Securing Industrial Cyber–Physical Systems: A Run-Time Multilayer Monitoring

Abstract

Industrial Cyber-Physical Systems (ICPSs) are widely deployed in monitoring and control of the nation's critical industrial processes such as water distribution networks and power grids. ICPSs are the tight integration of cyber (software) and physical entities connected via communication networks. Communication networks are typically realised via wireless channels to reduce the cost of wires and installation. However, they are also inherently unreliable, easy to disrupt and subvert, which makes them a potential target for cyber attacks. The failure of communication can cause data loss or delays, which can compromise system functionality and have catastrophic consequences due to the strict real-time requirements of ICPSs. Current run-time security monitors protect ICPSs either at communication level (through network intrusion monitors) or application level (through threat detection monitors). Such monitors are layer-specific and thus fail to detect advanced threats arising from the multi-layer disruption. In this paper, we present a multi-layer run-time security monitor that can detect discrepancies caused by interdependent application and communication layer attacks and prevent their propagation into the system's control loops. We demonstrate the effectiveness of the approach via an example of the ICPS used for control and monitoring of a water distribution network.

Formal Security Evaluation and Improvement of Wireless HART Protocol in Industrial Wireless Network

“…In this research, we focused on security and did not optimize performance well; hence, finding a balance between security and performance in the next work will be one of the focuses of our research work. With the advent of Industry 4.0, this protocol will involve more application scenarios [24,25], such as cloud center-based device data transmission and computing migration, which requires multifeature authentication (such as biometrics, smart cards) verification. Protocol security solutions based on these application scenarios need to consider the actual environment and development trends [26].…”

Cybersecurity in Cyber–Physical Power Systems

“…Reference [115] developed a methodology called Multilayer Run-Time Security Monitor (ML-RSM), which is capable of identifying divergences caused by communications and attacks on the application layer, as well as preventing the spread to other control layers. The robustness of this approach is tested in a water distribution monitoring system [115]. To monitor and secure ICPSs, the author of [116] developed a robust tool capable of identifying possible cyberattacks through hierarchically distributed intrusion detection.…”

“…Experimental study of intelligent home intrusion detection [124] For monitoring industrial systems, industrial cyber-physical systems (ICPSs) are used, consisting of a link between the software and hardware parts of the system. Reference [115] developed a methodology called Multilayer Run-Time Security Monitor (ML-RSM), which is capable of identifying divergences caused by communications and attacks on the application layer, as well as preventing the spread to other control layers. The robustness of this approach is tested in a water distribution monitoring system [115].…”

Performance Analysis of Fault-Tolerant Multiagent Coordination Mechanisms

“…The performance evaluation consists of simulating the workflow scheduling algorithms and measuring their execution times, since the overall goal is to decrease the probability of errors caused by transient faults while ensuring security services. Malicious activities are considered in [35] where the communication layer is monitored to guarantee reliability and to avoid the propagation of security threats at the application level. He et al [12] survey malicious attacks in MAS and report those considered in this paper, i.e., deception attacks including false data injection.…”