Ecology-inspired cyber risk model for propagation of vulnerability exploitation in tactical edge

Morris-King, James; Çam, Hasan

doi:10.1109/milcom.2015.7357465

Cited by 5 publications

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specify a vector for the time t A at which attack is initiated. (ii) Cycle over the rate of external compromise c and the rate of co-compromise c s (iii) Cycle over time from t � 0 to t � T. (iv) For each time, compute x(t) from equation (8) and y(t) � N − x(t). (v) Cycle over each time of attack.…”

Section: A3 Run the Model Of Compromise In The Absence Of Defensivementioning

confidence: 99%

“…To do this, we build on existing nonlinear dynamic models of compromise of cyber systems that import ideas from the population biology of disease [6][7][8][9][10][11], characterize performance using either a nonlinear metric for a generic physical system (cf. [6][7][8][9][10]) or the nonlinear dynamics of an electric grid, and introduce counter measures having nonlinear dynamics based on the immune systems [12,13].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Modeling Coupled Nonlinear Multilayered Dynamics: Cyber Attack and Disruption of an Electric Grid

Mangel

McEver

2021

Complexity

View full text Add to dashboard Cite

We study the consequences of cyberattack, defense, and recovery in systems for which a physical system is enabled by a cyber system by extending previous applications of models from the population biology of disease to the cyber system and coupling the state of the cyber system to the physical system, using the synchronous model for the electric grid. In analogy to disease models in which individuals are susceptible, infected, or recovered, in the cyber system, components can be uncompromised and vulnerable to attack, uncompromised and temporarily invulnerable to attack, compromised, or reset and thus not able to contribute to the performance of the physical system. We model cyber defensive countermeasures in analogy to the adaptive immune system. We link the physical and cyber systems through a metric of performance of the physical system that depends upon the state of the cyber system using (i) a generic nonlinear relationship between the state of the cyber system and the performance of the physical system and (ii) the synchronous motor model of an electric grid consisting of a utility with many customers whose smart meters can become compromised, in which a steady state in the difference in rotor angles is the metric of performance. We use the coupled models, both of which have emergent properties, to investigate two situations. First, when an attacker that relies on stealth compromise is hidden until it is either detected during routine maintenance or an attack is initiated. The probability that compromise remains undetected declines with time and the level of compromise increases with time. Because of these dynamics, an optimal time of attack emerges, and we explore how it varies with parameters of the cyber system. Second, we illustrate one of the Electric Power Research Institute scenarios for the reverse engineering of Advanced Metering Infrastructure (AMI) by coupling the synchronous motor equations for the generator and utility to the model of compromise. We derive a canonical condition for grid failure that relates the level of compromise at the time of detection of compromise and the dissipation parameter in the synchronous motor model. We conclude by discussing the innovative aspects of our methods, which include (i) a fraction of decoy components in the cyber system, which are not connected to the rest of the cyber system or the physical system and thus do not spread compromise but increase the probability of detection of compromise, (ii) allowing components of the cyber system to return to the un-compromised state either temporarily invulnerable or immediately vulnerable, (iii) adaptive Defensive Counter Measures that respond in a nonlinear fashion to attack and compromise (in analogy to killer T cells of the immune system), (iv) a generic metric of performance of the physical system that depends upon the state of the cyber system, and (v) coupling a model of the electric grid to the model of compromise of the cyber system that leads to a condition for failure of the grid in terms of parameters of both compromise and the synchronous motor model, directions for future investigations, and connections to recent studies on broadly the same topics. We include a pseudocode as an Appendix and indicate how to obtain R script for the models from the first author.

show abstract

Section: A3 Run the Model Of Compromise In The Absence Of Defensivementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Modeling Coupled Nonlinear Multilayered Dynamics: Cyber Attack and Disruption of an Electric Grid

Mangel

McEver

2021

Complexity

View full text Add to dashboard Cite

show abstract

Analysis of vulnerability propagation for the all-optical network based on Bio-PEPA

2019

View full text Add to dashboard Cite

Controlling proximity-malware infection in diverse tactical mobile networks using K-distance pruning

Morris-King

Çam

2016

MILCOM 2016 - 2016 IEEE Military Communications Conference

View full text Add to dashboard Cite

Ecology-inspired cyber risk model for propagation of vulnerability exploitation in tactical edge

Cited by 5 publications

References 19 publications

Modeling Coupled Nonlinear Multilayered Dynamics: Cyber Attack and Disruption of an Electric Grid

Modeling Coupled Nonlinear Multilayered Dynamics: Cyber Attack and Disruption of an Electric Grid

Analysis of vulnerability propagation for the all-optical network based on Bio-PEPA

Controlling proximity-malware infection in diverse tactical mobile networks using K-distance pruning

Contact Info

Product

Resources

About