Security Methods for Critical Infrastructure Communications

Zobaa, Ahmed F.; Bihl, Trevor J.

doi:10.1201/9781315105499-5

Cited by 2 publications

(2 citation statements)

References 43 publications

(75 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To enable the industrial IoT, CPS devices are finding increasing use in critical infrastructure, smart metering, and home automation [2,52]. CPS devices employ either open or proprietary protocols, with open protocols offering more aftermarket security options, but possibly more threats, while proprietary protocols offer "security through obscurity," but less additional aftermarket security options [53]. Of the proprietary wireless protocols, the most commonly used are Z-wave, which is based on the International Telecommunications Union-Telecommunications (ITU-T)…”

Section: Application and Example Resultsmentioning

confidence: 99%

Cyber-Physical Security with RF Fingerprint Classification through Distance Measure Extensions of Generalized Relevance Learning Vector Quantization

Bihl

Paciencia

Bauer

et al. 2020

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Radio frequency (RF) fingerprinting extracts fingerprint features from RF signals to protect against masquerade attacks by enabling reliable authentication of communication devices at the “serial number” level. Facilitating the reliable authentication of communication devices are machine learning (ML) algorithms which find meaningful statistical differences between measured data. The Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier is one ML algorithm which has shown efficacy for RF fingerprinting device discrimination. GRLVQI extends the Learning Vector Quantization (LVQ) family of “winner take all” classifiers that develop prototype vectors (PVs) which represent data. In LVQ algorithms, distances are computed between exemplars and PVs, and PVs are iteratively moved to accurately represent the data. GRLVQI extends LVQ with a sigmoidal cost function, relevance learning, and PV update logic improvements. However, both LVQ and GRLVQI are limited due to a reliance on squared Euclidean distance measures and a seemingly complex algorithm structure if changes are made to the underlying distance measure. Herein, the authors (1) develop GRLVQI-D (distance), an extension of GRLVQI to consider alternative distance measures and (2) present the Cosine GRLVQI classifier using this framework. To evaluate this framework, the authors consider experimentally collected Z-wave RF signals and develop RF fingerprints to identify devices. Z-wave devices are low-cost, low-power communication technologies seen increasingly in critical infrastructure. Both classification and verification, claimed identity, and performance comparisons are made with the new Cosine GRLVQI algorithm. The results show more robust performance when using the Cosine GRLVQI algorithm when compared with four algorithms in the literature. Additionally, the methodology used to create Cosine GRLVQI is generalizable to alternative measures.

show abstract

Section: Application and Example Resultsmentioning

confidence: 99%

Cyber-Physical Security with RF Fingerprint Classification through Distance Measure Extensions of Generalized Relevance Learning Vector Quantization

Bihl

Paciencia

Bauer

et al. 2020

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…e-Government cyber systems are enterprise level systems which encompass a variety of devices and standards due to the myriad of e-Government services offered. Additionally, these system are expected to be both secure and reliable in operations, accounting for and responding to a variety of cyber events [1] [2]. Enterprise cyber systems are all encompassing, which monitor and control access for any device that may use the network, from computers to Internet-of-Things (IoT) devices.…”

Section: Introductionmentioning

confidence: 99%

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

Bihl

Gutierrez

Bauer

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Forensic analysis of logs is one responsibility of an enterprise cyber defense team; inherently, this is a big data task with thousands of events possibly logged in minutes of activity. Logged events range from authorized users typing incorrect passwords to malignant threats. Log analysis is necessary to understand current threats, be proactive against emerging threats, and develop new firewall rules. This paper describes embedded analytics for log analysis, which incorporates five mechanisms: numerical, similarity, graph-based, graphical analysis, and interactive feedback. Topological Data Analysis (TDA) is introduced for log analysis with TDA providing novel graph-based similarity understanding of threats which additionally enables a feedback mechanism to further analyze log files. Using real-world firewall log data from an enterprise-level organization, our end-to-end evaluation shows the effective detection and interpretation of log anomalies via the proposed process, many of which would have otherwise been missed by traditional means.

show abstract

Security Methods for Critical Infrastructure Communications

Cited by 2 publications

References 43 publications

Cyber-Physical Security with RF Fingerprint Classification through Distance Measure Extensions of Generalized Relevance Learning Vector Quantization

Cyber-Physical Security with RF Fingerprint Classification through Distance Measure Extensions of Generalized Relevance Learning Vector Quantization

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

Contact Info

Product

Resources

About