Secure Contingency Prediction and Response for Cyber-Physical - - PowerPoint PPT Presentation

Secure Contingency Prediction and Response for Cyber-Physical Systems

Erik Miehling, Cedric Langbort, Tamer Başar

Coordinated Science Lab University of Illinois at Urbana-Champaign Urbana, IL, 61820 CCTA 2020 — August 26, 2020

Some cyber-physical attacls…

Stuxnet (~2005-09)

• Used a combination of exploits (including social

engineering atuacks and zero-days) to gain access to the computers responsible for re-programming PLCs

Ukrainian power grid hacl (2015)

• Used spear-phishing atuacks (malicious emails) to

install malware that opened a backdoor on the substations’ computers, in turn facilitating recon atuacks and eventual remote access

Kemuri water company attacl (2016)

• Exploited a vulnerability in the payment system to

gain access to the valve and flow control applications

• Altered setuings for water flow and chemical levels

2

Primary ciallenges

• Cyber-physical systems security shares all of the challenges of cyber-security…
• Partial observability
• Dynamic
• Large-scale
• Time-sensitivity
• …as well as challenges due to the existence of the physical system
• Cyber defenses are limited by operational requirements of the physical

system

• Tie need to maintain accurate estimates and good control performance in

the presence of corrupted sensors and compromised actuators

3

4

Related work and contribution

Related work

• Surveys: [Chaterji et al., ’19], [Zhu & Başar, ’15], [Lun et al., ’19], [Dibaji et al., ’19]
• CPS atuack analysis: [Chen et al., ’11], [Davis et al., ’15], [Li et al., ’17]
• Secure state estimation and control: [Zonouz et al., ’12], [Etigowni et al., ’16],

[Chang et al., ’18], [Barreto et al., ’13], [Fawzi et al., ’14]

Contribution

• We propose a model, termed secure contingency prediction and response

(SCPR), that links the security status of the cyber network with the operational status of the physical system

• First to use an atuack graph to define a state process on the cyber network for

the purposes of prescribing joint control of the cyber and physical processes

• Atuack graph description allows one to reason over combinatorially many

atuack paths in the cyber network, enabling a granular view of the atuacker’s capabilities

Tie SCPR Model

estimator

dk ∈ D

sc

k

sp

t

{ek} ⊆ E

zk ∈ Z

yτ ∈ Y

uτ ∈ U

ˆ xτ ∈ X

cyber layer

security alerts cyber actions exploit activity

cyber network

IRS IDS cyber-physical coupling estimator controller physical system physical layer

state estimates sensor measurements physical actions

Cyber layer

• Cyber network is described by a discrete

state evolving on

• Intrusion response system (IRS) translates

security alerts from an intrusion detection system (IDS) to cyber actions Physical layer

• Physical system is described by a

continuous state evolving on

• State estimates and physical actions are

defined on a discrete (sampled) time-scale Cyber-physical system

• Tie cyber-physical state at is

k = {0, 1, . . .}

sc

k

sp

t

t ∈ [0, ∞)

τ ∈ {0, 1, . . .}

(k, t)

sk,t = (sc

k, sp t )

5

State Processes - Cyber State

• Cyber state is quantified by an atuack graph1
• Node set represents security conditions

and exploits

• Relationships encoded by the directed edge set

describe how an atuacker uses security conditions to carry out exploits. Each exploit is associated with two sets:

• In summary, the cyber state is where ,

security conditions exploits 1[Ammann et al., ’02], [Miehling et al., ’15/’18]

G = (N, R)

N = C ∪ E

e ∈ E

C−(e) = {c ∈ C | ∃r = (c, e) ∈ R}

C+(e) = {c ∈ C | ∃r = (e, c) ∈ R}

sc

k = (Gk, ck)

Gk = (Ck ∪ Ek, Rk)

ck ⊆ Ck

R

• Note that the atuack graph structure may also evolve in time

6

State Processes - Physical State

• Physical state is quantified by:
• Physical components, , consisting of devices that directly interact with the

physical process (e.g., transmission lines, circuit breakers, buses, generators, loads, flow sensors)

• Continuous state, , represents the physical state process (e.g., power flow)

P

x

• Tie status of the physical components may evolve in time, e.g., random failures,

malicious actions, or as part of maintaining the control objective

• Tie state process evolves in time via physical actions and disturbances from the

environment, subject to the active physical components/structure

• In summary, the state of the physical system is given by the pair

where is the current set of physical components and is the current physical state sp

t = (Pt, xt)

xt ∈ X

Pt ⊆ P

7

Cyber actions:

• Tie IRS prescribes ,

Control Arciitecture

• Control of the cyber-physical system is carried out on both the cyber and

physical layers k ∈ {0, 1, . . .}

Physical (control) actions:

• Tie controller specifies ,

dk ∈ D

uτ ∈ U

τ ∈ {0, 1, . . .}

Gk+1 = fG(Gk, ck, dk, vG

k )

ck+1 = fc(Gk, ck, dk, ukτ , vc

k)

˙ Pt = gP(Gtk, ctk, Pt, xt, dtk, utτ , vP

t )

˙ xt = gx(Gtk, ctk, Pt, xt, utτ , vx

t )

• Cyber-physical state evolves as a function of joint cyber-physical action (dk, uτ)

)

)

updated cyber state, updated physical state, sc

k+1

˙ sp

t

8

Cyber-physical coupling

• Set of physical components with each cyber action that

become disabled as a result of the cyber action

• Each condition is associated with a set of physical components

such that if atuacker enables then it gains control over P(c) ⊆ P

P(d) ⊆ P

d ∈ D

c ∈ C

c

9

Information Structure

• Note that the decision maker does not possess perfect knowledge of the

underlying cyber-physical state, instead it receives the following information:

• In summary,
• Tie available information at time is

zk = h(sc

k, dk, ukτ , wc k)

yτ = l(sp

τt, dτk, uτ, wp τ)

Ik,τ = {d0:k−1, u0:τ−1, z1:k, y1:τ}

yτ ∈ Y

Physical layer:

• Physical sensors yield noisy measurements at each time τ

10

Cyber layer:

• Each exploit , when atuempted, generates a set of security alerts
• Each alert is also associated with a probability of false alarm
• Set of security alerts at each time is a binary vector

ei ∈ E

δij

ζj

zk ∈ Z = {0, 1}|A|

according to probability of detection aj ∈ A(ei) ⊆ A

k

aj

• Fixed atuack graph: for all
• Partially observable spreading dynamics:
• Atuack and success probabilities,
• Detection and false alarm probabilities, ;
• Cyber state:
• Defense actions: blocks exploits
• In summary,

Control-Aware Intrusion Response

• We propose a variant of intrusion response relevant to cyber-physical systems,

termed control-aware intrusion response, in which cyber actions are chosen to maintain the structural controllability of the physical system Gk = (C ∪ E, R)

k ∈ {0, 1, . . .}

sc

k = ck ⊆ C

ζj, aj ∈ A

d ∈ D

ck+1 ∼ p(· | ck, dk; G) zk+1 ∼ p(· | ck, ck+1, dk; G)

Cyber layer δij, ei ∈ E, aj ∈ A

αei, βei, ei ∈ E

E(d) ⊆ E

11

• Assume a deterministic, linear, time-invariant

system with state , nominal state matrix , and nominal input matrix

• Tie set of physical components is defined as

the collection of nodes, links, and actuators

• Tie update of is assumed to be

influenced only by the cyber layer

• Components become inactive

for each enabled condition node and selected defense action

Control-Aware Intrusion Response

˙ Pt = Pt \ (P(ctk) ∪ P(dtk)) ˙ xt = A(Ptk)xt + B(Ptk)utτ

1

2

3

4

5

6

7

8

9

10

11

xt ∈ Rn

A ∈ Rn×n

B ∈ Rn×m

P

Pt ⊆ P

P(c) ∪ P(d)

c ∈ C

d ∈ D

Physical layer

Figure: a sample physical system.

• In summary,

12

Control-Aware Intrusion Response

• Structural controllability is characterized by the minimum inputs theorem of [Liu et

al., ’11]

• In particular, valid control configurations (which nodes need to be controlled in order

for the system to be controllable) described by finding all maximum matchings of the physical system graph

1

2

3

4

5

6

7

8

9

10

11

13

Control-Aware Intrusion Response

1

2

3

4

5

6

7

8

9

10

11

14

Control-Aware Intrusion Response

• Define a controllability cost describing how the loss of physical

components (nodes, links, control inputs/actuators) due to enabled conditions and selected cyber actions results in the loss of control configurations

• Tie problem of choosing cyber actions, as a function of security alert

information, in order to minimize the controllability cost can then be writuen as a partially observable Markov decision process (POMDP), where the belief is the distribution on the set of enabled security conditions

• An optimal policy, which maximally prolongs the structural controllability
• f the physical system, can be computed by any off-the-shelf POMDP

solver (e.g., POMCP [Silver & Veness, ’10] as in the intrusion response system of [Miehling et al., ’18])

15

Concluding Remarks

• Introduced a general model for the secure operation of cyber-physical systems

by explicitly relating the security status of the cyber layer with the operational status of the physical layer

• An instance of the SCPR model, termed control-aware intrusion response, was

introduced

• While SCPR was presented from a centralized control (single decision maker)

perspective, we hope that the model will provide a structure for more complex analyses involving multiple decision makers and strategic interaction

Thank you!

16