Providing Autonomous Capabilities for Evolving SCADA (PACES)

SCADA （Supervisory Control And Data Acquisition）已被证明是一项强大而成功的技术。在世界范围内，SCADA系统被深度集成到用于发电、输电、放射性废物处理、制造、精炼、水处理、空间探索和各种军事应用的大型基础设施中。传统的SCADA实现采用集中式架构，要么跨一个地理站点，要么跨多个使用专有通信协议的站点。尽管分布式解决方案有这种趋势，但监督控制功能仍然在集中位置执行，通常由训练有素的人员使用兼容的HMI（人机界面）工具进行监督。这种集中式体系结构给系统设计人员带来了压倒性的问题，他们需要集成更多不同的组件，并扩展到更大、更复杂的部署。此外，这种日益增加的复杂性实际上只能通过采用自主或智能的系统组件来实现，这些组件可以取代人类提供的监督功能。最近的趋势表明，SCADA系统结合了广泛可用的COTS（商用现货）软件来提供功能，并采用公认的通信标准，如TCP/IP，以促进集成和远程管理。COTS的使用增加了可用的功能和健壮性，但是引入了新的漏洞。攻击者可以利用他们对这些广泛可用的组件的知识，并且可以以早期专有系统以前不可能的方式“设计”攻击。与安全性密切相关的是对容错的需求。在这里，我们也必须开发智能SCADA系统，它可以自我监控和检测异常行为（由恶意攻击或组件故障引起），并调用保护整个系统目标的响应。下一代SCADA系统必须开发一套自主和智能能力，以解决一些紧迫的需求。过程复杂性的增加、传感器技术的进步、与其他企业解决方案集成的需求的增加、安全保护的日益不足以及对容错标准的更高要求等问题都必须得到解决。为了解决这些问题，本文的研究重点是开发一种新的多智能体系统（MAS）体系结构。该体系结构集成了一个先进的事件推理框架，可以充分利用传感器数据和领域知识，包括处理固有的不确定性、不完整性和不一致性，以自主推断系统状态，并至关重要地通知系统中的人类和自主决策者。自主性的增强对系统安全性提出了新的挑战。下一代自主SCADA必须实时检测、诊断和响应安全漏洞和异常行为。提出的研究利用新的深度数据包检测功能和网络流量分析来开发独特的“网络传感器”，为人类操作员和自主组件提供整体系统健康和完整性的可见性。总之，这些新颖的研究成果将装备下一代自主SCADA系统，使其能够实时响应不断变化的情况、对变化和异常行为的自我意识、故障和噪声容忍以及实时决策支持。

SCADA (Supervisory Control And Data Acquisition) has proved to be a powerful and successful technology. Across the world SCADA systems are deeply integrated into the large scale infrastructures used in power generation, power transmission, radioactive waste processing, manufacturing, refining, water treatment, space exploration and various military applications. Traditionally SCADA implementations adopt a centralised architecture, either across one single geographical site, or across multiple sites using proprietary communications protocols. In spite of this trend to distributed solutions the supervisory control function continues to be performed at a centralised location, typically supervised by trained personnel using compliant HMI (Human-Machine Interface) tools. This centralised architecture presents overwhelming problems for system designers needing to integrate ever more diverse components and to scale to larger, more complex deployments. Moreover, this increasing complexity can realistically only be achieved through the adoption of autonomous or intelligent system components that can replace the supervisory function provided by humans. More recent trends show SCADA systems incorporating widely available COTS (Commercial Off-The-Shelf) software to deliver functionality and adopting recognised communications standards such as TCP/IP to facilitate integration and remote administration. The use of COTS increases available functionality and robustness but introduces new vulnerabilities. Attackers can exploit their knowledge of such widely available components and attacks can be 'designed' in ways previously not possible with the earlier proprietary systems. Closely linked to security is the need for fault tolerance. Here too we must develop intelligent SCADA systems that can self-monitor and detect anomalous behaviour (resulting from malicious attack or component fault) and invoke response that protects the goals of the whole system.The next generation of SCADA systems must develop a set of autonomous and intelligent capabilities to address a number of pressing requirements. Problems presented by increasing process complexity, advances in sensor technologies, the increasing demand for integration with other enterprise solutions, increasingly inadequate security protection and a higher required standard of fault tolerance must all be solved. To provide solutions to these problems the proposed research focuses on the development of a novel Multi-Agent System (MAS) architecture. This architecture is integrated with an advanced event reasoning framework that can fully exploit sensor data and domain knowledge, including treatment of inherent uncertainties, incompleteness and inconsistency to autonomously infer system state and crucially to inform human and autonomous decision makers in the system. Increased autonomy presents new challenges of system security. The next generation of autonomous SCADA must detect, diagnose and respond in real-time to security breaches and anomalous behaviours. The proposed research exploits new Deep Packet Inspection capabilities and network traffic analysis to develop a unique 'cyber-sensor', providing visibility of overall system health and integrity to human operators and autonomous components. Brought together, these novel research outputs will equip the next generation of autonomous SCADA systems with the capabilities to respond in real-time to evolving situations, self-awareness of changes and abnormal behaviours, fault and noise tolerance, and real-time decision support.