Key Concepts of Systemological Approach to CPS Adaptive Information Security Monitoring

Abstract

Modern cyber-physical systems (CPS) use digital control of physical processes. This allows attackers to conduct various cyberattacks on these systems. According to the current trends, an information security monitoring system (ISMS) becomes part of a security management system of CPS. It provides information to make a decision and generate a response. A large number of new methods are aimed at CPS security, including security assessment, intrusion detection, and ensuring sustainability. However, as a cyber-physical system operates over time, its structure and requirements may change. The datasets available for the protection object (CPS) and the security requirements have become dynamic. This dynamic effect causes asymmetry between the monitoring data collection and processing subsystem and the presented security tasks. The problem herein is the choice of the most appropriate set of methods in order to solve the security problems of a particular CPS configuration from a particular bank of the available methods. To solve this problem, the authors present a method for the management of an adaptive information security monitoring system. The method consists of solving a multicriteria discrete optimization problem under Pareto-optimality conditions when the available data, methods or external requirements change. The experimental study was performed on an example of smart home intrusion detection. In the study, the introduction of a constraint (a change in requirements) led to the revision of the monitoring scheme and a different recommendation of the monitoring method. As a result, the information security monitoring system gains the property of adaptability to changes in tasks and the available data. An important result from the study is the fact that the monitoring scheme obtained using the proposed management method has a proven optimality under the given conditions. Therefore, the asymmetry between the information security monitoring data collection and processing subsystem and the set of security requirements in cyber-physical systems can be overcome.

Adaptive Monitoring of Companies' Information Security

“…The introduction of IT into the IS management processes, and, in particular, into the organization of the IS Event Management processes of companies, helps to prevent potential losses. Taking into account the previous works [3,4,17,18,20,24], within the framework of building the company's ISMS, additions to the method of organizing the EM process were proposed, see Fig. 1.…”

“…And this, in turn, gives rise to inefficient use of the resources of the CIS defense side. And, more importantly, it can lead to a situation where important events in the context of information security can be overlooked by the company's IS analyst [20,21].…”

Cybersecurity in Cyber–Physical Power Systems

“…Experimental study of intelligent home intrusion detection [124] For monitoring industrial systems, industrial cyber-physical systems (ICPSs) are used, consisting of a link between the software and hardware parts of the system. Reference [115] developed a methodology called Multilayer Run-Time Security Monitor (ML-RSM), which is capable of identifying divergences caused by communications and attacks on the application layer, as well as preventing the spread to other control layers.…”

“…Information security in the monitoring layer of the CPS is important to maintain data integrity. In this sense, Reference [124] proposes an adaptive method that analyzes and solves a multicriteria optimization problem where the available inputs are mutable, seeking to ensure data integrity.…”

“…As discussed in this paper, the current power system is vulnerable and the target of numerous and constant cyberattacks that aim to undermine the planning, operation, maintenance, and supply of power to users. Thus, Sections 4.1-4.3 discussed works on cybersecurity in the areas of monitoring [115][116][117][118][119][120][121][122][123][124], control [125][126][127][128][129][130][131][132][133][134], and protection [135][136][137][138][139][140][141][142][143][144] of cyber-physical systems. The most common types of attacks were cyberattacks of fake data injection, malware attacks, DoS attacks, and eavesdropping.…”