CAREER: Trustworthy and Adaptive Intrusion Tolerance Capabilities in Cyber-Physical Critical Infrastructures

信息物理关键基础设施集成了计算和物理过程网络，为社会提供基本服务。特别是电网，它是一个巨大的、相互连接的信息物理网络，用于将电力从发电厂输送到终端消费者。保护电网关键基础设施是至关重要的，因为这些系统的故障将对经济安全和公共健康和安全产生破坏性影响。然而，最近几次大规模中断和过去四年中主要攻击数量的显着增加证实了这些系统当前保护解决方案的不足。现有繁琐的人工容错程序无法保护这些网格免受复杂的攻击。此外，使用纯网络安全解决方案来提高电网弹性是不够的，因为它们忽略了网络物理相互依赖性、功率侧传感器测量以及电力基础设施中对策的可能性。本研究的目的是研究网络物理容忍度中的基本问题，并开发一套数学上严格的、可在现实世界中部署的综合能力，从而形成一个能够以近乎实时的方式对计算、物理或通信资产中的复杂安全事件进行建模、分析、预测和容忍度的系统。拟议的研究将通过跟踪网络物理基础设施，为系统管理员和电网运营商提供可扩展的在线集成网络物理监测和事件响应能力。分布式安全事件导致的动态演化，针对未来潜在安全事件的最优主动响应和恢复对策，自适应准备。该研究将促进下一代复杂大规模电网的可靠运行。研究成果将整合到教育和知识转移计划中，包括实施课程活动，创新学习游戏开发，大学研讨会，动手K-12夏令营和学年高中课程，以及行业技术转移努力，以培养具有跨多学科推理能力的劳动力。通过全面考虑对抗情况下的网络和物理因素，这项基础工作将适用于其他网络物理领域，并可以改变人们处理网络物理安全问题的方式。

Cyber-physical critical infrastructures integrate networks of computational and physical processes to provide the society with essential services. The power grid, in particular, is a vast and interconnected cyber-physical network for delivering electricity from generation plants to end-point consumers. Protecting power grid critical infrastructures is a vital necessity because the failure of these systems would have a debilitating impact on economic security and public health and safety. However, several recent large-scale outages and the significant increase in the number of major attacks over the past four years confirm the insufficiency of the current protection solutions for these systems. Existing tedious manual tolerance procedures cannot protect those grids against sophisticated attacks. Additionally, use of purely-cyber security solutions for power grid resiliency is not sufficient because they ignore the cyber-physical interdependencies, power-side sensor measurements, and the possibility of countermeasures in power infrastructures.The objective of this research is to investigate fundamental problems in cyber-physical tolerance and develop an integrated set of mathematically rigorous and real-world deployable capabilities, resulting in a system that can model, analyze, predict, and tolerate complex security incidents in computing, physical, or communication assets in a near-real-time manner. The proposed research will provide system administrators and power grid operators with scalable and online integrated cyber-physical monitoring and incident response capabilities through keeping track of cyber-physical infrastructure?s dynamic evolution caused by distributed security incidents, optimal proactive response and recovery countermeasures and adaptive preparation for potential future security incidents.The proposed research will facilitate trustworthy operation of next-generation complex and large-scale power grids. The research outcomes will be integrated into educational and knowledge transfer initiatives that involves implementation of curricular activities, innovative learning game development, university workshops, and hands-on K-12 summer camps and academic-year high-school courses, as well as Industry technology transfer efforts to develop a workforce with the capability to reason across multiple disciplines. Through holistic consideration of both cyber and physical factors under adversarial situations, this fundamental work will be applicable to other cyber-physical domains and can transform the way people approach the problem of cyber-physical security.