No abstract

Today's distributed computing environments, like Energy Control Systems, lack a common and adaptive notion of trust and are vulnerable to a wide range of attacks from complex threats. These threats on our control systems are distributed, decentralized, dynamic, and operate over multiple timescales. Threats may also result from structural weaknesses in system designs that permit exploitation by insiders working inside globally trusted service providers. Although approaches such as Trusted Computing are part of the solution, we argue that a layered notion of distributed trust is required to effectively address the end-to-end security needs of these systems.

In this position paper we explore the use of behavior models as an enabling methodology in the promotion of a more holistic understanding of CPS that can bridge both cyber and physical domains. Thus, we investigate the use of aggregate behavior analysis techniques combined in both cyber and physical domains. Ultimately, our work focuses on the development of a cyber-physical behavior model that leverages behavior aggregation promoting the creation of a long-view sense-making capability driven by both cyber and physical observations. We look to the use of this approach to establish the ability to anticipate malicious activity in CPS, rather that react.