Diploma thesis analyses the potential of Cyber Threats towards critical energy infrastructure in terms of network theories originating in graph theories, complex networks and technological possibilities how to compromise security of networks belonging to critical infrastructure. By the analysis of defined dependent and independent variables the author finds out how networks behave under which circumstances, what means exist in the field of network security and if adopted measures to increase security are in accordance with the effort of creation safe and decentralized system of critical energy infrastructure. Main emphasis is put on the concept of smart grids as possible solution of decentralization. In these terms technical means of security are studied especially with emphasis on SCADA (Supervisory Control And Data Acquisition) systems and the Internet as one of the essential component of communication in modern communication technologies.

No description available.

This thesis examined the relationship between cyber operations and armed attacks to determine when the right of self-defence is triggered by cyber operations. The research question for this thesis was under what circumstances a cyber operation is considered a cyber attack and what kind of self-defence the targeted victim State can use.  The thesis concluded that it is not the weaponry used, but the scale and effects of an operation that determines whether it amounts to an armed attack or not. Thus, cyber operations can be amount to armed attacks i.e., cyber attacks if the scale and effects caused by the operations are severe enough. However, the thesis concluded that there are certain challenges regarding the determination of the severity threshold of operations through cyberspace that do not exist for operations of kinetic nature. Specifically regarding whether cyber operations that cause disruption of critical infrastructure can amount to a cyber attack. The thesis concluded that it is unclear whether these kinds of effects can be comparable to the effects caused by traditional military force. However, cyber operations that result in mere economic damages do not reach the scale and effects needed to amount to cyber attacks.  The thesis concluded that an imminent threat of a cyber attack triggers the right of self-defence. The meaning of imminence is ‘the last possible window of opportunity’ to repel the cyber attack, as this meaning coheres with the purpose of being able to resort to force in self-defence against an attack that has yet occurred.  The issue of responsibility of non-State actors was addressed in the thesis. The essay demonstrated that the questions regarding non-State actors are even more relevant for operations carried out in cyberspace. It was concluded that although the high threshold of attribution becomes even more challenging in cyberspace, the threshold is necessary in order to maintain international peace and security. Regarding independent non-State actors, it was concluded that State practice has shown acceptance of resorting to force against non-State actors without attribution to the territorial State. To balance opposed interests, this thesis concluded that the doctrine of unwilling and unable should be followed when a victim State considers resorting to force against a non-State actor.  Regarding the principles of necessity and proportionality, this thesis could conclude that the means used against a cyber attack, whether kinetic or cyber, are not vital to determine whether the self-defence used is legal or not. Instead, force used in self-defence used must be a means of last resort and cannot exceed the force needed to repel the attack.

No description available.

No description available.

Detta examensarbete tar upp digitala hot mot webbapplikationer och kategoriserar allmänhetens uppfattning om dem. Digitala hot är oftast kopplade till ekonomiska konsekvenser varvid även dessa kommer att studeras. Målet med detta arbete är att bidra till en vetenskaplig artikel i framtiden, som kan vara värdefull för allmänheten, samt för framtida arbete och sysselsättning. För att analysera samlade uppfattningar användes konstant jämförande metoden. Resultatet avslöjar flera spännande fynd för teori och praktik, där uppfattningar om cybervärlden presenteras för att kunna förstå mer hur andra ser på cybersäkerhet idag. Det visar även betydande variationer bland deltagarnas uppfattningar och att informationssäkerhet, även om den gradvis utvecklas, har en lång väg tills den blir en obruten del av affärsverksamheten och arbetskraftens verklighet.  Denna studie kan även fungera som en guide för de olika uppfattningarna om cyberattacker eftersom den ger en översikt över de idag mest relevanta cyberattackerna. Arbetet kompletterades med en studie som belyser ekonomiska konsekvenser av cyberattacker. Utöver detta studerades även cyberattacken mot Coop under sommaren 2021. / This thesis presents a categorization of conceptions about digital threats on web applications with a study showing the economic consequences of cyber-attacks. The aim of this thesis is to contribute to a scientific article, which can be valuable to the public, as well as for future work and employment. Constant comparison method was used to analyse aggregate perceptions. The results reveal several exciting findings for theory and practice, where perceptions of the cyber world were presented in order to understand more how others see cybersecurity today. It also shows significant variations among the participants' perceptions. This shows that information security, even if it is gradually developed, has a long way to go until it becomes an unbroken part of the business.  This study can also serve as a guide for the different perceptions of cyber-attacks as it provides an overview of the most relevant cyber-attacks today. This thesis was supplemented with a study that highlights the economic consequences of cyberattacks. In addition to this, the cyber-attack on Coop during the summer of 2021 was also studied.

A cyber-security problem is a conflict-resolution scenario that typically consists of a security system and at least two decision makers (e.g. attacker and defender) that can each have competing objectives. In this thesis, we are interested in cyber-security problems where one decision maker has superior or better information. Game theory is a well-established mathematical tool that can be used to analyze such problems and will be our tool of choice. In particular, we will formulate cyber-security problems as stochastic games with asymmetric information, where game-theoretic methods can then be applied to the problems to derive optimal policies for each decision maker. A severe limitation of considering optimal policies is that these policies are computationally prohibitive. We address the complexity issues by introducing methods, based on the ideas of model predictive control, to compute suboptimal polices. Specifically, we first prove that the methods generate suboptimal policies that have tight performance bounds. We then show that the suboptimal polices can be computed by solving a linear program online, and the complexity of the linear program remains constant with respect to the game length. Finally, we demonstrate how the suboptimal policy methods can be applied to cyber-security problems to reduce the computational complexity of forecasting cyber-attacks.

abstract: The flexibility in power system networks is not fully modeled in existing real-time contingency analysis (RTCA) and real-time security-constrained economic dispatch (RT SCED) applications. Thus, corrective transmission switching (CTS) is proposed in this dissertation to enable RTCA and RT SCED to take advantage of the flexibility in the transmission system in a practical way. RTCA is first conducted to identify critical contingencies that may cause violations. Then, for each critical contingency, CTS is performed to determine the beneficial switching actions that can reduce post-contingency violations. To reduce computational burden, fast heuristic algorithms are proposed to generate candidate switching lists. Numerical simulations performed on three large-scale realistic power systems (TVA, ERCOT, and PJM) demonstrate that CTS can significantly reduce post-contingency violations. Parallel computing can further reduce the solution time. RT SCED is to eliminate the actual overloads and potential post-contingency overloads identified by RTCA. Procedure-A, which is consistent with existing industry practices, is proposed to connect RTCA and RT SCED. As CTS can reduce post-contingency violations, higher branch limits, referred to as pseudo limits, may be available for some contingency-case network constraints. Thus, Procedure-B is proposed to take advantage of the reliability benefits provided by CTS. With the proposed Procedure-B, CTS can be modeled in RT SCED implicitly through the proposed pseudo limits for contingency-case network constraints, which requires no change to existing RT SCED tools. Numerical simulations demonstrate that the proposed Procedure-A can effectively eliminate the flow violations reported by RTCA and that the proposed Procedure-B can reduce most of the congestion cost with consideration of CTS. The system status may be inaccurately estimated due to false data injection (FDI) cyber-attacks, which may mislead operators to adjust the system improperly and cause network violations. Thus, a two-stage FDI detection (FDID) approach, along with several metrics and an alert system, is proposed in this dissertation to detect FDI attacks. The first stage is to determine whether the system is under attack and the second stage would identify the target branch. Numerical simulations demonstrate the effectiveness of the proposed two-stage FDID approach. / Dissertation/Thesis / Doctoral Dissertation Electrical Engineering 2017

No description available.

This research focuses on the development and validation of an autonomic security management (ASM) framework to proactively protect distributed systems (DSs) from a wide range of cyber assaults with little or no human intervention. Multi-dimensional cyber attack taxonomy was developed to characterize cyber attack methods and tactics against both a Web application (Web-app) and an industrial control system (ICS) by accounting for their impacts on a set of system, network, and security features. Based on this taxonomy, a normal region of system performance is constructed, refined, and used to predict and identify abnormal system behavior with the help of forecasting modules and intrusion detection systems (IDS). Protection mechanisms are evaluated and implemented by a multi-criteria analysis controller (MAC) for their efficiency in eliminating and/or mitigating attacks, maintaining normal services, and minimizing operational costs and impacts. Causes and impacts of unknown attacks are first investigated by an ASM framework learning module. Attack signatures are then captured to update IDS detection algorithms and MAC protection mechanisms in near real-time. The ASM approach was validated within Web-app and ICS testbeds demonstrating the effectiveness of the self-protection capability. Experiments were conducted using realworld cyber attack tools and profiles. Experimental results show that DS security behavior is predicted, detected, and eliminated thus validating our original hypothesis concerning the self-protection core capability. One important benefit from the self-protection feature is the cost-effective elimination of malicious requests before they impede, intrude or compromise victim systems. The ASM framework can also be used as a decision support system. This feature is important especially when unknown attack signatures are ambiguous or when responses selected automatically are not efficient or are too risky to mitigate attacks. In this scenario, man-in-the-loop decisions are necessary to provide manual countermeasures and recovery operations. The ASM framework is resilient because its main modules are installed on a master controller virtual machine (MC-VM). This MC-VM is simple to use and configure for various platforms. The MC-VM is protected; thus, even if the internal network is compromised, the MC-VM can still maintain “normal” self-protection services thereby defending the host system from cyber attack on-thely.