Disconnection-aware Attack Detection in Networked Control Systems - - PowerPoint PPT Presentation

Disconnection-aware Attack Detection in Networked Control Systems

IF IFAC World Congress 2020 July ly 12-17 17

Hampei mpei Sasahar ahara*, *, Takayuk uki i Ish shiz izak aki**, **, Jun-ic ichi hi Imur ura**, a**, Henrik nrik Sandber andberg* g* (* KTH Roy

• yal

al Insti stitut tute of Tec echno hnolo logy, ** Tokyo

• Ins

nstit titute ute of tec echn hnology)

• logy)

Cyb Cyber-Phy Physi sical cal Sy Syst stem m Se Security urity

1/15

malware programs targeting control systems

Information System (IS) Security

• BlackEnergy 3 (2015)
• Hatman (2017)

Control System (CS) Security

• cryptography
• firewall
• authorization
• model-based attack detection
• physical watermarking
• heterogeneous redundant devices
• Stuxnet (2010)

Uranium Plant Power Grid Industrial System

• cyber/physical attack surfaces
• standard protocol

interest in this talk

increasing vulnerability

• high connectivity

Mo Mode del-based based Attac tack k De Detection ection

2/15 idea: to create a dynamical model and check if the observed data coincide with the model

• bserved data

residual alarm attack detector residual generator local measurement networked system dynamical model

• ne of the most fruitful product in CPS security techniques provided by our control community

its role in more general security workflow?

3/15

In Incident ident Ha Hand ndling ling

[1] P . Cichonski, et al., Computer Security Incident Handling Guide, NIST, 2012.

• 1. detection
• 2. analysis
• 3. containment
• 4. eradication/recovery

model-based detection

IS: static interaction/operation CPS: dynamic interaction/operation through feedback containment process may cause loss of dynamic function (e.g., stability)

potential problem in CPS

attack

incident handling during an adverse event

guideline provided by NIST (National Institute of Standard and Technology) [1] disconnection of suspected components

4/15

Resear search h Obj bjectiv ctive

Objective designing disconnection-aware attack detectors

not design parameter

possible solution for CPS itself: proper segmentation

segmentation: design parameter possible to choose so as to cope with disconnection segmentation:

tracking capability??

4/15

Resear search h Obj bjectiv ctive

tracking capability?? naive approach: no feedback to the residual generator drawback: detection time depends on the time constant of the component

Objective designing disconnection-aware attack detectors

not design parameter

possible solution for CPS itself: proper segmentation

segmentation: design parameter possible to choose so as to cope with disconnection segmentation:

5/15

Ma Mathema hematical tical De Desc scription iption

: reference : interaction : attack : measurement : interaction th subsystem interaction : the remaining subsystem’s indices

5/15

Ma Mathema hematical tical De Desc scription iption

the entire system with remaining subsystems

distributed residual generator

: residual : estimated interactions

5/15

Ma Mathema hematical tical De Desc scription iption

commonly used residual generator Luenberger-type observer in a distributed form

the entire system with remaining subsystems

distributed residual generator

: residual : estimated interactions residual feedback with a static gain + residual generator

6/15

Ex Example: ple: Lo Low-Volta

• ltage

e Di Dist strib ibution ution Ne Netw twor

• rk

DG

distributed attack detector

false data injection attack DG DG

commonly used model (LinDistFlow)

disconnection at

voltage keep around setpoint properly segmented

disconnection

• power flow (at each node)

node edge

• Distributed Generation (DG)

(first-order system) keep around setpoint (> 229 [V])

229 [V] 230 [V] (setpoint)

(Luenberger)

• voltage drop (at each branch)

6/15

Ex Example: ple: Lo Low-Volta

• ltage

e Di Dist strib ibution ution Ne Netw twor

• rk

disconnection at

diverge loss of tracking capability by disconnection

perfect tracing (zero residual)

residual

DG

distributed attack detector

false data injection attack DG DG disconnection

commonly used model (LinDistFlow)

• power flow (at each node)

node edge

• Distributed Generation (DG)

(first-order system) (Luenberger)

• voltage drop (at each branch)

7/15

Pr Prob

• blem

lem Form

• rmula

ulation tion

notation: Assumption (proper segmentation) remaining subsystems is internally stable for any Problem Design a residual generator such that for any when internally stable for any Remark: naive approach is possible solution drawback: detection time depends on time constant of late detection we will seek for and

8/15

Pr Prob

• blem

lem Reform

• rmula

ulation tion

consider the particular residual generator

Remark: Luenberger-type observer

the error dynamics is the design parameters Reformulated Problem Design such that the closed-loop system is internally stable for any

Our approach: Retrofit Control

where (interaction errors) internally stable for any

block-diagram

with

9/15

Brief ief Revie view w of

• f Retr

trof

• fit

it Co Cont ntrol

• l

Retrofit Control: modular design method of a decentralized controller Crucial Premise the preexisting system is internally stable fundamental idea design such that the interaction relation is kept to be invariant preserving stability

system of interest intended situation multiple subcontroller designers : designer of : designer of

• nly with model knowledge of
• nly with model knowledge of

10/15

Brief Review of Retrofit Control (cont’d)

Retrofit Control: modular design method of a decentralized controller

system of interest intended situation multiple subcontroller designers : designer of : designer of

• nly with model knowledge of
• nly with model knowledge of

the th subcontroller designer’s viewpoint interaction relation is invariant

10/15

Brief Review of Retrofit Control (cont’d)

Retrofit Control: modular design method of a decentralized controller

system of interest intended situation multiple subcontroller designers : designer of : designer of

• nly with model knowledge of
• nly with model knowledge of

the th subcontroller designer’s viewpoint the entire system is stable Youla parameter interaction relation is invariant ( holds when other models are completely unknown)

Assumption: is measurable in addition to 11/15

Tracta ctable le Cl Classe sses of s of Retr trof

• fit

it Co Cont ntroller

• llers

is difficult to handle in general (i) output-rectifying retrofit controllers: (ii) input-rectifying retrofit controllers: Existing Result on (i) : locally stabilizing controller :rectified output Assumption can be satisfied by introducing abundant sensors

• n the other hand,

(ii) has not received much attention because the condition is on “control inputs” requiring modification of actuators relatively difficult to address in physical systems condition

Lemma (dual) 12/15

Pr Prop

• pose
• sed

d So Solu lution ion vi via Retr trof

• fit

it Co Cont ntrol

• l

back to our problem: disconnection-aware attack detector design approach: applying retrofit control so as to key observation: control inputs in residual generator: cyber signals physical actuators are not required idea: introducing an additional input for rectifying the original input th sub-closed-loop with designing such that Solution with the structured Remark: no requirements on input/output ports of residual generator broad applicability

13/15

Si Simula ulation tion

DG false data injection attack DG DG disconnection

CIGRE benchmark model

confirmation

[V] commonly used model (LinDistFlow)

• power flow (at each node)

node edge

• Distributed Generation (DG)

(first-order system) (European residential network) , for any

• 1. early detection
• 2. attack impact mitigation
• 3. preservation of tracking capability

measurement signal: (reactive power) controller design: linear quadratic regulator

• residual generator
• voltage drop (at each branch)

14/15

Si Simula ulation tion

the normalized residual response (for decision making) proposed decision line decisions are made at and

early detection is achieved by the proposed method Result 1:

threat model: step function from at the 4th customer’s reference voltage (0.95 DC gain) naive (no feedback)

14/15

Si Simula ulation tion

naive (no feedback) proposed disconnection disconnection the voltage response (should be regulated)

voltage drop is significantly reduced Result 2:

14/15

Si Simula ulation tion

tracking capability is preserved under disconnection Result 3:

stability under disconnection

disconnection at

residuals Luenberger-type proposed

15/15

Co Conc nclusion lusion

(i) point out importance of disconnection awareness in the context of incident handling

• 1. detection
• 2. analysis
• 3. containment
• 4. eradication/recovery

summary of contributions

(ii) propose a solution based on retrofit control theory (iii) show that a particular form of retrofit controllers is appropriate for our problem, which leads to broad applicability of our method

possible future directions

(i) attack detector design with a given ROC (receiver operating characteristic) curve residual alarm attack detector residual generator (ii) analysis for sophisticated attacks thank you for your kind attention