A design-centric modeling approach was proposed to model the behavior of the physical process controlled by an Industrial Control System (ICS) and study the cascading effects of data-oriented attacks. A threat model was used as input to guide the construction of the model where control components which are within the adversary's intent and capabilities are extracted. The relevant control components are subsequently modeled together with their control dependencies and operational design specifications. The approach was demonstrated and validated on a water treatment testbed. Attacks were simulated on the testbed model where its resilience to attacks was evaluated using proposed metrics such as Impact Ratio and Time-to-Critical-State. From the analysis of the attacks, design strengths and weaknesses were identified and design improvements were recommended to increase the testbed's resilience to attacks.
in @cite_4 proposed a framework to measure impact of attack on stochastic linear control systems using the infinity norm of critical states over a time window. The impact is measured by how much the critical states of the system deviates from the steady state over a period of time steps while remaining undetected by an anomaly detector. The impact metric provides information of the extent to which the system is perturbed during an attack but does not give resolution on the impact on the physical process.
@cite_4
2509307846 2905059695 2903296787 2342927499
Abstract Estimating the possible impacts of security attacks on physical processes can help to rank the critical assets based on their sensitivity to performed attacks and predict their attractiveness from the attacker’s point of view. To address this challenge, this paper proposes a new method for assessing the direct and indirect impacts of attacks on cyber–physical systems (CPSs). The proposed method studies the dynamic behavior of systems in normal situation and under security attacks and evaluates the consequence propagation of attacks. The inputs to the model are control parameters including sensor readings and controller signals. The output of the model is evaluating the consequence propagation of attacks, ranking the important assets of systems based on their sensitivity to conducted attacks, and prioritizing the attacks based on their impacts on the behavior of system. The validation phase of the proposed method is performed by modeling and evaluating the consequence propagation of attacks against a boiling water power plant (BWPP). The safety validation of automated driving of SAE level 3 and higher (AD) is still an unsolved issue. In the validation process, criticality metrics can be used for two different purposes. First, for the identification of test scenarios from recorded data that are later tested in simulation. Secondly, for an estimation of the safety of a specific AD system based on the likelihood of critical situations in test drives or in other words as a safety surrogate. In the past, different metrics for those purposes have been defined that work well in specific scenarios such as longitudinal traffic. However, a metric that describes criticality in all situations and is applicable to human and AD traffic is currently not available. In this paper, an approach to define a criticality metric is introduced. The metric is based on the definition of criticality as the level of driving requirements in the specific situation. The computation of the proposed metric uses elements of model predictive control using an objective function that contains four elements that describe the difficulty of the driving task. Based on those demands and a simplified driving dynamics model, the solution with the minimal criticality is computed. Finally, the metric is tested in four test scenarios that are typical for highway traffic. A short parameter variation study is conducted in order to study certain effects of the algorithm and to identify room for improvement. Risk assessment is an inevitable step in the implementation of cost-effective security strategies for control systems. One of the difficulties of risk assessment is to estimate the impact cyber-attacks may have. This paper proposes a framework to estimate the impact of several cyber-attack strategies against a dynamical control system equipped with an anomaly detector. In particular, we consider denial of service, sign alternation, rerouting, replay, false data injection, and bias injection attack strategies. The anomaly detectors we consider are stateless, cumulative sum, and multivariate exponentially weighted moving average detectors. As a measure of the attack impact, we adopt the infinity norm of critical states after a fixed number of time steps. For this measure and the aforementioned anomaly detectors, we prove that the attack impact for all of the attack strategies can be reduced to the problem of solving a set of convex minimization problems. Therefore, the exact value of the attack impact can be obtained easily. We demonstrate how our modeling framework can be used for risk assessment on a numerical example. In this paper, we propose two metrics, i.e., the optimal repair time and the resilience reduction worth, to measure the criticality of the components of a network system from the perspective of their contribution to system resilience. Specifically, the two metrics quantify: 1) the priority with which a failed component should be repaired and re-installed into the network and 2) the potential loss in the optimal system resilience due to a time delay in the recovery of a failed component, respectively. Given the stochastic nature of disruptive events on infrastructure networks, a Monte Carlo-based method is proposed to generate probability distributions of the two metrics for all of the components of the network; then, a stochastic ranking approach based on the Copeland's pairwise aggregation is used to rank components importance. Numerical results are obtained for the IEEE 30-bus test network and a comparison is made with three classical centrality measures.