GOALI: Robust Quality Control Tools for Cyber-Physical Manufacturing Systems: Assessing and Eliminating Cyber-Attack Vulnerabilities

随着信息时代的发展，网络攻击变得越来越恶意，而可见性却越来越低。与此同时，先进的制造系统在很大程度上依赖于新的网络技术，如基于互联网的计算机辅助工程支持工具和网络化的制造和检测设备。虽然由此产生的数据连接加快了产品/工艺设计周期，并允许广泛的分析能力，但它也导致了制造系统中数字入口点的增加。因此，问题不再是我们的制造业基础设施是否会成为网络攻击的受害者，而是何时成为受害者。一个多世纪以来，制造业在很大程度上依赖于使用质量控制（QC）系统来检测质量损失并确保生产高质量的零件。然而，目前的QC方法并不是用来检测网络攻击的影响的。制造系统中无法察觉的变化会对产品的设计意图、性能、质量或感知质量产生不利影响。结果可能会导致产品发布延迟、设备损坏、保修成本增加或失去客户信任，从而在经济上造成毁灭性的损失。更重要的是，攻击会对人类安全构成威胁，因为操作人员和消费者可能正在使用有缺陷的设备和产品。质量控制系统是建立在假设的基础上的，在受到攻击的情况下，这些假设可能不再有效。从本质上讲，这些假设变成了漏洞，可以用来使攻击无法检测到。这项学术与行业联络资助机会（GOALI）研究项目的目标是识别当前QC系统中存在的漏洞，并开发新的工具来显著减少或消除这些漏洞。本研究的重点是将质量监测-检测-诊断周期作为一个集成的网络-物理安全问题来研究。混合信息技术（IT）和质量控制系统能够检测和补偿质量损失造成的物理或网络过程转移将被调查。工作重点是统计过程控制（SPC）。对于这一努力，将在SPC的三个不同阶段识别漏洞，使用漏洞识别研究方法，该方法需要攻击者的角度来了解哪些信息可用于识别和利用漏洞。一旦识别出这些漏洞，将创建新的混合IT/QC工具来补充和/或取代目前使用的SPC方法，以显着减少或消除其对网络攻击的弱点。此外，这些新工具将根据用于利用系统的信息类型，考虑多个漏洞级别。

As the information age progresses, cyber-attacks have become increasingly malicious while decreasing in visibility. At the same time, advanced manufacturing systems rely heavily on new cyber-technologies, such as internet-based computer aided engineering support tools and networked manufacturing and inspection equipment. While the resulting data connectivity has accelerated the product/process design-cycle and allowed for extensive analytical capabilities, it has also resulted in an increase of digital entry points into a manufacturing system. Therefore, it is no longer a question of if, but rather when, our manufacturing infrastructure will become the victim of cyber-attacks. For over a century manufacturing has relied heavily upon the use of quality control (QC) systems to detect quality losses and ensure the production of high-quality parts. However, current QC approaches are not designed to detect the effects of a cyber-attack. An undetectable change in a manufacturing system can adversely affect a product's design intent, performance, quality, or perceived quality. The results could be financially devastating by delaying a product's launch, ruining equipment, increasing warranty costs, or losing customer trust. More importantly, attacks pose a risk to human safety as operators and consumers could be using faulty equipment and products. QC systems are based upon assumptions that may no longer be valid under the presence of an attack. In essence, these assumptions become vulnerabilities that can be used to make an attack undetectable. The goal of this Grant Opportunity for Academic Liaison with Industry (GOALI) research project is to identify vulnerabilities that exist in current QC systems and to develop new tools that significantly reduce or eliminate these vulnerabilities. The focus of this research is to approach the quality monitoring-detection-diagnosis cycle as an integrated cyber-physical security problem. A hybrid information technology (IT) and quality control system capable of detecting and compensating for quality losses caused by either physical or cyber process shifts will be investigated. The work focuses on statistical process control (SPC). For this endeavor, vulnerabilities will be identified across the three distinct phases of SPC, using a vulnerability identification study approach that takes the perspective of an attacker to understand what information could be used to identify and exploit vulnerabilities. Once these vulnerabilities are identified, new hybrid IT/QC tools will be created to supplement and/or replace currently used SPC approaches to significantly reduce or eliminate their weaknesses to cyber-attacks. Furthermore, these new tools will be developed considering multiple vulnerability levels, based on the type of information used to exploit the system.