Cyber-physical systems(CPSs)are regarded as the backbone of the fourth industrial revolution,in which communication,physical processes,and computer technology are integrated.In modern industrial systems,CPSs are widel...Cyber-physical systems(CPSs)are regarded as the backbone of the fourth industrial revolution,in which communication,physical processes,and computer technology are integrated.In modern industrial systems,CPSs are widely utilized across various domains,such as smart grids,smart healthcare systems,smart vehicles,and smart manufacturing,among others.Due to their unique spatial distribution,CPSs are highly vulnerable to cyber-attacks,which may result in severe performance degradation and even system instability.Consequently,the security concerns of CPSs have attracted significant attention in recent years.In this paper,a comprehensive survey on the security issues of CPSs under cyber-attacks is provided.Firstly,mathematical descriptions of various types of cyberattacks are introduced in detail.Secondly,two types of secure estimation and control processing schemes,including robust methods and active methods,are reviewed.Thirdly,research findings related to secure control and estimation problems for different types of CPSs are summarized.Finally,the survey is concluded by outlining the challenges and suggesting potential research directions for the future.展开更多
With the development of cyber-physical systems,system security faces more risks from cyber-attacks.In this work,we study the problem that an external attacker implements covert sensor and actuator attacks with resourc...With the development of cyber-physical systems,system security faces more risks from cyber-attacks.In this work,we study the problem that an external attacker implements covert sensor and actuator attacks with resource constraints(the total resource consumption of the attacks is not greater than a given initial resource of the attacker)to mislead a discrete event system under supervisory control to reach unsafe states.We consider that the attacker can implement two types of attacks:One by modifying the sensor readings observed by a supervisor and the other by enabling the actuator commands disabled by the supervisor.Each attack has its corresponding resource consumption and remains covert.To solve this problem,we first introduce a notion of combined-attackability to determine whether a closedloop system may reach an unsafe state after receiving attacks with resource constraints.We develop an algorithm to construct a corrupted supervisor under attacks,provide a verification method for combined-attackability in polynomial time based on a plant,a corrupted supervisor,and an attacker's initial resource,and propose a corresponding attack synthesis algorithm.The effectiveness of the proposed method is illustrated by an example.展开更多
In this paper, we study stealthy cyber-attacks on actuators of cyber-physical systems(CPS), namely zero dynamics and controllable attacks. In particular, under certain assumptions, we investigate and propose condition...In this paper, we study stealthy cyber-attacks on actuators of cyber-physical systems(CPS), namely zero dynamics and controllable attacks. In particular, under certain assumptions, we investigate and propose conditions under which one can execute zero dynamics and controllable attacks in the CPS. The above conditions are derived based on the Markov parameters of the CPS and elements of the system observability matrix. Consequently, in addition to outlining the number of required actuators to be attacked, these conditions provide one with the minimum system knowledge needed to perform zero dynamics and controllable cyber-attacks. As a countermeasure against the above stealthy cyber-attacks, we develop a dynamic coding scheme that increases the minimum number of the CPS required actuators to carry out zero dynamics and controllable cyber-attacks to its maximum possible value. It is shown that if at least one secure input channel exists, the proposed dynamic coding scheme can prevent adversaries from executing the zero dynamics and controllable attacks even if they have complete knowledge of the coding system. Finally, two illustrative numerical case studies are provided to demonstrate the effectiveness and capabilities of our derived conditions and proposed methodologies.展开更多
To improve the estimation accuracy of state of charge(SOC)and state of health(SOH)for lithium-ion batteries,in this paper,a joint estimation method of SOC and SOH at charging cut-off voltage based on genetic algorithm...To improve the estimation accuracy of state of charge(SOC)and state of health(SOH)for lithium-ion batteries,in this paper,a joint estimation method of SOC and SOH at charging cut-off voltage based on genetic algorithm(GA)combined with back propagation(BP)neural network is proposed,the research addresses the issue of data manipulation resulting fromcyber-attacks.Firstly,anomalous data stemming fromcyber-attacks are identified and eliminated using the isolated forest algorithm,followed by data restoration.Secondly,the incremental capacity(IC)curve is derived fromthe restored data using theKalman filtering algorithm,with the peak of the ICcurve(ICP)and its corresponding voltage serving as the health factor(HF).Thirdly,the GA-BP neural network is applied to map the relationship between HF,constant current charging time,and SOH,facilitating the estimation of SOH based on HF.Finally,SOC estimation at the charging cut-off voltage is calculated by inputting the SOH estimation value into the trained model to determine the constant current charging time,and by updating the maximum available capacity.Experiments show that the root mean squared error of the joint estimation results does not exceed 1%,which proves that the proposed method can estimate the SOC and SOH accurately and stably even in the presence of false data injection attacks.展开更多
We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoul...We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoulli variable is used to describe the hybrid-triggered scheme, which is introduced to alleviate the burden of the network.The mathematical model of the closed-loop control system is established by taking the influences of time-varying delayed control inputs,switching topologies, and stochastic cyber-attacks into account under the hybrid-triggered scheme.A theorem as the main result is given to make the system consistent based on the theory of Lyapunov stability and linear matrix inequality.Markov jumps with uncertain rates of transitions are applied to describe the switch of topologies.Finally, a simulation example demonstrates the feasibility of the theory in this paper.展开更多
In this paper, we investigate the group consensus for leaderless multi-agent systems. The group consensus protocol based on the position information from neighboring agents is designed. The network may be subjected to...In this paper, we investigate the group consensus for leaderless multi-agent systems. The group consensus protocol based on the position information from neighboring agents is designed. The network may be subjected to frequent cyberattacks, which is close to an actual case. The cyber-attacks are assumed to be recoverable. By utilizing algebraic graph theory, linear matrix inequality(LMI) and Lyapunov stability theory, the multi-agent systems can achieve group consensus under the proposed control protocol. The sufficient conditions of the group consensus for the multi-agent networks subjected to cyber-attacks are given. Furthermore, the results are extended to the consensus issue of multiple subgroups with cyber-attacks. Numerical simulations are performed to demonstrate the effectiveness of the theoretical results.展开更多
The United States of America faces an increasing number of threats to its critical infrastructure due to cyber-attacks. With the constant advancement of technology and the interconnectedness of various systems, the vu...The United States of America faces an increasing number of threats to its critical infrastructure due to cyber-attacks. With the constant advancement of technology and the interconnectedness of various systems, the vulnerabilities in the nation’s infrastructure have become more pronounced. Cyber-attacks on critical infrastructure, such as power grids, transportation networks, and financial systems, pose a significant risk to national security and public safety. These attacks can disrupt essential services, cause economic losses, and potentially have severe consequences for the well-being of individuals and communities. The rise of cyber-terrorism is also a concern. Cyber-terrorists can exploit vulnerabilities in cyberspace to compromise infrastructure systems, causing chaos and panic among the population. The potential for destructive attacks on critical infrastructure is a pressing issue requiring constant attention and proactive measures.展开更多
This paper examines the stabilization problem of a distributed networked control system under the effect of cyberattacks by employing a hybrid aperiodic triggering mechanism.The cyber-attack considered in the paper is...This paper examines the stabilization problem of a distributed networked control system under the effect of cyberattacks by employing a hybrid aperiodic triggering mechanism.The cyber-attack considered in the paper is a stochastic deception attack at the sensor-controller end. The probability of the occurrence of attack on a subsystem is represented using a random variable. A decentralized hybrid sampled-data strategy is introduced to save energy consumption and reduce the transmission load of the network. In the proposed decentralized strategy, each subsystem can decide independently whether its state should be transmitted to the controller or not. The scheme of the hybrid triggering mechanism for each subsystem composed of two stages: In the first stage, the next sampling instant is computed using a self-triggering strategy. Subsequently, in the second stage, an event-triggering condition is checked at these sampling instants and the control signal is computed only if the event-triggering condition is violated. The self-triggering condition used in the first stage is dependent on the selection of eventtriggering condition of the second stage. Finally, a comparison of the proposed approach with other triggering mechanisms existing in the literature is presented in terms of the sampling instants,transmission frequency and performance measures through simulation examples.展开更多
This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are...This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are plausible. Considered for the network system are two possible network attack paths. One network path represents an attack through the Internet, and the other represents an attack through the Wireless Access Points (WAPs) in the school network. The probabilities of success of the events, that is, 1) the attack payoff, and 2) the commitment of the attacker to infiltrate the network are estimated for the leaf nodes. These are used to calculate the Returns on Attacks (ROAs) at the Root Nodes. For Phase I, the “As Is” network, the ROA values for both attack paths, are higher than 7 (8.00 and 9.35 respectively), which are high values and unacceptable operationally. In Phase II, countermeasures are implemented, and the two attack trees reevaluated. The probabilities of success of the events, the attack payoff and the commitment of the attacker are then re-estimated. Also, the Returns on Attacks (ROAs) for the Root Nodes are re-assessed after executing the countermeasures. For one attack tree, the ROA value of the Root Node was reduced to 4.83 from 8.0, while, for the other attack tree, the ROA value of the Root Node changed to 3.30 from 9.35. ROA values of 4.83 and 3.30 are acceptable as they fall within the medium value range. The efficacy of this method whereby, attack trees are deployed to mitigate computer network risks, as well as using it to assess the vulnerability of computer networks is quantitatively substantiated.展开更多
In order to accurately receive early warning of the cascading failures caused by coordinated cyber-attacks(CFCC)in grid cyber-physical systems(GCPS),an adaptive early warning method of CFCC is proposed.First,the evolu...In order to accurately receive early warning of the cascading failures caused by coordinated cyber-attacks(CFCC)in grid cyber-physical systems(GCPS),an adaptive early warning method of CFCC is proposed.First,the evolutionary mechanism of CFCC is analyzed from the attackers'view,the CFCC mathematical model is established,and the transition processes of GCPS running states under the influence of CFCC staged failures are discussed.Then,the mathematical model of the adaptive early warning method is established.Further,the mathematical model of the adaptive early warning method is mapped as an adaptive control process with tolerating staged failures damage,and the solving process is presented to infer the CFCC and its next evolution trend.A decision-making idea for the optimal active defense scheme is proposed considering the costs and gains of various defense measures.Finally,to verify the effectiveness of the adaptive early warning method,the warning and defense processes of a typical CFCC are simulated in a GCPS experimental system based on CEPRI-36 BUS.展开更多
The exponential growth of the Internet of Things(IoT)has introduced significant security challenges,with zero-day attacks emerging as one of the most critical and challenging threats.Traditional Machine Learning(ML)an...The exponential growth of the Internet of Things(IoT)has introduced significant security challenges,with zero-day attacks emerging as one of the most critical and challenging threats.Traditional Machine Learning(ML)and Deep Learning(DL)techniques have demonstrated promising early detection capabilities.However,their effectiveness is limited when handling the vast volumes of IoT-generated data due to scalability constraints,high computational costs,and the costly time-intensive process of data labeling.To address these challenges,this study proposes a Federated Learning(FL)framework that leverages collaborative and hybrid supervised learning to enhance cyber threat detection in IoT networks.By employing Deep Neural Networks(DNNs)and decentralized model training,the approach reduces computational complexity while improving detection accuracy.The proposed model demonstrates robust performance,achieving accuracies of 94.34%,99.95%,and 87.94%on the publicly available kitsune,Bot-IoT,and UNSW-NB15 datasets,respectively.Furthermore,its ability to detect zero-day attacks is validated through evaluations on two additional benchmark datasets,TON-IoT and IoT-23,using a Deep Federated Learning(DFL)framework,underscoring the generalization and effectiveness of the model in heterogeneous and decentralized IoT environments.Experimental results demonstrate superior performance over existing methods,establishing the proposed framework as an efficient and scalable solution for IoT security.展开更多
With the widespread use of communication and information technology,power system has been evolving into cyber-physical power system(CPPS)and becoming more vulnerable to cyber-attacks.Therefore,it is necessary to enhan...With the widespread use of communication and information technology,power system has been evolving into cyber-physical power system(CPPS)and becoming more vulnerable to cyber-attacks.Therefore,it is necessary to enhance the ability of the communication and information system in CPPS to defend against cyber-attacks.This paper proposes a method to enhance the survivability of the communication and information system in CPPS.Firstly,the communication and information system for critical business of power system is decomposed into certain types of atomic services,and then the survivability evaluation indexes and their corresponding calculation method for the communication and information system are proposed.Secondly,considering the efficacy and cost defensive resources,a defensive resource allocation model is proposed to maximize the survivability of communication and information system in CPPS.Then,a modified genetic algorithm is adopted to solve the proposed model.Finally,the simulation results of CPPS for an IEEE 30-node system verify the proposed method.展开更多
Modern critical infrastructure,such as a water treatment plant,water distribution system,and power grid,are representative of Cyber Physical Systems(CPSs)in which the physical processes are monitored and controlled in...Modern critical infrastructure,such as a water treatment plant,water distribution system,and power grid,are representative of Cyber Physical Systems(CPSs)in which the physical processes are monitored and controlled in real time.One source of complexity in such systems is due to the intra-system interactions and inter-dependencies.Consequently,these systems are a potential target for attackers.When one or more of these infrastructure are attacked,the connected systems may also be affected due to potential cascading effects.In this paper,we report a study to investigate the cascading effects of cyber-attacks on two interdependent critical infrastructure namely,a Secure water treatment plant(SWaT)and a Water Distribution System(WADI).展开更多
Due to the tight coupling between the cyber and physical sides of a cyber-physical power system(CPPS),the safe and reliable operation of CPPSs is being increasingly impacted by cyber security.This situation poses a ch...Due to the tight coupling between the cyber and physical sides of a cyber-physical power system(CPPS),the safe and reliable operation of CPPSs is being increasingly impacted by cyber security.This situation poses a challenge to traditional security defense systems,which considers the threat from only one side,i.e.,cyber or physical.To cope with cyberattacks,this paper reaches beyond the traditional one-side security defense systems and proposes the concept of cyber-physical coordinated situation awareness and active defense to improve the ability of CPPSs.An example of a regional frequency control system is used to show the validness and potential of this concept.Then,the research framework is presented for studying and implementing this concept.Finally,key technologies for cyber-physical coordinated situation awareness and active defense against cyber-attacks are introduced.展开更多
Connected automated vehicles(CAVs)rely heavily on intelligent algorithms and remote sensors.If the control center or on-board sensors are under cyber-attack due to the security vulnerability of wireless communication,...Connected automated vehicles(CAVs)rely heavily on intelligent algorithms and remote sensors.If the control center or on-board sensors are under cyber-attack due to the security vulnerability of wireless communication,it can cause significant damage to CAVs or passengers.The primary objective of this study is to model cyberattacked traffic flow and evaluate the impacts of cyber-attack on the traffic system filled with CAVs in a connected environment.Based on the analysis on environmental perception system and possible cyber-attacks on sensors,a novel lane-changing model for CAVs is proposed and multiple traffic scenarios for cyber-attacks are designed.The impact of the proportion of cyber-attacked vehicles and the severity of the cyber-attack on the lanechanging process is then quantitatively analyzed.The evaluation indexes include spatio-temporal evolution of average speed,spatial distribution of selected lane-changing gaps,lane-changing rate distribution,lane-changing preparation search time,efficiency and safety.Finally,the numerical simulation results show that the freeway traffic near an off-ramp is more sensitive to the proportion of cyber-attacked vehicles than to the severity of the cyber-attack.Also,when the traffic system is under cyber-attack,more unsafe back gaps are chosen for lane-changing,especially in the center lane.Therefore,more lane-changing maneuvers are concentrated on approaching the off-ramp,causing severe congestions and potential rear-end collisions.In addition,as the number of cyber-attacked vehicles and the severity of cyber-attacks increase,the road capacity and safety level will rapidly decrease.The results of this study can provide a theoretical basis for accident avoidance and efficiency improvement for the design of CAVs and management of automated highway systems.展开更多
The field of biometric identification has seen significant advancements over the years,with research focusing on enhancing the accuracy and security of these systems.One of the key developments is the integration of d...The field of biometric identification has seen significant advancements over the years,with research focusing on enhancing the accuracy and security of these systems.One of the key developments is the integration of deep learning techniques in biometric systems.However,despite these advancements,certain challenges persist.One of the most significant challenges is scalability over growing complexity.Traditional methods either require maintaining and securing a growing database,introducing serious security challenges,or relying on retraining the entiremodelwhen new data is introduced-a process that can be computationally expensive and complex.This challenge underscores the need for more efficient methods to scale securely.To this end,we introduce a novel approach that addresses these challenges by integrating multimodal biometrics,cancelable biometrics,and incremental learning techniques.This work is among the first attempts to seamlessly incorporate deep cancelable biometrics with dynamic architectural updates,applied incrementally to the deep learning model as new users are enrolled,achieving high performance with minimal catastrophic forgetting.By leveraging a One-Dimensional Convolutional Neural Network(1D-CNN)architecture combined with a hybrid incremental learning approach,our system achieves high recognition accuracy,averaging 98.98% over incrementing datasets,while ensuring user privacy through cancelable templates generated via a pre-trained CNN model and random projection.The approach demonstrates remarkable adaptability,utilizing the least intrusive biometric traits like facial features and fingerprints,ensuring not only robust performance but also long-term serviceability.展开更多
The increasing adoption of Industrial Internet of Things(IIoT)systems in smart manufacturing is leading to raise cyberattack numbers and pressing the requirement for intrusion detection systems(IDS)to be effective.How...The increasing adoption of Industrial Internet of Things(IIoT)systems in smart manufacturing is leading to raise cyberattack numbers and pressing the requirement for intrusion detection systems(IDS)to be effective.However,existing datasets for IDS training often lack relevance to modern IIoT environments,limiting their applicability for research and development.To address the latter gap,this paper introduces the HiTar-2024 dataset specifically designed for IIoT systems.As a consequence,that can be used by an IDS to detect imminent threats.Likewise,HiTar-2024 was generated using the AREZZO simulator,which replicates realistic smart manufacturing scenarios.The generated dataset includes five distinct classes:Normal,Probing,Remote to Local(R2L),User to Root(U2R),and Denial of Service(DoS).Furthermore,comprehensive experiments with popular Machine Learning(ML)models using various classifiers,including BayesNet,Logistic,IBK,Multiclass,PART,and J48 demonstrate high accuracy,precision,recall,and F1-scores,exceeding 0.99 across all ML metrics.The latter result is reached thanks to the rigorous applied process to achieve this quite good result,including data pre-processing,features extraction,fixing the class imbalance problem,and using a test option for model robustness.This comprehensive approach emphasizes meticulous dataset construction through a complete dataset generation process,a careful labelling algorithm,and a sophisticated evaluation method,providing valuable insights to reinforce IIoT system security.Finally,the HiTar-2024 dataset is compared with other similar datasets in the literature,considering several factors such as data format,feature extraction tools,number of features,attack categories,number of instances,and ML metrics.展开更多
Cloud-based setups are intertwined with the Internet of Things and advanced,and technologies such as blockchain revolutionize conventional healthcare infrastructure.This digitization has major advantages,mainly enhanc...Cloud-based setups are intertwined with the Internet of Things and advanced,and technologies such as blockchain revolutionize conventional healthcare infrastructure.This digitization has major advantages,mainly enhancing the security barriers of the green tree infrastructure.In this study,we conducted a systematic review of over 150 articles that focused exclusively on blockchain-based healthcare systems,security vulnerabilities,cyberattacks,and system limitations.In addition,we considered several solutions proposed by thousands of researchers worldwide.Our results mostly delineate sustained threats and security concerns in blockchain-based medical health infrastructures for data management,transmission,and processing.Here,we describe 17 security threats that violate the privacy and data integrity of a system,over 21 cyber-attacks on security and QoS,and some system implementation problems such as node compromise,scalability,efficiency,regulatory issues,computation speed,and power consumption.We propose a multi-layered architecture for the future healthcare infrastructure.Second,we classify all threats and security concerns based on these layers and assess suggested solutions in terms of these contingencies.Our thorough theoretical examination of several performance criteria—including confidentiality,access control,interoperability problems,and energy efficiency—as well as mathematical verifications establishes the superiority of security,privacy maintenance,reliability,and efficiency over conventional systems.We conducted in-depth comparative studies on different interoperability parameters in the blockchain models.Our research justifies the use of various positive protocols and optimization methods to improve the quality of services in e-healthcare and overcome problems arising fromlaws and ethics.Determining the theoretical aspects,their scope,and future expectations encourages us to design reliable,secure,and privacy-preserving systems.展开更多
Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber secur...Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.展开更多
Smart Industrial environments use the Industrial Internet of Things(IIoT)for their routine operations and transform their industrial operations with intelligent and driven approaches.However,IIoT devices are vulnerabl...Smart Industrial environments use the Industrial Internet of Things(IIoT)for their routine operations and transform their industrial operations with intelligent and driven approaches.However,IIoT devices are vulnerable to cyber threats and exploits due to their connectivity with the internet.Traditional signature-based IDS are effective in detecting known attacks,but they are unable to detect unknown emerging attacks.Therefore,there is the need for an IDS which can learn from data and detect new threats.Ensemble Machine Learning(ML)and individual Deep Learning(DL)based IDS have been developed,and these individual models achieved low accuracy;however,their performance can be improved with the ensemble stacking technique.In this paper,we have proposed a Deep Stacked Neural Network(DSNN)based IDS,which consists of two stacked Convolutional Neural Network(CNN)models as base learners and Extreme Gradient Boosting(XGB)as the meta learner.The proposed DSNN model was trained and evaluated with the next-generation dataset,TON_IoT.Several pre-processing techniques were applied to prepare a dataset for the model,including ensemble feature selection and the SMOTE technique.Accuracy,precision,recall,F1-score,and false positive rates were used to evaluate the performance of the proposed ensemble model.Our experimental results showed that the accuracy for binary classification is 99.61%,which is better than in the baseline individual DL and ML models.In addition,the model proposed for IDS has been compared with similar models.The proposed DSNN achieved better performance metrics than the other models.The proposed DSNN model will be used to develop enhanced IDS for threat mitigation in smart industrial environments.展开更多
文摘Cyber-physical systems(CPSs)are regarded as the backbone of the fourth industrial revolution,in which communication,physical processes,and computer technology are integrated.In modern industrial systems,CPSs are widely utilized across various domains,such as smart grids,smart healthcare systems,smart vehicles,and smart manufacturing,among others.Due to their unique spatial distribution,CPSs are highly vulnerable to cyber-attacks,which may result in severe performance degradation and even system instability.Consequently,the security concerns of CPSs have attracted significant attention in recent years.In this paper,a comprehensive survey on the security issues of CPSs under cyber-attacks is provided.Firstly,mathematical descriptions of various types of cyberattacks are introduced in detail.Secondly,two types of secure estimation and control processing schemes,including robust methods and active methods,are reviewed.Thirdly,research findings related to secure control and estimation problems for different types of CPSs are summarized.Finally,the survey is concluded by outlining the challenges and suggesting potential research directions for the future.
基金partially supported by the Science Technology Development Fund,Macao Special Administrative Region(0029/2023/RIA1)the National Research Foundation Singapore under its AI Singapore Programme(AISG2-GC-2023-007)
文摘With the development of cyber-physical systems,system security faces more risks from cyber-attacks.In this work,we study the problem that an external attacker implements covert sensor and actuator attacks with resource constraints(the total resource consumption of the attacks is not greater than a given initial resource of the attacker)to mislead a discrete event system under supervisory control to reach unsafe states.We consider that the attacker can implement two types of attacks:One by modifying the sensor readings observed by a supervisor and the other by enabling the actuator commands disabled by the supervisor.Each attack has its corresponding resource consumption and remains covert.To solve this problem,we first introduce a notion of combined-attackability to determine whether a closedloop system may reach an unsafe state after receiving attacks with resource constraints.We develop an algorithm to construct a corrupted supervisor under attacks,provide a verification method for combined-attackability in polynomial time based on a plant,a corrupted supervisor,and an attacker's initial resource,and propose a corresponding attack synthesis algorithm.The effectiveness of the proposed method is illustrated by an example.
基金the financial support received from NATO under the Emerging Security Challenges Division programthe support received from NPRP (10-0105-17017) from the Qatar National Research Fund (a member of Qatar Foundation)+1 种基金the support received from the Natural Sciences and Engineering Research Council of Canada (NSERC) and the Department of National Defence (DND) under the Discovery Grant and DND Supplemental Programssupported in part by funding from the Innovation for Defence Excellence and Security (IDEaS) program from the Department of National Defence (DND)。
文摘In this paper, we study stealthy cyber-attacks on actuators of cyber-physical systems(CPS), namely zero dynamics and controllable attacks. In particular, under certain assumptions, we investigate and propose conditions under which one can execute zero dynamics and controllable attacks in the CPS. The above conditions are derived based on the Markov parameters of the CPS and elements of the system observability matrix. Consequently, in addition to outlining the number of required actuators to be attacked, these conditions provide one with the minimum system knowledge needed to perform zero dynamics and controllable cyber-attacks. As a countermeasure against the above stealthy cyber-attacks, we develop a dynamic coding scheme that increases the minimum number of the CPS required actuators to carry out zero dynamics and controllable cyber-attacks to its maximum possible value. It is shown that if at least one secure input channel exists, the proposed dynamic coding scheme can prevent adversaries from executing the zero dynamics and controllable attacks even if they have complete knowledge of the coding system. Finally, two illustrative numerical case studies are provided to demonstrate the effectiveness and capabilities of our derived conditions and proposed methodologies.
基金funded by the Scientific Research Project of the Education Department of Jilin Province(No.JJKH20230121KJ).
文摘To improve the estimation accuracy of state of charge(SOC)and state of health(SOH)for lithium-ion batteries,in this paper,a joint estimation method of SOC and SOH at charging cut-off voltage based on genetic algorithm(GA)combined with back propagation(BP)neural network is proposed,the research addresses the issue of data manipulation resulting fromcyber-attacks.Firstly,anomalous data stemming fromcyber-attacks are identified and eliminated using the isolated forest algorithm,followed by data restoration.Secondly,the incremental capacity(IC)curve is derived fromthe restored data using theKalman filtering algorithm,with the peak of the ICcurve(ICP)and its corresponding voltage serving as the health factor(HF).Thirdly,the GA-BP neural network is applied to map the relationship between HF,constant current charging time,and SOH,facilitating the estimation of SOH based on HF.Finally,SOC estimation at the charging cut-off voltage is calculated by inputting the SOH estimation value into the trained model to determine the constant current charging time,and by updating the maximum available capacity.Experiments show that the root mean squared error of the joint estimation results does not exceed 1%,which proves that the proposed method can estimate the SOC and SOH accurately and stably even in the presence of false data injection attacks.
基金Project supported by the National Natural Science Foundation of China(Grant Nos.61074159 and 61703286)
文摘We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoulli variable is used to describe the hybrid-triggered scheme, which is introduced to alleviate the burden of the network.The mathematical model of the closed-loop control system is established by taking the influences of time-varying delayed control inputs,switching topologies, and stochastic cyber-attacks into account under the hybrid-triggered scheme.A theorem as the main result is given to make the system consistent based on the theory of Lyapunov stability and linear matrix inequality.Markov jumps with uncertain rates of transitions are applied to describe the switch of topologies.Finally, a simulation example demonstrates the feasibility of the theory in this paper.
基金Project supported by the National Natural Science Foundation of China(Grant Nos.61807016 and 61772013)the Natural Science Foundation of Jiangsu Province,China(Grant No.BK20181342)
文摘In this paper, we investigate the group consensus for leaderless multi-agent systems. The group consensus protocol based on the position information from neighboring agents is designed. The network may be subjected to frequent cyberattacks, which is close to an actual case. The cyber-attacks are assumed to be recoverable. By utilizing algebraic graph theory, linear matrix inequality(LMI) and Lyapunov stability theory, the multi-agent systems can achieve group consensus under the proposed control protocol. The sufficient conditions of the group consensus for the multi-agent networks subjected to cyber-attacks are given. Furthermore, the results are extended to the consensus issue of multiple subgroups with cyber-attacks. Numerical simulations are performed to demonstrate the effectiveness of the theoretical results.
文摘The United States of America faces an increasing number of threats to its critical infrastructure due to cyber-attacks. With the constant advancement of technology and the interconnectedness of various systems, the vulnerabilities in the nation’s infrastructure have become more pronounced. Cyber-attacks on critical infrastructure, such as power grids, transportation networks, and financial systems, pose a significant risk to national security and public safety. These attacks can disrupt essential services, cause economic losses, and potentially have severe consequences for the well-being of individuals and communities. The rise of cyber-terrorism is also a concern. Cyber-terrorists can exploit vulnerabilities in cyberspace to compromise infrastructure systems, causing chaos and panic among the population. The potential for destructive attacks on critical infrastructure is a pressing issue requiring constant attention and proactive measures.
文摘This paper examines the stabilization problem of a distributed networked control system under the effect of cyberattacks by employing a hybrid aperiodic triggering mechanism.The cyber-attack considered in the paper is a stochastic deception attack at the sensor-controller end. The probability of the occurrence of attack on a subsystem is represented using a random variable. A decentralized hybrid sampled-data strategy is introduced to save energy consumption and reduce the transmission load of the network. In the proposed decentralized strategy, each subsystem can decide independently whether its state should be transmitted to the controller or not. The scheme of the hybrid triggering mechanism for each subsystem composed of two stages: In the first stage, the next sampling instant is computed using a self-triggering strategy. Subsequently, in the second stage, an event-triggering condition is checked at these sampling instants and the control signal is computed only if the event-triggering condition is violated. The self-triggering condition used in the first stage is dependent on the selection of eventtriggering condition of the second stage. Finally, a comparison of the proposed approach with other triggering mechanisms existing in the literature is presented in terms of the sampling instants,transmission frequency and performance measures through simulation examples.
文摘This paper presents the attack tree modeling technique of quantifying cyber-attacks on a hypothetical school network system. Attack trees are constructed by decomposing the path in the network system where attacks are plausible. Considered for the network system are two possible network attack paths. One network path represents an attack through the Internet, and the other represents an attack through the Wireless Access Points (WAPs) in the school network. The probabilities of success of the events, that is, 1) the attack payoff, and 2) the commitment of the attacker to infiltrate the network are estimated for the leaf nodes. These are used to calculate the Returns on Attacks (ROAs) at the Root Nodes. For Phase I, the “As Is” network, the ROA values for both attack paths, are higher than 7 (8.00 and 9.35 respectively), which are high values and unacceptable operationally. In Phase II, countermeasures are implemented, and the two attack trees reevaluated. The probabilities of success of the events, the attack payoff and the commitment of the attacker are then re-estimated. Also, the Returns on Attacks (ROAs) for the Root Nodes are re-assessed after executing the countermeasures. For one attack tree, the ROA value of the Root Node was reduced to 4.83 from 8.0, while, for the other attack tree, the ROA value of the Root Node changed to 3.30 from 9.35. ROA values of 4.83 and 3.30 are acceptable as they fall within the medium value range. The efficacy of this method whereby, attack trees are deployed to mitigate computer network risks, as well as using it to assess the vulnerability of computer networks is quantitatively substantiated.
基金supported by National Natural Science Foundation of China(No.51977155).
文摘In order to accurately receive early warning of the cascading failures caused by coordinated cyber-attacks(CFCC)in grid cyber-physical systems(GCPS),an adaptive early warning method of CFCC is proposed.First,the evolutionary mechanism of CFCC is analyzed from the attackers'view,the CFCC mathematical model is established,and the transition processes of GCPS running states under the influence of CFCC staged failures are discussed.Then,the mathematical model of the adaptive early warning method is established.Further,the mathematical model of the adaptive early warning method is mapped as an adaptive control process with tolerating staged failures damage,and the solving process is presented to infer the CFCC and its next evolution trend.A decision-making idea for the optimal active defense scheme is proposed considering the costs and gains of various defense measures.Finally,to verify the effectiveness of the adaptive early warning method,the warning and defense processes of a typical CFCC are simulated in a GCPS experimental system based on CEPRI-36 BUS.
基金supported by Princess Nourah bint Abdulrahman University Researchers Supporting Project Number(PNURSP2025R97)Princess Nourah bint Abdulrahman University,Riyadh,Saudi Arabia.
文摘The exponential growth of the Internet of Things(IoT)has introduced significant security challenges,with zero-day attacks emerging as one of the most critical and challenging threats.Traditional Machine Learning(ML)and Deep Learning(DL)techniques have demonstrated promising early detection capabilities.However,their effectiveness is limited when handling the vast volumes of IoT-generated data due to scalability constraints,high computational costs,and the costly time-intensive process of data labeling.To address these challenges,this study proposes a Federated Learning(FL)framework that leverages collaborative and hybrid supervised learning to enhance cyber threat detection in IoT networks.By employing Deep Neural Networks(DNNs)and decentralized model training,the approach reduces computational complexity while improving detection accuracy.The proposed model demonstrates robust performance,achieving accuracies of 94.34%,99.95%,and 87.94%on the publicly available kitsune,Bot-IoT,and UNSW-NB15 datasets,respectively.Furthermore,its ability to detect zero-day attacks is validated through evaluations on two additional benchmark datasets,TON-IoT and IoT-23,using a Deep Federated Learning(DFL)framework,underscoring the generalization and effectiveness of the model in heterogeneous and decentralized IoT environments.Experimental results demonstrate superior performance over existing methods,establishing the proposed framework as an efficient and scalable solution for IoT security.
基金supported by“Research on Operation Situation Awareness and Proactive Defense of Power Cyber-Physical System Against Cyber Attacks”the Fundamental Research Funds for the Central Universities(No.2018B05814)
文摘With the widespread use of communication and information technology,power system has been evolving into cyber-physical power system(CPPS)and becoming more vulnerable to cyber-attacks.Therefore,it is necessary to enhance the ability of the communication and information system in CPPS to defend against cyber-attacks.This paper proposes a method to enhance the survivability of the communication and information system in CPPS.Firstly,the communication and information system for critical business of power system is decomposed into certain types of atomic services,and then the survivability evaluation indexes and their corresponding calculation method for the communication and information system are proposed.Secondly,considering the efficacy and cost defensive resources,a defensive resource allocation model is proposed to maximize the survivability of communication and information system in CPPS.Then,a modified genetic algorithm is adopted to solve the proposed model.Finally,the simulation results of CPPS for an IEEE 30-node system verify the proposed method.
基金the National Research Foundation(NRF),Prime Minister’s Office,Singapore,under its National Cybersecurity R&D Programme(Award No.NRF2015NCR-NCR003-001)and administered by the National Cybersecurity R&D Directorate.
文摘Modern critical infrastructure,such as a water treatment plant,water distribution system,and power grid,are representative of Cyber Physical Systems(CPSs)in which the physical processes are monitored and controlled in real time.One source of complexity in such systems is due to the intra-system interactions and inter-dependencies.Consequently,these systems are a potential target for attackers.When one or more of these infrastructure are attacked,the connected systems may also be affected due to potential cascading effects.In this paper,we report a study to investigate the cascading effects of cyber-attacks on two interdependent critical infrastructure namely,a Secure water treatment plant(SWaT)and a Water Distribution System(WADI).
基金This work was supported in part by the National Key Research and Development Program of China(No.2017YFB0903000)the Science and Technology Project of the State Grid Corporation of China(Basic Theory and Methodology for Analysis and Control of Grid Cyber Physical Systems(Supporting Projects)).
文摘Due to the tight coupling between the cyber and physical sides of a cyber-physical power system(CPPS),the safe and reliable operation of CPPSs is being increasingly impacted by cyber security.This situation poses a challenge to traditional security defense systems,which considers the threat from only one side,i.e.,cyber or physical.To cope with cyberattacks,this paper reaches beyond the traditional one-side security defense systems and proposes the concept of cyber-physical coordinated situation awareness and active defense to improve the ability of CPPSs.An example of a regional frequency control system is used to show the validness and potential of this concept.Then,the research framework is presented for studying and implementing this concept.Finally,key technologies for cyber-physical coordinated situation awareness and active defense against cyber-attacks are introduced.
基金jointly supported by the National Key Research and Development Program of China(No.2022ZD0115600)National Natural Science Foundation of China(No.52072067)+3 种基金Natural Science Foundation of Jiangsu Province(No.BK20210249)China Postdoctoral Science Foundation(No.2020M681466)Jiangsu Planned Projects for Postdoctoral Research Funds(No.SBK2021041144)Jiangsu Planned Projects for Postdoctoral Research Funds(No.2021K094A)。
文摘Connected automated vehicles(CAVs)rely heavily on intelligent algorithms and remote sensors.If the control center or on-board sensors are under cyber-attack due to the security vulnerability of wireless communication,it can cause significant damage to CAVs or passengers.The primary objective of this study is to model cyberattacked traffic flow and evaluate the impacts of cyber-attack on the traffic system filled with CAVs in a connected environment.Based on the analysis on environmental perception system and possible cyber-attacks on sensors,a novel lane-changing model for CAVs is proposed and multiple traffic scenarios for cyber-attacks are designed.The impact of the proportion of cyber-attacked vehicles and the severity of the cyber-attack on the lanechanging process is then quantitatively analyzed.The evaluation indexes include spatio-temporal evolution of average speed,spatial distribution of selected lane-changing gaps,lane-changing rate distribution,lane-changing preparation search time,efficiency and safety.Finally,the numerical simulation results show that the freeway traffic near an off-ramp is more sensitive to the proportion of cyber-attacked vehicles than to the severity of the cyber-attack.Also,when the traffic system is under cyber-attack,more unsafe back gaps are chosen for lane-changing,especially in the center lane.Therefore,more lane-changing maneuvers are concentrated on approaching the off-ramp,causing severe congestions and potential rear-end collisions.In addition,as the number of cyber-attacked vehicles and the severity of cyber-attacks increase,the road capacity and safety level will rapidly decrease.The results of this study can provide a theoretical basis for accident avoidance and efficiency improvement for the design of CAVs and management of automated highway systems.
基金the Deputyship for Research&Innovation,Ministry of Education in Saudi Arabia for funding this research work through project number RI-44-0833.
文摘The field of biometric identification has seen significant advancements over the years,with research focusing on enhancing the accuracy and security of these systems.One of the key developments is the integration of deep learning techniques in biometric systems.However,despite these advancements,certain challenges persist.One of the most significant challenges is scalability over growing complexity.Traditional methods either require maintaining and securing a growing database,introducing serious security challenges,or relying on retraining the entiremodelwhen new data is introduced-a process that can be computationally expensive and complex.This challenge underscores the need for more efficient methods to scale securely.To this end,we introduce a novel approach that addresses these challenges by integrating multimodal biometrics,cancelable biometrics,and incremental learning techniques.This work is among the first attempts to seamlessly incorporate deep cancelable biometrics with dynamic architectural updates,applied incrementally to the deep learning model as new users are enrolled,achieving high performance with minimal catastrophic forgetting.By leveraging a One-Dimensional Convolutional Neural Network(1D-CNN)architecture combined with a hybrid incremental learning approach,our system achieves high recognition accuracy,averaging 98.98% over incrementing datasets,while ensuring user privacy through cancelable templates generated via a pre-trained CNN model and random projection.The approach demonstrates remarkable adaptability,utilizing the least intrusive biometric traits like facial features and fingerprints,ensuring not only robust performance but also long-term serviceability.
文摘The increasing adoption of Industrial Internet of Things(IIoT)systems in smart manufacturing is leading to raise cyberattack numbers and pressing the requirement for intrusion detection systems(IDS)to be effective.However,existing datasets for IDS training often lack relevance to modern IIoT environments,limiting their applicability for research and development.To address the latter gap,this paper introduces the HiTar-2024 dataset specifically designed for IIoT systems.As a consequence,that can be used by an IDS to detect imminent threats.Likewise,HiTar-2024 was generated using the AREZZO simulator,which replicates realistic smart manufacturing scenarios.The generated dataset includes five distinct classes:Normal,Probing,Remote to Local(R2L),User to Root(U2R),and Denial of Service(DoS).Furthermore,comprehensive experiments with popular Machine Learning(ML)models using various classifiers,including BayesNet,Logistic,IBK,Multiclass,PART,and J48 demonstrate high accuracy,precision,recall,and F1-scores,exceeding 0.99 across all ML metrics.The latter result is reached thanks to the rigorous applied process to achieve this quite good result,including data pre-processing,features extraction,fixing the class imbalance problem,and using a test option for model robustness.This comprehensive approach emphasizes meticulous dataset construction through a complete dataset generation process,a careful labelling algorithm,and a sophisticated evaluation method,providing valuable insights to reinforce IIoT system security.Finally,the HiTar-2024 dataset is compared with other similar datasets in the literature,considering several factors such as data format,feature extraction tools,number of features,attack categories,number of instances,and ML metrics.
文摘Cloud-based setups are intertwined with the Internet of Things and advanced,and technologies such as blockchain revolutionize conventional healthcare infrastructure.This digitization has major advantages,mainly enhancing the security barriers of the green tree infrastructure.In this study,we conducted a systematic review of over 150 articles that focused exclusively on blockchain-based healthcare systems,security vulnerabilities,cyberattacks,and system limitations.In addition,we considered several solutions proposed by thousands of researchers worldwide.Our results mostly delineate sustained threats and security concerns in blockchain-based medical health infrastructures for data management,transmission,and processing.Here,we describe 17 security threats that violate the privacy and data integrity of a system,over 21 cyber-attacks on security and QoS,and some system implementation problems such as node compromise,scalability,efficiency,regulatory issues,computation speed,and power consumption.We propose a multi-layered architecture for the future healthcare infrastructure.Second,we classify all threats and security concerns based on these layers and assess suggested solutions in terms of these contingencies.Our thorough theoretical examination of several performance criteria—including confidentiality,access control,interoperability problems,and energy efficiency—as well as mathematical verifications establishes the superiority of security,privacy maintenance,reliability,and efficiency over conventional systems.We conducted in-depth comparative studies on different interoperability parameters in the blockchain models.Our research justifies the use of various positive protocols and optimization methods to improve the quality of services in e-healthcare and overcome problems arising fromlaws and ethics.Determining the theoretical aspects,their scope,and future expectations encourages us to design reliable,secure,and privacy-preserving systems.
文摘Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.
文摘Smart Industrial environments use the Industrial Internet of Things(IIoT)for their routine operations and transform their industrial operations with intelligent and driven approaches.However,IIoT devices are vulnerable to cyber threats and exploits due to their connectivity with the internet.Traditional signature-based IDS are effective in detecting known attacks,but they are unable to detect unknown emerging attacks.Therefore,there is the need for an IDS which can learn from data and detect new threats.Ensemble Machine Learning(ML)and individual Deep Learning(DL)based IDS have been developed,and these individual models achieved low accuracy;however,their performance can be improved with the ensemble stacking technique.In this paper,we have proposed a Deep Stacked Neural Network(DSNN)based IDS,which consists of two stacked Convolutional Neural Network(CNN)models as base learners and Extreme Gradient Boosting(XGB)as the meta learner.The proposed DSNN model was trained and evaluated with the next-generation dataset,TON_IoT.Several pre-processing techniques were applied to prepare a dataset for the model,including ensemble feature selection and the SMOTE technique.Accuracy,precision,recall,F1-score,and false positive rates were used to evaluate the performance of the proposed ensemble model.Our experimental results showed that the accuracy for binary classification is 99.61%,which is better than in the baseline individual DL and ML models.In addition,the model proposed for IDS has been compared with similar models.The proposed DSNN achieved better performance metrics than the other models.The proposed DSNN model will be used to develop enhanced IDS for threat mitigation in smart industrial environments.
