Eunsuk Kang
ABSTRACT
An approach to analyzing the security of a cyber-physical system (CPS) is proposed, where the behavior of a physical plant and its controller are captured in approximate models, and their interaction is rigorously checked to discover potential attacks that involve a varying number of compromised sensors and actuators. As a preliminary study, this approach has been applied to a fully functional water treatment testbed constructed at the Singapore University of Technology and Design. The analysis revealed previously unknown attacks that were confirmed to pose serious threats to the safety of the testbed, and suggests a number of research challenges and opportunities for applying a similar type of formal analysis to cyber-physical security.
- SWaT: Secure Water Treatment Testbed, 2015. https://itrust.sutd.edu.sg/wp-content/uploads/sites/3/2015/11/Brief-Introduction-to-SWaT_181115.pdf.Google Scholar
- Alloy language and analyzer. http://alloy.mit.edu.Google Scholar
- Daniel Jackson. Software Abstractions: logic, language, and analysis. MIT Press, Second edition, 2012. Google ScholarDigital Library
- Emina Torlak and Daniel Jackson. Kodkod: A relational model finder. In Tools and Algorithms for the Construction and Analysis of Systems TACAS Portugal, 2007., pages 632--647, 2007. Google ScholarDigital Library
- Patrick Cousot and Radhia Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages, pages 238--252. ACM, 1977. Google ScholarDigital Library
- David. Urbina, Jairo. Giraldo, Nils Ole. Tippenhauer, and Alvaro Cardenas. Attacking fieldbus communications in ics: Applications to the swat testbed. In Proc. Singapore Cyber-Security Conference (SG-CRC), pages 75--89, 2016.Google Scholar
- André Platzer. Logical analysis of hybrid systems: proving theorems for complex dynamics. Springer Science & Business Media, 2010. Google ScholarDigital Library
- Sicun Gao, Soonho Kong, and Edmund M Clarke. dreal: An SMT solver for nonlinear theories over the reals. In Automated Deduction--CADE-24, pages 208--214. Springer, 2013. Google ScholarDigital Library
- Alessandro Cimatti, Sergio Mover, and Stefano Tonetta. SMT-based verification of hybrid systems. In AAAI, 2012. Google ScholarDigital Library
- Mathworks. Matlab. http://www.mathworks.com/products/matlab/.Google Scholar
- Mathworks. Simulink. http://www.mathworks.com/products/simulink/.Google Scholar
- Ravi Akella and Bruce M McMillin. Model-checking bndc properties in cyber-physical systems. In Computer Software and Applications Conference, 2009. COMPSAC'09. 33rd Annual IEEE International, volume 1, pages 660--663. IEEE, 2009. Google ScholarDigital Library
- Chih-Hong Cheng, Natarajan Shankar, Harald Ruess, and Saddek Bensalem. EFSMT: A logical framework for cyber-physical systems. arXiv preprint arXiv:1306.3456, 2013.Google Scholar
- Edmund M Clarke and Paolo Zuliani. Statistical model checking for cyber-physical systems. In Automated Technology for Verification and Analysis, pages 1--12. Springer, 2011. Google ScholarDigital Library
- Dean H Stamatis. Failure mode and effect analysis: FMEA from theory to execution. ASQ Quality Press, 2003.Google Scholar
- William E Vesely, Francine F Goldberg, Norman H Roberts, and David F Haasl. Fault tree handbook. Technical report, DTIC Document, 1981.Google Scholar
- X. Zheng, C. Julien, M. Kim, and S. Khurshid. Perceptions on the state of the art in verification and validation in cyber-physical systems. Systems Journal, IEEE, PP(99):1--14, 2015.Google Scholar
- Sridhar Adepu, Aditya Mathur, Jagadeesh Gunda, and Sasa Djokic. An agent-based framework for simulating and analysing attacks on cyber physical systems. In Algorithms and Architectures for Parallel Processing, pages 785--798. Springer, 2015.Google Scholar
- S. Adepu and A. Mathur. An investigation into the response of a water treatment system to cyber attacks. In Proceedings of the 17th IEEE High Assurance Systems Engineering Symposium, Orlando, January 2016. Google ScholarDigital Library
Recommendations
Automatic web security unit testing: XSS vulnerability detection
AST '16: Proceedings of the 11th International Workshop on Automation of Software TestIntegrating security testing into the workflow of software developers not only can save resources for separate security testing but also reduce the cost of fixing security vulnerabilities by detecting them early in the development cycle. We present an ...
Design and Analysis of Security Attacks against Critical Smart Grid Infrastructures
ICECCS '14: Proceedings of the 2014 19th International Conference on Engineering of Complex Computer SystemsSmart grid, the future power grid, is expected to provide better energy efficiency, more customer choices and improved reliability and security. As the smart grid is an integrated system that consists of multiple subsystems, understanding it as a whole ...
Honeypot Based Industrial Threat Detection Using Game Theory in Cyber-Physical System
AbstractCyber threats are clearly understood across the security landscape using honeypot technologies across industrial cyber-physical systems (ICPS). Specifically, Distributed Denial of Service (DDoS) and Man in the Middle (MITM) attacks are the ...
Comments