High-Fidelity Cyber and Physical Simulation of Water Distribution Systems. II: Enabling Cyber-Physical Attack Localization

Abstract

A fundamental problem in the realm of cyber-physical security of smart water networks is attack detection, a key step towards designing adequate countermeasures. This task is typically carried out by algorithms that analyze time series of process data. However, the nature of the data available to develop these algorithms limits their capabilities: by relying on process data only, one cannot distinguish a cyber-attack from the failure of a system's component or identify the root cause of an attack. Here, we show that these limitations can be addressed through the joint analysis of process and network data-with the latter representing the information exchanged between the components constituting the Industrial Control System, such as sensors and Programmable Logic Controllers (PLCs). For this purpose, we utilize a dataset generated by digital hydraulic simulator (DHALSIM)-a numerical modelling platform built on a two-way interaction between EPANET version 2.2 and a network emulation tool-which is extended here to include a framework for launching cyber-physical attacks. This paper presents a dataset with realistic network information of a smart water network under cyber-physical attacks and presents an analysis of how that information can enable the development of better intrusion detection systems that can localize and identify attacks. Through this analysis, the dataset provided here, and the open-source availability of DHALSIM, our work paves the way to a novel class of analytics for actionable detection.

High-Fidelity Cyber and Physical Simulation of Water Distribution Systems. I: Models and Data

“…scheduling (Di Nardo et al 2021). As we shall see in the companion paper (Murillo et al 2022), DAHLSIM simulation of the full protocol stack also broadens the opportunities available for research in cyber-security (Tables 3 and 4). Although validating network traffic was out of the scope of this paper, we believe that further research in this field could help to develop better and more accurate experimentation platforms for CPS.…”

“…• Attacks Configuration file: Attacks are configured in this optional file. Our companion paper (Murillo et al 2022) delves into the details of attacks and their implementation.…”

“…The network emulation is used to represent the cyber layer of a WDS and the physical emulation runs an EPANET simulation of the WDS. The network emulation component also includes a framework to launch network attacks, described in Murillo et al (2022). The file generator arranges all the configuration and file results in an output folder.…”

“…Finally, we note that DHALSIM's representation of both ICS and physical processes makes it a good platform to also study the impact of cyber-physical attacks on smart water networks. Such analysis is provided in a companion paper (Murillo et al 2022), where we illustrate how the data that DHALSIM provides may enable the development of more sophisticated intrusion detection systems that combine physical processes and network data.…”

Flood Risks of Cyber‐Physical Attacks in a Smart Storm Water System

“…For a comprehensive risk assessment, it’s essential to contemplate diverse attack modalities to reveal all potential vulnerabilities in a cyber‐physical system. Prior investigations in water distribution systems have developed platforms that assess a spectrum of attack vectors, both on process and traffic data (Murillo et al., 2023; Taormina et al., 2019). These can set a precedent for subsequent endeavors in stormwater systems.…”