A Joint Estimation Method of SOC and SOH for Lithium-ion Battery Considering Cyber-Attacks Based on GA-BP

To improve the estimation accuracy of state of charge(SOC)and state of health(SOH)for lithium-ion batteries,in this paper,a joint estimation method of SOC and SOH at charging cut-off voltage based on genetic algorithm(GA)combined with back propagation(BP)neural network is proposed,the research addresses the issue of data manipulation resulting fromcyber-attacks.Firstly,anomalous data stemming fromcyber-attacks are identified and eliminated using the isolated forest algorithm,followed by data restoration.Secondly,the incremental capacity(IC)curve is derived fromthe restored data using theKalman filtering algorithm,with the peak of the ICcurve(ICP)and its corresponding voltage serving as the health factor(HF).Thirdly,the GA-BP neural network is applied to map the relationship between HF,constant current charging time,and SOH,facilitating the estimation of SOH based on HF.Finally,SOC estimation at the charging cut-off voltage is calculated by inputting the SOH estimation value into the trained model to determine the constant current charging time,and by updating the maximum available capacity.Experiments show that the root mean squared error of the joint estimation results does not exceed 1%,which proves that the proposed method can estimate the SOC and SOH accurately and stably even in the presence of false data injection attacks.

Hybrid-triggered consensus for multi-agent systems with time-delays,uncertain switching topologies, and stochastic cyber-attacks

We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoulli variable is used to describe the hybrid-triggered scheme, which is introduced to alleviate the burden of the network.The mathematical model of the closed-loop control system is established by taking the influences of time-varying delayed control inputs,switching topologies, and stochastic cyber-attacks into account under the hybrid-triggered scheme.A theorem as the main result is given to make the system consistent based on the theory of Lyapunov stability and linear matrix inequality.Markov jumps with uncertain rates of transitions are applied to describe the switch of topologies.Finally, a simulation example demonstrates the feasibility of the theory in this paper.

Group consensus of multi-agent systems subjected to cyber-attacks

In this paper, we investigate the group consensus for leaderless multi-agent systems. The group consensus protocol based on the position information from neighboring agents is designed. The network may be subjected to frequent cyberattacks, which is close to an actual case. The cyber-attacks are assumed to be recoverable. By utilizing algebraic graph theory, linear matrix inequality(LMI) and Lyapunov stability theory, the multi-agent systems can achieve group consensus under the proposed control protocol. The sufficient conditions of the group consensus for the multi-agent networks subjected to cyber-attacks are given. Furthermore, the results are extended to the consensus issue of multiple subgroups with cyber-attacks. Numerical simulations are performed to demonstrate the effectiveness of the theoretical results.

Aperiodic Sampled-Data Control of Distributed Networked Control Systems Under Stochastic Cyber-Attacks

This paper examines the stabilization problem of a distributed networked control system under the effect of cyberattacks by employing a hybrid aperiodic triggering mechanism.The cyber-attack considered in the paper is a stochastic deception attack at the sensor-controller end. The probability of the occurrence of attack on a subsystem is represented using a random variable. A decentralized hybrid sampled-data strategy is introduced to save energy consumption and reduce the transmission load of the network. In the proposed decentralized strategy, each subsystem can decide independently whether its state should be transmitted to the controller or not. The scheme of the hybrid triggering mechanism for each subsystem composed of two stages: In the first stage, the next sampling instant is computed using a self-triggering strategy. Subsequently, in the second stage, an event-triggering condition is checked at these sampling instants and the control signal is computed only if the event-triggering condition is violated. The self-triggering condition used in the first stage is dependent on the selection of eventtriggering condition of the second stage. Finally, a comparison of the proposed approach with other triggering mechanisms existing in the literature is presented in terms of the sampling instants,transmission frequency and performance measures through simulation examples.

Quantitative Evaluation of Cyber-Attacks on a Hypothetical School Computer Network

This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are plausible. Considered for the network system are two possible network attack paths. One network path represents an attack through the Internet, and the other represents an attack through the Wireless Access Points (WAPs) in the school network. The probabilities of success of the events, that is, 1) the attack payoff, and 2) the commitment of the attacker to infiltrate the network are estimated for the leaf nodes. These are used to calculate the Returns on Attacks (ROAs) at the Root Nodes. For Phase I, the “As Is” network, the ROA values for both attack paths, are higher than 7 (8.00 and 9.35 respectively), which are high values and unacceptable operationally. In Phase II, countermeasures are implemented, and the two attack trees reevaluated. The probabilities of success of the events, the attack payoff and the commitment of the attacker are then re-estimated. Also, the Returns on Attacks (ROAs) for the Root Nodes are re-assessed after executing the countermeasures. For one attack tree, the ROA value of the Root Node was reduced to 4.83 from 8.0, while, for the other attack tree, the ROA value of the Root Node changed to 3.30 from 9.35. ROA values of 4.83 and 3.30 are acceptable as they fall within the medium value range. The efficacy of this method whereby, attack trees are deployed to mitigate computer network risks, as well as using it to assess the vulnerability of computer networks is quantitatively substantiated.

Data Mining Based Cyber-Attack Detection

Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.

Increasing Threats to United States of America Infrastructure Based on Cyber-Attacks

The United States of America faces an increasing number of threats to its critical infrastructure due to cyber-attacks. With the constant advancement of technology and the interconnectedness of various systems, the vulnerabilities in the nation’s infrastructure have become more pronounced. Cyber-attacks on critical infrastructure, such as power grids, transportation networks, and financial systems, pose a significant risk to national security and public safety. These attacks can disrupt essential services, cause economic losses, and potentially have severe consequences for the well-being of individuals and communities. The rise of cyber-terrorism is also a concern. Cyber-terrorists can exploit vulnerabilities in cyberspace to compromise infrastructure systems, causing chaos and panic among the population. The potential for destructive attacks on critical infrastructure is a pressing issue requiring constant attention and proactive measures.

An Algebraic Detection Approach for Control Systems under Multiple Stochastic Cyber-attacks

In order to compromise a target control system successfully, hackers possibly attempt to launch multiple cyberattacks aiming at multiple communication channels of the control system. However, the problem of detecting multiple cyber-attacks has been hardly investigated so far. Therefore, this paper deals with the detection of multiple stochastic cyber-attacks aiming at multiple communication channels of a control system. Our goal is to design a detector for the control system under multiple cyberattacks. Based on frequency-domain transformation technique and auxiliary detection tools, an algebraic detection approach is proposed. By applying the presented approach, residual information caused by different attacks is obtained respectively and anomalies in the control system are detected. Sufficient and necessary conditions guaranteeing the detectability of the multiple stochastic cyber-attacks are obtained. The presented detection approach is simple and straightforward. Finally, two simulation examples are provided, and the simulation results show that the detection approach is effective and feasible. © 2014 Chinese Association of Automation.

On Zero Dynamics and Controllable Cyber-Attacks in Cyber-Physical Systems and Dynamic Coding Schemes as Their Countermeasures

In this paper, we study stealthy cyber-attacks on actuators of cyber-physical systems(CPS), namely zero dynamics and controllable attacks. In particular, under certain assumptions, we investigate and propose conditions under which one can execute zero dynamics and controllable attacks in the CPS. The above conditions are derived based on the Markov parameters of the CPS and elements of the system observability matrix. Consequently, in addition to outlining the number of required actuators to be attacked, these conditions provide one with the minimum system knowledge needed to perform zero dynamics and controllable cyber-attacks. As a countermeasure against the above stealthy cyber-attacks, we develop a dynamic coding scheme that increases the minimum number of the CPS required actuators to carry out zero dynamics and controllable cyber-attacks to its maximum possible value. It is shown that if at least one secure input channel exists, the proposed dynamic coding scheme can prevent adversaries from executing the zero dynamics and controllable attacks even if they have complete knowledge of the coding system. Finally, two illustrative numerical case studies are provided to demonstrate the effectiveness and capabilities of our derived conditions and proposed methodologies.

Cyber-attack Detection Strategy Based on Distribution System State Estimation

Cyber-attacks that tamper with measurement information threaten the security of state estimation for the current distribution system.This paper proposes a cyber-attack detection strategy based on distribution system state estimation(DSSE).The uncertainty of the distribution network is represented by the interval of each state variable.A three-phase interval DSSE model is proposed to construct the interval of each state variable.An improved iterative algorithm(IIA)is developed to solve the interval DSSE model and to obtain the lower and upper bounds of the interval.A cyber-attack is detected when the value of the state variable estimated by the traditional DSSE is out of the corresponding interval determined by the interval DSSE.To validate the proposed cyber-attack detection strategy,the basic principle of the cyber-attack is studied,and its general model is formulated.The proposed cyber-attack model and detection strategy are conducted on the IEEE 33-bus and 123-bus systems.Comparative experiments of the proposed IIA,Monte Carlo simulation algorithm,and interval Gauss elimination algorithm prove the validation of the proposed method.

Concept and Research Framework for Coordinated Situation Awareness and Active Defense of Cyber-physical Power Systems Against Cyber-attacks

Due to the tight coupling between the cyber and physical sides of a cyber-physical power system(CPPS),the safe and reliable operation of CPPSs is being increasingly impacted by cyber security.This situation poses a challenge to traditional security defense systems,which considers the threat from only one side,i.e.,cyber or physical.To cope with cyberattacks,this paper reaches beyond the traditional one-side security defense systems and proposes the concept of cyber-physical coordinated situation awareness and active defense to improve the ability of CPPSs.An example of a regional frequency control system is used to show the validness and potential of this concept.Then,the research framework is presented for studying and implementing this concept.Finally,key technologies for cyber-physical coordinated situation awareness and active defense against cyber-attacks are introduced.

A Two-stage Kalman Filter for Cyber-attack Detection in Automatic Generation Control System

Communication plays a vital role in incorporating smartness into the interconnected power system.However,historical records prove that the data transfer has always been vulnerable to cyber-attacks.Unless these cyber-attacks are identified and cordoned off,they may lead to black-out and result in national security issues.This paper proposes an optimal two-stage Kalman filter(OTS-KF)for simultaneous state and cyber-attack estimation in automatic generation control(AGC)system.Biases/cyber-attacks are modeled as unknown inputs in the AGC dynamics.Five types of cyber-attacks,i.e.,false data injection(FDI),data replay attack,denial of service(DoS),scaling,and ramp attacks,are injected into the measurements and estimated using OTS-KF.As the load variations of each area are seldom available,OTS-KF is reformulated to estimate the states and outliers along with the load variations of the system.The proposed technique is validated on the benchmark two-area,three-area,and five-area power system models.The simulation results under various test conditions demonstrate the efficacy of the proposed filter.

Defensive Resource Allocation Method for Improving Survivability of Communication and Information System in CPPS Against Cyber-attacks

With the widespread use of communication and information technology,power system has been evolving into cyber-physical power system(CPPS)and becoming more vulnerable to cyber-attacks.Therefore,it is necessary to enhance the ability of the communication and information system in CPPS to defend against cyber-attacks.This paper proposes a method to enhance the survivability of the communication and information system in CPPS.Firstly,the communication and information system for critical business of power system is decomposed into certain types of atomic services,and then the survivability evaluation indexes and their corresponding calculation method for the communication and information system are proposed.Secondly,considering the efficacy and cost defensive resources,a defensive resource allocation model is proposed to maximize the survivability of communication and information system in CPPS.Then,a modified genetic algorithm is adopted to solve the proposed model.Finally,the simulation results of CPPS for an IEEE 30-node system verify the proposed method.

Cascading effects of cyber-attacks on interconnected critical infrastructure

Modern critical infrastructure,such as a water treatment plant,water distribution system,and power grid,are representative of Cyber Physical Systems(CPSs)in which the physical processes are monitored and controlled in real time.One source of complexity in such systems is due to the intra-system interactions and inter-dependencies.Consequently,these systems are a potential target for attackers.When one or more of these infrastructure are attacked,the connected systems may also be affected due to potential cascading effects.In this paper,we report a study to investigate the cascading effects of cyber-attacks on two interdependent critical infrastructure namely,a Secure water treatment plant(SWaT)and a Water Distribution System(WADI).

Cyber-Attack Detection for Autonomous Driving Using Vehicle Dynamic State Estimation

As intelligent vehicles become increasingly computerized and networked,they gain more autonomous capabilities.However,they are also becoming more exposed to cyber-threats which are likely to be a more prominent concern.This paper proposes a cyber-attack detection method for autonomous vehicles based on secure estimation of vehicle states,with an example application under attacks in the vehicle localization system.To investigate the effects of vehicle model and estimator on the attack detection performance,different nonlinear vehicle dynamic models and estimation approaches are employed.The deviation between the measurement from the onboard sensors and the state estimation is monitored in real time.With the designed vehicle state estimator and preset threshold,the cyber-attack detection algorithm is further developed for autonomous vehicles,whose performance is tested in simulations where the vehicle localization system is assumed to be compromised during a double lane change maneuver.The test results demonstrate the feasibility and effectiveness of the proposed cyber-attack algorithm.In addition,the results illustrate the impacts of vehicle nonlinear characteristics on the cyber-attack detection performance.Beyond this,the effects of different vehicle models on the attack detection performance,as well as the selection of suitable filtering approaches for the attack detection,are also discussed.

信息物理多重攻击下配电网状态估计关键技术评述

配电网数字化转型将进一步促进信息系统与物理系统的深度耦合,由于配电网信息安全防御资源有限,难以将信息侧安全风险隔离于物理系统之外,这也使得配电网状态估计正面临全新的挑战。首先,文中简要介绍了配电网信息物理系统体系结构,并构建了面向信息物理系统的配电网状态估计技术框架;其次,较为全面地梳理了信息物理融合背景下配电网状态估计技术的国内外研究现状,包括考虑网络攻击的配电网伪量测建模与分析、配电网虚假数据注入攻击分析与防御以及配电网信息物理系统安全风险分析与可靠性评估等方向;最后,对该领域未来进一步发展所面临的关键问题进行了探讨和分析。

攻防对抗视角下的网络安全主动防御体系研究

为了解决纵深防御体系中防御能力固化、灵活性不足等问题,从攻防对抗视角出发,提出一种网络安全主动防御体系。首先,基于情报收集、监测预警、防御指挥和防御行动等要素的详细描述,设计了用于规划主动防御系统的能力组成框架;其次,选择网络杀伤链、ATT&CK知识库和OODA循环法则,设计了一个以攻助防的防御模型,并分析了引入博弈论进行防御算法设计的优势;最后,以实现为目标,构想了一个典型应用场景,以期为安全能力的体系化设计提供有益借鉴。

新型配电系统分布式经济调度信息安全问题研究综述

随着大规模高比例的分布式电源接入电网运行,分布式经济调度系统因其优势显著受到更多的关注。但是,该系统特有的分布式通信构架、优化问题迭代求解过程和多利益主体参与模式为从系统内部和外部实施网络攻击提供了更宽广的时空条件,攻击模式和手段更加复杂多样,解决信息安全问题是提高分布式经济调度系统实用化程度的重要前提和基础。文中对分布式经济调度系统可能出现的信息安全问题及应对措施的研究现状进行了综述。首先,讨论了电力系统各种通信技术对分布式经济调度系统的适应性以及通信技术本身存在的安全风险;其次,介绍了外部网络攻击和内部恶意行为两类典型的信息安全问题,并进行了相关的特点分析和影响评估;然后,归纳和分析了两类信息安全问题的检测、预防、抑制措施和方法;最后,对信息安全问题模型的建立和综合安全防御体系构建进行了探讨。

Intrusion Detection System for Smart Industrial Environments with Ensemble Feature Selection and Deep Convolutional Neural Networks

Smart Industrial environments use the Industrial Internet of Things(IIoT)for their routine operations and transform their industrial operations with intelligent and driven approaches.However,IIoT devices are vulnerable to cyber threats and exploits due to their connectivity with the internet.Traditional signature-based IDS are effective in detecting known attacks,but they are unable to detect unknown emerging attacks.Therefore,there is the need for an IDS which can learn from data and detect new threats.Ensemble Machine Learning(ML)and individual Deep Learning(DL)based IDS have been developed,and these individual models achieved low accuracy;however,their performance can be improved with the ensemble stacking technique.In this paper,we have proposed a Deep Stacked Neural Network(DSNN)based IDS,which consists of two stacked Convolutional Neural Network(CNN)models as base learners and Extreme Gradient Boosting(XGB)as the meta learner.The proposed DSNN model was trained and evaluated with the next-generation dataset,TON_IoT.Several pre-processing techniques were applied to prepare a dataset for the model,including ensemble feature selection and the SMOTE technique.Accuracy,precision,recall,F1-score,and false positive rates were used to evaluate the performance of the proposed ensemble model.Our experimental results showed that the accuracy for binary classification is 99.61%,which is better than in the baseline individual DL and ML models.In addition,the model proposed for IDS has been compared with similar models.The proposed DSNN achieved better performance metrics than the other models.The proposed DSNN model will be used to develop enhanced IDS for threat mitigation in smart industrial environments.

医院近源网络攻击风险分析及对策建议

目的/意义分析医院面临的近源网络攻击风险,提出对策建议。方法/过程结合实际工作经验,先以近源网络攻击者视角对医院网络架构、现场物理环境、人员行为等方面进行风险分析,再以防守者视角,结合合规要求和技术实践做法,提出对策建议。结果/结论识别出无线局域网破解、有线网络插口暴露、自助机配置不当、投毒与钓鱼、敏感信息泄漏5类主要风险,提出加强Wi-Fi管理、联网终端准入全覆盖、多部门协作管理自助机设备、内网终端禁用移动存储介质、网络安全教育应与时俱进5条防范建议。