GOALI: Robust Quality Control Tools for Cyber-Physical Manufacturing Systems: Assessing and Eliminating Cyber-Attack Vulnerabilities

随着信息时代的发展，网络攻击变得越来越恶意，同时可见性降低。与此同时，先进的制造系统严重依赖新的网络技术，如基于互联网的计算机辅助工程支持工具和网络化的制造和检测设备。虽然由此产生的数据连接加快了产品/工艺设计周期，并允许广泛的分析能力，但它也增加了制造系统的数字入口点。因此，问题不再是我们的制造业基础设施是否会成为网络攻击的受害者，而是何时成为受害者。世纪以来，制造业一直严重依赖于质量控制（QC）系统的使用，以检测质量损失并确保生产高质量的零件。然而，目前的QC方法并不是为了检测网络攻击的影响而设计的。制造系统中不可检测的变化可能会对产品的设计意图、性能、质量或感知质量产生不利影响。其结果可能是财务上的破坏性延迟产品的推出，破坏设备，增加保修成本，或失去客户的信任。更重要的是，攻击对人类安全构成风险，因为运营商和消费者可能使用有缺陷的设备和产品。质量控制系统是基于假设，可能不再有效的攻击下的存在。从本质上讲，这些假设变成了可用于使攻击无法检测的漏洞。该研究项目的目标是确定当前QC系统中存在的漏洞，并开发新的工具，以显着减少或消除这些漏洞。本研究的重点是将质量监测-检测-诊断循环作为一个集成的网络物理安全问题进行处理。一个混合的信息技术（IT）和质量控制系统能够检测和补偿所造成的质量损失无论是物理或网络过程的转变将进行调查。工作重点是统计过程控制（SPC）。奋进，将在SPC的三个不同阶段中识别漏洞，使用漏洞识别研究方法，从攻击者的角度了解哪些信息可用于识别和利用漏洞。一旦发现这些漏洞，将创建新的混合IT/QC工具，以补充和/或取代目前使用的SPC方法，以显著减少或消除其对网络攻击的弱点。此外，在开发这些新工具时，将根据利用该系统所使用的信息类型，考虑到多个脆弱程度。

As the information age progresses, cyber-attacks have become increasingly malicious while decreasing in visibility. At the same time, advanced manufacturing systems rely heavily on new cyber-technologies, such as internet-based computer aided engineering support tools and networked manufacturing and inspection equipment. While the resulting data connectivity has accelerated the product/process design-cycle and allowed for extensive analytical capabilities, it has also resulted in an increase of digital entry points into a manufacturing system. Therefore, it is no longer a question of if, but rather when, our manufacturing infrastructure will become the victim of cyber-attacks. For over a century manufacturing has relied heavily upon the use of quality control (QC) systems to detect quality losses and ensure the production of high-quality parts. However, current QC approaches are not designed to detect the effects of a cyber-attack. An undetectable change in a manufacturing system can adversely affect a product's design intent, performance, quality, or perceived quality. The results could be financially devastating by delaying a product's launch, ruining equipment, increasing warranty costs, or losing customer trust. More importantly, attacks pose a risk to human safety as operators and consumers could be using faulty equipment and products. QC systems are based upon assumptions that may no longer be valid under the presence of an attack. In essence, these assumptions become vulnerabilities that can be used to make an attack undetectable. The goal of this Grant Opportunity for Academic Liaison with Industry (GOALI) research project is to identify vulnerabilities that exist in current QC systems and to develop new tools that significantly reduce or eliminate these vulnerabilities. The focus of this research is to approach the quality monitoring-detection-diagnosis cycle as an integrated cyber-physical security problem. A hybrid information technology (IT) and quality control system capable of detecting and compensating for quality losses caused by either physical or cyber process shifts will be investigated. The work focuses on statistical process control (SPC). For this endeavor, vulnerabilities will be identified across the three distinct phases of SPC, using a vulnerability identification study approach that takes the perspective of an attacker to understand what information could be used to identify and exploit vulnerabilities. Once these vulnerabilities are identified, new hybrid IT/QC tools will be created to supplement and/or replace currently used SPC approaches to significantly reduce or eliminate their weaknesses to cyber-attacks. Furthermore, these new tools will be developed considering multiple vulnerability levels, based on the type of information used to exploit the system.