CAREER: Formal TOols foR SafEty aNd Security of Industrial Control Systems (FORENSICS)

该项目的目标是开发一个多层安全框架，为控制技术人员和工程师提供更优越的机制，以应对易受攻击的水处理厂日益增加的网络安全攻击风险，并减少对公共卫生和安全、工业和国家安全的潜在风险。这些发现将产生知识库和取证工具，以帮助控制工程师快速检测和缓解控制系统中中央组件的潜在安全缺陷，包括工业控制软件、传感器和执行器。工业控制系统对美国许多最大的制造商以及水处理设施、石油和天然气生产以及发电厂的运营都是不可或缺的。对于组织来说，通过将其控制系统连接到互联网来促进组织或子公司之间以及组织之间的通信和效率的提高，这一点正变得越来越普遍。然而，在这样做的过程中，他们变得容易受到网络攻击，这些攻击可能会对城市或地区人口或地理上分散的生产链造成重大危险或破坏。该项目通过以下方式填补研究和部署空白：(1)开发可靠且可扩展的正式框架，以向控制技术人员提供实用的工具包，以在没有任何网络安全专业知识的情况下将安全集成到控制软件中；(2)开发过程控制异常检测机制和可视化工具；(3)开发新的实验方法和软件，以调查传感器和执行器的安全性，并检测基于高级持续威胁(APT)的入侵，(4)为学生、教师、控制工程师和控制技术人员提供培训，使他们更好地准备提出有关网络安全的问题，并在他们的日常责任中调查如何解决网络安全问题。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of the project is to develop a multi-layer security framework to provide control technicians and engineers with far superior mechanisms to address the increasing risk of cybersecurity attack on vulnerable water treatment plants and reduce latent risks to public health and safety, industry, and national security. The findings will generate knowledge base and forensic tools to help control engineers to quickly detect and mitigate potential security flaws in central components across control systems, including industrial control software, sensors, and actuators. Industrial control systems are integral to the operations of many of the nation's largest manufacturers as well as to water treatment facilities, oil and gas production, and power plants. It is becoming increasingly common for organizations to facilitate improved communication and efficiency across and between organizations or subsidiaries by connecting their control systems to the Internet. However, in so doing, they become vulnerable to cyberattacks that could result in significant danger or disruption to city or regional populations or to geographically dispersed production chains.The project fills research and deployment gaps by developing a reliable and scalable formal framework by (1) developing formal models, algorithms, tools, and libraries to provide control technicians with a practical toolkit to integrate security into the control software without any expertise in cybersecurity, (2) developing process control anomaly detection mechanism and visualization tools, (3) developing new experimental methods and software to investigate the security of sensors and actuators and detect intrusions that are based on the Advanced Persistent Threat (APT), (4) providing training for students, teachers, control engineers, and control technicians to be more prepared to ask questions about cybersecurity and investigate how to tackle cybersecurity in their daily responsibilities.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.