SaTC: CORE: Small: Towards Deceptive and Domain-Specific Cyber-Physical Honeypots

信息物理关键基础设施为关键任务公用事业（如电网）提供管理和控制能力。可编程逻辑控制器（plc）起着关键作用，因为它们是网络世界和物理世界之间的便捷桥梁。plc的关键角色使其成为旨在破坏其运营的复杂网络攻击的目标，这既会造成社会动荡，也会造成经济损失。在这种情况下，网络蜜罐已被证明是收集数据的非常有价值的工具，可以更好地了解攻击者的许多不同策略和目标。该项目的新颖之处在于为网络物理关键基础设施，特别是PLC控制器开发一种新的特定领域的隐形蜜罐。这些解决方案允许使用与攻击者软件的自主交互来激活其恶意功能，从而进行主动数据收集。该项目更广泛的意义和重要性是为研究人员和实践者提供指南，希望将蜜罐和安全方法纳入网络物理系统（CPS）和嵌入式控制器。为了实现完全隐身，该解决方案通过物理侧通道（如由设备上恶意代码执行产生的PLC处理器电源信号）利用对恶意软件行为的气隙观察。在欺骗方面，该技术利用数学模型和物理信息神经网络，为PLC输入输出端口提供真实的物理动力学仿真和误导性的物理过程接口。研究成果通过对恶意控制器代码进行自动二进制反向工程，从低级控制器软件执行轨迹中提取高级对抗目标，解决了上述语义缺口。这使得可以使用在线数据驱动的元学习算法动态地对对手进行分类。这项工作改变了人们在CPS中处理威胁情报和建模问题的方式，因为对网络和物理因素的整体认知变得普遍。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Cyber-physical critical infrastructures provide management and control capabilities for mission-critical utilities such as power grids. Programmable logic controllers (PLCs) play a key role as they serve as a convenient bridge between the cyber and the physical worlds. PLCs’ critical roles have made them the target of sophisticated cyberattacks that are designed to disrupt their operation, which creates both social unrest and financial losses. In this context, cyber honeypots have been shown to be highly valuable tools for collecting data to better understand the many different strategies and objectives of the attackers. The project’s novelty is to develop a new domain-specific stealthy honeypot for cyber-physical critical infrastructures and specifically PLC controllers. The solutions allow for active data collection using autonomous interactions with attacker’s software to activate its malicious capabilities. The project's broader significance and importance are to provide guidelines for researchers and practitioners looking to incorporate honeypots and security methods into cyber-physical systems (CPS) and embedded controllers. For complete stealth, the solutions leverage air-gapped observations of the malware behavior through physical side channels such as PLC processor power signal produced by the on-device malicious code execution. For deception, the techniques leverage mathematical models and physics-informed neural networks to provide a realistic emulation of the physical dynamics and a misleading physical process interface to the PLC input-output ports. The research outcomes address the above-mentioned semantic gap via an automated binary reverse engineering of the malicious controller code to extract the high-level adversarial objectives from low-level controller software execution traces. This enables the classification of adversaries dynamically using online data-driven meta-learning algorithms. This work transforms how people approach the problem of threat intelligence and modeling in CPS, in that the holistic view cognizant of both cyber and physical factors becomes widespread.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.