GOALI: Robust Quality Control Tools for Cyber-Physical Manufacturing Systems: Assessing and Eliminating Cyber-Attack Vulnerabilities

随着信息时代的进步，网络攻击变得越来越恶毒，但可见性却在下降。与此同时，先进制造系统严重依赖新的网络技术，如基于互联网的计算机辅助工程支持工具和网络化制造和检测设备。虽然由此产生的数据连接加快了产品/工艺设计周期，并允许广泛的分析能力，但它也导致进入制造系统的数字入口点增加。因此，问题不再是我们的制造业基础设施是否会成为网络攻击的受害者，而是何时成为受害者。一个多世纪以来，制造业一直严重依赖质量控制(QC)系统来检测质量损失并确保生产出高质量的零部件。然而，目前的质量控制方法并不是为了检测网络攻击的影响而设计的。制造系统中不可察觉的变化可能会对产品的设计意图、性能、质量或感知质量产生不利影响。推迟产品的发布、损坏设备、增加保修成本或失去客户信任，可能会造成财务上的毁灭性后果。更重要的是，由于运营商和消费者可能使用有问题的设备和产品，攻击对人类安全构成了风险。QC系统基于的假设在攻击出现时可能不再有效。本质上，这些假设变成了漏洞，可以用来使攻击变得不可检测。GOALI学术联络机会(GOALI)研究项目的目标是确定当前QC系统中存在的漏洞，并开发新的工具来显著减少或消除这些漏洞。本研究的重点是将质量监测-检测-诊断循环作为一个综合的网络-物理安全问题来探讨。将研究一种混合信息技术和质量控制系统，该系统能够检测和补偿因物理或网络流程转移而造成的质量损失。工作重点是统计过程控制(SPC)。在这项工作中，将使用漏洞识别研究方法在SPC的三个不同阶段识别漏洞，该方法从攻击者的角度了解哪些信息可用于识别和利用漏洞。一旦确定了这些漏洞，将创建新的IT/QC混合工具来补充和/或取代当前使用的SPC方法，以显著减少或消除它们在网络攻击中的弱点。此外，这些新工具将根据用于利用该系统的信息类型，考虑到多个漏洞级别而开发。

As the information age progresses, cyber-attacks have become increasingly malicious while decreasing in visibility. At the same time, advanced manufacturing systems rely heavily on new cyber-technologies, such as internet-based computer aided engineering support tools and networked manufacturing and inspection equipment. While the resulting data connectivity has accelerated the product/process design-cycle and allowed for extensive analytical capabilities, it has also resulted in an increase of digital entry points into a manufacturing system. Therefore, it is no longer a question of if, but rather when, our manufacturing infrastructure will become the victim of cyber-attacks. For over a century manufacturing has relied heavily upon the use of quality control (QC) systems to detect quality losses and ensure the production of high-quality parts. However, current QC approaches are not designed to detect the effects of a cyber-attack. An undetectable change in a manufacturing system can adversely affect a product's design intent, performance, quality, or perceived quality. The results could be financially devastating by delaying a product's launch, ruining equipment, increasing warranty costs, or losing customer trust. More importantly, attacks pose a risk to human safety as operators and consumers could be using faulty equipment and products. QC systems are based upon assumptions that may no longer be valid under the presence of an attack. In essence, these assumptions become vulnerabilities that can be used to make an attack undetectable. The goal of this Grant Opportunity for Academic Liaison with Industry (GOALI) research project is to identify vulnerabilities that exist in current QC systems and to develop new tools that significantly reduce or eliminate these vulnerabilities. The focus of this research is to approach the quality monitoring-detection-diagnosis cycle as an integrated cyber-physical security problem. A hybrid information technology (IT) and quality control system capable of detecting and compensating for quality losses caused by either physical or cyber process shifts will be investigated. The work focuses on statistical process control (SPC). For this endeavor, vulnerabilities will be identified across the three distinct phases of SPC, using a vulnerability identification study approach that takes the perspective of an attacker to understand what information could be used to identify and exploit vulnerabilities. Once these vulnerabilities are identified, new hybrid IT/QC tools will be created to supplement and/or replace currently used SPC approaches to significantly reduce or eliminate their weaknesses to cyber-attacks. Furthermore, these new tools will be developed considering multiple vulnerability levels, based on the type of information used to exploit the system.