Towards Secure and Resilient Cyber-Physical Systems

网络物理系统（cps）是关键基础设施的未来，如交通系统、电网、医疗支持和由物联网（IoT）驱动的主要智慧城市应用。cps是相互连接的软件依赖系统，具有嵌入式传感器和执行器，执行非常规的复杂交互。因此，它们通常会引入一个未开发的安全漏洞领域，并且由于涉及的物理过程和深度集成的网络物理空间而导致更广泛的攻击面。许多CPS应用程序分析从物理世界收集的数据，以实时生成关键决策。因此，由于网络攻击而导致的错误或次优决策可能会对CPS的操作、可靠性和安全性产生灾难性的影响。此外，对日益演变的网络物理攻击的预防和检测并不总是成功的。因此，在设计cps时，应该内置对入侵的容忍度，以保证在可能受到损害的情况下具有可接受的可靠性能。本研究旨在设计安全且有弹性的cps，以抵御针对感知层、网络层和应用层的隐形攻击。它将处理计算机和信息安全的三个基本方面（即，入侵预防、检测和缓解），同时尊重cps的内在特征（例如，资源受限）和功能需求（例如，大规模）。拟议的计划本质上是高度多学科的，包括三个主要轨道。第一条轨道包括开发智能入侵防御技术作为主要防线，特别关注设计有效的身份验证和授权方案，针对特定的CPS环境（如联网车辆和物联网）量身定制。第二个方向是通过利用深度学习技术的力量，在高度动态的cps中构建健壮的、上下文感知的入侵检测系统，以更准确地估计异常系统状态和检测零日攻击。第三条轨道涉及多层自适应弹性新结构的设计，该结构将广泛的先进攻击缓解解决方案、智能节点协作方法和优化的事件恢复措施深度集成到CPS运营和运行时决策中。总之，这三个轨道将创建一个原创的、纵深防御的安全战略，主要侧重于安全可靠的网络物理软件的初始设计阶段。该战略将对目前加拿大工业以及全国关键基础设施的CPS设计和实施选择产生巨大影响。该计划的成果将为研究界提供创新的安全思维和工具，这对新兴cps的安全状况的根本进步至关重要。

Cyber Physical Systems (CPSs) are the future of critical infrastructure such as transportation systems, electric grids, medical support, and major smart city applications driven by the Internet of Things (IoT). CPSs are interconnected, software-dependent systems with embedded sensors and actuators performing unconventional, complex interactions. Hence, they generally introduce an unexplored territory of security vulnerabilities and entail wider attack surfaces due to the physical processes involved and the deeply integrated cyber-physical space. Many CPS applications analyze the data collected from the physical world to generate critical decisions in real time. Consequently, erroneous or suboptimal decisions due to cyberattacks could have a disastrous impact on the CPS operations, its dependability, and safety. Furthermore, the prevention and detection of increasingly evolving cyber-physical attacks are not always successful. Therefore, CPSs should be designed with built-in tolerance to intrusions to guarantee an acceptable level of reliable performance under potential compromise. This research aims to design secure and resilient CPSs against stealthy attacks that target the perception, network, and application layers. It will address the three fundamental facets of computer and information security (i.e., intrusion prevention, detection, and mitigation) while respecting the intrinsic features (e.g., resource-constrained) and functional requirements (e.g., large scale) of CPSs. The proposed program is highly multidisciplinary in nature and encompasses three main tracks. The first track consists in developing smart intrusion prevention techniques as the primary line of defence, with special focus on the design of efficient authentication and authorization schemes, tailored to specific CPS environments such as connected vehicles and IoT. The second track is directed towards building robust, context-aware intrusion detection systems in highly dynamic CPSs by leveraging the power of deep learning techniques to enable more accurate estimation of abnormal system states and the detection of zero-day attacks. The third track involves the design of a new fabric of multi-layer, adaptive resilience which deeply integrates a wide range of advanced attack mitigation solutions, intelligent node collaboration approaches, and optimized incident recovery measures into the CPS operations and decision making at runtime. Together, the three tracks will create an original, defense-in-depth security strategy, with predominant focus on the initial design phases of secure and dependable cyber-physical software. The strategy will yield tremendous impact on current CPS design and implementation choices in the Canadian industry as well as nationwide critical infrastructures. The outcomes of the program will equip the research community with innovative security mindsets and tools that are essential to the radical advancement of the security status of emerging CPSs.