Towards Secure and Resilient Cyber-Physical Systems

网络物理系统(CPSS)是由物联网(IoT)驱动的关键基础设施的未来，例如交通系统、电网、医疗支持和主要的智慧城市应用。CPSS是相互连接的、依赖于软件的系统，带有嵌入式传感器和执行器，执行非传统的复杂交互。因此，由于所涉及的物理过程和深度整合的网络物理空间，它们通常会带来未知的安全漏洞领域，并带来更广泛的攻击面。许多CPS应用程序分析从物理世界收集的数据，以实时生成关键决策。因此，由于网络攻击而导致的错误或次优决策可能会对CPS的运营、其可靠性和安全性产生灾难性影响。此外，预防和检测日益演变的网络物理攻击并不总是成功的。因此，CPSS的设计应该具有对入侵的内置容忍度，以保证在潜在危害下具有可接受的可靠性能。本研究旨在设计安全和有弹性的CPSS，以抵御针对感知层、网络层和应用层的隐形攻击。它将涉及计算机和信息安全的三个基本方面(即入侵预防、检测和缓解)，同时尊重CPSS的固有特征(例如，资源受限)和功能要求(例如，大规模)。拟议的计划具有高度多学科的性质，包括三个主要方面。第一条道路是开发智能入侵防御技术作为主要防线，特别关注设计高效的身份验证和授权方案，以适应互联车辆和物联网等特定CPS环境。第二个目标是通过利用深度学习技术的力量，在高度动态的CPSS中构建健壮的、上下文感知的入侵检测系统，以实现对异常系统状态的更准确估计和零日攻击的检测。第三条路径涉及设计一种新的多层自适应弹性结构，该结构将各种高级攻击缓解解决方案、智能节点协作方法和优化的事件恢复措施深度集成到CPS的运行和决策中。这三个途径将共同创建一种原创的深度防御安全战略，主要侧重于安全可靠的网络物理软件的初始设计阶段。该战略将对加拿大行业当前的CPS设计和实施选择以及全国关键基础设施产生巨大影响。该计划的成果将使研究界具备创新的安全思维和工具，这些思维和工具对于从根本上提高新兴的CPSS的安全状况至关重要。

Cyber Physical Systems (CPSs) are the future of critical infrastructure such as transportation systems, electric grids, medical support, and major smart city applications driven by the Internet of Things (IoT). CPSs are interconnected, software-dependent systems with embedded sensors and actuators performing unconventional, complex interactions. Hence, they generally introduce an unexplored territory of security vulnerabilities and entail wider attack surfaces due to the physical processes involved and the deeply integrated cyber-physical space. Many CPS applications analyze the data collected from the physical world to generate critical decisions in real time. Consequently, erroneous or suboptimal decisions due to cyberattacks could have a disastrous impact on the CPS operations, its dependability, and safety. Furthermore, the prevention and detection of increasingly evolving cyber-physical attacks are not always successful. Therefore, CPSs should be designed with built-in tolerance to intrusions to guarantee an acceptable level of reliable performance under potential compromise. This research aims to design secure and resilient CPSs against stealthy attacks that target the perception, network, and application layers. It will address the three fundamental facets of computer and information security (i.e., intrusion prevention, detection, and mitigation) while respecting the intrinsic features (e.g., resource-constrained) and functional requirements (e.g., large scale) of CPSs. The proposed program is highly multidisciplinary in nature and encompasses three main tracks. The first track consists in developing smart intrusion prevention techniques as the primary line of defence, with special focus on the design of efficient authentication and authorization schemes, tailored to specific CPS environments such as connected vehicles and IoT. The second track is directed towards building robust, context-aware intrusion detection systems in highly dynamic CPSs by leveraging the power of deep learning techniques to enable more accurate estimation of abnormal system states and the detection of zero-day attacks. The third track involves the design of a new fabric of multi-layer, adaptive resilience which deeply integrates a wide range of advanced attack mitigation solutions, intelligent node collaboration approaches, and optimized incident recovery measures into the CPS operations and decision making at runtime. Together, the three tracks will create an original, defense-in-depth security strategy, with predominant focus on the initial design phases of secure and dependable cyber-physical software. The strategy will yield tremendous impact on current CPS design and implementation choices in the Canadian industry as well as nationwide critical infrastructures. The outcomes of the program will equip the research community with innovative security mindsets and tools that are essential to the radical advancement of the security status of emerging CPSs.