CRII: SaTC: Preempting Physical Damage from Control-Related Attacks on Smart Grids' Cyber-Physical Infrastructure

与控制相关的攻击是对智能电网等网络物理系统(CPSS)的严重威胁，因为它们可以通过使用以合法格式编制的恶意控制命令来带来灾难性的物理损害。虽然目前的研究工作集中在检测导致物理损害的恶意命令上，但调查员建议通过在对手发出恶意命令之前中断和误导他们的准备来先发制人地防止损害。为了实现这一目标，拟议的工作包括：(I)表征智能电网中来自网络域和物理域的正常活动之间的依赖关系；(Ii)确定网络欺骗范例，通过代表不存在的计算节点注入网络分组来扰乱攻击者对智能电网的了解；以及(Iii)制作诱骗测量来误导攻击者设计无损害攻击策略。这项拟议的工作将使用软件定义的联网(SDN)来防止智能电网的物理损害，而不会改变电网的物理基础设施。随着SDN在不同的CPSS中的广泛使用，这项工作可能会作为未来研究的基础，扩展到更广泛的CPS和物联网领域，这些领域连接了来自不同应用的设备，如智能医疗和智能家居。由于CPS公司正在用先进的网络技术升级他们的网络基础设施，这项工作在真实的实用环境中具有很好的应用前景，以增加他们的弹性。拟议的工作有可能将当前的被动检测方法转变为先发制人的方法，以误导性信息解除对手的武装。这项工作包括以下工作：(I)开发跨学科方法，通过结合数据分析和系统规格来确定网络和物理领域活动之间的相关性。在Bro网络分析仪启用的深度分组网络监控中收集的真实数据的驱动下，这些方法将通过整合不同学科的知识来揭示智能电网的彻底运行逻辑。(2)建立一个基于SDN的平台，以确定类似于正常活动的网络欺骗范例。通过建立Bro网络分析器和SDN网络控制器之间的交互，调查员将使用系统活动建模来注入在统计上无法与正常流量区分的网络流量，以防止攻击者学习真实的系统配置，而不会影响合法应用程序。(3)创建一种算法，以制作误导对手的诱饵测量方法。为了手工制作欺骗数据包的应用层有效负载，调查者将把对手的攻击准备过程建模为一个优化问题，从而确定诱饵测量，这些测量将误导攻击者设计针对不存在的组件的攻击，从而几乎不会造成任何物理损害。(Iv)使用网络物理试验台验证建议的先发制人方法，该试验台集成了实际的启用SDN的开关和由实际运行数据驱动的电力系统仿真。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Control-related attacks are a severe threat to cyber-physical systems (CPSs) such as smart grids, because they can introduce catastrophic physical damage by using malicious control commands crafted in a legitimate format. While current research efforts have focused on detecting malicious commands that lead to physical damage, the investigator proposes to preemptively prevent the damage by disrupting and misleading adversaries' preparation before they issue the malicious commands. To achieve this objective, the proposed work includes: (i) characterizing dependencies between normal activities from both the cyber and physical domains in smart grids; (ii) determining a network spoofing paradigm to disrupt adversaries' knowledge of smart grids by injecting network packets on behalf of nonexistent computing nodes; and (iii) crafting decoy measurements to mislead adversaries into designing damage-free attack strategies. The proposed work will use software-defined networking (SDN) to prevent physical damage in smart grids without changing the grids' physical infrastructure. With the wide use of SDN in different CPSs, this work may serve as the basis for future research that extends to the broader domains of CPS and Internet-of-Things, which connect devices from different applications, such as smart health and smart home. Since CPS companies are upgrading their cyberinfrastructure with advanced network technologies, this work has promising applications in real utility environments to increase their resilience.The proposed work has the potential to transform current passive detection methods into preemptive approaches that disarm adversaries with misleading information. This work includes the following thrusts: (i) Development of interdisciplinary methods to identify dependencies between activities from the cyber and physical domains by combining data analytics and system specifications. Driven by real data collected from deep-packet network monitoring enabled by the Bro network analyzer, these methods will reveal the thorough operational logic of smart grids by integrating knowledge from different disciplines. (ii) Creation of an SDN-based platform to determine a network spoofing paradigm that resembles normal activities. By establishing interactions between the Bro network analyzer and SDN network controllers, the investigator will use the modeling of system activities to inject network traffic that is statistically indistinguishable from normal traffic to prevent adversaries from learning the true system configuration, without affecting legitimate applications. (iii) Creation of an algorithm to craft decoy measurements that mislead adversaries. To craft the application-layer payload of the spoofed packets, the investigator will model adversaries' attack preparation procedure as an optimization problem and thus determine decoy measurements that will mislead adversaries into designing attacks that target nonexistent components to thus induce little if any physical damage. (iv) Validation of the proposed preemptive approach using a cyber-physical testbed that integrates real SDN-enabled switches and power system simulations driven by real operational data.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.