International Journal of Critical Infrastructure Protection最新文献

{"title":"Impact of Internet and mobile communication on cyber resilience: A multivariate adaptive regression spline modeling approach","authors":"Serhiy Lyeonov ,&nbsp;Wadim Strielkowski ,&nbsp;Vitaliia Koibichuk ,&nbsp;Serhii Drozd","doi":"10.1016/j.ijcip.2024.100722","DOIUrl":"10.1016/j.ijcip.2024.100722","url":null,"abstract":"<div><div>The spread of broadband Internet and the availability of mobile communication services expand access to digital services for businesses and the public alike. However, at the same time, it aggravates the problem of ensuring digital space security, protection against cyber threats, and the fight against cybercrime. This research aims to calculate the index of a country's resilience to cyber-hacking for 143 countries, to divide these countries into groups based on this resilience (high, above-average, average, below-average, and low), compare these results with those obtained on the basis of National Cyber Security Index (NCSI), and to identify the impact of the Internet and mobile communication prevalence in a country on this level. The selection of the countries is based on the availability of statistical data for 2022 in the databases of the Surfshark VPN service, and the International Telecommunication Union. The integral index of a country's resilience to cyber-hacking is calculated through the multiplicative convolution (with weighted geometric mean) of the number of breached accounts, the Internet penetration probability (penetration into users’ data through the Internet), and the breach density per thousand users. The influence of active mobile broadband subscriptions (per 100 inhabitants), mobile broadband basket (% of Gross National Income Per Capita), mobile cellular subscriptions (per 100 inhabitants), and total fixed broadband subscriptions on the integral index of a country's resilience to cyber-hacking is investigated using multivariate adaptive regression spline. According to the calculations, France, Iceland, Montenegro, the United States, and the United Arab Emirates were the least resistant to cyber hacking in 2022. For countries with high, above-average, and below-average levels of resilience to cyber-hacking, the most relevant factor is the number of active mobile broadband subscriptions (per 100 inhabitants). For countries with an average level, it is total fixed broadband subscriptions.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"47 ","pages":"Article 100722"},"PeriodicalIF":4.1,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142572557","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A tri-level optimization model for interdependent infrastructure network resilience against compound hazard events","authors":"Matthew R. Oster ,&nbsp;Ilya Amburg ,&nbsp;Samrat Chatterjee ,&nbsp;Daniel A. Eisenberg ,&nbsp;Dennis G. Thomas ,&nbsp;Feng Pan ,&nbsp;Auroop R. Ganguly","doi":"10.1016/j.ijcip.2024.100723","DOIUrl":"10.1016/j.ijcip.2024.100723","url":null,"abstract":"<div><div>Resilient operation of interdependent infrastructures against compound hazard events is essential for maintaining societal well-being. To address consequence assessment challenges in this problem space, we propose a novel tri-level optimization model applied to a proof-of-concept case study with fuel distribution and transportation networks – encompassing one realistic network; one fictitious, yet realistic network; as well as networks drawn from three synthetic distributions. Mathematically, our approach takes the form of a defender-attacker-defender (DAD) model—a multi-agent tri-level optimization, comprised of a defender, attacker, and an operator acting in sequence. Here, our notional operator may choose proxy actions to operate an interdependent system comprised of fuel terminals and gas stations (functioning as supplies) and a transportation network with traffic flow (functioning as demand) to minimize unmet demand at gas stations. A notional attacker aims to hypothetically disrupt normal operations by reducing supply at the supply terminals, and the notional defender aims to identify best proxy defense policy options which include hardening supply terminals or allowing alternative distribution methods such as trucking reserve supplies. We solve our DAD formulation at a metropolitan scale and present practical defense policy insights against hypothetical compound hazards. We demonstrate the generalizability of our framework by presenting results for a realistic network; a fictitious, yet realistic network; as well as for three networks drawn from synthetic distributions. We also analyze the sensitivity of outputs on budget constraints through a detailed case study. Additionally, we demonstrate the scalability of the framework by investigating runtime performance as a function of the network size. Steps for future research are also discussed.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"47 ","pages":"Article 100723"},"PeriodicalIF":4.1,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142593026","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Evaluation of SDN security measures in the context of IEC 62443-3-3","authors":"Georgios Michail Makrakis ,&nbsp;Dakota Roberson ,&nbsp;Constantinos Kolias ,&nbsp;Dallin Cook","doi":"10.1016/j.ijcip.2024.100716","DOIUrl":"10.1016/j.ijcip.2024.100716","url":null,"abstract":"<div><p>The security of assets within electrical substations is paramount to ensuring the reliable and resilient operation of the energy sector. However, implementing existing industry cybersecurity standards in these environments presents numerous technical challenges. In this work, we provide systematic guidance that emphasizes best practices and prioritizes requirement implementation. We examine the application of Software-Defined Networking (SDN) as a means to enhance security within the IEC 62443 family of standards. Specifically, we offer insights into how the security measures required for compliance with the IEC 62443 security standards can impact the stringent timing constraints of contemporary communication protocols, enabling advanced distribution system operations in the future. Utilizing a testbed modeled after a real-world electrical substation, we demonstrate that while SDN-based security features naturally introduce some additional latency, their operational impact on the network’s strict constraints is minimal.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"47 ","pages":"Article 100716"},"PeriodicalIF":4.1,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142169565","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Obfuscation strategies for industrial control systems","authors":"Vittoria Cozza ,&nbsp;Mila Dalla Preda ,&nbsp;Ruggero Lanotte ,&nbsp;Marco Lucchese ,&nbsp;Massimo Merro ,&nbsp;Nicola Zannone","doi":"10.1016/j.ijcip.2024.100717","DOIUrl":"10.1016/j.ijcip.2024.100717","url":null,"abstract":"<div><p>Recently released scan data on Shodan reveals that thousands of <em>Industrial Control Systems</em> (ICSs) worldwide are directly accessible via the Internet and, thus, exposed to cyber-attacks aiming at financial gain, espionage, or disruption and/or sabotage. Executing sophisticated cyber–physical attacks aiming to manipulate industrial functionalities requires a deep understanding of the underlying physical process at the core of the target ICS, for instance, through unauthorized access to memory registers of <em>Programmable Logic Controllers</em> (PLCs). However, to date, countermeasures aiming at hindering the comprehension of physical processes remain largely unexplored.</p><p>In this work, we investigate the use of <em>obfuscation strategies</em> to complicate <em>process comprehension</em> of ICSs while preserving their runtime evolution. To this end, we propose a framework to design and evaluate obfuscation strategies for PLCs, involving PLC memory registers, PLC code (user program), and the introduction of extra (spurious) physical processes. Our framework categorizes obfuscation strategies based on two dimensions: the <em>type of (spurious) registers</em> employed in the obfuscation strategy and the <em>dependence on the (genuine) physical process</em>. To evaluate the efficacy of proposed obfuscation strategies, we introduce <em>evaluation metrics</em> to assess their <em>potency</em> and <em>resilience</em>, in terms of <em>system invariants</em> the attacker can derive, and their <em>cost</em> in terms of computational overhead due to runtime modifications of spurious PLC registers. We developed a prototype tool to automatize the devised obfuscation strategies and applied them to a non-trivial use case in the field of water tank systems. Our results show that code obfuscation can be effectively used to counter malicious process comprehension of ICSs achieved via scanning of PLC memory registers. To our knowledge, this is the first work using obfuscation as a technique to protect ICSs from such threats. The efficacy of the proposed obfuscation strategies predominantly depends on the intrinsic complexity of the interplay introduced between genuine and spurious registers.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"47 ","pages":"Article 100717"},"PeriodicalIF":4.1,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.sciencedirect.com/science/article/pii/S1874548224000581/pdfft?md5=34c2c309641d7172bea1f3fdf4abfc70&pid=1-s2.0-S1874548224000581-main.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142136032","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Process-aware security monitoring in industrial control systems: A systematic review and future directions","authors":"Muaan ur Rehman ,&nbsp;Hayretdin Bahşi","doi":"10.1016/j.ijcip.2024.100719","DOIUrl":"10.1016/j.ijcip.2024.100719","url":null,"abstract":"<div><div>Due to the tight coupling between the cyber and physical components, control systems are subjected to emerging cyberattacks. In addition to attacks based on networking and communication, control systems are also susceptible to process-aware attacks that target the business logic behind a physical process. Due to the increasing frequency of such attacks, the process-aware defence mechanisms that incorporate knowledge of the underlying physical model, has gained increased attention in current cyber–physical system security-related research. However, the rapid expansion of literature complicates the ability to thoroughly review and ascertain the state-of-the-art, as well as to identify existing research challenges and gaps. This paper investigates research on process-aware-based security monitoring for control systems and aims to establish a common understanding of currently used methods in this domain. A systematic literature review is performed to outline and classify the existing work and present the authors’ cybersecurity vision. From an extensive review of publications between February 1, 2009 and October 30, 2023, we analysed and categorized the existing research on process-aware security monitoring techniques for control systems. Furthermore, we identified process-aware attack categories posing threats to the physical process in critical infrastructures. We have further mapped these attacks to the MITRE ATT&amp;CK matrix for Industrial Control Systems (ICS), detailing their tactics, techniques, and impacts.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"47 ","pages":"Article 100719"},"PeriodicalIF":4.1,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142421445","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Securing the green grid: A data anomaly detection method for mitigating cyberattacks on smart meter measurements","authors":"Asma Farooq ,&nbsp;Kamal Shahid ,&nbsp;Rasmus Løvenstein Olsen","doi":"10.1016/j.ijcip.2024.100694","DOIUrl":"10.1016/j.ijcip.2024.100694","url":null,"abstract":"<div><p>Smart meters, being a vital component in the advanced metering infrastructure (AMI), provide an opportunity to remotely monitor and control power usage and act like a bridge between customers and utilities. The installation of millions of smart meters in the power grid is a step forward towards a green transition. However, it also constitutes a massive cybersecurity vulnerability. Cyberattacks on AMI can result in inaccurate billing, energy theft, service disruptions, privacy breaches, network vulnerabilities, and malware distribution. Thus, utility companies should implement robust cyber-security measures to mitigate such risks. In order to assess the impact of cybersecurity breaches on AMI, this paper presents a cyber-attack scenario on grid measurements obtained via smart meters and assesses the stochastic grid estimations under attack. This paper also presents an efficient method for the detection and identification of anomalous data within the power grid by leveraging the distance between measurements and the confidence ellipse centered around the estimated value. To assess the proposed method, a comparative analysis is done against the chi-square test for detection and the largest normalized distribution test for the identification of bad data. Furthermore, by using a Danish low-voltage grid as a base case, this paper introduces two test cases to evaluate the performance of the proposed method under single and multiple-node cyber-attacks on the grid state estimation. Results show a notable improvement in accuracy when using the proposed method. Additionally, based on these numerical results, protective countermeasures are presented for the grid.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"46 ","pages":"Article 100694"},"PeriodicalIF":4.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.sciencedirect.com/science/article/pii/S1874548224000350/pdfft?md5=01d3394f250cb1b8e954cf085c10ccec&pid=1-s2.0-S1874548224000350-main.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141390691","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Robustness evaluation method and defense strategy of electricity-heat integrated energy system","authors":"Funian Hu,&nbsp;Chenhui Peng,&nbsp;Jun Chen","doi":"10.1016/j.ijcip.2024.100699","DOIUrl":"https://doi.org/10.1016/j.ijcip.2024.100699","url":null,"abstract":"<div><p>Even though electricity-heat integrated energy systems (IESs) can improve energy utilization, the faults generated by extreme events can induce more complex and wider impacts. Therefore, it is urgent to study the effective defense strategies associated with electricity-heat IES. Considering the theory of complex networks, a dynamic model was established in this paper which comprehensively considered the actual operating characteristics and cascading failure process of the electricity-heat IES. The structural and functional robustness of the electricity-heat IES after failure was evaluated by link survivability, capacity survivability and power survivability. According to the post-disaster system robustness evaluation results and system characteristics without adopting the defense strategy, the critical links of the system were identified. Also, seven defense strategies were formulated based on the cascading failure mechanism of the electricity-heat IES. The testing network coupled with an improved IEEE118-node power grid and 23-node heat supply network was used to verify the effectiveness of the proposed defense strategy and to provide a theoretical basis for the resilience enhancement strategy and defense resource allocation of the electricity-heat IES.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"46 ","pages":"Article 100699"},"PeriodicalIF":4.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141606269","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Assessment of cross-border electricity interconnection projects using a MCDA method","authors":"Natalia Naval,&nbsp;Jose M. Yusta","doi":"10.1016/j.ijcip.2024.100703","DOIUrl":"10.1016/j.ijcip.2024.100703","url":null,"abstract":"<div><p>The European Union is promoting cross-border electricity interconnection projects to achieve energy objectives, reduce the current fragmented European market, and eradicate the isolation of the most disadvantaged areas. However, selecting these projects is a complex task because there are multiple objectives, criteria, participants and alternatives involved. This paper aims to develop a multi-criteria decision analysis (MCDA) method for appropriately assessing and prioritizing cross-border electricity interconnection projects considering technical, economic, environmental and social criteria. Additionally, this work analyzes interconnection effects on the resilience of interconnected power systems. To verify its validity, this method is applied to prioritize new Spain-France interconnection infrastructure projects. From the results obtained, the technical and environmental criteria have proven to be the most important, since cross-border electricity interconnection projects are aimed at better market-coupling, less congestion and higher reliability while minimizing environmental impacts. In short, the proposed methodology provides a comprehensive view of the impact of these projects.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"46 ","pages":"Article 100703"},"PeriodicalIF":4.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.sciencedirect.com/science/article/pii/S1874548224000441/pdfft?md5=8b19846c0ed1e9f07e6bf1f0af07250e&pid=1-s2.0-S1874548224000441-main.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141939998","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Enterprise architecture modeling for cybersecurity analysis in critical infrastructures — A systematic literature review","authors":"Yuning Jiang ,&nbsp;Manfred A. Jeusfeld ,&nbsp;Michael Mosaad ,&nbsp;Nay Oo","doi":"10.1016/j.ijcip.2024.100700","DOIUrl":"10.1016/j.ijcip.2024.100700","url":null,"abstract":"<div><p>As digital landscapes become increasingly complex, safeguarding sensitive information and systems against cyber threats has become a paramount concern for organizations. This paper provides a comprehensive review of how enterprise architecture modeling is used in the context of cybersecurity assessment, particularly focusing on critical infrastructures. The use of enterprise architecture models for cybersecurity is motivated by the main purpose of enterprise architecture, namely to represent and manage business and IT assets and their interdependence. While enterprise architecture modeling originally served to assess Business/IT alignment, they are increasingly used to assess the cybersecurity of the enterprise. The research questions explored include the types of enterprise architecture models used for cybersecurity assessment, how security aspects are incorporated into these models, the theoretical frameworks and reference theories applied, the research methods used for evaluation, and the strengths and limitations of these models in supporting cybersecurity assessment. This review encompasses research papers published before 2024, focusing on high-quality research from peer-reviewed journals and reputable conferences, thereby providing a structured and comprehensive overview of the current state of research in this domain.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"46 ","pages":"Article 100700"},"PeriodicalIF":4.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141698603","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Power grid network security: A lightweight detection model for composite false data injection attacks using spatiotemporal features","authors":"Tianci Zhu ,&nbsp;Jun Wang ,&nbsp;Yonghai Zhu ,&nbsp;Haoran Chen ,&nbsp;Hang Zhang ,&nbsp;Shanshan Yin","doi":"10.1016/j.ijcip.2024.100697","DOIUrl":"https://doi.org/10.1016/j.ijcip.2024.100697","url":null,"abstract":"<div><p>The stability of power systems is paramount to industrial operations. The deleterious inherent characteristics of false data injection attacks (FDIA) have drawn substantial interest due to their severe threats to power grids. Contemporary detection systems face numerous challenges as attackers employ various tactics, such as injecting complex elements into measurement data and formulating quick attack strategies against critical nodes and transmission lines in the power grid network topology. Conventional models often fail to adapt to the intricacies of practical situations because they focus predominantly on detecting individual components. To overcome the above predicaments, this paper proposes a lightweight detection model integrating deep separable convolutional layers, squeeze neural networks, and a bidirectional long short-term memory architecture named DSE-BiLSTM. The acquisition process of network topological characteristics is accomplished through variable graph attention autoencoder (VGAAE). This approach leverages the effectiveness of the graph convolution (GCN) layer to acquire each node’s topological feature and the graph attention (GAT) module to identify and extract the topological features of critical nodes. Furthermore, the topology information obtained by the both techniques is embedded in one-dimensional vector space in the same form as measurement data. By combining the output of VGAAE with meter measurements, the feature fusion of temporal and spatial modalities is realized. DSE-BiLSTM with optimal hyperparameters achieves an F1-score of 99.56% and a row accuracy (RACC) of 93.10% on the conventional dataset. The experimental results of FDIA detection with composite datasets of IEEE 14-bus and IEEE 118-bus systems show that the F1-score and RACC of DSE-BiLSTM remain above 84.51% and 83.56% under various attack strengths and noise levels. In addition, as the power grid network scales up, noise level’s effect on detection performance decreases, while attack strength’s effect on recognition capability increases. DSE-BiLSTM can effectively process the composite data of spatiotemporal multimodes and provides a feasible solution for the localization and detection of FDIA in realistic scenes.</p></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"46 ","pages":"Article 100697"},"PeriodicalIF":4.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141596863","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}