Critical Systems Research Articles

Towards a Cyber Resilience Quantification Framework (CRQF) for IT infrastructure

Cyber resilience quantification is the process of evaluating and measuring an organisation’s ability to withstand, adapt to, and recover from cyber-attacks. It involves estimating IT systems, networks, and response strategies to ensure robust defence and effective recovery mechanisms in the event of a cyber-attack. Quantifying cyber resilience can be difficult due to the constantly changing components of IT infrastructure. Traditional methods like vulnerability assessments and penetration testing may not be effective. Measuring cyber resilience is essential to evaluate and strengthen an organisation’s preparedness against evolving cyber-attacks. It helps identify weaknesses, allocate resources, and ensure the uninterrupted operation of critical systems and information. There are various methods for measuring cyber resilience, such as evaluating, teaming and testing, and creating simulated models. This article proposes a cyber resilience quantification framework for IT infrastructure that utilises a simulation approach. This approach enables organisations to simulate different attack scenarios, identify vulnerabilities, and improve their cyber resilience. The comparative analysis of cyber resilience factors highlights pre-configuration’s robust planning and adaptation (61.44%), buffering supported’s initial readiness (44.53%), and network topologies’ robust planning but weak recovery and adaptation (60.04% to 77.86%), underscoring the need for comprehensive enhancements across all phases. The utilisation of the proposed factors is crucial in conducting a comprehensive evaluation of IT infrastructure in the event of a cyber-attack.

Railroad Infrastructure Management: A Novel Tool for Automatic Interpretation of GPR Imaging to Minimize Human Intervention in Railroad Inspection

Regular monitoring and inspection of military railroad tracks are necessary to ensure the safe transportation of military freight. Manual railroad inspection has drawbacks and limitations that can impact accuracy and efficiency. This study introduces a novel tool designed to automate Ground Penetrating Radar (GPR) imaging interpretation for railroad ballast condition assessment, aiming to reduce human intervention in inspections. The tool uses advanced signal processing techniques, such as the Short-Time Fourier Transform (STFT) and Wavelet Transform (WT), to quantify ballast fouling levels accurately, enhancing maintenance and safety protocols for railroad tracks. Validation through comprehensive testing, including two case studies, demonstrates the tool’s superior efficacy over traditional manual inspection methods. This research represents a pivotal step towards more efficient and reliable infrastructure management, ensuring critical railroad systems’ safety and operational integrity.

A Probabilistic Approach to Adaptive Protection in the Smart Grid

Smart grids are critical cyber-physical systems that are vital to our energy future. Smart grids’ fault resilience is dependent on the use of advanced protection systems that can reliably adapt to changing grid conditions. The vast amount of operational data generated and collected in smart grids can be used to develop these protection systems. However, given the safety-criticality of protection, the algorithms used to analyze this data must be stable, transparent, and easily interpretable to ensure the reliability of the protection decisions. Additionally, the protection decisions must be fast, selective, simple, and reliable. To address these challenges, this paper proposes a data-driven protection strategy, based on Gaussian Discriminant Analysis (GDA), for fault detection and isolation. This strategy minimizes the communication requirements for time-inverse relays, facilitates their coordination, and optimizes their settings. The interpretability of the protection decisions is a key focus of this paper. The method is demonstrated by showing how it can protect the medium-voltage CIGRE network as it transitions between islanded and grid-connected modes and radial and mesh topologies.

Prediction of depinning transitions in interface models using Gini and Kolkata indices.

The intermittent dynamics of driven interfaces through disordered media and its subsequent depinning for large enough driving force is a common feature for a myriad of diverse systems, starting from mode-I fracture, vortex lines in superconductors, and magnetic domain walls to invading fluid in a porous medium, to name a few. In this work, we outline a framework that can give a precursory signal of the imminent depinning transition by monitoring the variations in sizes or the inequality of the intermittent responses of a system that are seen prior to the depinning point. In particular, we use measures traditionally used to quantify economic inequality, i.e., the Gini index and the Kolkata index, for the case of the unequal responses of precritical systems. The crossing point of these two indices serves as a precursor to imminent depinning. Given a scale-free size distribution of the responses, we calculate the expressions for these indices, evaluate their crossing points, and give a recipe for forecasting depinning transitions. We apply this method to the Edwards-Wilkinson, Kardar-Parisi-Zhang, and fiber bundle model interface with variable interaction strengths and quenched disorder. The results are applicable for any interface dynamics undergoing a depinning transition. The results also explain previously observed near-universal values of Gini and Kolkata indices in self-organized critical systems.

"It made me feel like a shit parent": an intersectional analysis of pandemic mothering.

The COVID-19 pandemic brought to the fore the everyday and exceptional challenges for mothers. Rarely, however, did research or social commentary acknowledge the multiplicities of motherhood during this prolonged period of risk, disruption, and uncertainty. This paper draws upon interviews with 24 mothers living in Aotearoa New Zealand during the pandemic, including women who were pregnant and gave birth during lockdowns, teenage mothers, single and low-income mothers, and working mothers. The sample was intentionally diverse, including Māori, Pacific, Asian and migrant mothers. Engaging an intersectional lens on motherhood and women's health, this paper builds upon and extends feminist research on mothers' experiences during the pandemic, highlighting the many different challenges facing mothers of diverse social, cultural, and economic positionalities and during various stages of motherhood. Across the sample, we reveal the significant emotional toll on mothers, particularly with the absence of critical social, medical and health support systems during lockdown periods and sustained social restrictions. Many of the women described how the pandemic affected their feelings about motherhood, prompting new reflections on their relationships with the home, family, work, and broader society. Despite some similarities, the pandemic experiences of Māori, Pacific, migrant and single mothers were further intensified by various forms of isolation, judgement, and discrimination. In this way, the pandemic shed light on the gendering of everyday maternal life, but also the need for more intersectional culturally and gender-responsive policies that acknowledge the multi-layered complexities of mothers' lives.

Distributions of Energy, Luminosity, Duration, and Waiting Times of Gamma-Ray Burst Pulses with Known Redshift Detected by Fermi/GBM

Discovered more than 50 years ago, gamma-ray burst (GRB) prompt emission remains the most puzzling aspect of GRB physics. Its complex and irregular nature should reveal how newborn GRB engines release their energy. In this respect, the possibility that GRB engines could operate as self-organized critical (SOC) systems has been put forward. Here, we present the energy, luminosity, waiting time, and duration distributions of individual pulses of GRBs with known redshift detected by the Fermi Gamma-ray Burst Monitor. This is the first study of this kind in which selection effects are accounted for. The compatibility of our results with the framework of SOC theory is discussed. We found evidence for an intrinsic break in the power-law models that describe the energy and the luminosity distributions.

Factors that support public health infrastructure recovery in Puerto Rico and US Virgin Islands after Hurricanes Irma and Maria.

This paper describes the factors that support recovery of public health infrastructure (PHI), including conditions that facilitated or hindered recovery in United States (US) territories impacted by hurricanes Irma and Maria. A deductive approach was used to categorize data from five organizations that received crisis hurricane recovery (CHR) funds from the Centers for Disease Control and Prevention.* Spending was grouped into five infrastructure gaps: (1) human resources, (2) informatic upgrades, (3) equipment, (4) minor repairs, and (5) preventive maintenance. Unanticipated PHI costs, facilitators, and hinderances to PHI recovery were identified. Most (72 percent) of the $53,529,823 CHR funding was used to address infrastructure gaps in (1) human resources (56 percent), (2) informatics (16 percent), (3) equipment (13 percent), (4) minor repairs (10 percent), and (5) preventive maintenance (5 percent). Most of the requests (56 percent) to redirect funds were associated with unanticipated costs in initial work plans and budgets. The use of administrative partners, planning tools, dedicated staff, streamlined procedures, eg, contracts, and cost sharing facilitated PHI recovery. The most common hindrance to PHI recovery were delays in procurement and shipping. In summary, investments in dedicated funding to upgrade, repair, or replace critical structures and systems for infectious disease surveillance, laboratory capacity, vector control, environmental health inspections, and vaccine storage and administration in Puerto Rico and the US Virgin Islands after Hurricanes Irma and Maria contributed to their recovery capacity. These findings may inform funding and resource allocation considerations for PHI recovery in the US territories.

A Torpor-based Enhanced Security Model for CSMA/CA Protocol in Wireless Networks

Mobile wireless networks enable the connection of devices to a network with minimal or no infrastructure. This comes with the advantages of ease and cost-effectiveness, thus largely popularizing the network. Notwithstanding these merits, the open physical media, infrastructural-less attributes, and pervasive deployment of wireless networks make the channel of communication (media access) vulnerable to attacks such as traffic analysis, monitoring, and jamming. This study designed a virtual local area network (VLAN) model to circumvent virtual jamming attacks and other intrusions at the Media Access Control (MAC) layer of the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) protocol. A Torpor VLAN (TVLAN) Data Frame Encapsulation and the algorithm for T-VLAN security in CSMA/CA were formulated and presented. A simulation experiment was conducted on the model using OMNeT++ software. The performance metrics used to evaluate the model were packet delivery ratio, network throughput, end-to-end channel delay, and channel load. The simulation results show that the TVLAN defence mechanism did not increase the channel load arbitrarily during TVLAN defence. similarly, the system throughput was shown to be 82% during TVLAN defence. Nevertheless, the network delay of the system during TVLAN defence was significantly high but the channel load was 297 when the TVLAN security mechanism was launched. These results demonstrate the model’s ability to provide a survivability mechanism for critical systems when under attack and add a security layer to the CSMA/CA protocol in wireless networks. Such a remarkable performance is required of a CSMA/CA infrastructure for improving the cybersecurity posture of a wireless network.

An Incremental Mutual Information-Selection Technique for Early Ransomware Detection

Ransomware attacks have emerged as a significant threat to critical data and systems, extending beyond traditional computers to mobile and IoT/Cyber–Physical Systems. This study addresses the need to detect early ransomware behavior when only limited data are available. A major step for training such a detection model is choosing a set of relevant and non-redundant features, which is challenging when data are scarce. Therefore, this paper proposes an incremental mutual information-selection technique as a method for selecting the relevant features at the early stages of ransomware attacks. It introduces an adaptive feature-selection technique that processes data in smaller, manageable batches. This approach lessens the computational load and enhances the system’s ability to quickly adapt to new data arrival, making it particularly suitable for ongoing attacks during the initial phases of the attack. The experimental results emphasize the importance of the proposed technique in estimating feature significance in limited data scenarios. Such results underscore the significance of the incremental approach as a proactive measure in addressing the escalating challenges posed by ransomware.

Venus cloud sample return concept for astrobiology

The sulfuric acid clouds of Venus are of high scientific interest due to several intriguing observations from the past decades. These observations are not fully explained with current chemical models. Manyhypotheses have been posed to date, including the presence of complex organics or microbial life in the clouds. The possibility of life is primarily supported by the biologically benign temperatures in the cloud layers and is secondarily bolstered by several unresolved cloud-layer atmospheric chemical anomalies. Here we propose that a robust search for signs of life or life itself in the Venusian aerial environment requires a sample return of the cloud particles. We propose a Venus cloud sample return mission concept by performing key trade studies, and evaluating the requirements, feasibility, and technological needs. The baseline mission concept includes a Venus entry system, a balloon for sample collection and ascent in the clouds, a Venus Ascent Vehicle to deliver samples to orbit, a Venus orbiter, and an Earth return system. We present the concept of three critical systems that are the focus of our study: cloud sample collectors, an aerial platform, and a Venus Ascent Vehicle. We found an electrostatic fog collector for low-power, high-efficiency cloud sample capture. The most significant newly identified technology gaps for near-term focused development that we uncovered are the rapid inflation of a large 7000 m3 balloon and navigation and control of the ascent vehicle in a low-visibility and turbulent cloud environment. We discuss the various technologies of the sample return mission that need focused development and have synergies across multiple types of planetary missions.

Biofilm contamination in confined space stations: reduction, coexistence or an opportunity?

The prolonged human permanence in confined environments in space, such as in the case of the International Space Station, has inadvertently fostered conditions leading to uncontrolled microbial proliferation on surfaces, known as biofilm. Biofilm presence represents a challenge in critical spacecraft systems, that can lead to contamination issues and systems loss of function due to biofouling phenomena. This scenario is further complicated by microgravity that has a controversial role on biofilm growth and formation. Biocontamination can be a limiting factor in human long-term mission in outer Earth orbit and an economic and health issue on ISS. This study addresses the pressing need for effective antimicrobial strategies against such resilient biofilms in confined environments where the usage of biocidal chemical compounds is strictly controlled due to toxicity dangers. Traditional methods can be complemented by advanced antimicrobial coatings techniques. A promising approach is based on the oxygen plasma as coating platform. The technology can be potentially extended to a wide range of antibiofilm agents (e.g., peptides, bacteriophages, nanoparticles, quorum sensing disrupting agents, etc.) and substrates (e.g., metal, plastic, ceramic) showing an exceptional flexibility. An alternative vision of the biofilm challenge can be inspired by the dual nature of biofilms, addressed as “good” or “bad” depending on the specific application. Indeed, biofilm have a great potential in closed systems as small space habitat (e.g., ISS) that can be inspired by their role in “large space habitat” as planet Earth itself. The replication of such a complex biological equilibrium is an open challenge.

ACCESS: Assurance Case Centric Engineering of Safety–critical Systems

Assurance cases are used to communicate and assess confidence in critical system properties such as safety and security. Historically, assurance cases have been manually created documents, which are evaluated by system stakeholders through lengthy and complicated processes. In recent years, model-based system assurance approaches have gained popularity to improve the efficiency and quality of system assurance activities. This becomes increasingly important, as systems becomes more complex, it is a challenge to manage their development life-cycles, including coordination of development, verification and validation activities, and change impact analysis in inter-connected system assurance artifacts. Moreover, there is a need for assurance cases that support evolution during the operational life of the system, to enable continuous assurance in the face of an uncertain environment, as Robotics and Autonomous Systems (RAS) are adopted into society. In this paper, we contribute ACCESS — Assurance Case Centric Engineering of Safety–critical Systems, an engineering methodology, together with its tool support, for the development of safety–critical systems around evolving model-based assurance cases. We show how model-based system assurance cases can trace to heterogeneous engineering artifacts (e.g. system architectural models, system safety analysis, system behaviour models, etc.), and how formal methods can be integrated during the development process. We demonstrate how assurance cases can be automatically evaluated both at development and runtime. We apply our approach to a case study based on an Autonomous Underwater Vehicle (AUV).

Safety and Security Risk Assessments in Cyber Physical Space

As technological advancements continue to bridge the gap between the digital and physical worlds, the integration of Cyber-Physical Systems (CPS) has become pervasive in critical infrastructure, industrial processes, and daily life. This research paper explores the multifaceted landscape of Cyber-Physical Systems Security, addressing the intricate challenges and emerging threats posed by the convergence of the digital and physical realms. The study investigates the vulnerabilities inherent in CPS, encompassing critical infrastructure systems, industrial control systems, and interconnected smart devices. Additionally, the paper examines contemporary security measures, risk mitigation strategies, and the role of advanced technologies in fortifying Cyber-Physical Systems against malicious cyber threats. Through a comprehensive analysis of existing frameworks and real-world case studies, this research aims to contribute valuable insights to the ongoing discourse on safeguarding the integrity, confidentiality, and availability of Cyber-Physical Systems in our interconnected and technology-driven society. The findings of this research are anticipated to inform cybersecurity practitioners, policymakers, and researchers alike, fostering a more resilient and secure foundation for the future of Cyber-Physical Systems.

Securing Against Physical Intrusions

Offline device hacking refers to the exploitation of vulnerabilities in electronic devices without requiring an active internet connection. This paper explores various techniques used by hackers to compromise offline devices, including physical tampering, firmware manipulation, and side-channel attacks. Additionally, the risks associated with offline device hacking are discussed, such as unauthorized access to sensitive data, device control, and potential damage to infrastructure. Furthermore, mitigation strategies to defend against offline device hacking are examined, including robust physical security measures, firmware authentication mechanisms, and the implementation of secure boot processes. Understanding the methods employed by attackers and adopting effective countermeasures are crucial for safeguarding offline devices and maintaining the integrity of critical systems in today's interconnected world.

A Design for Availability Approach for Use with PHM


 
 
 Prognostics and Health Management (PHM) methods are incorporated into systems for the purpose of avoiding unanticipated failures that can impact system safety, result in additional life cycle cost, and/or adversely affect the availability of the system. Availability is the probability that a system will be able to function when called upon to do so. A vailability depends on the system’ s reliability (how often it fails) and its maintainability (how efficiently and frequently it is pro-actively maintained, and how quickly it can be repaired and restored to operation when it does fail). Availability is directly impacted by the success of PHM. Increasingly, customers of critical systems are entering into “availability contracts” in which the customer either buys the availability of the system (rather than actually purchasing the system itself) or the amount that the system developer/manufacturer/supplier is paid for the system is a function of the availability achieved by the customer. Predicting availability based on known or predicted system reliability, operational parameters, logistics, etc., is relatively straightforward and can be accomplished using existing methods. However, while determining the availability that results from a set of events is straightforward, determining the events that result in a desired availability is not, and prediction of a system’s attributes to meet an availability requirement can only be accomplished using “brute force” search-based methods that are not general and become quickly impractical for real systems and when uncertainties are introduced. This paper presents a “design for availability” approach that starts with an availability requirement and uses it to predict the required logistics, design and operation parameters. The method is general and can be applied when the inputs to the problem are uncertain (even the availability requirement can be a probability distribution). The method is demonstrated on several examples with and without PHM.
 
 

Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning Model for IIoT Environment

Intrusion Detection in the Industrial Internet of Things (IIoT) concentrations on the security and safety of critical structures and industrial developments. IIoT extends IoT principles to industrial environments, but linked sensors and devices can be deployed for monitoring, automation, and control of manufacturing, energy, and other critical systems. Intrusion detection systems (IDS) in IoT drive to monitor network traffic, device behavior, and system anomalies for detecting and responding to security breaches. These IDS solutions exploit a range of systems comprising signature-based detection, anomaly detection, machine learning (ML), and behavioral analysis, for identifying suspicious actions like device tampering, unauthorized access, data exfiltration, and denial-of-service (DoS) attacks. This study presents an Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning (IID-SBODL) model for IIoT Environment. The IID-SBODL technique initially preprocesses the input data for compatibility. Next, the IID-SBODL technique applies Echo State Network (ESN) model for effectual recognition and classification of the intrusions. Finally, the SBO algorithm optimizes the configuration of the ESN, boosting its capability for precise identification of anomalies and significant security breaches within IIoT networks. By widespread simulation evaluation, the experimental results pointed out that the IID-SBODL technique reaches maximum detection rate and improves the security of the IIoT environment. Through comprehensive experimentation on both UNSW-NB15 and UCI SECOM datasets, the model exhibited exceptional performance, achieving an average accuracy of 99.55% and 98.87%, precision of 98.90% and 98.93%, recall of 98.87% and 98.80%, and F-score of 98.88% and 98.87% for the respective datasets. The IID-SBODL model contributes to the development of robust intrusion detection mechanisms for safeguarding critical industrial processes in the era of interconnected and smart IIoT environments.

JMLKelinci+: Detecting Semantic Bugs and Covering Branches with Valid Inputs Using Coverage-guided Fuzzing and Runtime Assertion Checking

Testing to detect semantic bugs is essential, especially for critical systems. Coverage-guided fuzzing (CGF) and runtime assertion checking (RAC) are two well-known approaches for detecting semantic bugs. CGF aims to generate test inputs with high code coverage. However, while CGF tools can be equipped with sanitizers to detect a fixed set of semantic bugs, they can otherwise only detect bugs that lead to a crash. Thus, the first problem we address is how to help fuzzers detect previously unknown semantic bugs that do not lead to a crash. Moreover, a CGF tool may not necessarily cover all branches with valid inputs, although invalid inputs are useless for detecting semantic bugs. So, the second problem is how to guide a fuzzer to maximize coverage using only valid inputs. However, RAC monitors the expected behavior of a program dynamically and can only detect a semantic bug when a valid test input shows that the program does not satisfy its specification. Thus, the third problem is how to provide high-quality test inputs for a RAC that can trigger potential bugs. The combination of a CGF tool and RAC solves these problems and can cover branches with valid inputs and detect semantic bugs effectively. Our study uses RAC to guarantee that only valid inputs reach the program under test using the program’s specified preconditions, and it also uses RAC to detect semantic bugs using specified postconditions. A prototype tool was developed for this study, named JMLKelinci+. Our results show that combining a CGF tool with RAC will lead to executing the program under test only with valid inputs and that this technique can effectively detect semantic bugs. Also, this idea improves the feedback given to a CGF tool, enabling it to cover all branches faster in programs with non-trivial preconditions. 1

Preventing Catastrophic Cyber–Physical Attacks on the Global Maritime Transportation System: A Case Study of Hybrid Maritime Security in the Straits of Malacca and Singapore

This paper examines hybrid threats to maritime transportation systems and their governance responses; focusing on the congested Straits of Malacca and Singapore (SOMS) as an illustrative case study. The methodology combines secondary sources with primary data from 42 expert interviews, a 28 respondent survey, and two maritime security roundtables. Key findings were that ships’ critical systems are increasingly interconnected, yet aging IT infrastructure and minimal cybersecurity awareness among crews heighten risks. Meanwhile, regional terrorist groups have previously targeted shipping and shown considerable skill in exploiting online tools, aligning with broader calls for jihadist violence. Furthermore, opportunistic piracy persists in the SOMS with the potential to disrupt shipping. Experts confirmed that maritime cybersecurity lags behind other critical infrastructure sectors and needs updated governance. Initial International Maritime Organization (IMO) guidelines lack specificity but revisions and updated IMO guidance are in process, while Port state implementation of maritime cybersecurity standards varies. Crucially, information sharing remains inadequate, even as recorded attacks increase. Findings underscore that although major hybrid incidents have not occurred, simulations and threat actors’ capabilities demonstrate potential for catastrophic collisions or cascading disruption in congested waterways. Mitigating factors like redundancy and crew training are deficient currently. Some alignment between SOMS states on maritime security cooperation exists, but not on cyber threats specifically. Key recommendations include an anonymous cyber attack reporting system, reinforced training and shipboard systems, and consolidated regional frameworks. Until these priorities are addressed, the analysis concludes that hybrid vulnerabilities in this vital global chokepoint remain a serious concern.

Region-based cascading impact analysis in critical infrastructure systems

ABSTRACT Critical Infrastructure System (CIS) disruption cascades into all the dependent CISs, even the regions, over the internal system where the disruption occurs. This study develops a cascading impact analysis with a region-based path-flow estimation approach based on a complex network and provides a local-scale demonstration of the interdependent electric power-water supply system in Incheon, South Korea. The analytical framework facilitates the modeling of CISs considering three major structural relationships – CIS, CIS-CIS, and CIS-Region- with functional interdependency and quantifying cascading impacts on regions via a continuous service flow. The results demonstrate more practical cascading ranges and levels caused by each CIS disruption, highlighting that the potential impacts increase in an integrated network, which a single CIS network cannot capture. It emphasizes the need to consider functional interdependent CIS structures and estimate cascading impacts from a regional perspective. This study provides multiangle insights into how regions enhance resilience through infrastructure disaster management.

Delineating the parameters of integrated thinking: A synthetic literature review

Background: Many accounting professional bodies, of which the South African Institute of Chartered Accountants (SAICA) is one, expect academics to develop integrated thinking skills in their students during higher education. Integrated thinking is, however, often confused with critical thinking, systems thinking and design thinking.Aim: This article aims to delineate the concept of integrated thinking by analysing the similarities and differences between integrated thinking, integrative thinking, critical thinking, systems thinking and design thinking.Conclusion: Integrated thinking is a higher-order thinking skill with a strong emphasis on the ability to think in a creative manner. Although there are differences between integrated thinking and other higher-order thinking skills, there are also similarities. This article sets integrated thinking apart from other higher-order thinking skills.Contribution: Limited research has been conducted to distinguish integrated thinking from integrative thinking, critical thinking, systems thinking and design thinking. This article endeavours to identify the true nature of integrated thinking by comparing it with other higher-order thinking skills. If lecturers at higher education institutions are to develop integrated thinking skills, it is important for them to have a clear understanding of what integrated thinking is, and how it differs from other thinking models. Without a grounded understanding of what integrated thinking is, it is nearly impossible to develop it in students.