On Zero Dynamics and Controllable Cyber-Attacks in Cyber-Physical Systems and Dynamic Coding Schemes as Their Countermeasures

In this paper, we study stealthy cyber-attacks on actuators of cyber-physical systems(CPS), namely zero dynamics and controllable attacks. In particular, under certain assumptions, we investigate and propose conditions under which one can execute zero dynamics and controllable attacks in the CPS. The above conditions are derived based on the Markov parameters of the CPS and elements of the system observability matrix. Consequently, in addition to outlining the number of required actuators to be attacked, these conditions provide one with the minimum system knowledge needed to perform zero dynamics and controllable cyber-attacks. As a countermeasure against the above stealthy cyber-attacks, we develop a dynamic coding scheme that increases the minimum number of the CPS required actuators to carry out zero dynamics and controllable cyber-attacks to its maximum possible value. It is shown that if at least one secure input channel exists, the proposed dynamic coding scheme can prevent adversaries from executing the zero dynamics and controllable attacks even if they have complete knowledge of the coding system. Finally, two illustrative numerical case studies are provided to demonstrate the effectiveness and capabilities of our derived conditions and proposed methodologies.

A Joint Estimation Method of SOC and SOH for Lithium-ion Battery Considering Cyber-Attacks Based on GA-BP

To improve the estimation accuracy of state of charge(SOC)and state of health(SOH)for lithium-ion batteries,in this paper,a joint estimation method of SOC and SOH at charging cut-off voltage based on genetic algorithm(GA)combined with back propagation(BP)neural network is proposed,the research addresses the issue of data manipulation resulting fromcyber-attacks.Firstly,anomalous data stemming fromcyber-attacks are identified and eliminated using the isolated forest algorithm,followed by data restoration.Secondly,the incremental capacity(IC)curve is derived fromthe restored data using theKalman filtering algorithm,with the peak of the ICcurve(ICP)and its corresponding voltage serving as the health factor(HF).Thirdly,the GA-BP neural network is applied to map the relationship between HF,constant current charging time,and SOH,facilitating the estimation of SOH based on HF.Finally,SOC estimation at the charging cut-off voltage is calculated by inputting the SOH estimation value into the trained model to determine the constant current charging time,and by updating the maximum available capacity.Experiments show that the root mean squared error of the joint estimation results does not exceed 1%,which proves that the proposed method can estimate the SOC and SOH accurately and stably even in the presence of false data injection attacks.

Hybrid-triggered consensus for multi-agent systems with time-delays,uncertain switching topologies, and stochastic cyber-attacks

We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoulli variable is used to describe the hybrid-triggered scheme, which is introduced to alleviate the burden of the network.The mathematical model of the closed-loop control system is established by taking the influences of time-varying delayed control inputs,switching topologies, and stochastic cyber-attacks into account under the hybrid-triggered scheme.A theorem as the main result is given to make the system consistent based on the theory of Lyapunov stability and linear matrix inequality.Markov jumps with uncertain rates of transitions are applied to describe the switch of topologies.Finally, a simulation example demonstrates the feasibility of the theory in this paper.

Group consensus of multi-agent systems subjected to cyber-attacks

In this paper, we investigate the group consensus for leaderless multi-agent systems. The group consensus protocol based on the position information from neighboring agents is designed. The network may be subjected to frequent cyberattacks, which is close to an actual case. The cyber-attacks are assumed to be recoverable. By utilizing algebraic graph theory, linear matrix inequality(LMI) and Lyapunov stability theory, the multi-agent systems can achieve group consensus under the proposed control protocol. The sufficient conditions of the group consensus for the multi-agent networks subjected to cyber-attacks are given. Furthermore, the results are extended to the consensus issue of multiple subgroups with cyber-attacks. Numerical simulations are performed to demonstrate the effectiveness of the theoretical results.

Increasing Threats to United States of America Infrastructure Based on Cyber-Attacks

The United States of America faces an increasing number of threats to its critical infrastructure due to cyber-attacks. With the constant advancement of technology and the interconnectedness of various systems, the vulnerabilities in the nation’s infrastructure have become more pronounced. Cyber-attacks on critical infrastructure, such as power grids, transportation networks, and financial systems, pose a significant risk to national security and public safety. These attacks can disrupt essential services, cause economic losses, and potentially have severe consequences for the well-being of individuals and communities. The rise of cyber-terrorism is also a concern. Cyber-terrorists can exploit vulnerabilities in cyberspace to compromise infrastructure systems, causing chaos and panic among the population. The potential for destructive attacks on critical infrastructure is a pressing issue requiring constant attention and proactive measures.

Aperiodic Sampled-Data Control of Distributed Networked Control Systems Under Stochastic Cyber-Attacks

This paper examines the stabilization problem of a distributed networked control system under the effect of cyberattacks by employing a hybrid aperiodic triggering mechanism.The cyber-attack considered in the paper is a stochastic deception attack at the sensor-controller end. The probability of the occurrence of attack on a subsystem is represented using a random variable. A decentralized hybrid sampled-data strategy is introduced to save energy consumption and reduce the transmission load of the network. In the proposed decentralized strategy, each subsystem can decide independently whether its state should be transmitted to the controller or not. The scheme of the hybrid triggering mechanism for each subsystem composed of two stages: In the first stage, the next sampling instant is computed using a self-triggering strategy. Subsequently, in the second stage, an event-triggering condition is checked at these sampling instants and the control signal is computed only if the event-triggering condition is violated. The self-triggering condition used in the first stage is dependent on the selection of eventtriggering condition of the second stage. Finally, a comparison of the proposed approach with other triggering mechanisms existing in the literature is presented in terms of the sampling instants,transmission frequency and performance measures through simulation examples.

Quantitative Evaluation of Cyber-Attacks on a Hypothetical School Computer Network

This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are plausible. Considered for the network system are two possible network attack paths. One network path represents an attack through the Internet, and the other represents an attack through the Wireless Access Points (WAPs) in the school network. The probabilities of success of the events, that is, 1) the attack payoff, and 2) the commitment of the attacker to infiltrate the network are estimated for the leaf nodes. These are used to calculate the Returns on Attacks (ROAs) at the Root Nodes. For Phase I, the “As Is” network, the ROA values for both attack paths, are higher than 7 (8.00 and 9.35 respectively), which are high values and unacceptable operationally. In Phase II, countermeasures are implemented, and the two attack trees reevaluated. The probabilities of success of the events, the attack payoff and the commitment of the attacker are then re-estimated. Also, the Returns on Attacks (ROAs) for the Root Nodes are re-assessed after executing the countermeasures. For one attack tree, the ROA value of the Root Node was reduced to 4.83 from 8.0, while, for the other attack tree, the ROA value of the Root Node changed to 3.30 from 9.35. ROA values of 4.83 and 3.30 are acceptable as they fall within the medium value range. The efficacy of this method whereby, attack trees are deployed to mitigate computer network risks, as well as using it to assess the vulnerability of computer networks is quantitatively substantiated.

Defensive Resource Allocation Method for Improving Survivability of Communication and Information System in CPPS Against Cyber-attacks

With the widespread use of communication and information technology,power system has been evolving into cyber-physical power system(CPPS)and becoming more vulnerable to cyber-attacks.Therefore,it is necessary to enhance the ability of the communication and information system in CPPS to defend against cyber-attacks.This paper proposes a method to enhance the survivability of the communication and information system in CPPS.Firstly,the communication and information system for critical business of power system is decomposed into certain types of atomic services,and then the survivability evaluation indexes and their corresponding calculation method for the communication and information system are proposed.Secondly,considering the efficacy and cost defensive resources,a defensive resource allocation model is proposed to maximize the survivability of communication and information system in CPPS.Then,a modified genetic algorithm is adopted to solve the proposed model.Finally,the simulation results of CPPS for an IEEE 30-node system verify the proposed method.

Cascading effects of cyber-attacks on interconnected critical infrastructure

Modern critical infrastructure,such as a water treatment plant,water distribution system,and power grid,are representative of Cyber Physical Systems(CPSs)in which the physical processes are monitored and controlled in real time.One source of complexity in such systems is due to the intra-system interactions and inter-dependencies.Consequently,these systems are a potential target for attackers.When one or more of these infrastructure are attacked,the connected systems may also be affected due to potential cascading effects.In this paper,we report a study to investigate the cascading effects of cyber-attacks on two interdependent critical infrastructure namely,a Secure water treatment plant(SWaT)and a Water Distribution System(WADI).

Concept and Research Framework for Coordinated Situation Awareness and Active Defense of Cyber-physical Power Systems Against Cyber-attacks

Due to the tight coupling between the cyber and physical sides of a cyber-physical power system(CPPS),the safe and reliable operation of CPPSs is being increasingly impacted by cyber security.This situation poses a challenge to traditional security defense systems,which considers the threat from only one side,i.e.,cyber or physical.To cope with cyberattacks,this paper reaches beyond the traditional one-side security defense systems and proposes the concept of cyber-physical coordinated situation awareness and active defense to improve the ability of CPPSs.An example of a regional frequency control system is used to show the validness and potential of this concept.Then,the research framework is presented for studying and implementing this concept.Finally,key technologies for cyber-physical coordinated situation awareness and active defense against cyber-attacks are introduced.

Data Mining Based Cyber-Attack Detection

Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.

Intrusion Detection System for Smart Industrial Environments with Ensemble Feature Selection and Deep Convolutional Neural Networks

Smart Industrial environments use the Industrial Internet of Things(IIoT)for their routine operations and transform their industrial operations with intelligent and driven approaches.However,IIoT devices are vulnerable to cyber threats and exploits due to their connectivity with the internet.Traditional signature-based IDS are effective in detecting known attacks,but they are unable to detect unknown emerging attacks.Therefore,there is the need for an IDS which can learn from data and detect new threats.Ensemble Machine Learning(ML)and individual Deep Learning(DL)based IDS have been developed,and these individual models achieved low accuracy;however,their performance can be improved with the ensemble stacking technique.In this paper,we have proposed a Deep Stacked Neural Network(DSNN)based IDS,which consists of two stacked Convolutional Neural Network(CNN)models as base learners and Extreme Gradient Boosting(XGB)as the meta learner.The proposed DSNN model was trained and evaluated with the next-generation dataset,TON_IoT.Several pre-processing techniques were applied to prepare a dataset for the model,including ensemble feature selection and the SMOTE technique.Accuracy,precision,recall,F1-score,and false positive rates were used to evaluate the performance of the proposed ensemble model.Our experimental results showed that the accuracy for binary classification is 99.61%,which is better than in the baseline individual DL and ML models.In addition,the model proposed for IDS has been compared with similar models.The proposed DSNN achieved better performance metrics than the other models.The proposed DSNN model will be used to develop enhanced IDS for threat mitigation in smart industrial environments.

Non-Deterministic Liveness-Enforcing Supervisor Tolerant to Sensor-Reading Modification Attacks

In this paper, we study the supervisory control problem of discrete event systems assuming that cyber-attacks might occur. In particular, we focus on the problem of liveness enforcement and consider a sensor-reading modification attack(SM-attack) that may disguise the occurrence of an event as that of another event by intruding sensor communication channels. To solve the problem, we introduce non-deterministic supervisors in the paper, which associate to every observed sequence a set of possible control actions offline and choose a control action from the set randomly online to control the system. Specifically, given a bounded Petri net(PN) as the reference formalism and an SMattack, an algorithm that synthesizes a liveness-enforcing nondeterministic supervisor tolerant to the SM-attack is proposed for the first time.

A Survey on Sensor-and Communication-Based Issues of Autonomous UAVs

The application field for Unmanned Aerial Vehicle (UAV) technology and its adoption rate have been increasingsteadily in the past years. Decreasing cost of commercial drones has enabled their use at a scale broader thanever before. However, increasing the complexity of UAVs and decreasing the cost, both contribute to a lack ofimplemented securitymeasures and raise new security and safety concerns. For instance, the issue of implausible ortampered UAV sensor measurements is barely addressed in the current research literature and thus, requires moreattention from the research community. The goal of this survey is to extensively review state-of-the-art literatureregarding common sensor- and communication-based vulnerabilities, existing threats, and active or passive cyberattacksagainst UAVs, as well as shed light on the research gaps in the literature. In this work, we describe theUnmanned Aerial System (UAS) architecture to point out the origination sources for security and safety issues.Weevaluate the coverage and completeness of each related research work in a comprehensive comparison table as wellas classify the threats, vulnerabilities and cyber-attacks into sensor-based and communication-based categories.Additionally, for each individual cyber-attack, we describe existing countermeasures or detectionmechanisms andprovide a list of requirements to ensureUAV’s security and safety.We also address the problem of implausible sensormeasurements and introduce the idea of a plausibility check for sensor data. By doing so, we discover additionalmeasures to improve security and safety and report on a research niche that is not well represented in the currentresearch literature.

Cybersecurity Landscape on Remote State Estimation:A Comprehensive Review

Cyber-physical systems(CPSs)have emerged as an essential area of research in the last decade,providing a new paradigm for the integration of computational and physical units in modern control systems.Remote state estimation(RSE)is an indispensable functional module of CPSs.Recently,it has been demonstrated that malicious agents can manipulate data packets transmitted through unreliable channels of RSE,leading to severe estimation performance degradation.This paper aims to present an overview of recent advances in cyber-attacks and defensive countermeasures,with a specific focus on integrity attacks against RSE.Firstly,two representative frameworks for the synthesis of optimal deception attacks with various performance metrics and stealthiness constraints are discussed,which provide a deeper insight into the vulnerabilities of RSE.Secondly,a detailed review of typical attack detection and resilient estimation algorithms is included,illustrating the latest defensive measures safeguarding RSE from adversaries.Thirdly,some prevalent attacks impairing the confidentiality and data availability of RSE are examined from both attackers'and defenders'perspectives.Finally,several challenges and open problems are presented to inspire further exploration and future research in this field.

Deep Transfer Learning Techniques in Intrusion Detection System-Internet of Vehicles: A State-of-the-Art Review

The high performance of IoT technology in transportation networks has led to the increasing adoption of Internet of Vehicles(IoV)technology.The functional advantages of IoV include online communication services,accident prevention,cost reduction,and enhanced traffic regularity.Despite these benefits,IoV technology is susceptible to cyber-attacks,which can exploit vulnerabilities in the vehicle network,leading to perturbations,disturbances,non-recognition of traffic signs,accidents,and vehicle immobilization.This paper reviews the state-of-the-art achievements and developments in applying Deep Transfer Learning(DTL)models for Intrusion Detection Systems in the Internet of Vehicles(IDS-IoV)based on anomaly detection.IDS-IoV leverages anomaly detection through machine learning and DTL techniques to mitigate the risks posed by cyber-attacks.These systems can autonomously create specific models based on network data to differentiate between regular traffic and cyber-attacks.Among these techniques,transfer learning models are particularly promising due to their efficacy with tagged data,reduced training time,lower memory usage,and decreased computational complexity.We evaluate DTL models against criteria including the ability to transfer knowledge,detection rate,accurate analysis of complex data,and stability.This review highlights the significant progress made in the field,showcasing how DTL models enhance the performance and reliability of IDS-IoV systems.By examining recent advancements,we provide insights into how DTL can effectively address cyber-attack challenges in IoV environments,ensuring safer and more efficient transportation networks.

An Efficient Sound and Data Steganography Based Secure Authentication System

The prodigious advancements in contemporary technologies have also brought in the situation of unprecedented cyber-attacks.Further,the pin-based security system is an inadequate mechanism for handling such a scenario.The reason is that hackers use multiple strategies for evading security systems and thereby gaining access to private data.This research proposes to deploy diverse approaches for authenticating and securing a connection amongst two devices/gadgets via sound,thereby disregarding the pins’manual verification.Further,the results demonstrate that the proposed approaches outperform conventional pin-based authentication or QR authentication approaches.Firstly,a random signal is encrypted,and then it is transformed into a wave file,after which it gets transmitted in a short burst via the device’s speakers.Subsequently,the other device/gadget captures these audio bursts through its microphone and decrypts the audio signal for getting the essential data for pairing.Besides,this model requires two devices/gadgets with speakers and a microphone,and no extra hardware such as a camera,for reading the QR code is required.The first module is tested with realtime data and generates high scores for the widely accepted accuracy metrics,including precision,Recall,F1 score,entropy,and mutual information(MI).Additionally,this work also proposes a module helps in a secured transmission of sensitive data by encrypting it over images and other files.This steganographic module includes two-stage encryption with two different encryption algorithms to transmit data by embedding inside a file.Several encryption algorithms and their combinations are taken for this system to compare the resultant file size.Both these systems engender high accuracies and provide secure connectivity,leading to a sustainable communication ecosystem.

Multilayer Self-Defense System to Protect Enterprise Cloud

A data breach can seriously impact organizational intellectual property,resources,time,and product value.The risk of system intrusion is augmented by the intrinsic openness of commonly utilized technologies like TCP/IP protocols.As TCP relies on IP addresses,an attacker may easily trace the IP address of the organization.Given that many organizations run the risk of data breach and cyber-attacks at a certain point,a repeatable and well-developed incident response framework is critical to shield them.Enterprise cloud possesses the challenges of security,lack of transparency,trust and loss of controls.Technology eases quickens the processing of information but holds numerous risks including hacking and confidentiality problems.The risk increases when the organization outsources the cloud storage services through the vendor and suffers from security breaches and need to create security systems to prevent data networks from being compromised.The business model also leads to insecurity issues which derail its popularity.An attack mitigation system is the best solution to protect online services from emerging cyber-attacks.This research focuses on cloud computing security,cyber threats,machine learning-based attack detection,and mitigation system.The proposed SDN-based multilayer machine learning-based self-defense system effectively detects and mitigates the cyber-attack and protects cloud-based enterprise solutions.The results show the accuracy of the proposed machine learning techniques and the effectiveness of attack detection and the mitigation system.

Cyber Security and Privacy Issues in Industrial Internet of Things

The emergence of industry 4.0 stems from research that has received a great deal of attention in the last few decades.Consequently,there has been a huge paradigm shift in the manufacturing and production sectors.However,this poses a challenge for cybersecurity and highlights the need to address the possible threats targeting(various pillars of)industry 4.0.However,before providing a concrete solution certain aspect need to be researched,for instance,cybersecurity threats and privacy issues in the industry.To fill this gap,this paper discusses potential solutions to cybersecurity targeting this industry and highlights the consequences of possible attacks and countermeasures(in detail).In particular,the focus of the paper is on investigating the possible cyber-attacks targeting 4 layers of IIoT that is one of the key pillars of Industry 4.0.Based on a detailed review of existing literature,in this study,we have identified possible cyber threats,their consequences,and countermeasures.Further,we have provided a comprehensive framework based on an analysis of cybersecurity and privacy challenges.The suggested framework provides for a deeper understanding of the current state of cybersecurity and sets out directions for future research and applications.

Attack-resilient control for converter-based DC microgrids

In light of the growing integration of renewable energy sources in power systems,the adoption of DC microgrids has become increasingly popular,due to its simple structure,having no frequency,power factor concerns.However,the dependence of DC microgrids on cyber-networks also makes them susceptible to cyber-attacks.Potential cyberattacks can disrupt power system facilities and result in significant economic and loss of life.To address this concern,this paper presents an attack-resilient control strategy for microgrids to ensure voltage regulation and power sharing with stable operation under cyber-attack on the actuators.This paper first formulates the cyber-security problem considering a distributed generation based microgrid using the converter model,after which an attack-resilient control is proposed to eliminate the actuator attack impact on the system.Steady state analysis and root locus validation illustrate the feasibility of the proposed method.The effectiveness of the proposed control scheme is demonstrated through simulation results.