Helder Aranha, M. Masi, Tanja Pavleska, G. Sellitto
{"title":"Enabling Security-by-Design in Smart Grids: An Architecture-Based Approach","authors":"Helder Aranha, M. Masi, Tanja Pavleska, G. Sellitto","doi":"10.1109/EDCC.2019.00042","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00042","url":null,"abstract":"Energy Distribution Grids are considered critical infrastructure, hence the Distribution System Operators (DSOs) have developed sophisticated engineering practices to improve their resilience. Over the last years, due to the \"Smart Grid\" evolution, this infrastructure has become a distributed system where prosumers (the consumers who produce and share surplus energy through the grid) can plug in distributed energy resources (DERs) and manage a bi-directional flow of data and power enabled by an advanced IT and control infrastructure. This introduces new challenges, as the prosumers possess neither the skills nor the knowledge to assess the risk or secure the environment from cyber-threats. We propose a simple and usable approach based on the Reference Model of Information Assurance & Security (RMIAS), to support the prosumers in the selection of cybesecurity measures. The purpose is to reduce the risk of being directly targeted and to establish collective responsibility among prosumers as grid gatekeepers. The framework moves from a simple risk analysis based on security goals to providing guidelines for the users for adoption of adequate security countermeasures. One of the greatest advantages of the approach is that it does not constrain the user to a specific threat model.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128365481","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Lucas Leal, Leonardo Montecchi, A. Ceccarelli, E. Martins
{"title":"Exploiting MDE for Platform-Independent Testing of Service Orchestrations","authors":"Lucas Leal, Leonardo Montecchi, A. Ceccarelli, E. Martins","doi":"10.1109/EDCC.2019.00037","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00037","url":null,"abstract":"Service Oriented Architecture (SOA) is a common design pattern that allows building applications composed of several services. It promotes features as interoperability, scalability, and software reuse. Services composing a SOA system may evolve and change during runtime, often outside the control of the owner of the application, which makes the verification and validation processes complex. Among all the automated techniques to validate the behavior of an SOA application, is Model-Based Testing (MBT). MBT requires an accurate model of the application in order to generate suitable test cases. However, the intrinsic of a SOA application sets significant challenges to MBT effectiveness. In this paper we discuss the challenges in the testing of SOA applications, and we propose the use of Model-Driven Engineering (MDE) to improve the flexibility of testing tools. Finally, we outline our plan for realizing MDE-driven MBT within an existing online testing framework.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132396830","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mohammed S. Kemal, Wissam Aoudi, R. Olsen, M. Almgren, H. Schwefel
{"title":"Model-Free Detection of Cyberattacks on Voltage Control in Distribution Grids","authors":"Mohammed S. Kemal, Wissam Aoudi, R. Olsen, M. Almgren, H. Schwefel","doi":"10.1109/EDCC.2019.00041","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00041","url":null,"abstract":"Incorporating information and communication technology in the operation of the electricity grid is undoubtedly contributing to a more cost-efficient, controllable, and flexible power grid. Although this technology is promoting flexibility and convenience, its integration with the electricity grid is rendering this critical infrastructure inherently vulnerable to cyberattacks that have potential to cause large-scale and far-reaching damage. In light of the growing need for a resilient smart grid, developing suitable security mechanisms has become a pressing matter. In this work, we investigate the effectiveness of a model-free state-of-the-art attack-detection method recently proposed by the cybersecurity community in detecting common types of cyberattacks on voltage control in distribution grids. Experimental results show that, by monitoring raw controller and smart-meter data in real time, it is possible to detect denial of service, replay, and integrity attacks, thus contributing to a resilient and more secure grid.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"225 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131343349","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Domenico Cotroneo, L. Simone, Pietro Liguori, R. Natella, N. Bidokhti
{"title":"FailViz: A Tool for Visualizing Fault Injection Experiments in Distributed Systems","authors":"Domenico Cotroneo, L. Simone, Pietro Liguori, R. Natella, N. Bidokhti","doi":"10.1109/EDCC.2019.00036","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00036","url":null,"abstract":"The analysis of fault injection experiments can be a cumbersome task. These experiments can generate large volumes of data (e.g., message traces), which a human analyst needs to inspect to understand the behavior of the system under failure. This paper introduces the FailViz tool for visualizing fault injection experiments, which points out relevant events for interpreting the failures. We also present a motivating example in the context of OpenStack, and point out future research directions.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128280762","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Assessment of a Method for Detecting Process Anomalies Using Digital-Twinning","authors":"Gayathri Sugumar, A. Mathur","doi":"10.1109/EDCC.2019.00031","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00031","url":null,"abstract":"Several methods exist for detecting process anomalies resulting from cyber-attacks on critical infrastructure. The assessment of such methods could be conducted using simulation or directly on a realistic operational testbed. While the results of an assessment on a testbed may be more authentic than those carried out using simulation, conducting such experiments is fraught with challenges such as the time required to set up and launch attacks thus limiting the variety and number of attacks launched. To overcome such limitations, while maintaining the reliability of the outcome of the assessment, an approach based on timed automata models of a critical infrastructure was investigated. The investigation involved development of a digital twin for a 6-stage water treatment plant. A design-centric anomaly detection method, as well as an attack launcher, were integrated with the model and experiments were performed. The outcome of this investigation reveals the value of the proposed approach in rapid assessment of a design-centric anomaly detection method.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116749117","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
S. Hashemi, Amir M. Hajisadeghi, H. Zarandi, S. Pour-Mozafari
{"title":"A Fast and Efficient Fault Tree Analysis Using Approximate Computing","authors":"S. Hashemi, Amir M. Hajisadeghi, H. Zarandi, S. Pour-Mozafari","doi":"10.1109/EDCC.2019.00019","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00019","url":null,"abstract":"Fault tree analysis is one of the most widely used methods in reliability calculation and failure probability analysis. Although fault tree analysis is a popular method, its simulation is time-consuming. Therefore, speeding up fault tree simulations is essential for designers to calculate reliability. Several studies that reduced the mentioned simulation time just considered run-time and accuracy as effective parameters; however, power consumption and area efficiency are key parameters in most of the analyses. In this paper, we present a new method which utilizes approximate computing to mitigate the fault tree analysis simulation time, while considering accuracy, area efficiency, and power consumption as effective parameters. This method is capable of analyzing not only static fault trees but also dynamic fault trees. To do so, first, we describe a fault tree model by hardware description language (VHDL), then substitute its time-consuming arithmetic components including adders and multipliers with fast approximate hardware and eventually measure its reliability through Monte Carlo simulation. Experimental results reveal that compared to the best-related works, on average, we have decreased the emulation time by 15.2% and improved power consumption and circuit area by 61.9%, 68.8%, respectively with negligible inaccuracy.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125239656","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards Quantification of Assurance for Learning-Enabled Components","authors":"Erfan Asaadi, E. Denney, Ganesh J. Pai","doi":"10.1109/EDCC.2019.00021","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00021","url":null,"abstract":"Perception, localization, planning, and control, high-level functions often organized in a so-called pipeline, are amongst the core building blocks of modern autonomous (ground, air, and underwater) vehicle architectures. These functions are increasingly being implemented using learning-enabled components (LECs), i.e., (software) components leveraging knowledge acquisition and learning processes such as deep learning. Providing quantified component-level assurance as part of a wider (dynamic) assurance case can be useful in supporting both pre-operational approval of LECs (e.g., by regulators), and runtime hazard mitigation, e.g., using assurance-based failover configurations. This paper develops a notion of assurance for LECs based on i) identifying the relevant dependability attributes, and ii) quantifying those attributes and the associated uncertainty, using probabilistic techniques. We give a practical grounding for our work using an example from the aviation domain: an autonomous taxiing capability for an unmanned aircraft system (UAS), focusing on the application of LECs as sensors in the perception function. We identify the applicable quantitative measures of assurance, and characterize the associated uncertainty using a non-parametric Bayesian approach, namely Gaussian process regression. We additionally discuss the relevance and contribution of LEC assurance to system-level assurance, the generalizability of our approach, and the associated challenges.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"1 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131847023","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"On the Evaluation Measures for Machine Learning Algorithms for Safety-Critical Systems","authors":"M. Gharib, A. Bondavalli","doi":"10.1109/EDCC.2019.00035","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00035","url":null,"abstract":"The ability of Machine Learning (ML) algorithms to learn and work with incomplete knowledge has motivated many system manufacturers to include such algorithms in their products. However, some of these systems can be described as Safety-Critical Systems (SCS) since their failure may cause injury or even death to humans. Therefore, the performance of ML algorithms with respect to the safety requirements of such systems must be evaluated before they are used in their operational environment. Although there exist several measures that can be used for evaluating the performance of ML algorithms, most of these measures focus mainly on some properties of interest in the domains where they were developed. For example, Recall, Precision and F-Factor are, usually, used in Information Retrieval (IR) domain, and they mainly focus on correct predictions with less emphasis on incorrect predictions, which are very important in SCS. Accordingly, such measures need to be tuned to fit the needs for evaluating the safe performance of ML algorithms. This position paper presents the authors’ view on the inadequacy of existing measures, and it proposes a new set of measures to be used for the evaluation of the safe performance of ML algorithms.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"600 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116290345","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Facing Cyber-Physical Security Threats by PSIM-SIEM Integration","authors":"Flavio Frattini, Ugo Giordano, V. Conti","doi":"10.1109/EDCC.2019.00026","DOIUrl":"https://doi.org/10.1109/EDCC.2019.00026","url":null,"abstract":"Physical Protection Systems are Physical Systems that evolved towards the cyber world. Sensors, cameras, barriers and control panels are now networked, making up a monitoring system subject to cyber attacks. Physical Security Information Management (PSIM) software systems are used for managing physical security information; Security Information and Event Management (SIEM) systems are used for cyber security information and events. Considering cyber-physical risks, they can not remain separated. In this paper, we describe our experience in merging PCMS, a PSIM system widely used by Banks in Italy, with QRadar, the well known IBM SIEM. Their integration helps physical security personnel in figuring out hidden threats, as well as the cyber security team for understanding risks related to the Physical Protection System.","PeriodicalId":334498,"journal":{"name":"2019 15th European Dependable Computing Conference (EDCC)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125403919","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}