Security Testbeds Research Articles

Reinforcement Learning-Based Adaptive Feature Boosting for Smart Grid Intrusion Detection

Intrusion detection systems (IDSs) are crucial in the security monitoring for the smart grid with increasing machine-to-machine communications and cyber threats thereafter. However, the multi-sourced, correlated, and heterogeneous smart grid data pose significant challenges to the accurate attack detection by IDSs. To improve the attack detection, this paper proposes Reinforcement Learning-based Adaptive Feature Boosting, which aims to leverage a series of AutoEncoders (AEs) to capture critical features from the multi-sourced smart grid data for the classification of normal, fault, and attack events. Multiple AEs are utilized to extract representative features from different feature sets that are automatically generated through a weighted feature sampling process; each AE-extracted feature set is then applied to build a Random Forest (RF) base classifier. In the feature sampling process, Deep Deterministic Policy Gradient (DDPG) is introduced to dynamically determine the feature sampling probability based on the classification accuracy. The critical features that improve the classification accuracy are assigned larger sampling probabilities and increasingly participate in the training of next AE. The presence of critical features is increased in the event classification over the multi-sourced smart grid data. Considering potential different alarms among base classifiers, an ensemble classifier is further built to distinguish normal, fault, and attack events. Our proposed approach is evaluated on the two realistic datasets collected from Hardware-In-the-Loop (HIL) and WUSTIL-IIOT-2021 security testbeds, respectively. The evaluation on the HIL security dataset shows that our proposed approach achieves the classification accuracy with 97.28%, an effective 5.5% increase over the vanilla Adaptive Feature Boosting. Moreover, the proposed approach not only accurately and stably selects critical features on the WUSTIL-IIOT-2021 dataset based on the significant difference of feature sampling probabilities between critical and uncritical features, i.e., the probabilities greater than 0.08 and less than 0.01, but also outperforms the other best-performing approaches with the increasing Matthew Correlation Coefficient (MCC) of 8.03%.

ICSSIM — A framework for building industrial control systems security testbeds

With the advent of the smart industry, Industrial Control Systems (ICS) moved from isolated environments to connected platforms to meet Industry 4.0 targets. The inherent connectivity in these services exposes such systems to increased cybersecurity risks. To protect ICSs against cyberattacks, intrusion detection systems (IDS) empowered by machine learning are used to detect abnormal behavior of the systems. Operational ICSs are not safe environments to research IDSs due to the possibility of catastrophic risks. Therefore, realistic ICS testbeds enable researchers to analyze and validate their IDSs in a controlled environment. Although various ICS testbeds have been developed, researchers’ access to a low-cost, extendable, and customizable testbed that can accurately simulate ICSs and suits security research is still an important issue.In this paper, we present ICSSIM, a framework for building customized virtual ICS security testbeds in which various cyber threats and network attacks can be effectively and efficiently investigated. This framework contains base classes to simulate control system components and communications. Simulated components are deployable on actual hardware such as Raspberry Pis, containerized environments like Docker, and simulation environments such as GNS-3. ICSSIM also offers physical process modeling using software and hardware in the loop simulation. This framework reduces the time for developing ICS components and aims to produce extendable, versatile, reproducible, low-cost, and comprehensive ICS testbeds with realistic details and high fidelity. We demonstrate ICSSIM by creating a testbed and validating its functionality by showing how different cyberattacks can be applied.

Design Considerations for Building Credible Security Testbeds: Perspectives from Industrial Control System Use Cases

ABSTRACT This paper presents a mapping framework for design factors and an implementation process for building credible Industrial Control Systems (ICS) security testbeds. The security and resilience of ICSs has become a critical concern to operators and governments following widely publicised cyber security events. The inability to apply conventional Information Technology security practice to ICSs further compounds challenges in adequately securing critical systems. To overcome these challenges, and do so without impacting live environments, testbeds are widely used for the exploration, development, and evaluation of security controls. However, how a testbed is designed and its attributes, can directly impact not only its viability but also its credibility. Combining systematic and thematic analysis, and the mapping of identified ICS security testbed design attributes, we propose a novel relationship map of credibility-supporting design factors (and their associated attributes) and a process implementation flow structure for ICS security testbeds. The framework and implementation process highlight the significance of demonstrating some design factors such as user/experimenter expertise, clearly defined testbed design objectives, simulation implementation approach, covered architectural components, core structural and functional characteristics covered, and evaluations to enhance confidence, trustworthiness and acceptance of ICS security testbeds as credible. These can streamline testbed requirement definition, improve design consistency and quality while reducing implementation costs.

A DEFENSIVE APPROACH AGAINST MATHEMATICAL CRYPTANALYSIS USING SYMMETRIC KEY AND FUZZY BASED SESSION KEY

At present market, with the help of science, the information technology has developed rapidly as well as the information security as an important part of information technology is also strongly affecting people’s work and life. When the development of science and technology brings convenience to characters, it also exposes many security issues. In recent years, information security incidents such as information leakage, SQL injection vulnerabilities, network penetration, and hacking attacks have triggered irreparable losses to enterprises, society, and individuals. In our paper, a symmetric key encryption with fuzzy based session key has been proposed for satisfying the key issues like security; increase the strength of symmetric key. Here the session key is generated using fuzzy logic. Now the encryption is done by using this session key and symmetric key. Here a new authentication scheme is developed to generate cipher text. Different types of experiments to test the robustness of keys and encryption technique and comparative study with existing standard techniques have been done with satisfactory results. This paper has taken steps to develop an attack capability for use within a cyber challenge environment. The principles discussed within this paper aim to be applicable to all challenges against mathematical cryptanalysis and cryptographic protocol in general and also it is used to cover threat modeling, construction of cyber security test beds and take footsteps against offensive cyber operations.

Design and implementation of automated IoT security testbed

The emergence of technology associated with the Internet of Things (IoT) is reshaping our lives, while simultaneously raising many issues due to their low level of security, which attackers can exploit for malicious purposes. This research paper conducts a comprehensive analysis of previous studies on IoT device security with a focus on the various tools used to test IoT devices and the vulnerabilities that were found. Additionally, the paper contains a survey of IoT-based security testbeds in the research literature. In this research study, we introduce an open source platform for identifying weaknesses in IoT networks and communications. The platform is easily modifiable and extendible to enable the addition of new security assessment tests and functionalities. It automates security evaluation, allowing for testing without human intervention. The testbed reports the security problems of the tested devices and can detect all attacks made against the devices. It is also designed to monitor communications within the testbed and with connected devices, enabling the system to abort if malicious activity is detected. To demonstrate the capabilities of the proposed IoT security testbed, it is used to examine the vulnerabilities of two IoT devices: a wireless camera and a smart bulb.

Testbed@TWISC: A network security experiment platform

SummaryAs the internet continues to grow in width and depth, its very architecture brings many challenges in network research. One significant issue is cybersecurity. Owing to the characteristics of network connectivity, malicious actions may cause losses during information exchanges in communication. Therefore, studying suspicious behaviors and covering potential exploits are necessary to protect networked computers. To determine possible threats, researchers need an experimental environment that enables them to explore and practice. A network emulation testbed provides such a platform to fulfill these purposes. This paper introduces Testbed@TWISC, a large‐scale network emulation testbed on Taiwan's research and education network that supported open research and cybersecurity education for almost 10 years. The paper reviews this testbed's origination, development, and operation experiences. Several findings and open issues of the testbed are also discussed. Readers who plan to build network security testbeds may find useful information in this paper for a case study.

Taxonomy of SCADA systems security testbeds

Considerable research has focused on developing simulation environments to study the effects of cyber-attacks on supervisory control and data acquisition (SCADA) systems although a methodology to develop a SCADA security testbed is not yet available. This paper attempts to address the issue by presenting a reference model taken from the literature and classifying specific contributions on the development of SCADA security testbed according to the reference model. Specific techniques and experiments used to recreate cyber-attacks on the de facto standard communication protocol Modbus are also presented. This paper also explores the possibility of integrating specific simulation models into a SCADA security testbed to assess the impact of cyber-attacks on the physical system.

Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid

The development of a smarter electric grid will depend on increased deployments of information and communication technology (ICT) to support novel communication and control functions. Unfortunately, this additional dependency also expands the risk from cyber attacks. Designing systems with adequate cyber security depends heavily on the availability of representative environments, such as testbeds, where current issues and future ideas can be evaluated. This paper provides an overview of a smart grid security testbed, including the set of control, communication, and physical system components required to provide an accurate cyber-physical environment. It then identifies various testbed research applications and also identifies how various components support these applications. The PowerCyber testbed at Iowa State University is then introduced, including the architecture, applications, and novel capabilities, such as virtualization, Real Time Digital Simulators (RTDS), and ISEAGE WAN emulation. Finally, several attack scenarios are evaluated using the testbed to explore cyber-physical impacts. In particular, availability and integrity attacks are demonstrated with both isolated and coordinated approaches, these attacks are then evaluated based on the physical system's voltage and rotor angle stability.