Data-Driven Approaches for Cyber Security of Critical Infrastructures

分布式系统是其组件位于不同联网实体上的系统（例如，计算机、传感器）通过交换消息来通信和协调它们的动作。这些实体具有共享状态，并发操作，并且可以独立地失败而不影响整个系统的可扩展性。随着世界技术的不断发展，分布式系统变得越来越普遍。 在过去的几年里，我已经解决了分布式系统的保护和弹性，如云，数据中心，移动的代理和执行器网络，车载和无线传感器网络。基于这一专业知识，我计划在中期内解决各种网络安全问题，并为一种非常重要的分布式系统开发攻击弹性解决方案，即工业自动化控制系统和网络，这些系统和网络正在监测和控制不同部门的关键基础设施的运行。其中包括能源部门（例如，石油管道、核电站）、金融部门、政府运营、供水、卫生系统等。在过去十年中，针对重要基础设施的网络攻击大幅增加，造成了严重破坏，造成了非常重大的社会和经济损失。然而，保护关键基础设施控制系统免受网络攻击的研究仍处于早期阶段，面临许多公开的技术挑战。对于目前的研究计划提案，我将解决一个特定的关键能源基础设施，即电力系统（EPS）。 EPS的设施通常分散在数千平方公里的范围内。SCADA是控制这种地理上分散的系统的工具。我在未来五年的研究重点将集中在以下三个目标上：1）通过开发新的数据驱动的安全分析和漏洞评估方法，以了解和监控攻击导致的软件事件/行为与EPS网络级可观察到的事件/行为之间的紧密交互，减轻对基于SCADA的EPS系统的网络攻击。正是考虑到网络和物理层面之间的密切关系，使我的研究有别于现有的方法（通常忽视物理层面）。此外，我有必要的设备来监控EPS中的这种关系。2)通过开发新的基于机器学习的实时入侵检测技术来监控网络层数据和描述EPS物理行为的数据，以防范和响应恶意攻击。3)通过构建一个基于SCADA的数据驱动的攻击弹性系统，即使在受到攻击时也可以保持其正常功能，从而从对EPS的攻击中恢复。最终，我的建议与加拿大自然资源部保护关键能源基础设施的任务以及DND对弹性网络系统的兴趣保持一致。

A distributed system is a system whose components are located on different networked entities (e.g., computers, sensors) that communicate and coordinate their actions by exchanging messages. These entities have a shared state, operate concurrently and can fail independently without affecting the whole system's uptime. With the ever-growing technological expansion of the world, distributed systems are becoming more and more widespread. In past years, I have addressed the protection and resilience of distributed systems such as Clouds, Data Centres, Mobile Agent and Actuator Networks, Vehicular and Wireless Sensor Networks. Building on this expertise, in the medium term, I plan to address various cyber security issues and develop attack resilient solutions for a very important type of distributed systems, namely the industrial automated control systems and networks that are monitoring and controlling the operation of critical infrastructures in different sectors. These include the Energy sector (e.g., oil pipelines, nuclear plants), the Financial sector, Government Operations, Water Supply, Health Systems and more. Cyber-attacks against critical infrastructures have increased significantly in the last decade and caused serious damage with very important social and economic losses. However, research on protecting the control systems of critical infrastructures against cyber-attacks is still at an early stage and faces many open technical challenges. For this current research plan proposal, I will address a specific critical energy infrastructure, namely Electrical Power Systems (EPSs). The facilities of an EPS are often scattered over thousands of square kilometres. SCADA is a tool to control such a geographically dispersed system. The focus of my research over the next five years will be on the following three objectives: 1)Mitigate cyber-attacks against SCADA-based EPS systems by developing new data-driven security analysis and vulnerability assessment methods to understand and monitor the tight interaction between software events/behaviors resulting from attacks and the events/behaviors observable at the network level of an EPS. It is the consideration of the close relationship between the cyber and the physical level that sets my research apart from existing approaches (which often overlook the physical level). Moreover, I have the necessary equipment to monitor this relationship in an EPS. 2)Protect against and respond to malicious attacks by developing new real-time machine-learning-based intrusion detection techniques for monitoring both cyber-layer data and data describing the physical behavior of EPSs. 3)Recover from attacks on EPSs by building a data-driven attack-resilient SCADA-based system that can maintain its normal functions even when under attack. Ultimately, my proposal aligns well with the mandate of Natural Resources Canada to protect critical energy infrastructures and DND's interest in resilient networked systems.