CAREER: Trustworthy and Adaptive Intrusion Tolerance Capabilities in Cyber-Physical Critical Infrastructures

网络物理关键基础设施集成了计算和物理过程网络，为社会提供基本服务。特别是，电网是一个巨大的、相互连接的网络物理网络，用于将电力从发电厂输送到终端用户。保护电网的关键基础设施是至关重要的，因为这些系统的故障将对经济安全以及公共卫生和安全产生破坏性影响。然而，最近的几次大规模停电以及过去四年来重大攻击数量的显著增加证实了目前对这些系统的保护解决方案的不足。现有繁琐的手动容错程序无法保护这些电网免受复杂攻击。此外，使用纯粹的网络安全解决方案来实现电网的弹性是不够的，因为它们忽略了网络-物理相互依赖、电源侧传感器测量以及电力基础设施中对策的可能性。本研究的目标是调查网络-物理容忍度的基本问题，并开发一套集成的数学上严格的和现实世界可部署的能力，从而产生一个能够以接近实时的方式对计算、物理或通信资产中的复杂安全事件进行建模、分析、预测和容忍的系统。该研究将通过跟踪网络物理基础设施、S分布式安全事件引起的动态演变、最优的主动响应和恢复对策以及对未来潜在安全事件的自适应准备，为系统管理员和电网运营商提供可扩展的在线集成的网络物理监测和事件响应能力，为下一代复杂和大规模电网的可靠运行提供支持。研究成果将被整合到教育和知识转移倡议中，其中包括实施课程活动、创新的学习游戏开发、大学研讨会、实践K-12夏令营和学年高中课程，以及行业技术转移努力，以培养一支能够跨多个学科进行推理的劳动力队伍。通过全面考虑对抗情况下的网络和物理因素，这项基础性工作将适用于其他网络物理领域，并可以改变人们处理网络物理安全问题的方式。

Cyber-physical critical infrastructures integrate networks of computational and physical processes to provide the society with essential services. The power grid, in particular, is a vast and interconnected cyber-physical network for delivering electricity from generation plants to end-point consumers. Protecting power grid critical infrastructures is a vital necessity because the failure of these systems would have a debilitating impact on economic security and public health and safety. However, several recent large-scale outages and the significant increase in the number of major attacks over the past four years confirm the insufficiency of the current protection solutions for these systems. Existing tedious manual tolerance procedures cannot protect those grids against sophisticated attacks. Additionally, use of purely-cyber security solutions for power grid resiliency is not sufficient because they ignore the cyber-physical interdependencies, power-side sensor measurements, and the possibility of countermeasures in power infrastructures.The objective of this research is to investigate fundamental problems in cyber-physical tolerance and develop an integrated set of mathematically rigorous and real-world deployable capabilities, resulting in a system that can model, analyze, predict, and tolerate complex security incidents in computing, physical, or communication assets in a near-real-time manner. The proposed research will provide system administrators and power grid operators with scalable and online integrated cyber-physical monitoring and incident response capabilities through keeping track of cyber-physical infrastructure?s dynamic evolution caused by distributed security incidents, optimal proactive response and recovery countermeasures and adaptive preparation for potential future security incidents.The proposed research will facilitate trustworthy operation of next-generation complex and large-scale power grids. The research outcomes will be integrated into educational and knowledge transfer initiatives that involves implementation of curricular activities, innovative learning game development, university workshops, and hands-on K-12 summer camps and academic-year high-school courses, as well as Industry technology transfer efforts to develop a workforce with the capability to reason across multiple disciplines. Through holistic consideration of both cyber and physical factors under adversarial situations, this fundamental work will be applicable to other cyber-physical domains and can transform the way people approach the problem of cyber-physical security.