CAREER: PARP: Mislead Physical-Disruption Attacks by Preemptive Anti-Reconnaissance for Power Grids Cyber-Physical Infrastructures

与一般计算环境中的攻击相比，针对电网等工业控制系统的网络攻击呈现出独特的特征。由于物理过程在复杂的物理模型下运行，攻击者在穿透内部控制网络后，对网络和物理基础设施进行深入侦察。全面的侦察使他们能够造成快速的、可能不可逆转的破坏，如停电、经济损失，甚至人员伤亡。这个职业项目旨在设计和量化先发制人的反侦察技术，这些技术将在电网的网络物理基础设施方面误导对手。对于防止物理损害的目标，该项目将带来明显的好处。首先，它会在恶意活动发起之前误导攻击，提前消除潜在威胁，从而防止破坏。其次，阻止对关键物理数据集进行侦察可以防止广泛的攻击，包括未知的攻击。为了实现这一目标，该项目将通过两个关键的研究推进现有的反侦察方法。第一个研究重点是通过一种原创的控制功能虚拟化来误导对手对网络基础设施的看法。该技术利用软件定义的网络实现的网络可编程性，对在电网中提供控制功能的网络通信进行虚拟化，而无需为每个物理设备构建虚拟机。在保持控制功能性能的同时，虚拟化基于中和模式中和来自各种物理设备和欺骗节点的通信模式。因此，这将从通信通道中移除特定于设备的功能，并通过欺骗节点传递误导性信息，从而防止对手将易受攻击的设备定位到目标。第二个研究重点试图通过创建一个电子模型引导的生成性对抗网络来在物理基础设施方面误导对手。具体地说，这种方法通过将电子模型集成到生成性对抗网络的内部结构中，并制作生成真实数据和诱饵数据的电网，从而推动了当前生成性对抗网络的设计。真实数据和诱骗数据的组合将符合电气模型，但呈现出与实际电网不同的图景。因此，诱骗误导对手设计无效的攻击策略，以避免对实际网格的破坏，而真实数据继续为合法的控制应用服务。研究推力将在半实物电力系统试验台中进行评估，该试验台可以将物理设备的实时操作与高保真模拟器相结合，以量化电力系统对外部事件的运行反应。该项目由安全和值得信赖的网络空间(SATC)计划和既定的激励竞争研究计划(EPSCoR)联合资助。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Cyberattacks targeting industrial control systems like power grids present unique features compared to attacks in general computing environments. Because physical processes operate under complicated physical models, adversaries perform in-depth reconnaissance on both cyber and physical infrastructures after penetrating internal control networks. The comprehensive reconnaissance enables them to cause rapid and possibly irreversible damage like power outages, economic losses, and even human casualties. This CAREER project aims to design and quantify preemptive anti-reconnaissance techniques that will mislead adversaries about power grids’ cyber-physical infrastructures. Toward the objective of preventing physical damage, this project will introduce clear benefits. First, it will mislead attacks before malicious activities are launched, removing potential threats in advance and thus preventing damage. Second, preventing reconnaissance on a critical set of physical data can protect against a wide spectrum of attacks, including unknown ones. To achieve this objective, this project will advance existing anti-reconnaissance approaches with two critical research thrusts. The first research thrust aims to mislead adversaries about cyber infrastructures by an original control function virtualization. Leveraging network programmability enabled by software-defined networking, this technique virtualizes network communications that deliver control functions in power grids without building virtual machines for each physical device. While preserving the performance of control functions, virtualization neutralizes communication patterns from various physical devices and spoof nodes based on the neutralized patterns. This consequently removes device-specific features from communication channels and delivers misleading information by the spoofed nodes, preventing adversaries from pinpointing vulnerable devices to target. The second research thrust seeks to mislead adversaries about physical infrastructure by creating an electrical-model-guided generative adversarial network. Specifically, this method advances the current design of generative adversarial networks by integrating electrical models into their internal structures and crafting power grids that generate real and decoy data. The combination of real and decoy data will conform to electrical models but present a different picture from the actual power grid. Consequently, decoys mislead adversaries into designing ineffective attack strategies that avert damage to the actual grid, while real data continues to serve legitimate control applications. The research thrusts will be evaluated in a hardware-in-the-loop power system testbed, which can integrate real-time operations of physical devices with high-fidelity simulators to quantify power system runtime reactions to external events.This project is jointly funded by the Secure and Trustworthy Cyberspace (SaTC) program and the Established Program to Stimulate Competitive Research (EPSCoR).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.