With the recent increase in popularity of the Internet of Things (IoT), many companies quickly developed new devices using this technology to stake a claim in a blooming industry. While taking advantage of this technology has yielded many benefits and conveniences in the past few years, the glaring issue of security has not been properly addressed. We have seen many recent attacks on children through IoT devices, and while security mechanisms do exist and are available for use, users without a technical background generally may not see the risks as something worth putting effort into mitigating.

In this thesis, we perform a network analysis on some of the existing smart devices available on the market and collect survey data from parents about their understanding of IoT technologies. We form a generalizable mental model of parents and IoT devices as well as a threat model of possible attack vectors. We then address the issues found in our research and provide recommendations for developers to improve their IoT system security.

Despite all the increasing research efforts in industrial control systems (ICS), these systems still fail to defend themselves at the time of some high-profile cyber attacks. The most high-profile attack events include but not limited to the Stuxnet attack on an Iranian nuclear power plant in 2010, the Industroyer malware attack on the Ukrainian power grid in 2016, and the recent ransomware attack on the U.S. Colonial pipeline in May 2021, which severely limit the fuel supply to half of the east coast.

The Supervisory Control and Data Acquisition (SCADA) networks expose themselves to a broader attack surface after the migration from serial communication network to TCP/IP compatible networks. Therefore, they are susceptible to cyber-attacks. Another main reason why the security and resilience of SCADA networks have limited improvements over the decade is that, the majority of the previous work does not have access to real-world systems or datasets. Because it is not possible to interrupt the production process with penetration tests, and not easy to earn the trust of the operators.

In the prelusive chapter of this dissertation, we first introduce the concepts of SCADA and industrial control protocols. Then we review the previous work divided by energy sectors in the critical infrastructure, which enables us to recognize contributions, identify limitations, raise research questions, and discover answers. With network captures from the SCADA networks in operational industrial control systems, specifically the power grid and the natural gas distribution network, we launch our project with the reversal of the SCADA network topology with different levels of system knowledge, and show that even in the least bliss, one can still conduct network discovery to the majority of network nodes. The later characteristics we extract from the communication conversations between substations and control servers challenge the long-term understanding of the SCADA network in the security community. The primary industrial protocol under investigation is IEC 60870-5-104, an application-layer protocol designed to control and monitor the physical processes in federated SCADA networks.

With the knowledge base obtained from network characterization, then we propose network flow based anomaly detection method by applying unsupervised clustering of the network flows, and process-based anomaly detection. The anomaly detection is based on profiling process variables, by applying gradient boosting tree algorithm and deep neural networks on time series datasets. Both work flows are experimented with datasets divided by our system knowledge levels range from the system operators help verifying the majority of network topology and hardware devices, to no support at all.

Approaching from the perspective of network measurements, our goal is to establish the normal behavior baseline of the anomaly detector by applying deep-packet inspection, and have captured several intriguing outliers and process anomalies that are not available in a simulation/emulation environment. After successfully training of the gradient boosting based detector, we use feature importance analysis to mitigate the existing limitation of black-boxed machine learning applications, and quantify the contribution of features leading to the detection result.

The contributions of this dissertation are as follows:- Provide solid testimonies that shred the security community's consensus of SCADA networks being stable and predictable, from the overall network topology to the subtleties in the process variables - Construct the first network characterization for an operational bulk power grid, that offers the first view of the unique difficulties in defending a federated SCADA network - Implement the first process-aware anomaly detector for two operational SCADA networks, one bulk power grid and one gas pipeline network, that successfully identifies the process anomalies and potentially dangerous mis-configuration errors - Present the discussion of the ambiguous understanding of false positives in the anomaly detection for ICS, with the valuable insight from the study of real-world datasets

The ever-increasing ubiquity of cyber-physical systems is creating an attractive target for developing malware and cyber attacks. From consumer-grade IoT devices like drones to specialized industrial equipment in critical infrastructure, many new and varied attacks and malware emerge to afflict these systems, impacting the physical environment and processes handled by the devices.A fundamental part of protecting a system against malware and cyber attacks involves understanding the nature of the attack to devise an effective countermeasure. However, due to the nature of some of these systems, a comprehensive analysis might be unfeasible or outright dangerous. To overcome this limitation, we propose using a virtualized scenario, emulating the system's behavior, more specifically the physical and networking behavior, to dynamically analyze cyber-attacks and malware without compromising the physical integrity of the systems and their environment. We first test the feasibility of this idea by simulating cyber-attacks against a virtual quadcopter drone before testing the attacks on its physical counterpart once the attacks are deemed "safe" for the user and the drone. Then, we emulate an industrial process using software-defined networks to evaluate the feasibility of implementing defense mechanisms against attacks with some features provided by software-defined networks. Finally, we combine the virtualization of cyber-physical systems and the use of software-defined networks to simulate a power grid system to dynamically analyze the behavior of an actual malware known as "Win32.Industroyer" by infecting a virtual machine in an isolated virtual environment. Our ultimate goal is to refine a framework to allow researchers to safely simulate cyber-physical systems to test attacks, defenses, and malware against a virtual avatar of the existing system.

In recent years, an increasing number of attacks have targeted Industrial Control Systems (ICS) worldwide, exposing the fragility of these systems. Understanding the SCADA networks that govern critical infrastructures is increasingly vital to protect this system. However, the confidential nature of ICS data typically restricts access to the real world, limiting efforts of academic research for more realistic studies. While previous studies have focused on some isolated network characteristics in a single infrastructure, none have taken a comparative approach across multiple critical infrastructures and multiple industrial protocols.

Aiming to fill this gap, our research dissects operational SCADA networks across multiple ICS based on real-world data. This study focused on network measurement of SCADA traffic in two ways: (1) between distinct ICS such as power, gas, and water, and (2) among the subsystems in the power grid from generation to end-customer grids.

Our analysis reveals distinct and shared behaviors of these networks, providing insight into their network behavior and configuration. It also reveals non-standard configurations, protocol operation characteristics, topology configurations, and considerable variations in periodic traffic patterns, high packet transmission rates, and message types. These insights contribute to a more realistic understanding of SCADA networks, challenging previous assumptions and emphasizing the existence of substantial diversity in SCADA traffic within these infrastructures. Our findings underscore the need for a specialized approach tailored to each critical infrastructure and open the door for better network characterization for cybersecurity measures and more accurate designs in intrusion detection systems.