{"title":"Leader selection games under link noise injection attacks","authors":"Andrew Clark, L. Bushnell, R. Poovendran","doi":"10.1145/2185505.2185511","DOIUrl":"https://doi.org/10.1145/2185505.2185511","url":null,"abstract":"In a leader-follower multi-agent system, the states of a set of leader agents are controlled directly by the system owner and used to influence the behavior of the remaining follower agents. When deployed in hostile environments, leader-follower systems may be disrupted by adversaries introducing noise in the communication links between agents through interference or false packet insertion, thus corrupting the states of the follower agents. In this paper, we study the problem of mitigating the effect of noise injection attacks by selecting leader agents. We address two cases within a supermodular game-theoretic framework. In the first case, a fixed set of leaders is chosen when the system is initialized. We model this case as a Stackelberg game, in which the system moves first by choosing leaders in order to minimize the worst-case error and the adversary responds by introducing noise. In the second case, the set of leaders varies over time. We study the second case as a simultaneous-move game between the system and an adversary. We show that the game formulations for both cases have equilibria that can be approximated up to a provable bound using supermodular optimization techniques. We illustrate our approach via simulations.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125311672","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Distributed detection and isolation of topology attacks in power networks","authors":"James Weimer, S. Kar, K. Johansson","doi":"10.1145/2185505.2185516","DOIUrl":"https://doi.org/10.1145/2185505.2185516","url":null,"abstract":"This paper addresses the issue of detecting and isolating topology attacks in power networks. A topology attack, unlike a data attack and power injection attack, alters the physical dynamics of the power network by removing bus interconnections. These attacks can manifest as both cyber and physical attacks. A physical topology attack occurs when a bus interconnection is physically broken, while a cyber topology attack occurs when incorrect information about the network topology is transmitted to the system estimator and incorporated as the truth. To detect topology attacks, a stochastic hypothesis testing problem is considered assuming noisy measurements are obtained by periodically sampling a dynamic process described by the networked swing equation dynamics, modified to assume stochastic power injections. A centralized approach to network topology detection and isolation is introduced as a two-part scheme consisting of topology detection followed by topology isolation, assuming a topology attack exists. To address the complexity issues arising with performing centralized detection in large-scale power networks, a decentralized approach is presented that uses only local measurements to detect the presence of a topology attack. Simulation results illustrate that both the centralized and decentralized approaches accurately detect and isolate topology attacks.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116111624","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Integrity attacks on cyber-physical systems","authors":"Yilin Mo, B. Sinopoli","doi":"10.1145/2185505.2185514","DOIUrl":"https://doi.org/10.1145/2185505.2185514","url":null,"abstract":"In this paper we consider the integrity attack on Cyber-Physical System(CPS), which is modeled as a discrete linear time-invariant system equipped with a Kalman filter, LQG controller and Χ2 failure detector. An attacker wishes to disturb the system by injecting external control inputs and fake sensor measurements. In order to perform the attack without being detected, the adversary will need to carefully design its actions to fool the failure detector as abnormal sensor measurements will result in an alarm. The adversary's strategy is formulated as a constrained control problem. In this paper, we characterize the reachable set of the system state and estimation error under the attack, which provides a quantitative measure of the resilience of the system. To this end, we will provide an ellipsoidal algorithm to compute the outer approximation of the reachable set. We also prove a necessary condition under which the reachable set is unbounded, indicating that the attacker can successfully destabilize the system.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129156554","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
André M. H. Teixeira, D. Perez, H. Sandberg, K. Johansson
{"title":"Attack models and scenarios for networked control systems","authors":"André M. H. Teixeira, D. Perez, H. Sandberg, K. Johansson","doi":"10.1145/2185505.2185515","DOIUrl":"https://doi.org/10.1145/2185505.2185515","url":null,"abstract":"Cyber-secure networked control is modeled, analyzed, and experimentally illustrated in this paper. An attack space defined by the adversary's system knowledge, disclosure, and disruption resources is introduced. Adversaries constrained by these resources are modeled for a networked control system architecture. It is shown that attack scenarios corresponding to replay, zero dynamics, and bias injection attacks can be analyzed using this framework. An experimental setup based on a quadruple-tank process controlled over a wireless network is used to illustrate the attack scenarios, their consequences, and potential counter-measures.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"34 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132937254","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"NCS security experimentation using DETER","authors":"Alefiya Hussain, Saurabh Amin","doi":"10.1145/2185505.2185518","DOIUrl":"https://doi.org/10.1145/2185505.2185518","url":null,"abstract":"Numerous efforts are underway to develop testing and experimentation tools to evaluate the performance of networked control systems (NCS) and supervisory control and data acquisition (SCADA) systems. These tools offer varying levels of fidelity and scale. Yet, researchers lack an experimentation framework for systematic testing and evaluation of NCS reliability and security under a wide range of failure scenarios. In this paper, we propose a modular experimentation framework that integrates the NCS semantics with the DETERLab cyber security experimentation facilities. We develop several attack scenarios with realistic network topology and network traffic configurations to evaluate the impact of denial of service (DoS) attacks on scalar linear systems. We characterize the impact of the attack dynamics on six plants located at various levels in a hierarchical topology. Our results suggest that emulation-based evaluations can provide novel insights about the network-induced security and reliability failures in large scale NCS.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"128 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126268247","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Jian Chang, K. Venkatasubramanian, Chinwendu Enyioha, S. Sundaram, George J. Pappas, Insup Lee
{"title":"HMM-based characterization of channel behavior for networked control systems","authors":"Jian Chang, K. Venkatasubramanian, Chinwendu Enyioha, S. Sundaram, George J. Pappas, Insup Lee","doi":"10.1145/2185505.2185508","DOIUrl":"https://doi.org/10.1145/2185505.2185508","url":null,"abstract":"We study the problem of characterizing the behavior of lossy and data corrupting communication channels in a networked control setting, where the channel's behavior exhibits temporal correlation. We propose a behavior characterization mechanism based on a hidden Markov model (HMM). The use of a HMM in this regard presents multiple challenges including dealing with incomplete observation sequences (due to data losses and corruptions) and the lack of a priori information about the model complexity (number of states in the model). We address the first challenges by using the plant state information and history of received/applied control inputs to fill in the gaps in the observation sequences, and by enhancing the HMM learning algorithm to deal with missing observations. Further, we adopt two model quality criteria for determining behavior model complexity. The contributions of this paper include: (1) an enhanced learning algorithm for refining the HMM model parameters to handle missing observations, and (2) simultaneous use of two well-defined model quality criteria to determine the model complexity. Simulation results demonstrate over 90% accuracy in predicting the output of a channel at a given time step, when compared to a traditional HMM based model that requires complete knowledge of the model complexity and observation sequence.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122572646","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Coordinated variable structure switching in smart power systems: attacks and mitigation","authors":"Shan Liu, D. Kundur, T. Zourntos, K. Butler-Purry","doi":"10.1145/2185505.2185509","DOIUrl":"https://doi.org/10.1145/2185505.2185509","url":null,"abstract":"Recently, a class of cyber-physical attacks termed coordinated variable structure switching attacks has been identified for future smart grid systems. Here, an attacker who has remotely gained access to a circuit breaker or switch is able to disrupt power system operation by applying a state-dependent switching sequence. The sequence can be effectively designed employing variable structure systems theory. In this work, we extend this research to demonstrate an approach to mitigation within this variable structure system framework. Specifically, we study strategies employed by a power system operator in the face of a switching attack to steer the system to a stable equilibrium through persistent co-switching and by leveraging the existence of a stable sliding mode. We demonstrate how such co-switching can be designed for a variant of the WECC 3-machine, 9-bus system using linearized models and then employ simulations in MATLAB/Simulink and PSCAD to demonstrate its potential in practice.","PeriodicalId":203753,"journal":{"name":"International Conference on High Confidence Networked Systems","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-04-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134078848","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}