Data-Driven Approaches for Cyber Security of Critical Infrastructures

关键基础设施网络安全的数据驱动方法

• 批准号: RGPIN-2020-06482
• 负责人: Shi, Wei
• 金额: $ 2.11万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=741242
• 关键词: Data; Driven; Approaches; Cyber; Security

A distributed system is a system whose components are located on different networked entities (e.g., computers, sensors) that communicate and coordinate their actions by exchanging messages. These entities have a shared state, operate concurrently and can fail independently without affecting the whole system's uptime. With the ever-growing technological expansion of the world, distributed systems are becoming more and more widespread. In past years, I have addressed the protection and resilience of distributed systems such as Clouds, Data Centres, Mobile Agent and Actuator Networks, Vehicular and Wireless Sensor Networks. Building on this expertise, in the medium term, I plan to address various cyber security issues and develop attack resilient solutions for a very important type of distributed systems, namely the industrial automated control systems and networks that are monitoring and controlling the operation of critical infrastructures in different sectors. These include the Energy sector (e.g., oil pipelines, nuclear plants), the Financial sector, Government Operations, Water Supply, Health Systems and more. Cyber-attacks against critical infrastructures have increased significantly in the last decade and caused serious damage with very important social and economic losses. However, research on protecting the control systems of critical infrastructures against cyber-attacks is still at an early stage and faces many open technical challenges. For this current research plan proposal, I will address a specific critical energy infrastructure, namely Electrical Power Systems (EPSs). The facilities of an EPS are often scattered over thousands of square kilometres. SCADA is a tool to control such a geographically dispersed system. The focus of my research over the next five years will be on the following three objectives: 1)Mitigate cyber-attacks against SCADA-based EPS systems by developing new data-driven security analysis and vulnerability assessment methods to understand and monitor the tight interaction between software events/behaviors resulting from attacks and the events/behaviors observable at the network level of an EPS. It is the consideration of the close relationship between the cyber and the physical level that sets my research apart from existing approaches (which often overlook the physical level). Moreover, I have the necessary equipment to monitor this relationship in an EPS. 2)Protect against and respond to malicious attacks by developing new real-time machine-learning-based intrusion detection techniques for monitoring both cyber-layer data and data describing the physical behavior of EPSs. 3)Recover from attacks on EPSs by building a data-driven attack-resilient SCADA-based system that can maintain its normal functions even when under attack. Ultimately, my proposal aligns well with the mandate of Natural Resources Canada to protect critical energy infrastructures and DND's interest in resilient networked systems.

分布式系统是其组件位于不同的联网实体(例如，计算机、传感器)上的系统，这些实体通过交换消息来通信和协调它们的动作。这些实体具有共享状态、并发运行，并且可以独立发生故障，而不会影响整个系统的正常运行时间。随着世界技术的不断扩张，分布式系统正变得越来越广泛。在过去的几年里，我讨论了分布式系统的保护和弹性，如云、数据中心、移动代理和执行器网络、车辆和无线传感器网络。在此专业知识的基础上，我计划在中期内解决各种网络安全问题，并为一种非常重要的分布式系统开发可抵御攻击的解决方案，即监测和控制不同行业关键基础设施运行的工业自动化控制系统和网络。这些部门包括能源部门(如石油管道、核电站)、金融部门、政府业务、供水、卫生系统等。过去十年，针对关键基础设施的网络攻击大幅增加，造成了严重的破坏，造成了非常重大的社会和经济损失。然而，保护关键基础设施的控制系统免受网络攻击的研究仍处于早期阶段，面临着许多开放的技术挑战。对于目前的研究计划提案，我将讨论一个特定的关键能源基础设施，即电力系统(EPSS)。EPS的设施通常散布在数千平方公里的土地上。SCADA是一种控制这种地理上分散的系统的工具。在接下来的五年里，我的研究重点将集中在以下三个目标上：1)通过开发新的数据驱动的安全分析和漏洞评估方法来了解和监控攻击导致的软件事件/行为与EPS网络级别可观察到的事件/行为之间的紧密交互，从而缓解针对基于SCADA的EPS系统的网络攻击。正是考虑到网络和物理层面之间的密切关系，我的研究有别于现有的方法(通常忽略了物理层面)。此外，我有必要的设备来监控EPS中的这种关系。2)通过开发新的基于机器学习的实时入侵检测技术来监控网络层数据和描述EPS物理行为的数据，来防御和响应恶意攻击。3)通过构建数据驱动、攻击弹性强的SCADA系统，即使受到攻击也能保持正常功能，从而从EPS受到攻击的情况下恢复。归根结底，我的建议与加拿大自然资源部保护关键能源基础设施的任务以及国防部对弹性网络系统的兴趣非常一致。