The performance of different anomaly detection algorithms is typically compared using metrics that depend on the true positive rate (TPR) and the false positive rate (FPR). However, to obtain the TPR it is necessary to generate attacks that will be detected, which is useless to evaluate detection strategies against more realistic adversaries that can adapt their attacks to remain undetected. On the other hand, the FPR can be misleading and hard to interpret in practical applications since the amount of time a process is observed is not fixed. In this poster, we present a novel metric that is based on the maximum impact an adversary can cause while remaining stealthy, and on the expected time between false alarms. Our metric is useful for the evaluation and comparison of anomaly detection strategies in CPS.

Cyber-Physical Systems (CPS) have traditionally been considered more static with more regular communication patterns when compared to classical information technology networks. Because the structure of most CPS remains unchanged during long periods of times, they become vulnerable to adversaries with the precise knowledge of the system, and who can tailor their attacks based on their knowledge about the system dynamics, communications, and control. Moving Target Defense (MTD) has emerged as a key strategy to add uncertainty about the state and execution of a system in order to prevent attackers from having predictable effects with their attacks. In the last few years MTD has been used in different CPS scenarios by adding uncertainties into the physical characteristics of the system. Most of these applications are used to detect attacks, or to make difficult for attackers to gather information. In this chapter, we propose an MTD strategy for multi-vehicle systems that can be used to mitigate the impact caused by cyber-attacks. We characterize the trade-off between impact mitigation and performance degradation, and illustrate the viability of our approach in two applications, (1) vehicular platooning, and (2) UAV formation. Finally, we extend our results to a more general control systems framework, and we introduce different types of MTD mechanisms, i.e., at the controller level and at sensors.

In the past years we have seen an emerging field of research focusing on using the “physics” of a Cyber-Physical System to detect attacks. In its basic form, a security monitor is deployed somewhere in the industrial control network, observes a time-series of the operation of the system, and identifies anomalies in those measurements in order to detect potentially manipulated control commands or manipulated sensor readings. While there is a growing literature on detection mechanisms in that research direction, the problem of where to monitor the physical behavior of the system has received less attention. In this paper, we analyze the problem of where should we monitor these systems, and what attacks can and cannot be detected depending on the location of this network monitor. The location of the monitor is particularly important, because an attacker can bypass attack-detection by lying in some network interfaces while reporting that everything is normal in the others. Our paper is the first detailed study of what can and cannot be detected based on the devices an attacker has compromised and where we monitor our network. We show that there are locations that maximize our visibility against such attacks. Based on our analysis, we design a low-level security monitor that is able to directly observe the field communication between sensors, actuators, and Programmable Logic Controllers (PLCs). We implement that security monitor in a realistic testbed, and demonstrate that it can detect attacks that would otherwise be undetected at the supervisory network.

Industrial Control Systems (ICS) collect information from a variety of sensors throughout the process, and then use that information to control some physical components. Control engineers usually have to pick which measurements they are going to use and then they purchase sensors to take these measurements. However, in most cases they only need a small subset of all possible measurements that can be used. Economic and efficiency reasons motivate engineers to use only a small number of sensors for controlling a system; however, as attacks against industrial systems continue to increase, we need to study a systematic way to add sensors to the system to identify potentially malicious attacks. We propose the addition of hidden sensor measurements to a system to improve its security. Hidden sensor measurements are by our definition measurements that were not considered in the original design of the system, and are not used for any operational reason. We only add them to improve the security of the system and using them in anomaly detection and mitigation. We show the addition of these new, independent, but correlated measurements to the system makes it harder for adversaries to launch false-data injection stealthy attacks and, even if they do, it is possible to limit the impact caused by those attacks. When an attack is detected, we replace the compromised sensor measurements with estimated ones from the new sensors improving the risky open-loop simulations proposed by previous work.

Unmanned Vehicles (UVs), including aerial, sea, and ground vehicles, include remotely operated vehicles and autonomous vehicles. The use of these vehicles is increasing rapidly, from military operations to the consumer space. UVs assess their environment (or relay it to the remote operator) with a variety of sensors and actuators that allow them to perform specific tasks such as navigating a route, hovering, or avoiding collisions. So far, UVs tend to trust the information provided by their sensors to make navigation decisions without data validation or verification. Therefore, attackers can exploit these limitations by feeding erroneous sensor data to disrupt or take control of the system. In this paper, we leverage the Dynamic Data Driven Application Systems (DDDAS) paradigm to design and implement an architecture for securing unmanned vehicles. We argue that DDDAS principles are a perfect fit to secure feedback-control systems with protections that classical security mechanisms cannot provide. In particular, by using exact models of the vehicle dynamics, we can compare and correlate their expected behavior (given by the models) with the values from data acquisition. If there is a persistent anomaly, we can replace sensor values with models, or fuse other sensors to replace the missing ones, enabling the vehicle to maintain safety in the immediate future.

In the past decade we have seen an active research community proposing attacks and defenses to Cyber-Physical Systems (CPS). Most of these attacks and defenses have been heuristic in nature, limiting the attacker to a set of predefined operations, and proposing defenses with unclear security guarantees. In this paper, we propose a generic adversary model that can capture any type of attack (our attacker is not constrained to follow specific attacks such as replay, delay, or bias) and use it to design security mechanisms with provable security guarantees. In particular, we propose a new secure design paradigm we call DARIA: Designing Actuators to Resist arbItrary Attacks. The main idea behind DARIA is the design of physical limits to actuators in order to prevent attackers from arbitrarily manipulating the system, irrespective of their point of attack (sensors or actuators) or the specific attack algorithm (bias, replay, delays, etc.). As far as we are aware, we are the first research team to propose the design of physical limits to actuators in a control loop in order to keep the system secure against attacks. We demonstrate the generality of our proposal on simulations of vehicular platooning and industrial processes.