Critical Infrastructure Control Research Articles

Approaches to the intellectualization of information and telecommunication networks security control in transport

The specifics of modern information and telecommunication networks in transport, as an object of information security control, are investigated. The main trends in the development of information and telecommunication network protection technologies (TNPT) have been identified. The presence of the interrelation of the main integrative properties: readiness, mobility, throughput, stealth, accessibility, manageability, which is a consequence of the convergence of information transmission and processing technologies, is noted. A new integrative property of ITCS has become the presence and characteristics of distributed system memory, which allows storing transmitted messages for a certain time. An important feature of modern TNPT is the presence of artificial intelligence, which is formed on the basis of information and algorithmic support of modern TNPT, providing flexibility of the system behavior. These trends indicate the transformation of TNPT into a supersystem, the management tasks of which are insufficiently investigated at present. The purpose of this work is to study new approaches to ensuring the safety management of modern TNPT critical infrastructure, which includes modern systems of sea and river transport, taking into account their features. The object of the study is the information security control system of modern TNPT. The subject of the study is the scientific and methodological support of the TNPT critical infrastructure control. The research objectives are to analyze existing and develop new conceptual frameworks, as well as approaches to improving the TNPT information security control system based on intellectualization methods. The analysis of the existing methodology for managing complex organizational and technical systems and information security control technologies is carried out. The concept of TNPT information security control is formalized schematically. The analysis of the existing approach to the organization of the TNPT information security control process is carried out. The tasks of control intellectualization are defined. The problem of ensuring the efficiency and reliability of the TNPT control is formulated. The main scientific tasks of the development of the TNPT information security control methodology are defined.

Predicting Cybersecurity Threats in Critical Infrastructure for Industry 4.0: A Proactive Approach Based on Attacker Motivations.

In Industry 4.0, manufacturing and critical systems require high levels of flexibility and resilience for dynamic outcomes. Industrial Control Systems (ICS), specifically Supervisory Control and Data Acquisition (SCADA) systems, are commonly used for operation and control of Critical Infrastructure (CI). However, due to the lack of security controls, standards, and proactive security measures in the design of these systems, they have security risks and vulnerabilities. Therefore, efficient and effective security solutions are needed to secure the conjunction between CI and I4.0 applications. This paper predicts potential cyberattacks and threats against CI systems by considering attacker motivations and using machine learning models. The approach presents a novel cybersecurity prediction technique that forecasts potential attack methods, depending on specific CI and attacker motivations. The proposed model's accuracy in terms of False Positive Rate (FPR) reached 66% with the trained and test datasets. This proactive approach predicts potential attack methods based on specific CI and attacker motivations, and doubling the trained data sets will improve the accuracy of the proposed model in the future.

A model for measuring multi‐concern assurance of critical infrastructure control systems

AbstractDigital transformation of engineering practice, paradigms, processes, and workforce engender agreement uncertainty among professionals, particularly in the critical industry control system field. Control systems are susceptible to cyber‐mediated changes that can uniquely affect the control of the physical world from data‐centric information systems. Change to the system can be introduced by any proposed or forced alteration that affects the acceptability, suitability, feasibility, or resiliency to perform its intended mission, either positively or negatively. The potential impact of the cybersecurity threat on control systems is difficult to quantify. Agreement among professionals about decision authority and Command and Control (C2) over this threat is even more challenging to quantify. Understanding what cybersecurity entails still needs to be widely understood by the critical infrastructure control system workforce, and the control system assets are not widely understood by the Information Technology (IT) workforce. This research introduces a model and methodology for measuring multi‐concern assurance through the statistical uncertainty analysis of Likert semantic differential scales. The model addresses agreement in priority, the lack of which means there might be competing aims, competing spending, and competing focus on different aspects of the cybersecurity governance or policy as examples. The outcome identifies where different types of professionals do not agree about cybersecurity readiness and best practices for critical infrastructure control systems.

A Cyber-Physical System for Integrated Remote Control and Protection of Smart grid Critical Infrastructures

This work proposes a Cyber-Physical System (CPS) for protecting smart electric grid critical infrastructures using video surveillance while remotely monitoring them. Due to the critical nature of the smart grid, it is necessary to guarantee an adequate level of safety, security and reliability. Thus, this CPS is back-boned by a Time-Sensitive Network solution providing concurrent support for smart video surveillance and smart grid control over a single communication infrastructure. To this end, TSN delivers high-bandwidth communication for video surveillance and deterministic quality of service, latency and bandwidth guarantees, required by the time-critical revision smart grid control. On the one hand, the CPS utilizes High-availability Seamless Redundancy in the control subsystem via Remote Terminal Units (RTUs) guaranteeing seamless failover against failures in smart grid. On the other hand, the smart video surveillance subsystem applies machine learning to monitor secured perimeters and detect people around the smart grid critical infrastructure. Moreover, it is also able to directly interoperate with RTUs to send alarms in case of for example, an intrusion. The work evaluates the accuracy and performance of the detection using common metrics in surveillance field. An integrated monitoring dashboard has also been developed in which all CPS information is available in real time.

A novel strategy for locational detection of false data injection attack

State estimation algorithms furnish an effective approach in monitoring and control of critical infrastructures like smart grid in real-time. Recently, false data injection attack (FDIA) has shown its detrimental effects by bypassing the conventional bad data detection test. The current trend in the detection technique of such class of attack remains localised in their presence detection within the measurement set whereas their exact locations of intrusions remain unknown. To palliate this issue, this work showcases an effective implementation of deep learning models to determine the exact intrusion points in real-time. Such novel deep learning models along with the conventional bad data detector can effectively identify the presence of any unstructured and structured false data injections within the measurement set, hence providing a cost-effective strategy. These deep learning models can effectively capture the inconsistency with co-occurrence dependency of the potential attack vectors within the measurement set, thus providing a multilabel classification approach. Moreover, such class of deep learning architectures being model free endow the grid operators with real-time detection without any preliminary statistical assumptions of the grid. An extensive analysis on the standard IEEE test bench showcases the efficacy of such class of detection policy undergoing varying attack and noise margins.

Endüstriyel Kontrol Sistemlerinin Siber Güvenliğinde Yeni Bir Yaklaşım: Li-Fi

Industrial Control Systems used in the control of critical infrastructures, especially in smart grids, have made a rapid transition from an isolated network architecture to wired and wireless external networks due to the factors that facilitate human life such as productivity, economy and speed. With this transition, industrial control systems specific protocols have become insufficient and hybrid protocols have started to be used. As a result, the vulnerabilities specific to the internet and new protocols besides the vulnerabilities specific to industrial control systems have started to threaten control systems. In this study, the usability of the Light Fidelity (Li-Fi) transmission infrastructure in data transmission was investigated as a solution proposal for the smart city / network infrastructure where attack of False Data Injection carried out. This study will make important contributions to the studies carried out for industrial control systems security.

Информационные и телекоммуникационные ресурсы критически важных инфраструктур: особенности интервального анализа защищенности

The object of the research is a new methodological approach to solving the problem of interval analysis 
 of the security of information and telecommunication resources of critical infrastructures. This approach is one of the variants of practising the methods of the class midvalues (interval calculations). The approach characteristics were analyzed to determine its validity and usefulness for assessing the security indicators of such complex technical systems over a time interval. There have been considered theoretical aspects of building the algorithms for calculating the class midvalues of security levels of information and telecommunication resources of critical infrastructures, factors of calculating the upper and lower class midvalues of security levels. A sequence of calculations and analytical expressions for calculations on the example of a specific security indicator are proposed. The approach offers taking into account the modern requirements of security management subsystems of complex technical systems, the requirements of officials (auditors, security administrators) related to the inertia of decision-making processes, with the duration of cycles of security control and security management of systems of this class. It allows one to obtain not point (instantaneous), but interval estimates of security indicators, while the analysis is carried out with a predetermined frequency and takes into account the uncertainty of the initial data – observed and controlled security indicators. At the same time, interval analysis does not have great mathematical and computational complexity, but it allows one to obtain interval estimates of resource security adequate to control and management tasks, saves computing resources and, ultimately, works 
 to increase the reliability of security control of modern critical infrastructures

IDS for Industrial Applications: A Federated Learning Approach with Active Personalization.

Internet of Things (IoT) is a concept adopted in nearly every aspect of human life, leading to an explosive utilization of intelligent devices. Notably, such solutions are especially integrated in the industrial sector, to allow the remote monitoring and control of critical infrastructure. Such global integration of IoT solutions has led to an expanded attack surface against IoT-enabled infrastructures. Artificial intelligence and machine learning have demonstrated their ability to resolve issues that would have been impossible or difficult to address otherwise; thus, such solutions are closely associated with securing IoT. Classical collaborative and distributed machine learning approaches are known to compromise sensitive information. In our paper, we demonstrate the creation of a network flow-based Intrusion Detection System (IDS) aiming to protecting critical infrastructures, stemming from the pairing of two machine learning techniques, namely, federated learning and active learning. The former is utilized for privately training models in federation, while the latter is a semi-supervised approach applied for global model adaptation to each of the participant’s traffic. Experimental results indicate that global models perform significantly better for each participant, when locally personalized with just a few active learning queries. Specifically, we demonstrate how the accuracy increase can reach 7.07% in only 10 queries.

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in providing remote access, monitoring and control of critical infrastructures (CIs) which includes electrical power systems, water distribution systems, nuclear power plants, etc. The growing interconnectivity, standardization of communication protocols and remote accessibility of modern SCADA systems have contributed massively to the exposure of SCADA systems and CIs to various forms of security challenges. Any form of intrusive action on the SCADA modules and communication networks can create devastating consequences on nations due to their strategic importance to CIs’ operations. Therefore, the prompt and efficient detection and classification of SCADA systems intrusions hold great importance for national CIs operational stability. Due to their well-recognized and documented efficiencies, several literature works have proposed numerous supervised learning techniques for SCADA intrusion detection and classification (IDC). This paper presents a critical review of recent studies whereby supervised learning techniques were modelled for SCADA intrusion solutions. The paper aims to contribute to the state-of-the-art, recognize critical open issues and offer ideas for future studies. The intention is to provide a research-based resource for researchers working on industrial control systems security. The analysis and comparison of different supervised learning techniques for SCADA IDC systems were critically reviewed, in terms of the methodologies, datasets and testbeds used, feature engineering and optimization mechanisms and classification procedures. Finally, we briefly summarized some suggestions and recommendations for future research works.

Critical infrastructures as sites of conflict over state legitimacy: The case of Hargeisa Airport in Somaliland, Northern Somalia

This article explores how the control of critical infrastructures play an important role in legitimizing new political orders through a case study of Hargeisa Airport in Somaliland (Northern Somalia). I argue that the quest by new authorities for authority, legitimacy and independent statehood highlights state visibility and effectiveness as well as a contestation of state legitimacy at times mediated by non-state actors. For Hargeisa airport, conflicts between the state and local landowners resulted in a legitimacy struggle where the new government resorted to familiar practices of the ousted military regime, provoking criticism from sections of the public who regarded these practices as evidence of continuities with the deposed authoritarian regime.

The faster the better: On the shortest paths role for near real-time decision making of water utilities

Near real-time monitoring and control of critical infrastructure is essential for the operation and management of cities in a world that is, today, more complex and interconnected than ever. Such an infrastructure can be represented as complex networks an some of their related indices and statistics, many of them based on the shortest paths, play a pivotal role in the decision making for public services such as internet, energy or water. Particularly, the literature has shown that shortest paths are key for resilience and criticality assessment in a water distribution systems (WDS). This paper proposes a procedure to speed-up the computation of shortest paths in a WDS, as it can straightforwardly benefit any critical infrastructure. The proposal is based on a reduced dimension of a complex network representing any critical infrastructure. Despite the consequent decrease in the number of all possible paths in the network, the main advantage and novelty of this proposal is to continue finding the exact solution for the shortest paths. Experimental results show that the procedure brings a computational-time reduction consistently over 50% and up to 90% in some cases. In addition, the paper reveals how the use of shortest paths benefits WDS operation and management, as well as playing a key role in near real-time contamination detection and leakage control.

Hybrid SCADA Security Testbed as a Service

Supervisory Control and Data Acquisition (SCADA) systems are deployed for control and management of critical infrastructures (power, oil, gas, water, etc.), industries (manufacturing, production, etc.) and public facilities (airport, ships, transport etc.). With the evolution of the technologies in communication, SCADA systems are connected to different networks using heterogeneous communication infrastructure. Thus, SCADA systems became vulnerable to threats of connected systems along with its legacy threats. A security assessment is required to understand the security posture of the system. However, it is not possible to simulate and analyze attacks on a real SCADA system. Hence, a testbed is needed to conduct any security assessment by modeling the architecture on the SCADA testbed. In this paper, we will discuss the need for testbeds, hybrid testbeds, how we established a hybrid testbed, simulation and impact analysis of attacks on the hybrid testbed and the process of providing the testbed as a service.

Detection and Differentiation of Replay Attack and Equipment Faults in SCADA Systems

Supervisory control and data acquisition (SCADA) systems are widely used for industrial control of critical infrastructures, such as power plants and manufacturing systems. There is abundant evidence of SCADA systems being subject to cyberattacks. With increasing interest in industrial digitization, the cybersecurity of SCADA systems is poised to be even more important. Equipment faults and cyberattacks can manifest themselves in a similar fashion, i.e., they can exhibit similar signatures. This article focuses on methods that are capable of distinguishing equipment faults from bona fide cyberattacks. Especially, we consider a relatively sophisticated form of cyberattack known as the “replay attack” (RA). We derive mathematical formalisms that distinguish the RA from several classes of equipment faults and verify our methodology through an extensive numerical study. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —This article is motivated by the problem of detecting replay cyberattacks in industrial control systems and differentiating it from equipment faults. Existing approaches mainly focus on the detection aspect but usually ignore the importance of differentiation. We an ensembled statistical process monitoring approach based on five statistical metrics. The statistical metrics are derived based on a theoretical analysis that shows the data characteristics under each system anomaly, including replay attack (RA), controller fault, and plant fault. We mathematically prove that the signatures generated by the derived metrics can be used to differentiate an RA from the equipment faults. We conduct a sensitivity analysis of the detection delay of our method regarding the magnitude of the cyberattack. Physical experiments on a rotating machinery setup show that the proposed approach applies to some simple real-world settings. In future research, we will address the scalability issue of our method as well as more generalized nonlinear system settings.

A genetic algorithm for energy efficient fog layer resource management in context-aware smart cities

The development of novel Information and Communication Technology (ICT) based solutions becomes essential to meet the ever increasing rate of global urbanization in order to satiate the constraint in resources. The popular ‘smart city paradigm is characterized by ubiquitous cyber provisions for the monitoring and control of such city's critical infrastructures, encompassing healthcare, environment, transportation and utilities among others. In order to manage the numerous services keeping their Quality of Service (QoS) demands upright, it is imperative to employ context aware computing as well as fog computing simultaneously. This paper investigates the feasibility of energy minimization at the fog layer through intelligent sleep and wake-up cycles of the fog nodes which are context-aware. It proposes a virtual machine management approach for effectively allocating service requests with a minimal number of active fog nodes using a genetic algorithm (GA); and thereafter, a reinforcement learning (RL) approach is incorporated to optimize the period of fog nodes’ duty cycle. Simulations are carried out using MATLAB and the results demonstrate that the proposed scheme improves energy consumption of the fog layer by approximately 11–21% when compared to existing context sharing based algorithms.

Secure Automated Forensic Investigation for Sustainable Critical Infrastructures Compliant with Green Computing Requirements

SCADA (Supervisory Control and Data Acquisition) networks are built to efficiently provide supervisory and control of national and international critical infrastructures. SCADA networks represent a challenging domain for forensic investigators who have the responsibility to discover the main causes of the catastrophic incidents that could happen in these critical mission systems and provide precise and logical evidences supported with comprehensive technical reports to the legal organizations. They urgently need technological tools and frameworks that enable them to effectively do their mission without affecting the running state of SCADA networks which must be sustainable and robust against technical and disruptive incidents. This paper discusses the challenges and opportunities towards achieving that goal and highlights the emerging technological approaches and paradigms that can be considered as promising for the realization of such a framework taking into account the efficient consumption of computational resources. Further, this paper proposes a conceptual framework for automated and secure forensic investigation in modern complex SCADA networks accompanied with a possible realization architecture based on the Multi-Agent Systems (MAS) and Wireless Sensor Networks (WSN) promising technological paradigms. The proposed framework is intentionally designed to be compliant with the currently active motivation towards promoting green computing requirements.

Critical link analysis of a national internet backbone via dynamic perturbation

Long-haul backbone communication networks provide internet services across a region or a country. The access to internet at smaller areas and the functioning of other critical infrastructures rely on the long-haul backbone high speed services and resilience. Hence, such networks are key for the decision-making of internet service managers and providers, as well as for the management and control of other critical infrastructures. This paper proposes a critical link analysis of the physical infrastructure of the UK internet backbone network from a dynamic, complex network approach. To this end, perturbation network analyses provide a natural framework to measure the network tolerance facing structural or topological modifcations. Furthermore, there have been taken into account variations on data-traffic for the internet backbone that usually happen in a typical day. The novelty of the proposal is, then, twofold: proposing a weighted (traffic informed) Laplacian matrix to compute a perturbation centrality measure, and enhancing it by a time-dependent perturbation analysis to detect changes in link criticality within the network, coming from data traffic variation in a day. The results show which are the most critical links at every time of the day, being of main importance for protection, maintenance and mitigation plans for the UK internet backbone.

Decomposition and sequential-AND analysis of known cyber-attacks on critical infrastructure control systems

Abstract We perform a detailed survey and analysis of the most significant attacks, which have targeted industrial control systems over the past decade, based on detailed incident reports from scientific and non-traditional resources. This work is the first that considers together a comprehensive set of real-world cyber-attacks with the purpose of deriving a set of common features focusing particularly on the process control network. Each attack is decomposed to provide a comprehensive overview followed by a discussion of the commonalities identified across attacks. To achieve this, each attack is modelled using Attack Trees with Sequential AND, and mapped to the industrial control system Cyber Kill Chain. We focus on the methods of intrusion rather than the identification of actors. This article can be read in two parts: first, an analysis of each attack, and secondly a discussion of the derived commonalities. The resulting commonalities can be used to develop improved detection strategies to detect modern adversarial techniques and tactics.

Satellite-Based Capillary 5G-mMTC Networks for Environmental Applications

Besides traditional 5G MBB and ULLRC services, 5G networks will also embody connections to billions of Internet of Things (IoT) objects. Future IoT 5G-mMTC applications for environmental monitoring, remote metering, and surveillance over metropolitan areas are among the main enablers of the Smart City concept. The role of satellite to transfer large amount of data gathered from (any type of) sensors spread over geographical metropolitan areas in a country can be helpful to promote the implementation of smart applications aimed for example to optimize usage of resources (e.g., energy), transportation flows, centralized control of critical infrastructures, etc., at a nation-wide scale. One of the main limitations of this scenario consists in the availability of sensors devices incorporating transmission facilities to directly connect to the satellite. In this paper, we assess the achievable performance of a FttC-based capillary network extended to include terrestrial radio stations (RSs) collecting data from surrounding IoT devices. RS data are then transferred using one (or more) copper pair(s) to the satellite modem installed at the cabinet as well as at the central office. Performance of the considered network architecture is expressed in terms of the blocking probability for satellite access.

China's Belt &amp; Road Sri Lankan Projects - White Elephants or Strategic Dormant Assets?

Sri Lanka has been the recipient of significant debt capital from China to fuel a variety of infrastructure projects. Needless to say the projects have failed commercially, necessitating debt to equity restructuring which has delivered control of critical strategic infrastructure to Chinese companies. This paper outlines 2 of the key projects in question and contemplates the strategic intent of the funding of remote infrastructure projects that coincidentally have a high strategic value to China's trade security.

Secure and Resilient Industrial Control Systems

Industrial control systems (ICSs) are special purpose networked computing systems used to implement control processes and management operations. Their design, which enables realtime operation as well as continuous operation under failures, has made them attractive for the management and control of critical infrastructures, such as power, water supply, and transport infrastructures. Their increasing adoption in infrastructures has led to their exposure to attacks from various actors; such attacks, if successful, can have catastrophic results for infrastructures and cause even loss of life. Thus, their security and resilience are critical. In this paper, we provide a short description of problems and solution approaches for the security of ICSs. Considering their special purpose and their characteristics, we address application-level security demonstrating that a complete solution requires a combination of design methods and technologies including trusted components, secure networks, software security, as well as effective vulnerability analysis.