Collaborative Research: SaTC: CORE: Medium: Cyber-threat Detection and Diagnosis in Multistage Manufacturing Systems through Cyber and Physical Data Analytics

协作研究：SaTC：核心：中：通过网络和物理数据分析进行多级制造系统中的网络威胁检测和诊断

• 批准号: 2019340
• 负责人: Peng Liu
• 金额: $ 30万
• 依托单位: Pennsylvania State Univ University Park
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2020
• 资助国家: 美国
• 起止时间: 2020-10-01 至 2025-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2019340&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

In modern multistage manufacturing systems, with increased software-defined automation and control as well as monitoring of manufacturing assets across networks, exposure to cyber-attacks also grows. The cyber-threats may compromise the integrity of manufacturing assets (manufacturing systems and processes, machine tools, fabricated parts), reduce manufacturing productivity, and increase costs. Some cyber-threats including integrity attacks are only partially observable in cyberspace alone, and therefore need to be detected and diagnosed through inter-dependency analysis of both cyber and physical signals. Thus, there is a significant opportunity in exploring physical signals, together with cyber signals, to advance trustworthy manufacturing system research and design. This project brings together leading researchers from manufacturing systems, computer security, and electrical drives to develop and demonstrate a new methodology and tool for cyber-threat detection and diagnosis in multistage manufacturing systems. The cyber-security tool will monitor a variety of cyber and physical signals and perform cyber-threat detection and root cause diagnosis through advanced cyber-physical data fusion and taint analysis. The goal is to enable the prevention and mitigation of potential harms at the early stage, proactive and predictive maintenance, and countermeasures. This project attempts to integrate and analyze the process and quality signals, and the signals from the power networks and cyber networks of multistage manufacturing systems to detect and diagnose cyber-threats. This new systematic approach expects to capture new cyber-threats, especially data integrity attacks, that traditional cyber-security approaches may not capture. The proposed data analytics and methodology for integrating cyber and physical signals will advance a fundamental understanding of cyber-threat detection and diagnosis in multistage manufacturing systems and can broadly apply to other cyber-physical systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

在现代多阶段制造系统中，随着软件定义的自动化和控制以及跨网络监控制造资产的增加，暴露在网络攻击下的风险也在增加。网络威胁可能会损害制造业资产(制造系统和流程、机床、零部件)的完整性，降低制造业生产率，并增加成本。一些网络威胁，包括完整性攻击，仅在网络空间中只能部分观察到，因此需要通过对网络信号和物理信号的相互依存分析来检测和诊断。因此，在探索物理信号和网络信号方面，有一个重大的机会来推动值得信赖的制造系统研究和设计。该项目汇集了来自制造系统、计算机安全和电气驱动的领先研究人员，以开发和演示用于多阶段制造系统中的网络威胁检测和诊断的新方法和工具。网络安全工具将监测各种网络和物理信号，并通过先进的网络-物理数据融合和污点分析执行网络威胁检测和根本原因诊断。目标是能够在早期阶段预防和缓解潜在危害，进行前瞻性和预测性维护，并采取对策。该项目试图集成和分析多阶段制造系统的过程和质量信号，以及来自电力网络和网络的信号，以检测和诊断网络威胁。这种新的系统化方法有望捕获新的网络威胁，特别是数据完整性攻击，而传统的网络安全方法可能无法捕获这些威胁。建议的数据分析和集成网络和物理信号的方法将促进对多阶段制造系统中的网络威胁检测和诊断的基本理解，并可广泛应用于其他网络物理系统。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

• DOI: 10.1109/jiot.2023.3303780
• 发表时间: 2023-12
• 期刊: IEEE Internet of Things Journal
• 影响因子: 10.6
• 作者: Lingyun Situ;Chi Zhang;Le Guan;Zhiqiang Zuo;Linzhang Wang;Xuandong Li;Peng Liu;Jin Shi

Identifying Channel Related Vulnerabilities in Zephyr Firmware

• DOI: 10.1109/ithings-greencom-cpscom-smartdata-cybermatics55523.2022.00055
• 发表时间: 2022-08
• 期刊: 2022 IEEE International Conferences on Internet of Things (iThings) and IEEE Green Computing & Communications (GreenCom) and IEEE Cyber, Physical & Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics)
• 作者: Devansh Rajgarhia;Peng Liu;S. Sural

A co-design adaptive defense scheme with bounded security damages against Heartbleed-like attacks

一种针对类似 Heartbleed 的攻击具有有限安全损害的协同设计自适应防御方案

• DOI: 10.1109/tifs.2021.3113512
• 发表时间: 2021
• 期刊: IEEE Transactions on Information Forensics and Security
• 影响因子: 6.8
• 作者: Hu, Zhisheng;Chen, Ping;Zhu, Minghui;Liu, Peng
• 通讯作者: Liu, Peng

Recompose Event Sequences vs. Predict Next Events: A Novel Anomaly Detection Approach for Discrete Event Logs

• DOI: 10.1145/3433210.3453098
• 发表时间: 2020-12
• 期刊: Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security
• 作者: Lun-Pin Yuan;Peng Liu;Sencun Zhu

Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation

• DOI: 10.1145/3427228.3427280
• 发表时间: 2020-12
• 期刊: Proceedings of the 36th Annual Computer Security Applications Conference
• 作者: Chen Cao;Le Guan;Jiang Ming;Peng Liu