A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> In the last years there has been an increasing interest in the security of process control and SCADA systems. Furthermore, recent computer attacks such as the Stuxnet worm, have shown there are parties with the motivation and resources to effectively attack control systems. While previous work has proposed new security mechanisms for control systems, few of them have explored new and fundamentally different research problems for securing control systems when compared to securing traditional information technology (IT) systems. In particular, the sophistication of new malware attacking control systems--malware including zero-days attacks, rootkits created for control systems, and software signed by trusted certificate authorities--has shown that it is very difficult to prevent and detect these attacks based solely on IT system information. In this paper we show how, by incorporating knowledge of the physical system under control, we are able to detect computer attacks that change the behavior of the targeted control system. By using knowledge of the physical system we are able to focus on the final objective of the attack, and not on the particular mechanisms of how vulnerabilities are exploited, and how the attack is hidden. We analyze the security and safety of our mechanisms by exploring the effects of stealthy attacks, and by ensuring that automatic attack-response mechanisms will not drive the system to an unsafe state. A secondary goal of this paper is to initiate the discussion between control and security practitioners--two areas that have had little interaction in the past. We believe that control engineers can leverage security engineering to design--based on a combination of their best practices--control algorithms that go beyond safety and fault tolerance, and include considerations to survive targeted attacks. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Smart grid deployment initiatives have been witnessed in the past recent years. Smart grids provide bi-directional communication between meters and headend system through Advanced Metering Infrastructure (AMI). Recent studies highlight the threats targeting AMI. Despite the need of tailored Intrusion Detection Systems (IDS) for the smart grid, very limited progress has been made in this area. Unlike traditional networks, smart grid has its own unique challenges, such as limited computational power devices and potentially high deployment cost, that restrict the deployment options of intrusion detectors. We show that smart grid exhibits deterministic and predictable behavior that can be accurately modeled to develop intrusion detection system. In this paper, we show that AMI behavior can be modeled using event logs collected at smart collectors, which in turn can be verified using the specifications invariant generated from the configurations of the AMI devices. Event logs are modeled using fourth order Markov Chain and specifications are written in Linear Temporal Logic (LTL). The approach provides robustness against evasion and mimicry attacks, however, we discuss that it still can be evaded to a certain extent. We validate our approach on a real-world dataset of thousands of meters collected at the AMI of a leading utility provider. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Networked control systems used in energy, manufacturing, and transportation combine large, vulnerable attack surfaces with far overprovisioned privileges. Often, compromising a single computer or user account is sufficient to give an attacker free reign over physical machinery. Significant reduction of attack surface size is an ongoing problem, so we shift our focus to reducing the privileges granted to system operators and embedded controllers. To this end, we introduce C2, an enforcement mechanism for policies governing the usage of electromechanical devices. In presenting C2, we address two basic problems: (i.) How should a policy for physical device usage be expressed and enforced? This is a challenging question, as the safe usage of physical devices is dependent on mechanical limitations and the behavior of nearby devices. (ii.) What actions should be taken if a physical machine is issued an operation that violates the policy? C2 takes measures to ensure unsafe behaviors are not caused when denying slightly erroneous yet legitimate operations. We evaluate C2 against six representative control systems, and show that it can efficiently perform policy checks with less than 3.7% overhead, while not introducing new unsafe behaviors into a control system. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Off-the-shelf intrusion detection systems prove an ill fit for protecting industrial control systems, as they do not take their process semantics into account. Specifically, current systems fail to detect recent process control attacks that manifest as unauthorized changes to the configuration of a plant's programmable logic controllers (PLCs). In this work we present a detector that continuously tracks updates to corresponding process variables to then derive variable-specific prediction models as the basis for assessing future activity. Taking a specification-agnostic approach, we passively monitor plant activity by extracting variable updates from the devices' network communication. We evaluate the capabilities of our detection approach with traffic recorded at two operational water treatment plants serving a total of about one million people in two urban areas. We show that the proposed approach can detect direct attacks on process control, and we further explore its potential to identify more sophisticated indirect attacks on field device measurements as well. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Advanced false data injection attack in targeted malware intrusion is becoming an emerging severe threat to the Supervisory Control And Data Acquisition SCADA system. Several intrusion detection schemes have been proposed previously [1, 2]. However, designing an effective real-time detection system for a resource-constraint device is still an open problem for the research community. In this paper, we propose a new relation-graph-based detection scheme to defeat false data injection attacks at the SCADA system, even when injected data may seemly fall within a valid/normal range. To balance effectiveness and efficiency, we design a novel detection model, alternation vectors with state relation graph. Furthermore, we propose a new inference algorithm to infer the injection points, i.e., the attack origin, in the system. We evaluate SRID with a real-world power plant simulator. The experiment results show that SRID can detect various false data injection attacks with a low false positive rate at 0.0125%. Meanwhile, SRID can dramatically reduce the search space of attack origins and accurately locate most of attack origins. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Modern Process Control Systems (PCS) exhibit an increasing trend towards the pervasive adoption of commodity, off-the-shelf Information and Communication Technologies (ICT). This has brought significant economical and operational benefits, but it also shifted the architecture of PCS from a completely isolated environment to an open, “system of systems” integration with traditional ICT systems, susceptible to traditional computer attacks. In this paper we present a novel approach to detect cyber attacks targeting measurements sent to control hardware, i.e., typically to Programmable Logical Controllers (PLC). The approach builds on the Gaussian mixture model to cluster sensor measurement values and a cluster assessment technique known as silhouette. We experimentally demonstrate that in this particular problem the Gaussian mixture clustering outperforms the k-means clustering algorithm. The effectiveness of the proposed technique is tested in a scenario involving the simulated Tennessee-Eastman chemical process and three different cyber attacks. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> Cyber-physical systems are characterized by an IT infrastructure controlling effects in the physical world. Attacks are intentional actions trying to cause undesired physical effects. When process data originating in the physical world is manipulated before being handed to the IT infrastructure, the data security property called "veracity" or trustworthiness will be violated. There is no canonical IT security solution guaranteeing that the inputs from a sensor faithfully represent reality. However, the laws of physics may help the defender to detect impossible or implausible sensor readings. This paper proposes a process-aware approach to detect when a sensor signal is being maliciously manipulated. We present a set of lightweight real-time algorithms for spoofing sensor signals directly at the microcontroller of the field device. The detection of spoofed measurements takes the form of plausibility and consistency checks with the help of the correlation entropy in a cluster of related sensors. We use the Tennessee Eastman challenge process to demonstrate the performance of our approach and to highlight aspects relevant to the detection effectiveness. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Cyber-Security <s> The new culture of networked systems that offer everywhere accessible services has given rise to various types of security tradeoffs. In fact, with the evolution of physical systems that keep getting integrated with cyber frameworks, cyber threats have far more critical effects as they get reflected on the physical environment. As a result, the issue of security of cyber physical systems requires a special holistic treatment. In this paper, we study the tradeoff between security, safety, and availability in such systems and demonstrate these concepts on implantable medical devices as a case study. We discuss the challenges and constraints associated with securing such systems and focus on the tradeoff between security measures required for blocking unauthorized access to the device and the safety of the patient in emergency situations where such measures must be dropped to allow access. We analyze the up to date proposed solutions and discuss their strengths and limitations. <s> BIB008
The cyber-security community is also very active in the physics-based attack detection space. While the control theory and power systems communities tend to work at the conceptual level, the cyber-security community has focused on the details and complexities of implementing attackdetection in practice. Real-world Modbus-based Detection. One of the first papers to analyze network data from a real-world industrial system was the work of Hadziosmanovic et al. BIB004 . In particular, they showed how to use Modbus (an industrial protocol) traces from a real-world operational system to detect attacks by monitoring the state variables of the system, including: constants, attribute data, and continuous data. We focus on their analysis of continuous data, because this research is a motivation for our own experiments in this article. Attack Detection: To model the behavior of continuous sensor observations y k like the water level in a tank or the water pressure in a pipe, the authors use an AR model as we described in Equation BIB002 . This corresponds to models of individual signals, and as we will show in our experiments, if we can create models that show the correlation of multiple variables, then we can obtain better attack detection algorithms. In fact, that was an observation made by the authors, as they found that multiple variables exhibit similar (even identical) behavior. The detection mechanism raises an alert if (1) the measurement y k reaches outside of specified limits (this is equivalent to the Safety Check box in Figure 6 ) or (2) y k produces a deviation in the predictionŷ k of the autoregressive model (noting that r k = y k −ŷ k ), this is the stateless statistical test from Figure 6 . Attack Location: It is not clear where in the control architecture the real-world data trace was collected. Because deploying a large-scale collection of a variety of devices in a control network is easier at the supervisory control network, it is likely that the real-world traffic monitors data exchanged between the control centers and the PLCs. In this case the PLC must be trusted, and therefore the adversary must attack the actuators or the sensors. Validation: The paper focuses on understanding how accurately their AR system models the real-world system and identifying the cases where it fails. They mention that they are more interested in understanding the model fidelity rather than in specific true-/false-alarm rates, and we agree with them, because measuring the true positive rate would be an artificial metric. Understanding the model fidelity is implicitly looking at the potential of false alarms, because deviations between predictions and observations during normal operations are indicators of false alarms. While this is a good approach for the exploratory data analysis done in the paper, it might be misunderstood by future proposals. After all, the rule never raise an alert will have zero false alarms (but it will never detect any attack). We discuss this further in Section 5. Authors implement their proposed strategy using real data from a testbed. State Relation-based Intrusion Detection (SRID). Similar to the work on secure state estimation, SRID BIB005 attempts to detect attacks and then find the root cause of the attack in an industrial control system. SRID is an outlier in our survey; despite a growing literature that follow similar approaches for the topic of using the physics of CPS to detect attacks, SRID proposes system identification, and bad data detection tests that are unique. Attack Detection: Instead of using a traditional and well-understood system identification approach to learn a model of the boiler simulator they study, they propose a set of heuristics they name feedback correlations and forward correlations; however, we were not able to find a good justification as to why these heuristics are needed, or why they are better than traditional system identification methods. We recommend that for any future work, if the authors propose a new system identification tool (previously untested), they should use a traditional tool to test as a baseline approach. One of the goals of SRID is to identify the location of an attack; but we believe that if we know all the control loops in their boiler simulation, we can create models for each of them and identify the root cause using traditional methods; however, the paper does not mention where other researchers can find the boiler simulator SRID used in the experiments, so we cannot compare our methods to theirs. However, SRID does not specify if they use control and sensor measurements for their anomaly detection, but from the description it appears they use only sensor measurements. SRID proposes a new bad data detection based on alternation vectors, which basically tracks the history of measured variables going up or down. If this time series is not an allowable trend (not previously seen), then the detection test generates an alert. It is not clear why this heuristic can perform better than the traditional residual generation approach. Attack Location: The sensors cannot be trusted, but the attacker sends arbitrary data that falls within the sensor's valid range. Therefore, this attacker is not strategic and it behaves exactly as random faults. It is not clear therefore how their evaluation will differ whenever there is a sensor fault (within the valid range) or the attacker they propose. Validation: SRID measures the successful attack detection rate and the false-alarm rate using simulation results. Attack-Detection and Response. Cardenas et al. BIB001 consider a chemical industrial control system. Attack Detection: The authors approximate the nonlinear dynamics of the chemical system with an input/output linear system, as we defined in Equation BIB008 . Therefore this model captures the correlations among multiple different observations y k (with the matrix C) but also the correlation between input u k and output y k and is therefore a model that can match the fidelity of observations very closely. The authors use the linear system to predictŷ k given the previous input u k−1 and the previous measurement y k−1 and then test whether or not the prediction is close to the observed measurement r k = y k −ŷ k . They raise an alert if the CUSUM statistic (the stateful test of Figure 6 ) is higher than a threshold. Attack Location: One or more sensors are compromised, and cannot be trusted. The goal of the adversary is to violate the safety of the system: i.e., an attacker that wants to raise the pressure level in the tank above 3,000kPa and at the same time remain undetected by the test. The actuators and the control logic are assumed to be trusted. Validation: The paper proposes a control reconfiguration whenever an attack is detected, in particular a switch to open-loop control, meaning that the control algorithm will ignore sensor measurements and will attempt to estimate the state of the system based only on the expected consequences of its own control commands. As a result, instead of measuring the false-alarm rate, the authors measure the impact of a reconfiguration triggered by a false alarm on the safety of the system-in other words, a false alarm must never drive the system to an unsafe state (a pressure inside the tank greater than 3,000kPa). To evaluate the security of the detection algorithm, the authors also test to see if an attacker that wants to remain undetected can drive the pressure inside the tank above 3,000kPa. All the results were tested via simulation. Clustering. Another approach to detect attacks in process control systems is to learn unsupervised clustering models containing the pair-wise relationship between variables of a process. Attack Detection: Using these models it is possible to identify anomalies that do not fit the clusters BIB006 BIB007 . Attak Location: They consider sensor attacks. Validation: The authors used the Tennessee Eastman process simulation to validate the proposed approach for several types of attacks. These approaches are non-parametric, which have the advantage of creating models of the physical process without a priori knowledge of the physics of the process; however, a non-parametric approach does not have the fidelity to the real physics of the system as an LDS or AR model will have, in particular when modeling the time-evolution of the system or the evolution outside of a steady state. Detecting Safety Violations and Response. Another paper that proposes control reconfiguration is McLaughlin BIB003 . This paper tackles the problem of how to verify that control signals u k will not drive the system to an unsafe state, and if they do, to modify the control signal and produce a reconfiguration control that will prevent the system from reaching an unsafe state. As such, this is one of the few papers that considers a reconfiguration option when an attack (or possible safety violation) is detected. The proposed approach, C 2 , mediates all control signals u k sent by operators and embedded controllers to the physical system. Attack Detection: C 2 considers multiple systems with discrete states and formal specifications, as such this approach is better suited for systems where safety is specified as logical control actions instead of systems with continuous states (where we would need to use system identification to learn their dynamics). This approach is most similar to the attack on control signals in Figure 2 . However, their focus is not to detect if u k K (y k ), but to check if u k will violate a safety condition of the control signal or not. As such, their approach is most similar to using the Safety Check block we introduced in Figure 6 . Attack Location: McLaughlin mentions that "the approach can prevent any unsafe device behavior caused by a false data injection attack, but it cannot detect forged sensor data," and later in the paper we find "C 2 mitigates all control channel attacks against devices, and only requires trust in process engineers and physical sensors." This is a contradiction, and the correct statement to satisfy the security of their model is the latter. As such C 2 assumes trusted sensors and trusted actuation devices (specifically stating trusted actuators is a missing trust assumption in their model). C 2 is related to traditional safety systems for control like safety interlocks, and not necessarily malicious attacks as there does not seem to be a difference between preventing an unsafe accidental action to an unsafe malicious action. Validation: There are three main properties that C 2 attempts to hold: (1) safety (the approach must not introduce new unsafe behaviors, i.e., when operations are denied the "automated" control over the plant should not lead the plant to an unsafe state), (2) security (mediation guarantees should hold under all attacks allowed by the threat model), and (3) performance (control systems must meet real time deadlines while imposing minimal overhead). C 2 was tested using simulations and real PLCs for six different case studies.