CRII: SaTC: Preempting Physical Damage from Control-Related Attacks on Smart Grids' Cyber-Physical Infrastructure

与控制相关的攻击对智能电网等网络物理系统（cps）是一个严重的威胁，因为它们可以通过使用以合法格式制作的恶意控制命令来引入灾难性的物理破坏。虽然目前的研究工作主要集中在检测导致物理损害的恶意命令，但研究人员建议在对手发出恶意命令之前，通过破坏和误导对手的准备来先发制人地防止损害。为了实现这一目标，建议的工作包括：(i)表征智能电网中网络和物理领域正常活动之间的依赖关系；（ii）确定网络欺骗范例，通过代表不存在的计算节点注入网络数据包来破坏对手对智能电网的了解；（三）制作诱饵测量，误导对手设计无伤害的攻击策略。拟议的工作将使用软件定义网络（SDN）在不改变电网物理基础设施的情况下防止智能电网的物理损坏。随着SDN在不同CPS中的广泛应用，这项工作可以作为未来研究的基础，扩展到更广泛的CPS和物联网领域，这些领域连接来自不同应用的设备，如智能健康和智能家居。由于CPS公司正在使用先进的网络技术升级其网络基础设施，因此这项工作在实际公用事业环境中具有很好的应用前景，可以提高其弹性。拟议的工作有可能将目前的被动探测方法转变为先发制人的方法，用误导性的信息解除对手的武装。这项工作包括以下重点：(i)发展跨学科方法，通过结合数据分析和系统规范来确定网络和物理领域活动之间的依赖关系。这些方法以Bro网络分析仪实现的深度包网络监测的真实数据为驱动，通过整合不同学科的知识，揭示智能电网的全面运行逻辑。（ii）创建基于sdn的平台，以确定类似于正常活动的网络欺骗范例。通过在Bro网络分析仪和SDN网络控制器之间建立交互，调查人员将使用系统活动建模来注入与正常流量在统计上无法区分的网络流量，以防止攻击者了解真实的系统配置，而不会影响合法的应用程序。（iii）创建一种算法，以制作误导对手的诱饵测量。为了制作欺骗数据包的应用层有效载荷，研究人员将把对手的攻击准备过程建模为一个优化问题，从而确定诱饵测量，这些测量将误导对手设计针对不存在的组件的攻击，从而导致很少（如果有的话）物理损害。（iv）使用网络物理试验台验证拟议的先发制人方法，该试验台集成了实际sdn启用的开关和由实际操作数据驱动的电力系统模拟。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Control-related attacks are a severe threat to cyber-physical systems (CPSs) such as smart grids, because they can introduce catastrophic physical damage by using malicious control commands crafted in a legitimate format. While current research efforts have focused on detecting malicious commands that lead to physical damage, the investigator proposes to preemptively prevent the damage by disrupting and misleading adversaries' preparation before they issue the malicious commands. To achieve this objective, the proposed work includes: (i) characterizing dependencies between normal activities from both the cyber and physical domains in smart grids; (ii) determining a network spoofing paradigm to disrupt adversaries' knowledge of smart grids by injecting network packets on behalf of nonexistent computing nodes; and (iii) crafting decoy measurements to mislead adversaries into designing damage-free attack strategies. The proposed work will use software-defined networking (SDN) to prevent physical damage in smart grids without changing the grids' physical infrastructure. With the wide use of SDN in different CPSs, this work may serve as the basis for future research that extends to the broader domains of CPS and Internet-of-Things, which connect devices from different applications, such as smart health and smart home. Since CPS companies are upgrading their cyberinfrastructure with advanced network technologies, this work has promising applications in real utility environments to increase their resilience.The proposed work has the potential to transform current passive detection methods into preemptive approaches that disarm adversaries with misleading information. This work includes the following thrusts: (i) Development of interdisciplinary methods to identify dependencies between activities from the cyber and physical domains by combining data analytics and system specifications. Driven by real data collected from deep-packet network monitoring enabled by the Bro network analyzer, these methods will reveal the thorough operational logic of smart grids by integrating knowledge from different disciplines. (ii) Creation of an SDN-based platform to determine a network spoofing paradigm that resembles normal activities. By establishing interactions between the Bro network analyzer and SDN network controllers, the investigator will use the modeling of system activities to inject network traffic that is statistically indistinguishable from normal traffic to prevent adversaries from learning the true system configuration, without affecting legitimate applications. (iii) Creation of an algorithm to craft decoy measurements that mislead adversaries. To craft the application-layer payload of the spoofed packets, the investigator will model adversaries' attack preparation procedure as an optimization problem and thus determine decoy measurements that will mislead adversaries into designing attacks that target nonexistent components to thus induce little if any physical damage. (iv) Validation of the proposed preemptive approach using a cyber-physical testbed that integrates real SDN-enabled switches and power system simulations driven by real operational data.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.