Side-Channel Attacks & Data Exfiltration Using Wall Outlet USB Power Adapters

The number and creativity of side channel attacks have increased dramatically in recent years. Of particular interest are attacks leveraging power line communication to 1) gather information on power consumption from the victim and 2) exfiltrate data from compromised machines. Attack strategies of this nature on the greater power grid and building infrastructure levels have been shown to be a serious threat. This project further explores this concept of a novel attack vector by creating a new type of penetration testing tool: an USB power adapter capable of remote monitoring of device power consumption and communicating through powerline communications.

Analysis of cascading failures of power cyber-physical systems considering false data injection attacks

This study considers the performance impacts of false data injection attacks on the cascading failures of a power cyber-physical system,and identifies vulnerable nodes.First,considering the monitoring and control functions of a cyber network and power flow characteristics of a power network,a power cyber-physical system model is established.Then,the influences of a false data attack on the decision-making and control processes of the cyber network communication processes are studied,and a cascading failure analysis process is proposed for the cyber-attack environment.In addition,a vulnerability evaluation index is defined from two perspectives,i.e.,the topology integrity and power network operation characteristics.Moreover,the effectiveness of a power flow betweenness assessment for vulnerable nodes in the cyberphysical environment is verified based on comparing the node power flow betweenness and vulnerability assessment index.Finally,an IEEE14-bus power network is selected for constructing a power cyber-physical system.Simulations show that both the uplink communication channel and downlink communication channel suffer from false data attacks,which affect the ability of the cyber network to suppress the propagation of cascading failures,and expand the scale of the cascading failures.The vulnerability evaluation index is calculated for each node,so as to verify the effectiveness of identifying vulnerable nodes based on the power flow betweenness.

Clustering Collision Power Attack on RSA-CRT

In this paper,we propose two new attack algorithms on RSA implementations with CRT(Chinese remainder theorem).To improve the attack efficiency considerably,a clustering collision power attack on RSA with CRT is introduced via chosen-message pairs.This attack method is that the key parameters dp and dq are segmented by byte,and the modular multiplication collisions are identified by k-means clustering.The exponents dp and dq were recovered by 12 power traces of six groups of the specific message pairs,and the exponent d was obtained.We also propose a second order clustering collision power analysis attack against RSA implementation with CRT,which applies double blinding exponentiation.To reduce noise and artificial participation,we analyze the power points of interest by preprocessing and k-means clustering with horizontal correlation collisions.Thus,we recovered approximately 91%of the secret exponents manipulated with a single power curve on RSA-CRT with countermeasures of double blinding methods.

Decentralized Resilient H_∞Load Frequency Control for Cyber-Physical Power Systems Under DoS Attacks

This paper designs a decentralized resilient H_(∞)load frequency control(LFC)scheme for multi-area cyber-physical power systems(CPPSs).Under the network-based control framework,the sampled measurements are transmitted through the communication networks,which may be attacked by energylimited denial-of-service(DoS)attacks with a characterization of the maximum count of continuous data losses(resilience index).Each area is controlled in a decentralized mode,and the impacts on one area from other areas via their interconnections are regarded as the additional load disturbance of this area.Then,the closed-loop LFC system of each area under DoS attacks is modeled as an aperiodic sampled-data control system with external disturbances.Under this modeling,a decentralized resilient H_(∞)scheme is presented to design the state-feedback controllers with guaranteed H∞performance and resilience index based on a novel transmission interval-dependent loop functional method.When given the controllers,the proposed scheme can obtain a less conservative H_(∞)performance and resilience index that the LFC system can tolerate.The effectiveness of the proposed LFC scheme is evaluated on a one-area CPPS and two three-area CPPSs under DoS attacks.

An Improved Empirical Mode Decomposition for Power Analysis Attack

Correlation power analysis(CPA) has become a successful attack method about crypto-graphic hardware to recover the secret keys. However, the noise influence caused by the random process interrupts(RPIs) becomes an important factor of the power analysis attack efficiency, which will cost more traces or attack time. To address the issue, an improved method about empirical mode decomposition(EMD) was proposed. Instead of restructuring the decomposed signals of intrinsic mode functions(IMFs), we extract a certain intrinsic mode function(IMF) as new feature signal for CPA attack. Meantime, a new attack assessment is proposed to compare the attack effectiveness of different methods. The experiment shows that our method has more excellent performance on CPA than others. The first and the second IMF can be chosen as two optimal feature signals in CPA. In the new method, the signals of the first IMF increase peak visibility by 64% than those of the tradition EMD method in the situation of non-noise. On the condition of different noise interference, the orders of attack efficiencies are also same. With external noise interference, the attack effect of the first IMF based on noise with 15dB is the best.

An Improved Simple Power Attack against Camellia's Key Schedule

This paper presents an improved simple power attack against the key schedule of Camellia. While the original attack required an exact determination of the Hamming weight of intermediate data values based on power measurements, in this paper, two types of the simple power attack are presented and shown to be tolerant of errors that might occur in the Hamming weight determinations. In practical applications of the attack, such errors are likely to occur due to noise and distortion in the power measurements and their mapping to the Hamming weights of the data. To resist these attacks, the required design rationale of key schedules and several practical countermeasures are suggested.

Invariant of Enhanced AES Algorithm Implementations Against Power Analysis Attacks

The security of Internet of Things(IoT)is a challenging task for researchers due to plethora of IoT networks.Side Channel Attacks(SCA)are one of the major concerns.The prime objective of SCA is to acquire the information by observing the power consumption,electromagnetic(EM)field,timing analysis,and acoustics of the device.Later,the attackers perform statistical functions to recover the key.Advanced Encryption Standard(AES)algorithm has proved to be a good security solution for constrained IoT devices.This paper implements a simulation model which is used to modify theAES algorithm using logicalmasking properties.This invariant of the AES algorithm hides the array of bits during substitution byte transformation of AES.This model is used against SCAand particularly Power Analysis Attacks(PAAs).Simulation model is designed on MATLAB simulator.Results will give better solution by hiding power profiles of the IoT devices against PAAs.In future,the lightweight AES algorithm with false key mechanisms and power reduction techniques such as wave dynamic differential logic(WDDL)will be used to safeguard IoT devices against side channel attacks by using Arduino and field programmable gate array(FPGA).

Analysis of Causes and Actual Events on Electric Power Infrastructure Impacted by Cyber Attack

With the development of electric power technology, information technology and military technology, the impact of cyber attack on electric power infrastructure has increasingly become a hot spot issue which calls both domestic and foreign attention. First, main reasons of the impact on power infrastructure caused by cyber attack are analyzed from the following two aspects: 1) The dependence of electric power infrastructure on information infrastructure makes cyber attack issues in information field likely to affect electric power field. 2) As regards to the potential threat sources, it will be considerably profitable to launch cyber attacks on electric power infrastructure. On this basis, this paper gives a classified elaboration on the characteristics and the possibilities of cyber attacks on electrical infrastructures. Finally, the recently published actual events of cyber attacks in respect of threat sources, vulnerabilities and assaulting modes are analyzed and summarized.

针对风机变桨距控制系统隐蔽攻击的防御方法研究

伴随信息化程度不断提高,隐蔽攻击将对风机变桨距控制系统构成威胁。为此,设计了一种防御结构。将攻击信号对被控对象的影响反馈给控制器,由控制器实时调节控制输出信号,进而防御隐蔽攻击。分别在有攻击和无攻击场景下分析了采用防御结构后系统的稳定性。仿真结果显示,在隐蔽攻击时间段内,采用防御结构后,风机输出功率与设定值的平均误差为0.004 MW;在无攻击时间段内,风机输出功率与原系统保持一致。该结果说明,防御结构有效。

基于SOS-LSTM的核电站隐蔽攻击方法研究

针对实现隐蔽攻击需要获取攻击目标高精度估计模型的问题,提出一种基于共生生物搜索算法优化长短期记忆神经网络(SOS-LSTM)的隐蔽攻击方法。首先,将攻击目标的反馈控制器输出和输入信号作为长短期记忆神经网络的数据集,通过训练得到受攻击区域的估计模型,再利用估计模型设计隐蔽攻击器向受攻击对象施加攻击信号。此外,使用SOS算法优化LSTM的网络参数来提升隐蔽攻击器的性能。对核电站一回路控制系统进行隐蔽攻击的仿真实验结果表明,该攻击方法在对目标控制系统输出信号实现预先设定攻击行为的同时具有较高隐蔽性。

面向智算融合网络的自主防御范式研究

随着数字经济时代算力供给模式的变革,以算力为核心的新型网络基础设施已成为实现算力资源共享、支撑数字经济转型的重要动力.在算力网络中,多元异构用户终端通过多种方式高频接入网络以随时随地获取算力服务,网络的开放性和动态性增大,算力网络将面临更严峻的安全挑战.然而,基于传统网络的安全防御模式通常针对具体安全问题静态式增补安全防护组件,无法主动适配用户需求灵活调整防御策略,难以应对算力网络中的安全风险.因此,本文面向新型算力网络安全需求,将安全功能作为网络内部属性,基于智算融合网络提出一种多维协同自主防御范式.结合智算融合网络“三层”“三域”的设计思想,在“三层”中,以广义服务层定义安全固有服务,以映射适配层智慧适配安全功能,以融合组件层执行安全策略;在“三域”中,以实体域先导资源适配,以知识域驱动安全服务流程,以感控域实施具体安全技术,构建“检测”“溯源”“防御”三维一体的完整基础管控流程,其中安全策略与技术可根据场景扩展性与业务安全性进行灵活调整.最终,通过仿真实验对所提范式有效性进行了验证,为未来智算融合安全的进一步研究和应用提供参考.

基于自适应生成对抗网络的智能电网状态重构的虚假数据攻击检测

考虑到电力系统与能源互联网的深度耦合,虚假数据注入攻击对电力系统的威胁不断提升。文章针对虚假数据注入攻击(false data injection attack,FDIA)设计自适应生成对抗网络(adaptive generative adversarial networks,AGAN)状态重构的虚假数据注入攻击检测方法。该方法在生成对抗网络(generative adversarial networks,GAN)基础上融入卷积神经网络(convolutional neural network,CNN)以及自适应约束下的自注意力机制(self-attention,SA),实现节点间全局参考性,从而实现状态的有效重构和异常状态的准确预测;根据AGAN的异常数据预测结果设计结合网络判别值的检测逻辑。最后,在IEEE14节点的电力系统上验证所提方法的有效性,且对比GAN、CNN,AGAN重构的平均绝对百分比误差为0.0001%,检测准确率可达到98%。

基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法

农业设备、传感器和监控系统与网络的连接日益紧密,给农村配电网带来了新的网络安全挑战。其中,分布式拒绝服务(DDoS)攻击是一种常见的网络威胁,对农村配电网的安全性构成了严重威胁。针对农村配电网的特殊需求,提出一种基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法。通过制定网络应用层流量数据包捕获流程并构建多模态神经网络模型,成功提取并分析了网络应用层DDoS攻击流量的特征。在加载DDoS攻击背景下的异常流量特征后,计算相关系数并设计相应的DDoS攻击检测规则,以实现对DDoS攻击的有效检测。经试验分析,所提出的方法在提取DDoS攻击相关特征上表现出色,最大提取完整度可达95%,效果明显优于对比试验中基于EEMD-LSTM的检测方法和基于条件熵与决策树的检测方法。

基于双掩码技术的抗功耗攻击CMOS电路设计

为增强现有差分传输管预充电逻辑(differential pass-transistor pre-charge logic,DP^(2)L)电路结构的抗功耗攻击性能,设计并开发了一种改进型DP^(2)L电路。与改进前电路相比,改进型DP^(2)L电路在不同输入信号下晶体管的导通数目保持相同,从而表现出更好的功耗恒定性能。在此基础上,进一步设计了双轨双掩码差分传输管预充电逻辑(double masked differential pass-transistor pre-charge logic,DMDP^(2)L)电路。该电路不仅改善了原有电路的功耗恒定特性,而且引入的双掩码具有随机性,加大了攻击者获取电路运算结果的难度。模拟结果表明,设计的双轨DMDP^(2)L电路较其他3种同类型逻辑电路的标准化能量偏差(normalized energy deviation,NED)分别减小了11.33%,5.19%和3.06%,表明其具有更好的功耗恒定特性和抗功耗攻击能力。

随机空间几何构型下物联网络攻击节点定位

物联网各节点形成的空间几何构型随机性,决定了攻击节点的空间分辨率出现较大波动,继而影响攻击节点的定位精度。针对物联网下各节点形成的空间几何构型随机性,利用节点脉冲和功率的关联属性不受空间几何构型影响的特征,设计一种攻击节点定位算法。定位算法检测节点脉冲信号,设计最优功率关联算法,关联功率与脉冲的属性。通过关联属性构建节点距离测算定位方法。实验结果表明:文中的物联网攻击节点定位方法,在低、中、高阶三种攻击特征形式下,可以实时准确定位攻击性节点位置,具备较强的实用性。

电力高级量测体系网络攻击致损路径图构建及风险评估

高级量测体系(AMI)是新型电力系统的重要组成部分,随着大量智能终端和异构通信链路广泛接入,网络攻击的风险与日俱增。因此,提出电力AMI网络攻击致损路径图构建及风险量化评估方法,量化分析网络攻击对系统的影响。首先,考虑AMI中的3种网络攻击场景,构建了各场景攻击致损路径图及贝叶斯攻击图。其次,考虑到漏洞利用的难度和攻击者的技术水平,建立了漏洞平均攻破时间(MTTC)模型,计算各攻击目标的攻破概率。然后,建立了针对AMI虚假数据注入的负荷损失评估模型,求解出负荷削减问题,并结合攻击概率提出了安全风险综合定量评估模型。最后,基于IEEE 39节点系统,对比分析了不同级别攻击者在AMI不同攻击致损路径下的MTTC,计算了网络攻击下系统的安全风险值,验证了所提方法的有效性。

电力信息物理系统跨域攻击协同防御架构及机制研究

我国电力基础设施已经发展成为具有高度信息化、自动化、智能化特征的信息物理融合系统.信息-物理交互在显著提升电力供给效率和性能的同时,也引入了新型网络安全威胁,通过发生于信息域并明确作用于物理域的跨域攻击,可造成电力基础设施系统性瘫痪,继而引发大面积停电事故,而当前孤立的信息侧或物理侧防御体系难以有效应对跨域攻击威胁.本文介绍了电力系统面临的信息物理跨域攻击威胁现状,分析了传统防御方法面对跨域攻击时存在的不足,提出了一种信息物理协同的跨域攻击防御架构,在针对跨域攻击传播的不同阶段,从感知、辨识、阻断三个角度设计了防御方法,通过算例验证了所提信息物理协同防御架构能够有效保障电力系统安全稳定运行.

最新电压毛刺(Power Glitch)攻击与防御方法研究

电压毛刺(Power Glitch)攻击是通过快速改变输入到芯片的电压,使得芯片里的某些晶体管受到影响,引起一个或多个触发器进入错误状态,从而导致处理器会跳过或实施错误的操作,使芯片内隐藏的信息随着产生的错误而泄露出来。对电压毛刺攻击与防御技术的最新进展情况进行了综述。在攻击方面,针对攻击目的的不同,详细介绍了RSA-CRT签名运算、RSA非CRT签名运算、对非易失存储器的攻击技术。防御技术分别介绍了电压毛刺检测电路和掩码,并分析了各种防御方案的优缺点。

Game-theoretical Model for Dynamic Defense Resource Allocation in Cyber-physical Power Systems Under Distributed Denial of Service Attacks

Electric power grids are evolving into complex cyber-physical power systems(CPPSs)that integrate advanced information and communication technologies(ICTs)but face increasing cyberspace threats and attacks.This study considers CPPS cyberspace security under distributed denial of service(DDoS)attacks and proposes a nonzero-sum game-theoretical model with incomplete information for appropriate allocation of defense resources based on the availability of limited resources.Task time delay is applied to quantify the expected utility as CPPSs have high time requirements and incur massive damage DDoS attacks.Different resource allocation strategies are adopted by attackers and defenders under the three cases of attack-free,failed attack,and successful attack,which lead to a corresponding consumption of resources.A multidimensional node value analysis is designed to introduce physical and cybersecurity indices.Simulation experiments and numerical results demonstrate the effectiveness of the proposed model for the appropriate allocation of defense resources in CPPSs under limited resource availability.

数字化新型电力系统攻击与防御方法研究综述

随着先进数字技术、通信技术和互联网技术的发展,传统电力系统转变为数字化、自动化和高效管理的新型电力系统。然而,信息域与物理域的深度融合使新型电力系统中的网络、层次和组件变得更加复杂,大量的智能电子设备频繁访问与信息交互,更容易出现如窃取篡改数据、堵塞通信信道和破坏关键设备等恶意攻击,对新型电力系统的安全性、稳定性和经济性构成巨大威胁,引发了学术界的极大关注。首先,文中剖析了新型电力系统的结构和面临的潜在威胁,从控制层、网络层、物理层3个层面对新型电力系统攻击模式进行了深入分析。然后,详细归纳总结了新型电力系统攻击前、攻击中、攻击后的3层安全防御方法。最后,明确阐述了新型电力系统安全性研究的未来技术发展前景,为构建可靠、安全、健壮的新型电力系统提供技术支撑。