CAREER: Trustworthy and Adaptive Intrusion Tolerance Capabilities in Cyber-Physical Critical Infrastructures

网络物理关键基础设施整合了计算和物理过程的网络，为社会提供基本服务。特别是电网，它是一个巨大的互联网络，用于将电力从发电厂输送到终端消费者。保护电网关键基础设施至关重要，因为这些系统的故障将对经济安全和公共健康和安全产生破坏性影响。然而，最近几次大规模停电和过去四年来重大攻击数量的显著增加证实了这些系统目前的保护解决方案的不足。现有繁琐的人工容错程序不能保护这些网格免受复杂的攻击。此外，使用纯粹的网络安全解决方案来实现电网弹性是不够的，因为它们忽略了网络物理的相互依赖性，电力侧传感器测量以及电力基础设施中对策的可能性。本研究的目标是调查网络物理耐受性的基本问题，并开发一套完整的数学严格和现实世界可部署的能力，从而产生能够以接近实时的方式对计算、物理或通信资产中的复杂安全事件进行建模、分析、预测和容忍的系统。拟议的研究将通过跟踪网络物理基础设施，为系统管理员和电网运营商提供可扩展的在线集成网络物理监测和事件响应能力。的动态演化所造成的分布式安全事件，最佳的主动响应和恢复对策，并为未来潜在的安全事件的自适应准备，拟议的研究将促进下一代复杂的大规模电网的可靠运行。研究成果将被整合到教育和知识转移计划中，其中涉及实施课程活动、创新学习游戏开发、大学研讨会、实践K-12夏令营和学年高中课程，以及行业技术转移工作，以培养一支具有跨学科推理能力的劳动力队伍。通过全面考虑对抗情况下的网络和物理因素，这项基础工作将适用于其他网络物理领域，并可以改变人们处理网络物理安全问题的方式。

Cyber-physical critical infrastructures integrate networks of computational and physical processes to provide the society with essential services. The power grid, in particular, is a vast and interconnected cyber-physical network for delivering electricity from generation plants to end-point consumers. Protecting power grid critical infrastructures is a vital necessity because the failure of these systems would have a debilitating impact on economic security and public health and safety. However, several recent large-scale outages and the significant increase in the number of major attacks over the past four years confirm the insufficiency of the current protection solutions for these systems. Existing tedious manual tolerance procedures cannot protect those grids against sophisticated attacks. Additionally, use of purely-cyber security solutions for power grid resiliency is not sufficient because they ignore the cyber-physical interdependencies, power-side sensor measurements, and the possibility of countermeasures in power infrastructures.The objective of this research is to investigate fundamental problems in cyber-physical tolerance and develop an integrated set of mathematically rigorous and real-world deployable capabilities, resulting in a system that can model, analyze, predict, and tolerate complex security incidents in computing, physical, or communication assets in a near-real-time manner. The proposed research will provide system administrators and power grid operators with scalable and online integrated cyber-physical monitoring and incident response capabilities through keeping track of cyber-physical infrastructure?s dynamic evolution caused by distributed security incidents, optimal proactive response and recovery countermeasures and adaptive preparation for potential future security incidents.The proposed research will facilitate trustworthy operation of next-generation complex and large-scale power grids. The research outcomes will be integrated into educational and knowledge transfer initiatives that involves implementation of curricular activities, innovative learning game development, university workshops, and hands-on K-12 summer camps and academic-year high-school courses, as well as Industry technology transfer efforts to develop a workforce with the capability to reason across multiple disciplines. Through holistic consideration of both cyber and physical factors under adversarial situations, this fundamental work will be applicable to other cyber-physical domains and can transform the way people approach the problem of cyber-physical security.