TWC: Small: Behavior-Based Zero-Day Intrusion Detection for Real-Time Cyber-Physical Systems

点击翻译按钮获取中文摘要

Cyber-Physical Systems (CPS) have distinct cyber and physical components that must work cohesively with each other to ensure correct operation. Examples include automobiles, power plants, avionics systems, and home automation systems. Traditionally such systems were isolated from external accesses and used proprietary components and protocols. Today that is not the case as CPS systems are increasingly networked. A failure to protect these systems from harm in cyber could result in significant physical harm. Many cyber-physical systems have real-time constraints i.e., they must function correctly within predetermined time scales. Systems that have such real-time properties are predictable by design. The execution behavior of such systems (e.g., execution time, memory usage, control flow, system properties, etc.) is analyzed in detail and controlled to a high degree of precision in order to guarantee predictable real-time behavior. This project aims to use this very predictability of real-time CPS to detect intrusions as soon as they occur and take evasive and corrective actions. This will be combined with the development of an architectural framework to (a) detect intrusions and (b) guarantee that the underlying physical system does not come to harm. The development of these analysis techniques and intrusion-detection architectures being proposed here will inherently make such systems more secure and hence, safer. It will bring us one step closer to understanding how to integrate two seemingly diverse yet important fields, CPS and cybersecurity, while gaining a better understanding of both areas.