synERGY: Cross-correlation of operational and contextual data to timely detect and mitigate attacks to cyber-physical systems

Skopik, Florian; Landauer, Max; Wurzenberger, Markus; Vormayr, Gernot; Milošević, Jelena; Fabini, Joachim; Prüggler, Wolfgang; Kruschitz, Oskar; Widmann, Benjamin; Truckenthanner, Kevin; Raß, Stefan; Simmer, Michael; Zauner, Christoph

doi:10.1016/j.jisa.2020.102544

Cited by 9 publications

(9 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…ADSs are implemented to detect cyber-attacks, and intrusion attempts are referred to as anomaly-based Intrusion Detection Systems (IDS) [20]. Due to the complex nature of CPSs, various ADS strategies have been exploited in recent literature [14,16,17].…”

Section: Related Workmentioning

confidence: 99%

“…Cross correlation of several anomaly detection systems has been recognized in literature as an approach to provide more accurate detection of anomalies in CPSs [16]. In [16], a combination of Autoencoders and parsers are used to detect anomalies by analysing network flows and SCADA log files. In [15], bayesian networks are used to identify anomalous behavior using network events and physical data.…”

Section: Related Workmentioning

confidence: 99%

“…Certain attempts establish correlation schemes between cyber and physical data using Bayesian networks for anomaly detection, and root-cause isolation [15]. In [16], cross-correlation between anomaly detection on network flow data and parsed Supervisory Control and Data Acquisition (SCADA) log files is used to increase the confidence of security alerts. Unlike similar efforts that examine the temporal correlation of different anomaly detection outputs [16], we present a health monitoring metric that indicates the source of the disturbance (cyber or physical).…”

Section: Introductionmentioning

confidence: 99%

“…In [16], cross-correlation between anomaly detection on network flow data and parsed Supervisory Control and Data Acquisition (SCADA) log files is used to increase the confidence of security alerts. Unlike similar efforts that examine the temporal correlation of different anomaly detection outputs [16], we present a health monitoring metric that indicates the source of the disturbance (cyber or physical). The metric serves as a holistic health monitoring mechanism that provides a human-recognizable measure of misbehavior caused either by internal anomalies or external intrusions.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Marino¹,

Wickramasinghe

Tsouvalas

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Concerns of cyber-security threats are increasingly becoming a part of everyday operations of cyber-physical systems, especially in the context of critical infrastructures. However, despite the tight integration of cyber and physical components in modern critical infrastructures, the monitoring of cyber and physical subsystems is still done separately. For successful health monitoring of such systems, a holistic approach is needed. In this paper, we present an approach for holistic health monitoring of cyber-physical systems based on cyber and physical anomaly detection and correlation. We provide a data-driven approach for the detection of cyber and physical anomalies based on machine learning. The benefits of the presented approach are: 1) integrated architecture that supports acquisition and real-time analysis of both cyber and physical data; 2) a metric for holistic health monitoring that allows for differentiation between physical faults, cyber intrusion, and cyber-physical attacks. We present experimental analysis on a power-grid use case using the IEEE-33 bus model. The system was tested on several types of attacks such as network scan, Denial of Service (DOS), and malicious command injections.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Marino¹,

Wickramasinghe

Tsouvalas

et al. 2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The authors of [27] addressed the issue of physical security information management and security information and event management integration by using the IBM SIEM QRadar as a platform. The authors of [28] presented another framework, called synERGY, for cross-layer anomaly detection based on ML techniques, in order to enable the early discovery of both cyber and physical attacks that may impact the cyber-physical system.…”

Section: State-of-the-art On Siemmentioning

confidence: 99%

Toward the Integration of Cyber and Physical Security Monitoring Systems for Critical Infrastructures

Fausto

Gaggero

Patrone

et al. 2021

Sensors

View full text Add to dashboard Cite

Critical Infrastructures (CIs) are sensible targets. They could be physically damaged by natural or human actions, causing service disruptions, economic losses, and, in some extreme cases, harm to people. They, therefore, need a high level of protection against possible unintentional and intentional events. In this paper, we show a logical architecture that exploits information from both physical and cybersecurity systems to improve the overall security in a power plant scenario. We propose a Machine Learning (ML)-based anomaly detection approach to detect possible anomaly events by jointly correlating data related to both the physical and cyber domains. The performance evaluation showed encouraging results—obtained by different ML algorithms—which highlights how our proposed approach is able to detect possible abnormal situations that could not have been detected by using only information from either the physical or cyber domain.

show abstract

Introduction

Skopik¹,

Wurzenberger²,

Landauer³

2021

Smart Log Data Analytics

View full text Add to dashboard Cite

synERGY: Cross-correlation of operational and contextual data to timely detect and mitigate attacks to cyber-physical systems

Cited by 9 publications

References 31 publications

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Toward the Integration of Cyber and Physical Security Monitoring Systems for Critical Infrastructures

Introduction

Contact Info

Product

Resources

About