Data-Driven Approaches for Cyber Security of Critical Infrastructures

点击翻译按钮获取中文摘要

A distributed system is a system whose components are located on different networked entities (e.g., computers, sensors) that communicate and coordinate their actions by exchanging messages. These entities have a shared state, operate concurrently and can fail independently without affecting the whole system's uptime. With the ever-growing technological expansion of the world, distributed systems are becoming more and more widespread. In past years, I have addressed the protection and resilience of distributed systems such as Clouds, Data Centres, Mobile Agent and Actuator Networks, Vehicular and Wireless Sensor Networks. Building on this expertise, in the medium term, I plan to address various cyber security issues and develop attack resilient solutions for a very important type of distributed systems, namely the industrial automated control systems and networks that are monitoring and controlling the operation of critical infrastructures in different sectors. These include the Energy sector (e.g., oil pipelines, nuclear plants), the Financial sector, Government Operations, Water Supply, Health Systems and more. Cyber-attacks against critical infrastructures have increased significantly in the last decade and caused serious damage with very important social and economic losses. However, research on protecting the control systems of critical infrastructures against cyber-attacks is still at an early stage and faces many open technical challenges. For this current research plan proposal, I will address a specific critical energy infrastructure, namely Electrical Power Systems (EPSs). The facilities of an EPS are often scattered over thousands of square kilometres. SCADA is a tool to control such a geographically dispersed system. The focus of my research over the next five years will be on the following three objectives: 1)Mitigate cyber-attacks against SCADA-based EPS systems by developing new data-driven security analysis and vulnerability assessment methods to understand and monitor the tight interaction between software events/behaviors resulting from attacks and the events/behaviors observable at the network level of an EPS. It is the consideration of the close relationship between the cyber and the physical level that sets my research apart from existing approaches (which often overlook the physical level). Moreover, I have the necessary equipment to monitor this relationship in an EPS. 2)Protect against and respond to malicious attacks by developing new real-time machine-learning-based intrusion detection techniques for monitoring both cyber-layer data and data describing the physical behavior of EPSs. 3)Recover from attacks on EPSs by building a data-driven attack-resilient SCADA-based system that can maintain its normal functions even when under attack. Ultimately, my proposal aligns well with the mandate of Natural Resources Canada to protect critical energy infrastructures and DND's interest in resilient networked systems.