CIF: Small: Combining Information Theoretic Security and Stochastic Control to Study Advanced Persistent Threats

尽管在密码学和通信安全方面取得了巨大的进步，但信息攻击——无论是被动的，如窃听，还是主动的，如未经授权的数据注入——都可能严重损害结合了网络通信系统和网络物理组件的现代基础设施系统的功能。攻击者在不被发现的情况下持续监控传输数据或引入虚假信息的能力，可能导致敏感信息泄露或对底层系统造成严重损害，其后果包括飞机碰撞、电力中断和核反应堆故障。在本研究中，开发了严格的框架来研究网络物理系统对此类持续安全威胁的脆弱性，目标是设计新颖且具有弹性的系统控制器。研究对抗行为的系统方法不仅可以实现有效的网络警务，还可以为开发技术奠定平台，以防止下一代网络恐怖主义，这些恐怖主义旨在削弱能源，医疗保健，交通等基础设施系统。教育和推广部分将有助于提高社会对新兴的物联网潜在漏洞的认识，以及实现网络物理安全的途径。本研究将研究保护网络物理系统的两个关键挑战：通过持续监控的网络流防止物理系统信息的检索，以及通过不断被黑客入侵的网络流限制对系统操作的中断。将信息理论安全和统计推理方法的优势纳入动态规划框架，该框架将网络物理系统演化建模为外部信息和内部控制的函数，本研究将定量研究信息安全和系统运行性能之间的权衡，并通过该过程，开发攻击检测和缓解方法。

Despite tremendous advances in cryptography and communication security, information attacks -- both passive such as eavesdropping, and active such as unauthorized data injection --, can severely impair the functioning of modern infrastructural systems that combine cyber communication systems and networked physical components. The ability of adversaries to monitor transmitted data or introduce false information for sustained periods of time whilst staying undetected can result in leakage of sensitive information or cause critical damages to underlying systems with consequences ranging from airline collisions, power blackouts to malfunctioning nuclear reactors. In this research, rigorous frameworks are developed to study vulnerabilities of cyber physical systems to such persistent security threats with the goal of designing novel and resilient system controllers. The systematic approach to study adversarial behavior will not only enable effective cyber policing, but also lay a platform for developing technologies to prevent the next generation of cyber terrorism that aims to cripple basic infrastructural systems in energy, healthcare, transportation etc. The education and outreach components will facilitate an enhanced awareness in society of potential vulnerabilities of the burgeoning Internet of Things and the path towards cyber physical security. This research will study two key challenges in securing cyber physical systems: preventing retrieval of physical system information through continually monitored cyber flows, and limiting disruption to system operations through continually hacked cyber flows. Incorporating the strengths of information theoretic security and statistical inference methodologies into a dynamic programming framework which models cyber physical system evolution as a function of external information and internal control, this research will study quantitatively the trade-offs between information security and the system operational performance, and through the process, develop attack detection and mitigation methodologies.