Mission-critical Domains Research Articles

Zero-trust design and assurance patterns for cyber–physical systems

Security is paramount in all mission-critical domains, including the aerospace industry. Cyber-attacks are increasing both in number and sophistication. Zero-trust is an emerging initiative that has proven very effective for enterprise systems in the Information Technology domain; however, research is lacking on applicable zero-trust mechanisms and their assurance for cyber–physical systems (CPS). We have already identified various zero-trust mechanisms in our previous work. In this paper, we present our zero-trust architecture design patterns and provide a methodology for the assurance of these mechanisms. Towards this objective, we have identified an initial set of assurance patterns covering individual zero-trust components in a system design. Our design and assurance patterns are made available to system engineers in pattern libraries. Engineers can model system architectures and utilize one or more of these patterns to provide design assurance based on individual zero-trust security requirements to improve the overall system cyber-security. To demonstrate our approach, we apply our assurance patterns to an unmanned aerial vehicle surveillance application. We discuss how our framework leverages the use of these patterns to develop zero-trust-enabled systems with different security requirements. Furthermore, our assurance patterns enable engineers to identify any design flaws and correct them during the initial system design phase, thus saving development time, effort, and cost. As a result, the overall approach can be utilized to design system models with specific zero-trust security requirements to improve the security posture of a CPS.

Learning Safe Numeric Action Models

Powerful domain-independent planners have been developed to solve various types of planning problems. These planners often require a model of the acting agent's actions, given in some planning domain description language. Yet obtaining such an action model is a notoriously hard task. This task is even more challenging in mission-critical domains, where a trial-and-error approach to learning how to act is not an option. In such domains, the action model used to generate plans must be safe, in the sense that plans generated with it must be applicable and achieve their goals. Learning safe action models for planning has been recently explored for domains in which states are sufficiently described with Boolean variables. In this work, we go beyond this limitation and propose the NSAM algorithm. NSAM runs in time that is polynomial in the number of observations and, under certain conditions, is guaranteed to return safe action models. We analyze its worst-case sample complexity, which may be intractable for some domains. Empirically, however, NSAM can quickly learn a safe action model that can solve most problems in the domain.

PremiUm-CNN: Propagating Uncertainty Towards Robust Convolutional Neural Networks

Deep neural networks (DNNs) have surpassed human-level accuracy in various learning tasks. However, unlike humans who have a natural cognitive intuition for probabilities, DNNs cannot express their uncertainty in the output decisions. This limits the deployment of DNNs in mission-critical domains, such as warfighter decision-making or medical diagnosis. Bayesian inference provides a principled approach to reason about model's uncertainty by estimating the posterior distribution of the unknown parameters. The challenge in DNNs remains the multi-layer stages of non-linearities, which make the propagation of high-dimensional distributions mathematically intractable. This paper establishes the theoretical and algorithmic foundations of uncertainty or belief propagation by developing new deep learning models named PremiUm-CNNs (Propagating Uncertainty in Convolutional Neural Networks). We introduce a tensor normal distribution as a prior over convolutional kernels and estimate the variational posterior by maximizing the evidence lower bound (ELBO). We start by deriving the first-order mean-covariance propagation framework. Later, we develop a framework based on the unscented transformation (correct at least up to the second-order) that propagates sigma points of the variational distribution through layers of a CNN. The propagated covariance of the predictive distribution captures uncertainty in the output decision. Comprehensive experiments conducted on diverse benchmark datasets demonstrate: 1) superior robustness against noise and adversarial attacks, 2) self-assessment through predictive uncertainty that increases quickly with increasing levels of noise or attacks, and 3) an ability to detect a targeted attack from ambient noise.

Adaptive Threshold Generation for Fault Detection with High Dependability for Cyber-Physical Systems

Cyber-physical systems (CPS) applied to safety-critical or mission-critical domains require high dependability including safety, security, and reliability. However, the safety of CPS can be significantly threatened by increased security vulnerabilities and the lack of flexibility in accepting various normal environments or conditions. To enhance safety and security in CPS, a common and cost-effective strategy is to employ the model-based detection technique; however, detecting faults in practice is challenging due to model and environment uncertainties. In this paper, we present a novel generation method of the adaptive threshold required for providing dependability for the model-based fault detection system. In particular, we focus on statistical and information theoretic analysis to consider the model and environment uncertainties, and non-linear programming to determine an adaptive threshold as an equilibrium point in terms of adaptability and sensitivity. To do this, we assess the normality of the data obtained from real sensors, define performance measures representing the system requirements, and formulate the optimal threshold problem. In addition, in order to efficiently exploit the adaptive thresholds, we design the storage so that it is added to the basic structure of the model-based detection system. By executing the performance evaluation with various fault scenarios by varying intensities, duration and types of faults injected, we prove that the proposed method is well designed to cope with uncertainties. In particular, against noise faults, the proposed method shows nearly 100% accuracy, recall, and precision at each of the operation, regardless of the intensity and duration of faults. Under the constant faults, it achieves the accuracy from 85.4% to 100%, the recall of 100% from the lowest 54.2%, and the precision of 100%. It also gives the accuracy of 100% from the lowest 83.2%, the recall of 100% from the lowest 43.8%, and the precision of 100% against random faults. These results indicate that the proposed method achieves a significantly better performance than existing dynamic threshold methods. Consequently, an extensive performance evaluation demonstrates that the proposed method is able to accurately and reliably detect the faults and achieve high levels of adaptability and sensitivity, compared with other dynamic thresholds.

Analysis of Link State Resource Reservation Protocol for Congestion Management in Smart Web Hotspot Environments

With the wide spread of WiFi hotspots, concentrated traffic workload on Smart Web (SW) can slow down the network performance. This paper presents a congestion management strategy considering real time activities in today’s smart web. With the SW context, cooperative packet recovery using resource reservation procedure for TCP flows was adapted for mitigating packet losses. This is to maintain data consistency between various access points of smart web hotspot. Using a real world scenario, it was confirmed that generic TCP cannot handle traffic congestion in a SW hotspot network. With TCP in scalable workload environments, continuous packet drops at the event of congestion remains obvious. This is unacceptable for mission critical domains. An enhanced Link State Resource Reservation Protocol (LSRSVP) which serves as dynamic feedback mechanism in smart web hotspots is presented. The contextual behaviour was contrasted with the generic TCP model. For the LS-RSVP, a simulation experiment for TCP connection between servers at the remote core layer and the access layer was carried out while using selected benchmark metrics. From the results, under realistic workloads, a steady-state throughput response was achieved by TCP LS-RSVP to about 3650Bits /secs compared with generic TCP plots in a previous study. Considering network service availability, this was found to be dependent on fault-tolerance of the hotspot network. From study, a high peak threshold of 0.009 (i.e. 90%) was observed. This shows fairly acceptable service availability behaviour compared with the existing TCP schemes. For packet drop effects, an analysis on the network behaviour with respect to the LS-RSVP yielded a drop response of about 0.000106 bits/sec which is much lower compared with the case with generic TCP with over 0.38 bits/sec. The latency profile of average FTP download response was found to be 0.030secs, but with that of FTP upload response, this yielded about 0.028 sec. The results from the study demonstrate efficiency and optimality for realistic loads in Smart web contexts.

Formal Reliability Analysis Using Theorem Proving

Reliability analysis has become a tool of fundamental importance to virtually all electrical and computer engineers because of the extensive usage of hardware systems in safety and mission critical domains, such as medicine, military, and transportation. Due to the strong relationship between reliability theory and probabilistic notions, computer simulation techniques have been traditionally used to perform reliability analysis. However, simulation provides less accurate results and cannot handle large-scale systems due to its enormous CPU time requirements. To ensure accurate and complete reliability analysis and thus more reliable hardware designs, we propose to conduct a formal reliability analysis of systems within the sound core of a higher order logic theorem prover (HOL). In this paper, we present the higher order logic formalization of some fundamental reliability theory concepts, which can be built upon to precisely analyze the reliability of various engineering systems. The proposed approach and formalization is then utilized to analyze the repairability conditions for a reconfigurable memory array in the presence of stuck-at and coupling faults.

Guest Editors' Introduction: Special Section on System-Level Design of Reliable Architectures

Guest Editors' Introduction: Special Section on System-Level Design of Reliable Architectures

Shoestring

Aggressive technology scaling provides designers with an ever increasing budget of cheaper and faster transistors. Unfortunately, this trend is accompanied by a decline in individual device reliability as transistors become increasingly susceptible to soft errors. We are quickly approaching a new era where resilience to soft errors is no longer a luxury that can be reserved for just processors in high-reliability, mission-critical domains. Even processors used in mainstream computing will soon require protection. However, due to tighter profit margins, reliable operation for these devices must come at little or no cost. This paper presents Shoestring, a minimally invasive software solution that provides high soft error coverage with very little overhead, enabling its deployment even in commodity processors with "shoestring" reliability budgets. Leveraging intelligent analysis at compile time, and exploiting low-cost, symptom-based error detection, Shoestring is able to focus its efforts on protecting statistically-vulnerable portions of program code. Shoestring effectively applies instruction duplication to protect only those segments of code that, when subjected to a soft error, are likely to result in user-visible faults without first exhibiting symptomatic behavior. Shoestring is able to recover from an additional 33.9% of soft errors that are undetected by a symptom-only approach, achieving an overall user-visible failure rate of 1.6%. This reliability improvement comes at a modest performance overhead of 15.8%.

Shoestring

Aggressive technology scaling provides designers with an ever increasing budget of cheaper and faster transistors. Unfortunately, this trend is accompanied by a decline in individual device reliability as transistors become increasingly susceptible to soft errors. We are quickly approaching a new era where resilience to soft errors is no longer a luxury that can be reserved for just processors in high-reliability, mission-critical domains. Even processors used in mainstream computing will soon require protection. However, due to tighter profit margins, reliable operation for these devices must come at little or no cost. This paper presents Shoestring, a minimally invasive software solution that provides high soft error coverage with very little overhead, enabling its deployment even in commodity processors with "shoestring" reliability budgets. Leveraging intelligent analysis at compile time, and exploiting low-cost, symptom-based error detection, Shoestring is able to focus its efforts on protecting statistically-vulnerable portions of program code. Shoestring effectively applies instruction duplication to protect only those segments of code that, when subjected to a soft error, are likely to result in user-visible faults without first exhibiting symptomatic behavior. Shoestring is able to recover from an additional 33.9% of soft errors that are undetected by a symptom-only approach, achieving an overall user-visible failure rate of 1.6%. This reliability improvement comes at a modest performance overhead of 15.8%.

Drbd: Dynamic Reliability Block Diagrams for System Reliability Modelling

With the rapid advances of computer-based technology in mission-critical domains such as aerospace, military, and power industries, critical systems exhibit more complex, dependent, and dynamic behaviours. Such dynamic system behaviours cannot be fully captured by existing reliability modelling tools. In this paper, we introduce a new reliability modelling tool, called dynamic reliability block diagrams (DRBD), to model dynamic relationships between system components. Due to the complexity of DRBD models that involve dynamic conceptual modelling constructs, such as a state dependency (SDEP) block, design errors, which are subtle and difficult to detect, can be easily introduced during the modelling process. To formally verify and validate the correctness of a DRBD model, we propose a Petri net based approach by converting DRBD constructs into coloured Petri nets (CPN). We use a case study to illustrate how to convert a DRBD model into CPN, and how to use an existing Petri net tool to analyse and verify dynamic system behavioural properties. Our case study and experimental results show that DRBD models are a powerful tool for system reliability modelling, and our proposed verification approach can effectively ensure the correct design of DRBD models for complex and large-scale computer-based systems.

High Velocity Human Factors: Human Factors of Mission Critical Domains in Nonequilibrium

Mission critical domains (MCDs), such as fire fighting, military combat, etc., experience periods of nonequilibrium. This typically occurs when extended periods of low grade activity are punctuated by intense, high stakes actions unfolding at high velocities (e.g., fighting a fire, engaging in combat, etc.). These periods of nonequilibrium are typically characterized by volatility, uncertainty, complexity and ambiguity. Human agents operating under these conditions experience a variety of reactions, such as emotional modulation of cognition, recognition primed decision making, among others. To study this phenomenon a construct named High Velocity Human Factors (HVHF) is defined and described. On the practical side, the HVHF framework will be used to analyze demands placed on personnel operating in MCDs and inform the design of systems and solutions.

Supporting the Cognitive Work of Information Analysis and Synthesis: A Study of the Military Intelligence Domain

Information Analysis and Synthesis (henceforth “IAS”) is a type of cognitive work that plays a key role in many high-performance, complex, and mission-critical domains. These can range from tactical military intelligence to scientific or technological forecasting, business and financial intelligence to national strategic counterterrorism, and include areas as disparate as geopolitical policy analysis to computer network intrusion detection. The specific subject of this study is the military intelligence domain as one instantiation of IAS. Several innovative ethnographic and cognitive task analysis methods were used to observe team-based distributed work done by actual domain practitioners. The main investigative effort took the form of a scaled-world study, leveraging a real world tactical intelligence training exercise as a natural laboratory for investigating the contrasts between weaker and stronger IAS. Specifically, we examined the role of instructors in providing broadening checks to the team analytic process, and mapped the findings to an existing framework.

A Distributed Cognition Approach to Understanding Information Transfer in Mission Critical Domains

We developed a conceptual framework that describes how information transfer occurs in mission critical domains using a distributed cognition approach. According to this framework, information tools and the physical workspace comprise an “information arena”, which plays a crucial role in information transfer. Information tools and the information arena support joint work and may improve efficiency and reliability by providing visual cues to collaborators, by getting everyone on the same page, by helping collaborators focus on critical information, by facilitating attention management under time pressure, and by providing an evanescent (transient) communication space. We illustrate the concepts in this framework using an example from multidisciplinary rounds, an information transfer mechanism common in the intensive care unit, a mission critical domain. The framework can be used as a guide to further understanding of information transfer in mission critical domains and to develop information tools that facilitate and enhance discourse.

Affective Factors: A Model of Cognition Under Emotional States

A range of aversive emotions, such as fear, anger and surprise, are automatically triggered when humans engage in mission critical tasks or operate in risky environments. These emotions modulate human cognition and behavior to protect and prevent from any harm being inflicted on them. Emotion accomplishes this by drawing attention to stimuli with emotional valence and by prioritizing the manner and order in which information processing occurs. It is known from research done in the neurosciences and social psychology that emotional states alter the cognitive processes non-consciously, well before the feelings of an emotion are perceived in the consciousness. Human information processing models, which inform and guide human factors research and practice, have not accounted for emotions. This paper presents a framework as to how emotions could be integrated into human information processing models. It does this by first demonstrating the primacy of emotional modulation of cognition, and its applicability to the field of human factors, particularly to the design of human-machine systems in mission critical domains.

An Architecture Validation Toolset for Ensuring Patient Safety in an Open Source Software Toolkit for Image-Guided Surgery Applications

As open source software projects gain acceptance in mission critical domains of a technology-enabled society, they must adapt their lightweight processes and tools to address the quality needs of these domains. One such domain is technology-supported surgical interventions. This paper presents an in-development toolset for validating the architecture of the open source Image-guided Surgical Toolkit (IGSTK). IGSTK components must conform to a specific architecture pattern based on state machines. Applications built on top of the IGSTK framework process and route instructions under specific constraints imposed by the architecture. This toolset focuses on validating that component state machines in IGSTK are designed and implemented in accordance with the architecture’s constraints. These tools employ open source components as well, and apply theoretical concepts from computer science to a practical problem of guaranteeing safety in a mission critical domain.

Slicing and partial evaluation of CORBA component model designs for avionics system

The use of component models such as Enterprise Java Beans and the CORBA Component Model (CCM) in application development is expanding rapidly. Even in real-time safety-critical and mission-critical domains, component-based development is beginning to take hold as a mechanism for in-corporating non-functional aspects such as real-time, quality-of-service, and distribution.