Assessing the Severity of Smart Attacks in Industrial Cyber-Physical Systems

Abstract

Industrial cyber-physical systems (<monospace>ICPS</monospace>) are heterogeneous inter-operating parts that can be physical, technical, networking, and even social like agent operators. Incrementally, they perform a central role in critical and industrial infrastructures, governmental, and personal daily life. Especially with the Industry 4.0 revolution, they became more dependent on the connectivity by supporting novel communication and distance control functionalities, which expand their attack surfaces that result in a high risk for cyber-attacks. Furthermore, regarding physical and social constraints, they may push up new classes of security breaches that might result in serious economic damages. Thus, designing a secure <monospace>ICPS</monospace> is a complex task, since this needs to guarantee security and harmonize the functionalities between the various parts that interact with different technologies. This article highlights the significance of cyber-security infrastructure and shows how to evaluate, prevent, and mitigate <monospace>ICPS</monospace>-based cyber-attacks. We carried out this objective by establishing an adequate semantics for <monospace>ICPS</monospace>’s entities and their composition, which includes social actors that act differently than mobile robots and automated processes. This article also provides the feasible attacks generated by a reinforcement learning mechanism based on multiple criteria that selects both appropriate actions for each <monospace>ICPS</monospace> component and the possible countermeasures for mitigation. To efficiently analyze <monospace>ICPS</monospace>’s security, we proposed a model-checking-based framework that relies on a set of predefined attacks from where the security requirements are used to assess how well the model is secure. Finally, to show the effectiveness of the proposed solution, we model, analyze, and evaluate the <monospace>ICPS</monospace> security on two real use cases.