A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> Abstract This paper presents the basic concepts which comprise the Purdue Enterprise Reference Architecture along with a description of its development and use. This architecture provides the capability for modelling the human component as well as the manufacturing or customer service component of anyenterprise in addition to the information and control system component. This latter component is the major focus of most reference architectures and models available today for computer integrated manufacturing or complete enterprise study. This paper particularly points out those areas where this architecture differs from others available. In doing this it describes a new and unique method for defining the place of the human in the computer integrated plant or enterprise. It also develops the concept of customer service, which allowed the architecture, which was originally developed for computer integrated manufacturing, to be extended to define the development and operation of any enterprise regardless of the industry or field of endeavor involved. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> Cyber-secure networked control is modeled, analyzed, and experimentally illustrated in this paper. An attack space defined by the adversary's system knowledge, disclosure, and disruption resources is introduced. Adversaries constrained by these resources are modeled for a networked control system architecture. It is shown that attack scenarios corresponding to replay, zero dynamics, and bias injection attacks can be analyzed using this framework. An experimental setup based on a quadruple-tank process controlled over a wireless network is used to illustrate the attack scenarios, their consequences, and potential counter-measures. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> In this paper the problem of revealing stealthy data-injection attacks on control systems is addressed. In particular we consider the scenario where the attacker performs zero-dynamics attacks on the system. First, we characterize and analyze the stealthiness properties of these attacks for linear time-invariant systems. Then we tackle the problem of detecting such attacks by modifying the system's structure. Our results provide necessary and sufficient conditions that the modifications should satisfy in order to detect the zero-dynamics attacks. The results and proposed detection methods are illustrated through numerical examples. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> Nowadays, computer systems are presented in almost all types of human activity and they support any kind of industry as well. Most of these systems are distributed where the communication between nodes is based on computer networks of any kind. Connectivity between system components is the key issue when designing distributed systems, especially systems of industrial informatics. The industrial area requires a wide range of computer communication means, particularly time-constrained and safety-enhancing ones. From fieldbus and industrial Ethernet technologies through wireless and internet-working solutions to standardization issues, there are many aspects of computer networks uses and many interesting research domains. Lots of them are quite sophisticated or even unique. The main goal of this paper is to present the survey of the latest trends in the communication domain of industrial distributed systems and to emphasize important questions as dependability, and standardization. Finally, the general assessment and estimation of the future development is provided. The presentation is based on the abstract description of dataflow within a system. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> When SCADA systems are exposed to public networks, attackers can more easily penetrate the control systems that operate electrical power grids, water plants, and other critical infrastructures. To detect such attacks, SCADA systems require an intrusion detection technique that can understand the information carried by their usually proprietary network protocols. To achieve that goal, we propose to attach to SCADA systems a specification-based intrusion detection framework based on Bro [7][8], a runtime network traffic analyzer. We have built a parser in Bro to support DNP3, a network protocol widely used in SCADA systems that operate electrical power grids. This built-in parser provides a clear view of all network events related to SCADA systems. Consequently, security policies to analyze SCADA-specific semantics related to the network events can be accurately defined. As a proof of concept, we specify a protocol validation policy to verify that the semantics of the data extracted from network packets conform to protocol definitions. We performed an experimental evaluation to study the processing capabilities of the proposed intrusion detection framework. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> In the current generation of SCADA (Supervisory Control And Data Acquisition) systems used in power grids, a sophisticated attacker can exploit system vulnerabilities and use a legitimate maliciously crafted command to cause a wide range of system changes that traditional contingency analysis does not consider and remedial action schemes cannot handle. To detect such malicious commands, we propose a semantic analysis framework based on a distributed network of intrusion detection systems (IDSes). The framework combines system knowledge of both cyber and physical infrastructure in power grid to help IDS to estimate execution consequences of control commands, thus to reveal attacker's malicious intentions. We evaluated the approach on the IEEE 30-bus system. Our experiments demonstrate that: (i) by opening 3 transmission lines, an attacker can avoid detection by the traditional contingency analysis and instantly put the tested 30-bus system into an insecure state and (ii) the semantic analysis provides reliable detection of malicious commands with a small amount of analysis time. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> IMPROVING PHYSICS-BASED ATTACK DETECTION 6.1 Trust Assumptions <s> Cyber-physical systems integrate computation, communication, and physical capabilities to interact with the physical world and humans. Besides failures of components, cyber-physical systems are prone to malignant attacks, and specific analysis tools as well as monitoring mechanisms need to be developed to enforce system security and reliability. This paper proposes a unified framework to analyze the resilience of cyber-physical systems against attacks cast by an omniscient adversary. We model cyber-physical systems as linear descriptor systems, and attacks as exogenous unknown inputs. Despite its simplicity, our model captures various real-world cyber-physical systems, and it includes and generalizes many prototypical attacks, including stealth, (dynamic) false-data injection and replay attacks. First, we characterize fundamental limitations of static, dynamic, and active monitors for attack detection and identification. Second, we provide constructive algebraic conditions to cast undetectable and unidentifiable attacks. Third, by using the system interconnection structure, we describe graph-theoretic conditions for the existence of undetectable and unidentifiable attacks. Finally, we validate our findings through some illustrative examples with different cyber-physical systems, such as a municipal water supply network and two electrical power grids. <s> BIB007
Understanding the general architecture between actuators, sensors, controllers, and control centers is of fundamental importance to analyze the implementation of a monitoring device and most importantly, the trust assumptions about each of these devices, as any of these devices (actuators, sensors, PLCs, or even the control center) can be compromised. Control systems have in general a layered hierarchy BIB001 , with the highest levels consisting of the Supervisory Control Network (SCN) and the lowest levels focusing on the Field Communications Network (FCN) with the physical system, as shown in Figure 10 . A survey of communications in industrial control systems can be found in Gaj et al. BIB004 . If we were to deploy our anomaly detection system in the SCN (which typically has network switches with mirror ports making it the easy choice), then a compromised PLC can send manipulated data to the FCN, while pretending to report that everything is normal back to the SCN. In the Stuxnet attack, the attacker compromised a PLC (Siemens 315) and sent a manipulated control signal u a (which was different from the original u, i.e., u a u) to a field device. Upon reception of u a , the frequency converters periodically increased and decreased the rotor speeds well above and below their intended operation levels. While the status of the frequency converters y was then relayed back to the PLC in the field communications layer, the compromised PLC reported a false value y a y to the control center (through the SCN) claiming that devices were operating normally. By deploying our network monitor at the SCN, we are not able to detect compromised PLCs (unless we are able to correlate information from other trusted PLCs), or unless we receive (trusted) sensor data directly. A number of papers we analyzed did not mention where the monitoring devices will be placed, which makes it difficult to analyze the author's trust model. For example, analyzing the DNP3 communications standard BIB005 BIB006 implicitly assumes that the monitoring device is placed in the SCN, where DNP3 is most commonly used, and this security monitor will thus miss attacks that send some values to the SCN, and others to the FCN (such as Stuxnet). Therefore, such papers implicitly assume that the PLC is reporting truthfully the measurements it receives, and the control commands it sends to actuators. This weak attacker model limits the usefulness of the intrusion detection tool. To mitigate such restrictions, we argue that anomaly detection monitors should (also) be used at the FCN to detect compromised PLCs, actuators, and sensors. Assuming the monitor is placed in the FCN, the selection of trusted components determines the kind of attacks that can be detected (see Table 3 ). Our analysis shows that as long as you trust two components in the loop, it is possible to detect an attack on the remaining component. If we trust the sensors but do not trust either the actuators or the PLCs, then we can still detect attacks, unless they are zero-dynamic attacks BIB007 BIB002 BIB003 (although not all physical systems are vulnerable to these attacks). Finally, if we only trust the actuator (or only the PLC), the attacks could be completely undetected. We note that while there are still some attacks that cannot be detected, we can still detect more attacks than at the SCN. To illustrate some advantages of monitoring the FCN, we show experimental results obtained from a water treatment testbed.