Cyber-Physical Systems Security—A Survey <s> A. General CPS Controls <s> In this paper we address the survivability issue of a mobile cyber physical system (MCPS) comprising sensor-carried human actors, vehicles, or robots assembled together for executing a specific mission in battlefield or emergency response situations. We develop a mathematical model to assess the survivability property of a MCPS subject to energy exhaustion and security failure. Our model-based analysis reveals the optimal design setting for invoking intrusion detection to best balance energy conservation vs. intrusion tolerance for achieving high survivability. We test the effectiveness of our approach with a dynamic voting-based intrusion detection technique leveraging sensing and ranging capabilities of mobile nodes in the MCPS and demonstrate its validity with numerical data. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> A. General CPS Controls <s> We present a generic yet practical framework for assessing security risks to cyber-physical systems (CPSs). Our framework can be used to benchmark security risks when information is less than perfect, and interdependencies of physical and computational components may result in correlated failures. Such environments are prone to externalities, and can cause huge societal losses. We focus on the risks that arise from interdependent reliability failures (faults) and security failures (attacks). We advocate that a sound assessment of these risks requires explicit modeling of the effects of both technology-based defenses and institutions necessary for supporting them. Thus, we consider technology-based security defenses grounded in information security tools and fault-tolerant control in conjunction with institutional structures. Our game-theoretic approach to estimating security risks facilitates more effective defenses, especially against correlated failures. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> A. General CPS Controls <s> In this paper we analyze the effect of intrusion detection and response on the reliability of a cyber physical system (CPS) comprising sensors, actuators, control units, and physical objects for controlling and protecting a physical infrastructure. We develop a probability model based on stochastic Petri nets to describe the behavior of the CPS in the presence of both malicious nodes exhibiting a range of attacker behaviors, and an intrusion detection and response system (IDRS) for detecting and responding to malicious events at runtime. Our results indicate that adjusting detection and response strength in response to attacker strength and behavior detected can significantly improve the reliability of the CPS. We report numerical data for a CPS subject to persistent, random and insidious attacks with physical interpretations given. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> A. General CPS Controls <s> Pervasive healthcare systems, smart grids, and unmanned aircraft systems are examples of Cyber-Physical Systems (CPSs) that have become highly integrated in the modern world. As this integration deepens, the importance of securing these systems increases. In order to identify gaps and propose research directions in CPS intrusion detection research, we survey the literature of this area. Our approach is to classify modern CPS Intrusion Detection System (IDS) techniques based on two design dimensions: detection technique and audit material. We summarize advantages and drawbacks of each dimension’s options. We also summarize the most and least studied CPS IDS techniques in the literature and provide insight on the effectiveness of IDS techniques as they apply to CPSs. Finally, we identify gaps in CPS IDS research and suggest future research areas. <s> BIB004
Here we review controls that consider securing CPS, regardless of the application. Addressing the vulnerability causes is the first step in the solution. 1) Controls Against More Connectivity: New security considerations must be taken into account to secure the access point from unauthorized access. Furthermore, the communication protocols used for realizing such connectivity are either proprietary protocols, such as Modbus and DNP3 in deployed ICS and smart grids, or open protocols such as TCP/IP. The proprietary protocols are burdened with a lot of vulnerabilities due to the isolation assumption when the protocols were designed BIB002 . 2) Communication Controls: Security solutions at the communication level in ICS should consider the differences with traditional IT solutions. For example, intrusion detection systems (IDSs) should be time-critical so that long delays are intolerable BIB004 . Mitchell and Chen BIB001 , BIB003 focused on designing IDS solutions for CPS. They also provided a comprehensive survey on IDS solutions in CPS applications BIB004 . 3) Device Attestation: CPS components running software need to verify the software's authenticity. This verification helps significantly minimize malware. For example, hardwarebased solutions such as trusted platform module (TPM) provides code attestation. However, TPMs are assumed to be physical secure, which is infeasible to guarantee in some CPS applications such as ICS and smart grids. Another problem with TPM is the computational overhead on the limited resource CPS applications. Therefore, a new generation of TPMs that considers the limited CPS resources is needed.