A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> Electricity theft is estimated to cost billions of dollars per year in many countries. To reduce electricity theft, electric utilities are leveraging data collected by the new Advanced Metering Infrastructure (AMI) and using data analytics to identify abnormal consumption trends and possible fraud. In this paper, we propose the first threat model for the use of data analytics in detecting electricity theft, and a new metric that leverages this threat model in order to evaluate and compare anomaly detectors. We use real data from an AMI system to validate our approach. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> In the current generation of SCADA (Supervisory Control And Data Acquisition) systems used in power grids, a sophisticated attacker can exploit system vulnerabilities and use a legitimate maliciously crafted command to cause a wide range of system changes that traditional contingency analysis does not consider and remedial action schemes cannot handle. To detect such malicious commands, we propose a semantic analysis framework based on a distributed network of intrusion detection systems (IDSes). The framework combines system knowledge of both cyber and physical infrastructure in power grid to help IDS to estimate execution consequences of control commands, thus to reveal attacker's malicious intentions. We evaluated the approach on the IEEE 30-bus system. Our experiments demonstrate that: (i) by opening 3 transmission lines, an attacker can avoid detection by the traditional contingency analysis and instantly put the tested 30-bus system into an insecure state and (ii) the semantic analysis provides reliable detection of malicious commands with a small amount of analysis time. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> Safety-compromising bugs in software-controlled systems are often hard to detect. In a 2007 DARPA Urban Challenge vehicle, such a defect remained hidden during more than 300 miles of test-driving, manifesting for the first time during the competition. With this incident as an example, the authors discuss formalisms and techniques available for safety analysis of cyber-physical systems. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> Smart grid deployment initiatives have been witnessed in the past recent years. Smart grids provide bi-directional communication between meters and headend system through Advanced Metering Infrastructure (AMI). Recent studies highlight the threats targeting AMI. Despite the need of tailored Intrusion Detection Systems (IDS) for the smart grid, very limited progress has been made in this area. Unlike traditional networks, smart grid has its own unique challenges, such as limited computational power devices and potentially high deployment cost, that restrict the deployment options of intrusion detectors. We show that smart grid exhibits deterministic and predictable behavior that can be accurately modeled to develop intrusion detection system. In this paper, we show that AMI behavior can be modeled using event logs collected at smart collectors, which in turn can be verified using the specifications invariant generated from the configurations of the AMI devices. Event logs are modeled using fourth order Markov Chain and specifications are written in Linear Temporal Logic (LTL). The approach provides robustness against evasion and mimicry attacks, however, we discuss that it still can be evaded to a certain extent. We validate our approach on a real-world dataset of thousands of meters collected at the AMI of a leading utility provider. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> In this paper, we propose a novel use of network intrusion detection systems (NIDSs) tailored to detect attacks against networks that support hybrid controllers that implement power grid protection schemes. In our approach, we implement specification-based intrusion detection signatures based on the execution of the hybrid automata that specify the communication rules and physical limits that the system should obey. To validate our idea, we developed an experimental framework consisting of a simulation of the physical system and an emulation of the master controller, which serves as the digital relay that implements the protection mechanism. Our Hybrid Control NIDS (HC-NIDS) continuously monitors and analyzes the network traffic exchanged within the physical system. It identifies traffic that deviates from the expected communication pattern or physical limitations, which could place the system in an unsafe mode of operation. Our experimental analysis demonstrates that our approach is able to detect a diverse range of attack scenarios aimed at compromising the physical process by leveraging information about the physical part of the power system. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> In this paper, we describe our novel use of network intrusion detection systems (NIDS) for protecting automated distribution systems (ADS) against certain types of cyber attacks in a new way. The novelty consists of using the hybrid control environment rules and model as the baseline for what is normal and what is an anomaly, tailoring the security policies to the physical operation of the system. NIDS sensors in our architecture continuously analyze traffic in the communication medium that comes from embedded controllers, checking if the data and commands exchanged conform to the expected structure of the controllers interactions, and evolution of the system's physical state. Considering its importance in future ADSs, we chose the fault location, isolation and service restoration (FLISR) process as our distribution automation case study for the NIDS deployment. To test our scheme, we emulated the FLISR process using real programmable logic controllers (PLCs) that interact with a simulated physical infrastructure. We used this test bed to examine the capability of our NIDS approach in several attack scenarios. The experimental analysis reveals that our approach is capable of detecting various attacks scenarios including the attacks initiated within the trusted perimeter of the automation network by attackers that have complete knowledge about the communication information exchanged. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> Embedded sensing systems are pervasively used in life- and security-critical systems such as those found in airplanes, automobiles, and healthcare. Traditional security mechanisms for these sensors focus on data encryption and other post-processing techniques, but the sensors themselves often remain vulnerable to attacks in the physical/analog domain. If an adversary manipulates a physical/analog signal prior to digitization, no amount of digital security mechanisms after the fact can help. Fortunately, nature imposes fundamental constraints on how these analog signals can behave. This work presents PyCRA, a physical challenge-response authentication scheme designed to protect active sensing systems against physical attacks occurring in the analog domain. PyCRA provides secure active sensing by continually challenging the surrounding environment via random but deliberate physical probes. By analyzing the responses to these probes, the system is able to ensure that the underlying physics involved are not violated, providing an authentication mechanism that not only detects malicious attacks but provides resilience against them. We demonstrate the effectiveness of PyCRA in detecting and mitigating attacks through several case studies using two sensing systems: (1) magnetic sensors like those found on gear and wheel speed sensors in robotics and automotive, and (2) commercial Radio Frequency Identification (RFID) tags used in many security-critical applications. In doing so, we evaluate both the robustness and the limitations of the PyCRA security scheme, concluding by outlining practical considerations as well as further applications for the proposed authentication mechanism. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> We propose a new way to verify the integrity and freshness of footage from security cameras by sending visual challenges to the area being monitored by the camera. We study the effectiveness of periodically updating plain text and QR code visual challenges, propose attack detection statistics for each of them, and study their performance under normal conditions (without attack) and against a variety of adversaries. Our implementation results show that visual challenges are an effective method to add defense-in-depth mechanisms to improve the trustworthiness of security cameras. <s> BIB008 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> In this paper, we consider a mitigation strategy to prevent a vehicle controlled by an attacker from causing collisions in a vehicular platoon. An adversarial-aware control scheme, based on sliding mode control using only local sensor information and a decentralized attack detector, is shown to significantly reduce the number and severity of collisions, without the need for inter-vehicle or vehicle-to-infrastructure communication. Simulations demonstrate that collisions are eliminated (or significantly reduced) when the attacker and normal vehicles have same capabilities, and collisions are reduced even with more powerful attackers. <s> BIB009 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Detecting Malicious Control Commands. <s> We propose the use of trusted and verified social media feeds as visual challenges to increase our confidence that video footage from public spaces is fresh and authentic. Our work is related to recent advances in a growing area dealing with ways to prove physical statements to a digital (or even human) verifier, where a verifier sends a physical (real-world) challenge to the prover and the prover (usually a sensor) takes measurements of the physical property and submits the response to the verifier. Our proposal can be used to automatically verify the video feed from a (possibly untrusted) camera monitoring a public space. <s> BIB010
There is other related work in trying to understand consequences of potentially malicious control commands from the control center. Their goal is to understand safe sequences of commands and commands that might create problems to the system. Attack Location: These attacks correspond (logically) to the attack on control signals in Figure 2 BIB005 BIB002 BIB006 . Attack Detection: Lin et al. BIB002 use contingency analysis to predict the consequences of control commands, and Mitra et al. BIB003 combine the dynamics of the system with discrete transitions (finite state machines) such as interruptions. Using set theory, they show it is possible to determine the set of safe states, the set of reachable states, and invariant sets; therefore, if there is not an input that can drive the states out of the safety set, the model is safe. Finding these sets requires some relaxations and a good knowledge of the behavior and limitations of the system. Finally, attacks are detected using a stateless IDS, that checks the validity of the control commands. Validation: The approach is validated by using simulations. Active Monitoring for Sensors. Active monitoring has also been used to verify the freshness and authenticity of a variety of sensors BIB007 and video cameras BIB008 . Attack Detection: PyCRA BIB007 uses an LDS model to predict the response of sensors and to compute the residual r k , which is then passed to a stateful χ 2 anomaly detection statistic. The attacker in PyCRA has a physical actuator to respond to the active challenge. Validation: The evaluation of the proposal focuses on computing the trade-off between false alarms and probability of detection (i.e., ROC curves). Another active monitoring approach suggests visual challenges BIB008 BIB010 to detect attacks against video cameras. Anomaly Detection: In particular, a trusted verifier sends a visual challenge such as a passphrase, Quick Response (QR) code, or random tweets to a display that is part of the visual field of the camera, and if the visual challenge is detected in the video relayed by the camera, the footage is deemed trustworthy. The paper considers an adversary model that knows all the details of the system and tries to forge video footage after capturing the visual challenge. The authors use the CUSUM statistic to keep track of decoding errors. Validation: Using real data from a test-bed, the authors evaluated several visual challenges and investigated their advantages. Electricity Theft. There is also work on the problem of electricity theft detection by monitoring real traces from electricity consumption from deployed smart meters BIB001 . Attack detection: To model the electricity consumption the authors use ARMA models, which are output-only models similar to those in Equation BIB004 . Since their detection is not done online (similar to the video forensics case), the detection test is not stateless but stateful (an average of the residuals), where the detector can collect a lot of data and is not in a rush to make a quick decision. Attack location: The attacker has compromised one sensor (the smart meter at their home) and sends false electricity consumption. Validation: The evaluation metric is the largest amount of electricity that the attacker can steal without being detected and the trade-off between the false positive rate and the cost of an attack. Authors used a real-data set to validate their results. Platooning. Sajjad et al. BIB009 consider the control of cars in automated platoons. Attack Detection: They use LDS to model the physical system and then use a stateful test with a fixed window of time to process the residuals. Attack Location: Authors consider attacks in sensors and actuators. Validation: To evaluate their system they show via simulation that when attacks are detected, the cars in the platoon can take evasive maneuvers to avoid collisions.