Vulnerability Analysis Of Systems Research Articles

Switching attack modeling and vulnerability analysis of generator for dynamics study

This paper presents novel insights about cyber-attacks in the power network and their consequence in terms of stability. Compared to existing cyber-attack related studies in power systems, the work discusses switching attack construction and evaluates the impact on generator dynamics. As such, the study is in two folds: (i) switching attack construction, with selection of switching instants based on system states and (ii) vulnerability analysis of power system components, circuit breaker, governor system and excitation system of generators. The role of inherently present communication delay/state variable delay becomes important as it has direct impact on dynamic performance of the system. The impact of the constant and timedependent delay on the stability is addressed by determining the time-delay margin using Lyapunov-Krasovskii functional. Thereafter, the condition for successful switching attack construction is given in terms of delay margin. The accuracy of the derived condition for successful switching attack is demonstrated via real-time co-simulation (RTDS) and MATLAB software. The vulnerability of power system components in IEEE 3-machine, 9-bus network are analysed as individuals or their combinations when subjected to switching attacks. The adequacy related to power system stability as a consequence of cyber-attacks is investigated with an estimation of RoCoF of generators.

Vulnerability analysis of public transit systems from the perspective of the traffic situation

The critical to sustainable urban development that a robust bus transit system is constructed to alleviate urban congestion problems. Unfortunately, disruptions in bus transit systems can lead to dysfunction and threaten sustainable development. This paper proposed a vulnerability analysis model for constructing complementary urban bus networks (UBNs), which considers the actual capacity of the bus network at the speed of transport roads. In addition, the UBNs aimed analysis method is presented from three specific aspects: (a) utilizing the stochastic user equilibrium model and different traffic situations to measure the UBNs of passenger flow distribution according to multi-source data; (b) introducing the node capacity and structural, functional vulnerability analysis model by combining real traffic flows and the complex network theory; (c) analysing the vulnerability characteristics of UBNs cascading failures from different passenger flow distributions and increasing capacity parameters, and comparing with those under different attack methods. Then, the new vulnerability analysis model is applied to the Harbin trunk bus. Considering different attack scenarios, the UBNs show strong vulnerability in the case of high congestion. Compared with other deliberate attacks, the bus network based on the attack mode of the maximum intensity site is more vulnerable at different times. These insights could be used to inform a vulnerability-based spatiotemporal design of bus transit networks.

Model-Based Cybersecurity Analysis

Critical infrastructure (CIs) such as power grids link a plethora of physical components from many different vendors to the software systems that control them. These systems are constantly threatened by sophisticated cyber attacks. The need to improve the cybersecurity of such CIs, through holistic system modeling and vulnerability analysis, cannot be overstated. This is challenging since a CI incorporates complex data from multiple interconnected physical and computation systems. Meanwhile, exploiting vulnerabilities in different information technology (IT) and operational technology (OT) systems leads to various cascading effects due to interconnections between systems. The paper investigates the use of a comprehensive taxonomy to model such interconnections and the implied dependencies within complex CIs, bridging the knowledge gap between IT security and OT security. The complexity of CI dependence analysis is harnessed by partitioning complicated dependencies into cyber and cyber-physical functional dependencies. These defined functional dependencies further support cascade modeling for vulnerability severity assessment and identification of critical components in a complex system. On top of the proposed taxonomy, the paper further suggests power-grid reference models that enhance the reproducibility and applicability of the proposed method. The methodology followed was design science research (DSR) to support the designing and validation of the proposed artifacts. More specifically, the structural, functional adequacy, compatibility, and coverage characteristics of the proposed artifacts are evaluated through a three-fold validation (two case studies and expert interviews). The first study uses two instantiated power-grid models extracted from existing architectures and frameworks like the IEC 62351 series. The second study involves a real-world municipal power grid.

A novel grey multi-objective binary linear programming model for risk assessment in supply chain management

Robust and resilient agri-food supply chain management (AFSCM) is paramount to agribusinesses, given the many challenges and risks that this increased demand will bring in the coming decades. Interruptions caused by various risks to this crucial supply chain network, particularly in emerging economies, can put the lives of millions in danger, not to mention creating devastating impacts on the economy and the environment. Even so, there are only a limited number of quantitative risk management studies in the AFSCM literature. In this study, an integrated modified risk mitigation matrix (M-RMM) is developed to analyze the mitigation strategies for dealing with various risks in the context of the agri-food supply chain. The M-RMM is integrated with the grey multi-objective binary linear programming (GMOBLP) model to obtain the optimal risk mitigation strategies related to the three objective functions of risk, cost, and time minimization. The proposed model is a useful tool for formulating sustainable business policies and reducing food waste, and acquiring a context-specific (i.e., a developing economy), sector-specific (i.e., the agri-food processing sector), and multi-product (i.e., fresh and non-perishable) approach. The findings reveal that continuous training and development and vulnerability analysis of IT systems are the most effective risk mitigation strategies to lessen the impacts of lack of skilled personnel, sub-standard leadership, failure in IT systems, insufficient capacity to produce quality products, and poor customer relationships. The findings assist practitioners in managing risks in supply chains.

An approach for accessibility assessment and vulnerability analysis of national multimodal transport systems.

A series of ambitious accessibility-oriented policies have been launched in the world, which center around improving accessibility via the national multimodal transport systems including road, airline, and railway. The national multimodal transport accessibility assessment is one of the "basic" analyses for the design and implementation of these policies, whereas existing national-scale accessibility studies either focus on single-mode or two-mode transport or ignore the schedule-dependent nature of railway and airline. This article models the integrated road, railway, airline, and walking transport as a four-layer network with the consideration of their interdependencies. An algorithm is then developed to accurately assess the travel time-based accessibility on the four-layer network with the consideration of the daily schedule of trains and flights. The proposed approach is applied to map accessibility to 363 cities in mainland China and analyze the optimal travel modes. In addition, this article investigates the travel time-based vulnerability of the national multimodal transport system in mainland China under the extreme storm recently occurred in Zhengzhou (July 2021). The findings in this work provide insightful suggestions for transport planners to design the national multimodal transport systems and for stakeholders to schedule travels.

Wind vulnerability analysis of standing seam roof system considering fatigue damage

Fatigue failure is a common failure mode of roof systems in wind disasters, therefore, it is necessary to consider fatigue damage in the wind vulnerability analysis of roof systems. To evaluate the wind vulnerability of a roof system while considering damage, a dynamic numerical simulation of the roof system with an optimised load cycle is proposed herein, based on the principle of damage equivalence. For this purpose, a damage constitutive model of the material was used in simulations, which was then verified experimentally. Second, the wind uplift failure process of the roof system was analysed in combination with the simulation and test results. The results revealed that the wind uplift failure process of the roof system conformed with the characteristics of a three-stage failure. Furthermore, values of the damage variable D corresponding to the abovementioned failure stages were measured for 90 numerical cases. Using these average values of the damage variable D as the standard, the three-stage performance levels of the roof system were quantified. Notably, values of the damage variable D corresponding to the three-stage performance levels of the roof system were 0.2, 0.62, and 1.0. Lastly, considering the uncertainty of the material parameters and wind load, a vulnerability analysis of the five types of standing seam roof systems was performed. Based on the vulnerability curve, Model 1 exhibited the lowest vulnerability, whereas Model 4 showed the highest vulnerability. Considering evident differences in the vulnerabilities of different types of roof systems can afford additional choices for engineering designs. In addition, a comparison of the wind vulnerability curves for the roof system under static and cyclic loads indicated that the wind vulnerability of the roof system under cyclic loads was significantly worse.

Convex Optimization of Cyberattacks Overflowing Multiple Lines in Cyber-Physical Power Systems

Cyberattacks designed to overflow transmission or distribution lines may lead to cascading failures or blackouts in smart grids. Accurately modeling these attacks is the first step in designing appropriate countermeasures. Therefore, this article aims at power system vulnerability analysis from the operator’s perspective, i.e., identifying the scenarios, where false data injection (FDI) cyberattacks can lead to overflow of multiple lines. A nonlinear optimization model is developed for cyberattacks that can bypass the state-estimation and result in congestion of multiple lines in smart grids. Unlike existing line congestion attacks that focused on dc state-estimation, the proposed model is based on FDIs on targeted set of buses to overflow targeted set of lines by bypassing ac state-estimation. Considering ac state-estimation in the attack model generalizes the proposed model for both transmission and distribution-level power grids. The nonconvex model is then converted to a convex formulation using second-order cone programming relaxation, and global optimality conditions are discussed. Several case studies are considered to validate the effectiveness of the proposed attack model using IEEE 118-bus benchmark.

A DDoS Vulnerability Analysis System against Distributed SDN Controllers in a Cloud Computing Environment

Software-Defined Networking (SDN) is now a well-established approach in 5G, Internet of Things (IoT) and Cloud Computing. The primary idea behind its immense popularity is the separation of its underlying intelligence from the data-carrying components like routers and switches. The intelligence of the SDN-based networks lies in the central point, popularly known as the SDN controller. It is the central control hub of the SDN-based network, which has full privileges and a global view over the entire network. Providing security to SDN controllers is one such important task. Whenever one wishes to implement SDN into their data center or network, they are required to provide the website to SDN controllers. Several attacks are becoming a hurdle in the exponential growth of SDN, and among all one such attack is a Distributed Denial of Service (DDoS) attack. In a couple of years, several new SDN controllers will be available. Among many, Open Networking Operating System (ONOS) and OpenDayLight (ODL) are two popular SDN controllers laying the foundation for many other controllers. These SDN controllers are now being used by numerous businesses, including Cisco, Juniper, IBM, Google, etc. In this paper, vulnerability analysis is carried out against DDoS attacks on the latest released versions of both ODL and ONOS SDN controllers in real-time cloud data centers. For this, we have considered distributed SDN controllers (located at different locations) on two different clouds (AWS and Azure). These controllers are connected through the Internet and work on different networks. DDoS attacks are bombarded on the distributed SDN controllers, and vulnerability is analyzed. It was observed with experimentation that, under five different scenarios (malicious traffic generated), ODL-3 node cluster controller had performed better than ONOS. In these five different scenarios, the amount of malicious traffic was incregradually increased. It also observed that, in terms of disk utilization, memory utilization, and CPU utilization, the ODL 3-node cluster was way ahead of the SDN controller.

Vulnerability Analysis of Structural Systems under Extreme Flood Events

Vulnerability analyses of coastal or inland bridges in terms of flood actions and structural and fluid flow characteristics are carried out. In particular, a numerical model based on a two-phase fluid flow is implemented for the multiphase fluid system, whereas a three-dimensional formulation based on shell/volume finite elements is adopted for the structure. The governing equations can simulate the interaction between fluids and the structures, by using the Arbitrary Lagrangian–Eulerian (ALE) strategy. The results of the hydrodynamic forces, bridge displacements and dynamic amplification factors (DAFs) show that the existing formulas, available in the literature or in structural design codes, do not accurately predict the maximum design effects. For the investigated cases, the DAFs may vary from 1 to 4.5. The worst scenarios are observed for the upload vertical direction. Finally, the performance of the protection fairing system is investigated. The results show that such devices are able to efficiently reduce the effects of the wave load in terms of the applied hydraulic forces on the structure and bridge deformability, in particular, with 40% more accuracy than the unprotected configuration.

System Vulnerability Analysis Simulation Model for Substation Subjected to Earthquakes

To evaluate the earthquake-resistance capability of an entire substation, which is a complex multi-input-multi-output system (MIMOS) composed of many various types of electrical equipment interconnected by conductors, a flow-based analysis model integrating the merit of the flow block diagram and state tree method was introduced. Two performance indicators of a substation were defined from different stakeholders, one is the expected total power transmission capacity and the other is the power accessibility to the targeted users from the substation. And directed graph logic system analysis models were developed on the Simulink platform based on the original internal logic relationship among distributed components and the power delivery path in the substation with different function types. Afterward, the defined reliability indicators associated with the overall system under a certain seismic intensity level can be obtained by combining the seismic vulnerability curve at the equipment level through the Monte Carlo simulation method. The feasibility and accuracy of the proposed system vulnerability analysis model were verified by comparison with the analytical solution through the illustrative simple MIMOS. Then A case study on a practical 220/110 kV substation was conducted, the analysis results can assist decision-makers in seismic optimization of different retrofitting measures and distribution plans for substations.

Performance-driven vulnerability analysis of infrastructure systems

In this research we suggest a novel approach that reduces the complexity of vulnerability analysis of infrastructure systems, by addressing the vital information necessary for decision makers and avoiding an exhaustive analysis of data that is ultimately irrelevant. This objective is achieved by framing the vulnerability analysis as part of a decision-making process, thus focusing on clear and quantifiable requirements of specific essential end-users, and assessing under which particular circumstances these requirements are no longer satisfied by the infrastructure systems that support the end users' activities. Methodically, this is made possible by reversing the process through which the vulnerability of infrastructure systems is typically analysed and identifying specific minimum threshold states in which critical supplies will be interrupted to reveal the critical components in supply chains. This reduction in the complexity of vulnerability analysis also allows the consideration of highly relevant information that may currently be ignored to avoid an excessive computational burden. To test its feasibility, the approach was implemented in a synthetic, though realistic case study of an analysis of the vulnerability of a healthcare system to seismic hazards. This enabled the identification of several potential threats to the healthcare system's continued performance following future earthquakes.

Vulnerability analysis of cyber physical systems under the false alarm cyber attacks

More and more infrastructure networks have evolved into cyber physical systems (CPS). Among the previous work, CPS has developed a series of emergency mechanisms to deal with physical failures or attacks. However, the occurrence of cyber attacks, can still severely affect the normal operation of CPS. Thus, the goal of this paper is studying and analyzing the vulnerability of CPS under the cyber attacks. Taking the smart grid as a typical CPS, we consider a specific attack scenario—false alarm attack (FAA), and mathematically propose the FAA model. The attackers can inject hidden vector to make the control center mistakenly believe that links are overloaded, which further results in unnecessary power loss. Based on the FAA model, we further analyze the vulnerability of CPS under different network structures and redundant parameters. Finally, we propose a hybrid indicator, which takes the topological and electrical characteristics of links into consideration, to identify the vulnerable links in smart grid. The simulation results show that the hybrid indicator can effectively identify the vulnerable links, and has a strong correlation with the vulnerability of smart grid. Our work can provide new insights into the construction of robust CPS.

Rail transport system vulnerability analysis and policy implementation: Past progress and future directions

Analysis of the vulnerability of rail transport systems has received considerable attention in the literature over several decades. Since economic development is usually associated with increasing demand for railway transport as more and more passengers rely on railways, the consequence of disruptions to the railway system becomes unaffordable and creates significant impact on society and economies. Hence, there is a growing need for effective mitigation strategies and greater appreciation of the linkage between vulnerability analysis and policy implementation. This paper reviews recent studies of methods applied for vulnerability analysis of rail transport systems and assesses their policy or strategy-related content. The result shows the predominance of topological approaches in the railway vulnerability analysis context; however, very few provide concrete policy- or strategy-related implications and suggestions. The findings also show that the link between research in the context of vulnerability analysis and risk analysis is weak, and practice-oriented studies are limited; this is identified as an area for future work. Overall, this paper provides a comprehensive insight into the state-of-the-art vulnerability analysis of rail transport systems, drawing on both research and practice and offers a guide for future studies. The remaining gap between theory and policymaking is clearly elaborated.

Assessment and influencing factors analysis of economic system vulnerability of the Belt and Road Initiative countries.

Economic vulnerability is an important indicator to measure regional coordination, health and stability. Despite the importance of vulnerabilities, this is the first study that presents 26 indicators selected from the dimensions of the domestic economic system, external economic system and financial system in the Belt and Road Initiative (BRI) countries. A quantitative analysis is conducted to analyze the characteristics of spatial heterogeneity of vulnerability of the economic subsystems and the comprehensive economic system of the BRI countries and the main influencing factors of the comprehensive economic system vulnerability (CESV) are identified based on obstacle degree model. The results show that the CESV of the East Asia, South Asia and ASEAN countries are lower than that of the Middle Eastern Europe, Central Asia and West Asia countries. The CESV of the BRI countries are generally in the middle level and the average vulnerability index of highly vulnerable countries is twice as much as that of lowly vulnerable countries. In addition, in terms of the vulnerability of the three subsystems, the spatial distribution of vulnerability of the domestic economic system (DESV) and financial system (FSV) is basically consistent with the spatial distribution pattern of CESV, both of which are low in East Asia and South Asia and high in West Asia and Central Asia. While, the vulnerability of external economic system (EESV) shows a different spatial pattern, with vulnerability of West Asia, Central Asia and ASEAN higher than that of East Asia and South Asia. The main obstacle factors influencing the CESV of BRI countries include GDP growth rate, saving ratio, ratio of bank capital to assets, service industry level, industrialization level and loan rate. Therefore, the key way to maintain the stability and mitigate the vulnerability of the economic system of BRI countries is to focus on the macroeconomic development and operation, stimulate the economy and market vitality, promote the development of industries, especially the service and secondary industries, and optimize the economic structure, banking system and financial system.

Effects of Spatial Variation of Ground Motion (SVGM) on Seismic Vulnerability of Ultra-high Tower and Multi-tower Cable-stayed Bridges

ABSTRACT This study focused on the influence of SVGM on the vulnerability of an ultra-high tower cable-stayed bridge. Components and system vulnerability analysis of the bridge with longitudinal constraint and floating structural systems was conducted, considering nine combinations of wave passages, sites and incoherence effects. Results generated by these combinations showed that bridge components and systems suffered the greatest damage under conditions where the soil changes from firm to soft and with the lowest incoherence coefficient. Moreover, compared with uniform excitation, the damage probabilities in a longitudinal constraint structure decreased, while a floating structure was found to be more threatened.

Power system vulnerability analysis based on topological potential field theory

Evaluating the vulnerability of power system effectively and accurately is of great significance for predicting cascading failures and preventing blackouts. Therefore, we propose a power system vulnerability analysis method based on the topological potential field theory in this paper. Firstly, according to the overload risk and operation risk of transmission lines in cascading failures, we construct a fault chain graph considering two-level cascading failures. Secondly, we define the generalized node quality, and then propose a power system vulnerability evaluation method based on the topological potential theory of the data field by using the network edge weights to quantify the node entropy degree. At the topological structure level, this method pays attention to the influence between lines and that of each line on the entire power system, which can more reflect the important lines in the power system accurately. Finally, we do vulnerability simulations on the IEEE-39 bus system and a certain regional power grid in China respectively. The results show that the method has higher identification accuracy and lower time complexity on the basis of ensuring the integrity of the power grid topology.

Empirical seismic vulnerability analysis of infrastructure systems in Nepal

Empirical seismic vulnerability analysis of infrastructure systems in Nepal

A selective ensemble model for cognitive cybersecurity analysis

Dynamic data-driven vulnerability assessments face massive heterogeneous data contained in, and produced by SOCs (Security Operations Centres). Manual vulnerability assessment practices result in inaccurate data and induce complex analytical reasoning. Contemporary security repositories’ diversity, incompleteness and redundancy contribute to such security concerns. These issues are typical characteristics of public and manufacturer vulnerability reports, which exacerbate direct analysis to root out security deficiencies. Recent advances in machine learning techniques promise novel approaches to overcome these notorious diversity and incompleteness issues across massively increasing vulnerability reports corpora. Yet, these techniques themselves exhibit varying degrees of performance as a result of their diverse methods. We propose a cognitive cybersecurity approach that empowers human cognitive capital along two dimensions. We first resolve conflicting vulnerability reports and preprocess embedded security indicators into reliable data sets. Then, we use these data sets as a base for our proposed ensemble meta-classifier methods that fuse machine learning techniques to improve the predictive accuracy over individual machine learning algorithms. The application and implication of this methodology in the context of vulnerability analysis of computer systems are yet to unfold the full extent of its potential. The proposed cognitive security methodology in this paper is shown to improve performances when addressing the above-mentioned incompleteness and diversity issues across cybersecurity alert repositories. The experimental analysis conducted on actual cybersecurity data sources reveals interesting tradeoffs of our proposed selective ensemble methodology, to infer patterns of computer system vulnerabilities.

Spatiotemporal analysis of water resources system vulnerability in the Lancang River Basin, China

The Lancang River (Upper Mekong), originated from Qinghai-Tibet Plateau, is the main water source for Southeast Asia countries. In recent years, people have paid more and more attention to the impact of climate change and human activities on the Lancang River water resources system. Due to external disturbances, the vulnerability of water resources in the Lancang River Basin (LRB) is also changing, leading to an increase in the probability of possible risks. This study proposes an assessment framework to evaluate water resources system vulnerability and analyze its dynamic change in the LRB during 1998–2014. Quantitative approaches for calculation of sensitivity, exposure, hazard and adaptability are respectively formulated, which highlight the impacts of natural and anthropogenic interference on water resources. Specific management strategies are put forward based on the spatial recognition of water resources system vulnerable areas in the LRB. The results indicate that the sensitivity and exposure of the LRB show an upward trend, while the adaptive capacity shows a downward trend during 1998–2014. The vulnerability of the LRB is at low level currently. However, fluctuations in its vulnerability have increased over time. As a whole, the vulnerability displays a high-to-low gradient from southeast to northwest of the LRB during the study period, the Dali region is the most vulnerable region in the LRB. The areas with high vulnerability are distributed in the southeast of the study area, mainly in the mainstream areas with characterization of frequent human interferences, tend to increase persistently. Based on the results, some suggestions targeted at different vulnerable areas were proposed. This study maps the spatiotemporal characteristics of the water resource vulnerability in the LRB, which reveals hotspot areas from climate-related threats and can provide useful information to improve the adaptation and resilience of the water resources system.

AutoVAS: An automated vulnerability analysis system with a deep learning approach

Owing to the advances in automated hacking and analysis technologies in recent years, numerous software security vulnerabilities have been announced. Software vulnerabilities are increasing rapidly, whereas methods to analyze and cope with them depend on manual analyses, which result in a slow response. In recent years, studies concerning the prediction of vulnerabilities or the detection of patterns of previous vulnerabilities have been conducted by applying deep learning algorithms in an automated vulnerability search based on source code. However, existing methods target only certain security vulnerabilities or make limited use of source code to compile information. Few studies have been conducted on methods that represent source code as an embedding vector. Thus, this study proposes a deep learning-based automated vulnerability analysis system (AutoVAS) that effectively represents source code as embedding vectors by using datasets from various projects in the National Vulnerability Database (NVD) and Software Assurance Reference Database (SARD). To evaluate AutoVAS, we present and share a dataset for deep learning models. Experimental results show that AutoVAS achieves a false negative rate (FNR) of 3.62%, a false positive rate (FPR) of 1.88%, and an F1-score of 96.11%, which represent lower FNR and FPR values than those achieved by other approaches. We further apply AutoVAS to nine open-source projects and detect eleven vulnerabilities, most of which are missed by the other approaches we experimented with. Notably, we discovered three zero-day vulnerabilities, two of which were patched after being informed by AutoVAS. The other vulnerability received the Common Vulnerabilities and Exposures (CVE) ID after being detected by AutoVAS.