Vulnerabilities of cyber-physical systems to stale data—Determining the optimal time to launch attacks

Krotofil, Marina; Cárdenas, Álvaro A.; Larsen, Jason; Gollmann, Dieter

doi:10.1016/j.ijcip.2014.10.003

Cited by 50 publications

(26 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The combination of these metrics was used to deliver a node ranking in a graphbased representation of electricity grids. Finally, in the recent work of Krotofil et al [26] and that of Genge and Siaterlis [14], the impact of attacks on the underlying physical process was measured as the time interval after which the system reaches its emergency shutdown limits.…”

Section: B Caiamentioning

confidence: 99%

“…These may alter legitimate control signals in order to cause important damages. Finally, studies such as the one of Krotofil et al [26] showed that sensor data analysis may be used to infer the optimal time for launching denial-of-service attacks on control signals. These examples are clear evidence on the necessity to address the security requirements of ICS networks at early design phases.…”

Section: Requirements and Approach Overviewmentioning

confidence: 99%

“…Obviously, many different cyber attacks may be tested, and as shown by other studies as well [14], [24]- [26], [40], the attacker's targets may vary according to his goals. Therefore, in general, the CAIA procedure might need to be applied several times for different ICS cyber asset and attacker goals in order to obtain a more accurate and complete solution.…”

Section: A Scenario A: Qualitative Assessmentmentioning

confidence: 99%

See 2 more Smart Citations

Cyber-Security-Aware Network Design of Industrial Control Systems

Genge

Haller

Kiss

2017

IEEE Systems Journal

View full text Add to dashboard Cite

The pervasive adoption of traditional information and communication technologies hardware and software in industrial control systems (ICS) has given birth to a unique technological ecosystem encapsulating a variety of objects ranging from sensors and actuators to video surveillance cameras and generic PCs. Despite their invaluable advantages, these advanced ICS create new design challenges, which expose them to significant cyber threats. To address these challenges, an innovative ICS network design technique is proposed in this paper to harmonize the traditional ICS design requirements pertaining to strong architectural determinism and real-time data transfer with security recommendations outlined in the ISA-62443.03.02 standard. The proposed technique accommodates security requirements by partitioning the network into security zones and by provisioning critical communication channels, known as security conduits, between two or more security zones. The ICS network design is formulated as an integer linear programming (ILP) problem that minimizes the cost of the installation. Real-time data transfer limitations and security requirements are included as constraints imposing the selection of specific traffic paths, the selection of routing nodes, and the provisioning of security zones and conduits. The security requirements of cyber assets denoted by traffic and communication endpoints are determined by a cyber attack impact assessment technique proposed in this paper. The sensitivity of the proposed techniques to different parameters is evaluated in a first scenario involving the IEEE 14-bus model and in a second scenario involving a large network topology based on generated data. Experimental results demonstrate the efficiency and scalability of the ILP model. Index Terms-Industrial control systems (ICS), ISA-62443, network design, security conduit, security zone.

show abstract

Section: B Caiamentioning

confidence: 99%

Section: Requirements and Approach Overviewmentioning

confidence: 99%

Section: A Scenario A: Qualitative Assessmentmentioning

confidence: 99%

See 1 more Smart Citation

Cyber-Security-Aware Network Design of Industrial Control Systems

Genge

Haller

Kiss

2017

IEEE Systems Journal

View full text Add to dashboard Cite

show abstract

“…Cyber-physical systems with the help of sensors, actuators, computation, and communication components control the physical process [2]. Some observed information about physical phenomena, such as rotating speed, pressure, or temperature, is received by sensors.…”

Section: Introductionmentioning

confidence: 99%

“…An adversarial attack on these systems may change the behavior of controlled processes through modifying automation programs or modifying commands [2]. Any modification in the controller code changes the process behavior.…”

Section: Introductionmentioning

confidence: 99%

Predicting the behavior of attackers and the consequences of attacks against cyber‐physical systems

Orojloo

Azgomi

2016

Security Comm Networks

View full text Add to dashboard Cite

One of the main challenges of the security of cyber-physical systems (CPSs) is the lack of an efficient approach to evaluate the impacts of attacks on physical processes and their probabilities of occurrence. This paper proposes a method for evaluating the security of CPSs. By using the proposed method, one can predict the attacker's preferences in attacking CPSs and study the dynamic behavior of systems under security attacks. To deal with uncertainties in attacker's decision making to conduct attacks, the attack tree structure is used and parameterized with suitable fuzzy data. In the next step, the fuzzy technique for order of preference by similarity to ideal solution method is used to evaluate the model and predict the behavior of attackers. Besides, the dynamic behavior of CPSs under attacks is investigated by using the system's process model. The output of the model is a relative estimation of the security level of system based on suitable security metrics, such as the probability of attack scenarios, the time that the process is able to operate after conducting attack before shutting down (time-to-shutdown), and security risks. We illustrate the effectiveness of the method by comparing it with another attack tree-based method. Furthermore, we present two illustrative examples and estimate the defined quantitative security measures.

show abstract

Concluding Remarks and Future Outlook

Ferrari

2021

Lecture Notes in Control and Information Sciences

View full text Add to dashboard Cite

Vulnerabilities of cyber-physical systems to stale data—Determining the optimal time to launch attacks

Cited by 50 publications

References 19 publications

Cyber-Security-Aware Network Design of Industrial Control Systems

Cyber-Security-Aware Network Design of Industrial Control Systems

Predicting the behavior of attackers and the consequences of attacks against cyber‐physical systems

Concluding Remarks and Future Outlook

Contact Info

Product

Resources

About