing mission critical functionality. However, configuration of these systems remains a manual activity, with misconfigurations staying undetected for extended periods, unneeded systems remaining in place long after they are needed, and systems not getting updated to include the latest protections against vulnerabilities. This environment provides a rich environment for targeted cyber attacks that remain undetected for weeks to months and pose a serious national security threat. To counter this threat, technologies have started to emerge to provide continuous monitoring across any network-attached device for the purpose of increasing resiliency by virtue of identifying and then mitigating targeted attacks. For these technologies to be effective, it is of utmost importance to avoid any inadvertent increase in the attack surface of the monitored system. This paper describes the security architecture of Gestalt, a next-generation cyber information management platform that aims to increase resiliency by providing ready and secure access to granular cyber event data available across a network. Gestalt's federated monitoring architecture is based on the principles of strong isolation, least-privilege policies, defense-in-depth, crypto-strong authentication and encryption, and self-regeneration. Remote monitoring functionality is achieved through an orchestrated workflow across a distributed set of components, linked via a specialized secure communication protocol, that together enable unified access to cyber observables in a secure and resilient way.
Keywords: Web services; information management; security of data; Gestalt platform; attack identification; attack mitigation; communication protocol; computer networks; computer systems; cyber attacks;cyber observables; cyber space; granular cyber event data; mission critical functionality; national security threat; network-attached device; next-generation cyber information management platform; remote monitoring functionality; resilient remote monitoring; Bridges; Firewalls (computing);Monitoring; Protocols; Servers; XML; cyber security; federated access; middleware; semantic web}, (ID#: 15-3520)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900090&isnumber=6900080
Fink, G.A.; Griswold, R.L.; Beech, Z.W., "Quantifying Cyber-Resilience Against Resource-Exhaustion Attacks," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 8, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900093 Resilience in the information sciences is notoriously difficult to define much less to measure. But in mechanical engineering, the resilience of a substance is mathematically well-defined as an area under the stress-strain curve. We combined inspiration from mechanics of materials and axioms from queuing theory in an attempt to define resilience precisely for information systems. We first examine the meaning of resilience in linguistic and engineering terms and then translate these definitions to information sciences. As a general assessment of our approach's fitness, we quantify how resilience may be measured in a simple queuing system. By using a very simple model we allow clear application of established theory while being flexible enough to apply to many other engineering contexts in information science and cyber security. We tested our definitions of resilience via simulation and analysis of networked queuing systems. We conclude with a discussion of the results and make recommendations for future work.
Keywords: queueing theory; security of data; cyber security; cyber-resilience quantification; engineering terms; information sciences; linguistic terms; mechanical engineering; networked queuing systems; queuing theory; resource-exhaustion attacks; simple queuing system; stress-strain curve; Information systems; Queueing analysis; Resilience; Servers; Strain; Stress; Resilience; cyber systems; information science; material science; strain; stress (ID#: 15-3521)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900093&isnumber=6900080
Khamis, A.; Subbaram Naidu, D., "Real-time Algorithm For Nonlinear Systems With Incomplete State Information Using Finite-Horizon Optimal Control Technique," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900094 This paper discusses a novel efficient real-time technique used for finite-horizon nonlinear regulator problems with incomplete state information. This technique based on integrating the Kalman filter algorithm and the finite-horizon differential State Dependent Riccati Equation (SDRE) technique. In this technique, the optimal control problem of the nonlinear system is solved by using finite-horizon differential SDRE algorithm, which makes this technique effective for a wide range of operating points. A nonlinear mechanical crane is given to show the effectiveness of the proposed technique.
Keywords: Kalman filters; Lyapunov methods; Riccati equations; nonlinear control systems; optimal control; stochastic systems; Kalman filter algorithm; SDRE technique; finite-horizon differential state dependent Riccati equation; finite-horizon nonlinear regulator; finite-horizon optimal control technique; incomplete state information; nonlinear mechanical crane; nonlinear systems; Cranes; Equations; Kalman filters; Mathematical model; Noise; Nonlinear systems; Optimal control (ID#: 15-3522)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900094&isnumber=6900080
Borges Hink, R.C.; Beaver, J.M.; Buckner, M.A.; Morris, T.; Adhikari, U.; Shengyi Pan, "Machine Learning For Power System Disturbance And Cyber-Attack Discrimination," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1, 8, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900095 Power system disturbances are inherently complex and can be attributed to a wide range of sources, including both natural and man-made events. Currently, the power system operators are heavily relied on to make decisions regarding the causes of experienced disturbances and the appropriate course of action as a response. In the case of cyber-attacks against a power system, human judgment is less certain since there is an overt attempt to disguise the attack and deceive the operators as to the true state of the system. To enable the human decision maker, we explore the viability of machine learning as a means for discriminating types of power system disturbances, and focus specifically on detecting cyber-attacks where deception is a core tenet of the event. We evaluate various machine learning methods as disturbance discriminators and discuss the practical implications for deploying machine learning systems as an enhancement to existing power system architectures.
Keywords: learning (artificial intelligence); power engineering computing; power system faults; security of data; cyber-attack discrimination; machine learning; power system architectures; power system disturbance; power system operators; Accuracy; Classification algorithms; Learning systems; Protocols; Relays; Smart grids; SCADA; Smart grid; cyber-attack; machine learning (ID#: 15-3523)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900095&isnumber=6900080
Feng Xie; Yong Peng; Wei Zhao; Xuefeng Han; Hui Li; Ru Zhang; Jing Zhao; Jianyi Liu, "Using Simulation Platform To Analyze Radio Modem Security in SCADA," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,5, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900097 Radio modems are the most common long-range communication equipments in supervisory control and data acquisition (SCADA) systems such as water treatment plants and petrochemical factories. However, since there are lack of security mechanisms in radio modems, many traditional cyber attacks can have an impact on the data transmission via radio modems. In this paper, a simulation platform based on radio modems is built. And many attacks, e.g. communication jam, data eavesdropping and tamper as well as DOS attack, are carried out in this platform to test the security of radio modem. Experimental results indicate that there is something wrong in data transmission in SCADA systems when facing these cyber attacks, which means that some security measures should be applied to protect radio modems.
Keywords: SCADA systems; computer network security; jamming; modems; DOS attack; SCADA systems; communication jam;cyber attacks; data eavesdropping; data transmission; long-range communication equipments; petrochemical factories; radio modem protection; radio modem security analysis; security measures; simulation platform; supervisory control-and-data acquisition systems; tamper; water treatment plants; Computer crime; Data acquisition; Data communication; Modems; Monitoring; SCADA systems; SCADA systems; cyber attacks; radio modem; security; simulation platform (ID#: 15-3524)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900097&isnumber=6900080
Martins, G.; Bhattacharjee, A.; Dubey, A.; Koutsoukos, X.D., "Performance Evaluation Of An Authentication Mechanism In Time-Triggered Networked Control Systems," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1, 6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900098 An important challenge in networked control systems is to ensure the confidentiality and integrity of the message in order to secure the communication and prevent attackers or intruders from compromising the system. However, security mechanisms may jeopardize the temporal behavior of the network data communication because of the computation and communication overhead. In this paper, we study the effect of adding Hash Based Message Authentication (HMAC) to a time-triggered networked control system. Time Triggered Architectures (TTAs) provide a deterministic and predictable timing behavior that is used to ensure safety, reliability and fault tolerance properties. The paper analyzes the computation and communication overhead of adding HMAC and the impact on the performance of the time-triggered network. Experimental validation and performance evaluation results using a TTEthernet network are also presented.
Keywords: authorisation; computer network security; local area networks; networked control systems; HMAC; TTEthernet network; authentication mechanism; communication overhead; computation overhead; fault tolerance property; hash based message authentication; message confidentiality; message integrity; network data communication; reliability property; safety property; security mechanisms; time triggered architectures; time-triggered networked control systems; timing behavior; Cryptography; Message authentication;Receivers;Switches;Synchronization;HMAC;Performance Evaluation; Secure Messages; TTEthernet; Time-Trigger Architectures (ID#: 15-3525)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900098&isnumber=6900080
Bodeau, D.; Brtis, J.; Graubart, R.; Salwen, J., "Resiliency Techniques For Systems-Of-Systems Extending And Applying The Cyber Resiliency Engineering Framework To The Space Domain," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900099 This paper describes how resiliency techniques apply to an acknowledged system-of-systems. The Cyber Resiliency Engineering Framework is extended to apply to resilience in general, with a focus on resilience of space systems. Resiliency techniques can improve system-of-systems operations. Both opportunities and challenges are identified for resilience as an emergent property in an acknowledged system-of-systems.
Keywords: aerospace computing; security of data; cyber resiliency engineering framework; resiliency technique; space domain; system-of-systems operations; Collaboration; Dynamic scheduling; Interoperability; Monitoring; Redundancy; Resilience; Space vehicles; cyber security ;resilience; system-of-systems (ID#: 15-3526)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900099&isnumber=6900080
Abbas, W.; Vorobeychik, Y.; Koutsoukos, X., "Resilient Consensus Protocol In The Presence Of Trusted Nodes," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 7, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900100 In this paper, we propose a scheme for a resilient distributed consensus problem through a set of trusted nodes within the network. Currently, algorithms that solve resilient consensus problem demand networks to have high connectivity to overrule the effects of adversaries, or require nodes to have access to some non-local information. In our scheme, we incorporate the notion of trusted nodes to guarantee distributed consensus despite any number of adversarial attacks, even in sparse networks. A subset of nodes, which are more secured against the attacks, constitute a set of trusted nodes. It is shown that the network becomes resilient against any number of attacks whenever the set of trusted nodes form a connected dominating set within the network. We also study a relationship between trusted nodes and the network robustness. Simulations are presented to illustrate and compare our scheme with the existing ones.
Keywords: network theory (graphs);adversarial attacks; connected dominating set; nonlocal information access; resilient consensus protocol; resilient distributed consensus problem; trusted nodes notion; Buildings; Network topology; Protocols; Resilience; Robustness; Topology; Tree graphs; Resilience; adversary; consensus; dominating set; graph robustness (ID#: 15-3527)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900100&isnumber=6900080
Rege, A.; Ferrese, F.; Biswas, S.; Li Bai, "Adversary Dynamics And Smart Grid Security: A Multiagent System Approach," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,7, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900101 Power grid is the backbone of infrastructures that drive the US economy and security, which makes it a prime target of cybercriminals or state-sponsored terrorists, and warrants special attention for its protection. Commonly used approaches to smart grid security are usually based on various mathematical tools, and ignore the human behavior component of cybercriminals. This paper introduces a new dimension to the cyberphysical system architecture, namely human behavior, and presents a modified CPS framework, consisting of a. cyber system: SCADA control system and related protocols, b. physical system: power grid infrastructure, c. the adversary: cybercriminals, and d. the defender: system operators and engineers. Based on interviews of ethical hackers, this paper presents an adversary-centric method that uses adversary's decision tree along with control theoretic tools to develop defense strategies against cyberattacks on power grid.
Keywords: SCADA systems; computer crime; decision trees; multi-agent systems; power engineering computing; power system control; power system protection; power system security; protocols; smart power grids; SCADA control system; Smart Grid protection; US economy; US security; adversary-centric method; cyberattack; cybercriminals; cyberphysical system architecture; decision tree; ethical hackers; human behavior; mathematical tools; modified CPS framework; multiagent system approach; power grid; power grid infrastructure; protocols; smart grid security; Computer crime; Control systems; Decision making; Mathematical model; Power grids; Power system dynamics; Grid security; cyber attackers; cyberphysical systems; ethical hackers; human behavior (ID#: 15-3528)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900101&isnumber=6900080
Miles, C.; Lakhotia, A.; LeDoux, C.; Newsom, A.; Notani, V., "VirusBattle: State-of-the-Art Malware Analysis For Better Cyber Threat Intelligence," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900103 Discovered interrelationships among instances of malware can be used to infer connections among seemingly unconnected objects, including actors, machines, and the malware itself. However, such malware interrelationships are currently underutilized in the cyber threat intelligence arena. To fill that gap, we are developing VirusBattle, a system employing state-of-the-art malware analyses to automatically discover interrelationships among instances of malware. VirusBattle analyses mine malware interrelationships over many types of malware artifacts, including the binary, code, code semantics, dynamic behaviors, malware metadata, distribution sites and e-mails. The result is a malware interrelationships graph which can be explored automatically or interactively to infer previously unknown connections.
Keywords: computer viruses; data mining; graph theory; VirusBattle; binary; code semantics; cyber threat intelligence; distribution sites; dynamic behaviors; e-mails; malware analysis; malware artifacts; malware interrelationship mining; malware interrelationships graph; malware metadata; Computers; Data visualization; Electronic mail; Malware; Performance analysis; Semantics; Visualization (ID#: 15-3529)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900103&isnumber=6900080
Balchanos, M.G.; Domercant, J.C.; Tran, H.T.; Mavris, D.N., "Metrics-Based Analysis And Evaluation Framework For Engineering Resilient Systems," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp.1,7, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900107 The DoD's ERS initiative calls for affordable, effective, and adaptable systems development. In support of this, a metrics-based analysis framework is introduced to address certain challenges for the design of future C2 military System-of-Systems (SoS). The interpretation of the concept of resilience, as well as a supporting threat analysis procedure for military SoS applications, have been the key driver for the evaluation of a system's ability to maintain its mission capability and health, when under attack due to given threats. An agent-based C2 UAV communication network application has been developed for the demonstration of the framework. Scenario-based case studies that involved communication jamming by the adversary forces are introduced for the evaluation the C2 system's response to a threat, including both degradation and recovery periods.
Keywords: autonomous aerial vehicles; command and control systems; Department of Defense ;DoD ERS initiative; agent-based C2 UAV communication network; command and control systems; communication jamming; engineering resilient systems; metrics-based analysis framework; metrics-based evaluation framework; military system-of-systems; mission capability; mission health; resilience concept; unmanned aerial vehicles; Facsimile; Jamming; Resilience; Robustness (ID#: 15-3530)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900107&isnumber=6900080
Rieger, C.G., "Resilient Control Systems Practical Metrics Basis For Defining Mission Impact," Resilient Control Systems (ISRCS), 2014 7th International Symposium onpp.1, 10, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900108 “Resilience” describes how systems operate at an acceptable level of normalcy despite disturbances or threats. In this paper we first consider the cognitive, cyber-physical interdependencies inherent in critical infrastructure systems and how resilience differs from reliability to mitigate these risks. Terminology and metrics basis are provided to integrate the cognitive, cyber-physical aspects that should be considered when defining solutions for resilience. A practical approach is taken to roll this metrics basis up to system integrity and business case metrics that establish “proper operation” and “impact.” A notional chemical processing plant is the use case for demonstrating how the system integrity metrics can be applied to establish performance, and as well, the effects on the process that roll into the business case.
Keywords: control system synthesis; business case metrics; cyber-physical interdependency; mission impact; notional chemical processing plant; resilient control systems; risk mitigation; system integrity metrics; Computer aided software engineering; Computer crime; Control systems; Degradation; Measurement; Optimization; Robustness; Metrics; adaptive capacity; adaptive insufficience;cogntive;cyber-physical;performance;resilience;robustness;threats (ID#: 15-3531)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900108&isnumber=6900080
Note:
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to news@scienceofsecurity.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.