D. Sebastian-Cardenas, Hussain M. Mustafa, A. Hahn, Amal Srivastava
{"title":"Grid-ViDS: A Smart Grid Co-Simulation Platform for Virtual Device Simulation","authors":"D. Sebastian-Cardenas, Hussain M. Mustafa, A. Hahn, Amal Srivastava","doi":"10.1109/RWS55399.2022.9984028","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984028","url":null,"abstract":"In this work, we present a generic co-simulation platform that allows researchers to evaluate and test the effects of communication networks within distribution systems to support analyzing cyber-resilience. The developed set of tools seeks to simplify the exchange of electrical data with external controllers/systems while at the same time offering the ability to evaluate the effects of different communication network architectures and/or events. The proposed solution is built around OpenDSS and Mininet using a python-based wrapper, potentially enabling the integration of third-party libraries with ease. To demonstrate this concept, the paper presents a Modbus-based DER control platform that has been coupled to the IEEE 13 bus system; a cyber-physical system that could be used to assess the cyber-resilience of different volt-var control strategies. Our paper specifically focuses on highlighting the effort-saving features that could be of interest to researchers and developers, potentially reducing the number of resources needed to build such systems from scratch. Finally, this paper represents the first public release of our tool.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133172576","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Designing Secure and Resilient Cyber-Physical Systems Using Formal Models","authors":"Robert S. Lois, D. Cole","doi":"10.1109/RWS55399.2022.9984044","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984044","url":null,"abstract":"This work-in-progress paper proposes a design methodology that addresses the complexity and heterogeneity of cyber-physical systems (CPS) while simultaneously proving resilient control logic and security properties. The design methodology involves a formal methods-based approach by translating the complex control logic and security properties of a water flow CPS into timed automata. Timed automata are a formal model that describes system behaviors and properties using mathematics-based logic languages with precision. Due to the semantics that are used in developing the formal models, verification techniques, such as theorem proving and model checking, are used to mathematically prove the specifications and security properties of the CPS. This work-in-progress paper aims to highlight the need for formalizing plant models by creating a timed automata of the physical portions of the water flow CPS. Extending the time automata with control logic, network security, and privacy control processes is investigated. The final model will be formally verified to prove the design specifications of the water flow CPS to ensure efficacy and security.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128721695","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mukesh Gautam, Michael Abdelmalak, Mohammed Ben-Idris, E. Hotchkiss
{"title":"Post-Disaster Microgrid Formation for Enhanced Distribution System Resilience","authors":"Mukesh Gautam, Michael Abdelmalak, Mohammed Ben-Idris, E. Hotchkiss","doi":"10.1109/RWS55399.2022.9984027","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984027","url":null,"abstract":"This paper proposes a deep reinforcement learning (DRL) based approach for post-disaster critical load restoration in active distribution systems to form microgrids through network reconfiguration to minimize critical load curtailments. Distribution networks are represented as graph networks, and optimal network configurations with microgrids are obtained by searching for the optimal spanning forest. The constraints to the research question being explored are the radial topology and power balance. Unlike existing analytical and population-based approaches, which necessitate the repetition of entire analyses and computation for each outage scenario to find the optimal spanning forest, the proposed approach, once properly trained, can quickly determine the optimal, or near-optimal, spanning forest even when outage scenarios change. When multiple lines fail in the system, the proposed approach forms microgrids with distributed energy resources in active distribution systems to reduce critical load curtailment. The proposed DRL-based model learns the action-value function using the REINFORCE algorithm, which is a model-free reinforcement learning technique based on stochastic policy gradients. A case study was conducted on a 33-node distribution test system, demonstrating the effectiveness of the proposed approach for post-disaster critical load restoration.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127314093","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
C. Rieger, C. Kolias, Robert C. Ivans, Shannon Eggers
{"title":"Trade-off Analysis of Operational Technologies to Advance Cyber Resilience through Automated and Autonomous Response to Threats","authors":"C. Rieger, C. Kolias, Robert C. Ivans, Shannon Eggers","doi":"10.1109/RWS55399.2022.9984031","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984031","url":null,"abstract":"The advancement of cyber resilience requires a preliminary stage of characterizing the trade-off space of mitigation options and how these might affect the stability and determinism of an operational technology (OT). This first step will set the stage for the proper cyber-secure and cyber-resilient design and confirm the affects that can be considered and approved by the OT and the security groups. To provide a baseline for this discussion, this paper provides a consideration of the cyber-physical interactions, possible mitigation steps against certain attacks and their corresponding affects that lend to the security design planning and evaluation process. As an integral part of the proposed scheme this work introduces the concept of system-wide fuzzer, i.e., a tool that manipulates the system state in an effort to determine mitigation response sequences that minimize detriments and maximize benefit in accordance with specified operational requirements.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128283090","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An Experimental Platform for Autonomous Intelligent Cyber-Defense Agents: Towards a collaborative community approach (WIPP)","authors":"Benjamin A. Blakely","doi":"10.1109/RWS55399.2022.9984037","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984037","url":null,"abstract":"Cyber defenses are increasingly challenged to keep up with attackers who might be using automation or machine learning as part of their attack strategies. Autonomous defensive systems will become critical in the coming years to respond to this threat. We present an update on ongoing work to build an autonomous intelligent cyber-defense agent. An initial prototype was demonstrated to NATO ACT in the fall of 2021, and work continues to add additional capabilities to it. The agent in its current state is capable of simple, statically-configured responsive actions as well as storing several types of observations (network scans, IDS alerts, Netflow data) in a knowledge graph. We outline the background for this work, detail the demonstration scenario used last fall, progress since then, and a future roadmap and collaborative strategy for this project including a reinforcement learning approach to automated reasoning.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133040933","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Supply Chain Risk Management: Data Structuring","authors":"Nina Lopez, Animesh Pattanayak, J. Smith","doi":"10.1109/RWS55399.2022.9984043","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984043","url":null,"abstract":"Supply chain risk management (SCRM) is an area of research that addresses both logistics concepts to maximize efficiency, reliability, and revenue as well as risk features, such as potential weak points, break points, and vulnerabilities within the supply chain. SCRM is used to find risks introduced at each node in a supply chain and how these risks can impact a company’s products, individuals, customers, and reputation. SCRM is a relatively new field, so standardized processes including data structuring are not fully documented. This paper explains the importance of a standard data structuring methodology and how it can enhance current SCRM efforts. Data ingest, structuring, and analysis are predominantly managed by humans. Automating some of the less complex steps can positively impact SCRM by allowing human analysts to focus on more strategic analyses. Types of data to be collected and structured are collected via publicly available information related to hardware, software, and corporate entities. After the data has been collected, the information is formatted in a specific manner, conforming to a schema, to allow for more effective and efficient ingest for further analysis. This paper outlines data structures used by Pacific Northwest National Laboratory for SCRM research and analysis purposes. These structures have been used for hundreds of analyses and have been successful in developing a common baseline. Data structuring is one of the first steps in data standardization, which will further mature and enhance the SCRM research area.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115791125","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Craig Bakker, Andrew August, Sen Huang, Soumya Vasisht, D. Vrabie
{"title":"Deception-Based Cyber Attacks on Hierarchical Control Systems using Domain-Aware Koopman Learning*","authors":"Craig Bakker, Andrew August, Sen Huang, Soumya Vasisht, D. Vrabie","doi":"10.1109/RWS55399.2022.9984030","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984030","url":null,"abstract":"Industrial control systems are subject to cyber attacks that produce physical consequences. These attacks can be both hard to detect and protracted. Here, we focus on deception-based sensor bias attacks made against a hierarchical control system where the attacker attempts to be stealthy. We develop a data-driven, optimization-based attacker model and use the Koopman operator to represent the system dynamics in a domain-aware and computationally efficient manner. Using this model, we compute several different attacks against a high-fidelity commercial building emulator and compare the impacts of those attacks to each other. Finally, we discuss some computational considerations and identify avenues for future research.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127871600","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"ESE: A Tool for Enhanced STIX Elevation","authors":"Tianqiao Zhao, Bryan Beckman, Meng Yue, Rita Foster","doi":"10.1109/RWS55399.2022.9984039","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984039","url":null,"abstract":"Structured Threat Information eXpression (STIX) language has been widely used to automate the sharing of cyber threat information (CTI) across s intelligence communities. There are different versions, i.e., STIX 1.x and 2.x., while STIX 2.x is gaining more popularity. There is a strong need to convert the existing, well-developed STIX 1.x (in XML format) files to STIX 2.x (in JSON format) files using, e.g., tools such as cti-stix-elevator. Despite the success and usefulness of such STIX elevation tools, one of the major issues is that the many objects and relationships defined in XML serializations are not converted properly. This has been a major barrier to information sharing based on the well-developed XML files. The manual effort, a tedious and time-consuming process, is the only option for fixing the missing relationships in the converted JSON files. To facilitate information sharing, we propose to design an automated tool to enhance the elevation by fixing the missing objects and relationship/sighting objects during the conversion process. This automated tool is developed by taking advantage of two open-source tools, namely Python-STIX and Python-STIX2, which provide a set of APIs to work with XML and JSON files. The tool, enhanced STIX elevation or ESE, is implemented by detecting the missing relationship/sighting objects in JSON files and extracting relationship information directly from XML files for creating the missing relationship/sighting objects in JSON. The performance of the ESE is demonstrated via case studies of two malware cases.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117228787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Souradeep Bhattacharya, Burhan Hyder, G. Manimaran
{"title":"ICS-CTM2: Industrial Control System Cybersecurity Testbed Maturity Model","authors":"Souradeep Bhattacharya, Burhan Hyder, G. Manimaran","doi":"10.1109/RWS55399.2022.9984023","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984023","url":null,"abstract":"Industrial Control System (ICS) testbeds serve as a platform for evaluating and validating control system performances, cybersecurity tools and technologies. In order to build or enhance an ICS testbed, it is vital to have a deeper understanding of its design specifications and characteristic attributes. Satisfying this prerequisite involves examination and assessment of these attributes for existing testbeds. To further increase confidence in a testbed’s functionality, it is important to perform a comparative analysis of its specifications with other ICS testbeds. However, at present, there is no standardized methodology available to provide a comparative assessment of different testbeds. In this paper, we propose a methodology for analyzing ICS testbeds, inspired by the Cybersecurity Capability Maturity Model (C2M2). In particular, we then define a ICS Cybersecurity Testbed Maturity Model, its domains, and the associated maturity indicator levels. To demonstrate the benefit of the model, we have conducted a case study analysis for several ICS testbeds, representing different industrial sectors. Our analysis provides deeper insights into the relative strengths and limitations of these testbeds, together with scope for future enhancements, with respect to the domains defined by the model.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116257822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards Resilient Communities: Strengthening Infrastructure for Critical Service Provision under Severe Weather Conditions","authors":"L. Souto, M. Pregnolato, Philip C. Taylor","doi":"10.1109/RWS55399.2022.9984041","DOIUrl":"https://doi.org/10.1109/RWS55399.2022.9984041","url":null,"abstract":"This article presents a methodology aimed at enhancing infrastructure resilience to extreme weather events while ensuring provision of critical services at community level. It describes critical infrastructure systems and services as features of a resilient community, considering that the accessibility to critical services is conditioned to the availability of critical infrastructure systems in different ways. The methodology is written as a mixed-integer linear programming model. The selection of appropriate planning and operational measures for resilience enhancements is made with the objective of ensuring provision of critical services under severe weather conditions subject to technical operating constraints. Furthermore, the methodology is demonstrated in a realistic setting in Stockport, UK, with an impact assessment of disruptions to power and transportation infrastructure systems caused by flooding on the provision of distinct critical services.","PeriodicalId":170769,"journal":{"name":"2022 Resilience Week (RWS)","volume":"138 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116440264","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}