Critical infrastructures (CIs) distributing water, oil, gas, electricity, etc., to community residents and businesses, leverage cyber-physical systems (CPSs) to supervise and control the physical processes that these services entail. Over recent decades, these systems have moved to implement more modern IT-resembling solutions using Supervisory Control and Data Acquisition Systems (SCADA) for increased reliability, scalability, and remote connectivity. This change exposes these highly critical systems to new threats and vulnerabilities. One approach to mitigate the risks faced by these systems is to perform analysis on digital representations in the form of digital models or digital shadows of the CPSs. However, this is not a trivial task in practice. These practical issues are explored in this design science research through the development of a guidance process to perform the data collection necessary to create a static digital model of a small-scale power grid CPS in Sweden. The results show that it is possible to gather information on the CPS components through the four approaches: SCADA system exports, documentation information, CLI scripting, and network scanning. While the artefact presented in this report demonstrates these results, challenges still remain such as a lack of SCADA export tools, reaching the SCADA network with scanning tools in a responsible manner, and accessing insights into the complete documentation held by the organisations. The researcher suggests these topics for future research directions.

Denna rapport närmar sig cyberfysiska system (CPS) ur både användnings- och utvecklingsperspektiv, med särskilt fokus på utmaningarna i en sjukhusmiljö. Vikten av en kontinuerlig utveckling för att optimera teknologins prestanda och användbarhet betonas, och de specifika utmaningar som är unika för en sjukhusmiljö belyses. Studien undersöker hantering av komplexitet kopplat till CPS i form av automatiserade transportsystem på Nya Karolinska Universitetssjukhuset, Stockholm, Sverige. Målet är att ge framtida sjukhusprojekt en klar beskrivning av erfarenheterna av att utveckla och hantera CPS i sjukhusmiljö. Genom att titta på både möjligheter och utmaningar kommer rapporten att bidra till en ökad förståelse för CPS och dess förmåga att förbättra vården. Resultaten visar att utmaningarna inkluderar höga säkerhetskrav, integrering med personal, noga övervakning för att undvika driftstörningar och behovet av samarbete och flexibilitet. Rapporten drar slutsatsen att samarbete, proaktiv inställning och kontinuerlig utveckling är nödvändiga för att optimera prestanda och användbarhet hos CPS. Användare och kunder bör också vara aktiva i att dokumentera och rapportera systemets beteende för en kontinuerlig förbättring. Utvecklingen av CPS inom sjukhusmiljöer kräver också kontinuerlig testning och utbildning av personal samt ett koordinerat och strategiskt förhållningssätt för att säkerställa god samverkan mellan systemets olika aspekter. / This report approaches CPS technology from both usage and development perspectives, with a particular focus on the challenges in a hospital environment. The importance of continuous development to optimize the technology's performance and usability is explored, as well as the specific challenges that are unique to a hospital environment. The study investigates the complexity management of CPS in the form of automated transport systems at the New Karolinska University Hospital in Stockholm, Sweden. The goal is to provide future hospital projects with a clear description of the experiences of developing and managing CPS in a hospital environment. By looking at both opportunities and challenges, the report contributes to a greater understanding of CPS and its ability to improve health care. The study shows that the challenges include high security requirements, integration with staff, careful monitoring to avoid disruptions, and the need for cooperation and flexibility. The report concludes that cooperation, proactive attitude and continuous development are necessary to optimize the performance and usability of CPS. Users and customers should be active in documenting and reporting the system's behavior for continuous improvement. The development of CPS in hospital environments also requires continuous testing and training of staff and a coordinated and strategic approach to ensure cooperation between the system's different aspects.

<p>The progressive integration of microcontrollers into various domains has transformed traditional mechanical systems into modern cyber-physical systems. However, the beginning of this transformation predated the era of hyper-interconnectedness that characterizes our contemporary world. As such, the principles and visions guiding the design choices of this transformation had not accounted for many of today's security challenges. Many designers had envisioned their systems to operate in an air-gapped-like fashion where few security threats loom. However, with the hyper-connectivity of today's world, many CPS find themselves in uncharted territory for which they are unprepared.</p> <p><br></p> <p>An example of this evolution is the Controller Area Network (CAN). CAN emerged during the transformation of many mechanical systems into cyber-physical systems as a pivotal communication standard, reducing vehicle wiring and enabling efficient data exchange. CAN's features, including noise resistance, decentralization, error handling, and fault confinement mechanisms, made it a widely adopted communication medium not only in transportation but also in diverse applications such as factories, elevators, medical equipment, avionic systems, and naval applications.</p> <p><br></p> <p>The increasing connectivity of modern vehicles through CD players, USB sticks, Bluetooth, and WiFi access has exposed CAN systems to unprecedented security challenges and highlighted the need to bolster their security posture. This dissertation addresses the urgent need to enhance the security of modern cyber-physical systems in the face of emerging threats by proposing a proactive vulnerability identification and defense construction approach and applying it to CAN as a lucid case study. By adopting this proactive approach, vulnerabilities can be systematically identified, and robust defense mechanisms can be constructed to safeguard the resilience of CAN systems.</p> <p><br></p> <p>We focus on developing vulnerability scanning techniques and innovative defense system designs tailored for CAN systems. By systematically identifying vulnerabilities before they are discovered and exploited by external actors, we minimize the risks associated with cyber-attacks, ensuring the longevity and reliability of CAN systems. Furthermore, the defense mechanisms proposed in this research overcome the limitations of existing solutions, providing holistic protection against CAN threats while considering its performance requirements and operational conditions.</p> <p><br></p> <p>It is important to emphasize that while this dissertation focuses on CAN, the techniques and rationale used here could be replicated to secure other cyber-physical systems. Specifically, due to CAN's presence in many cyber-physical systems, it shares many performance and security challenges with those systems, which makes most of the techniques and approaches used here easily transferrable to them. By accentuating the importance of proactive security, this research endeavors to establish a foundational approach to cyber-physical systems security and resiliency. It recognizes the evolving nature of cyber-physical systems and the specific security challenges facing each system in today's hyper-connected world and hence focuses on a single case study. </p>

No description available.

Increasingly flexible and efficient industrial processes and automation systems are developed by integrating computational systems and physical processes, thereby forming large heterogeneous systems of cyber-physical systems. Such systems depend on particular data models and payload formats for communication, and making different entities interoperable is a challenging problem that drives the engineering costs and time to deployment. Interoperability is typically established and maintained manually using domain knowledge and tools for processing and visualization of symbolic metadata, which limits the scalability of the present approach. The vision of next generation automation frameworks, like the Arrowhead Framework, is to provide autonomous interoperability solutions. In this thesis the problem to automatically establish interoperability between cyber-physical systems is reviewed and formulated as a mathematical optimisation problem, where symbolic metadata and message payloads are combined with machine learning methods to enable message translation and improve system of systems utility. An autoencoder based implementation of the model is investigated and simulation results for a heating and ventilation system are presented, where messages are partially translated correctly by semantic interpolation and generalisation of the latent representations. A maximum translation accuracy of 49% is obtained using this unsupervised learning approach. Further work is required to improve the translation accuracy, in particular by further exploiting metadata in the model architecture and autoencoder training protocol, and by considering more advanced regularization methods and utility optimization. / Productive 4.0

Under de senaste åren har produkterna blivit mer invecklade beträffande anslutningen, prestanda och funktionalitet. Därför är syftet av denna studie att undersöka hur komplexa system utvecklas och leds genom att genomföra fallstudie på olika svenska företag som utvecklar mekatroniska och cyber-fysiska system. Resultatet av denna studie har lett till identifieringen av många utmaningar som de undersökta företagen har och som i sin tur har lett till framställningen av ett analytiskt ramverk som diskuterar hur och vad man bör göra för att utveckla komplexa produkter på ett effektivt sätt, så att onödig komplexitet i produktutvecklingen kan reduceras. / In recent years, products have become more complex in terms of connectivity, performance and functionality. Therefore, this study aims at studying how complex products are developed and managed through conducting multiple case studies at different Swedish companies that develop mechatronic or cyberphysical systems. The results of this study is the identification of many challenges that the investigated companies have, which have led to a presentation of an analytical framework that discusses how complex product development projects can and should be managed in order to be efficient, in order to reduce unnecessary complexity in the way companies develop these complex products.

<p dir="ltr">In the contemporary digital era, Advanced Persistent Threat (APT) attacks are evolving, becoming increasingly sophisticated, and now perilously targeting critical cyber-physical systems, notably Industrial Control Systems (ICS). The intersection of digital and physical realms in these systems enables APT attacks on ICSs to potentially inflict physical damage, disrupt critical infrastructure, and jeopardize human safety, thereby posing severe consequences for our interconnected world. Provenance tracing techniques are essential for investigating these attacks, yet existing APT attack forensics approaches grapple with scalability and maintainability issues. These approaches often hinge on system- or application-level logging, incurring high space and run-time overheads and potentially encountering difficulties in accessing source code. Their dependency on heuristics and manual rules necessitates perpetual updates by domain-knowledge experts to counteract newly developed attacks. Additionally, while there have been efforts to verify the safety of Programming Logic Controller (PLC) code as adversaries increasingly target industrial environments, these works either exclusively consider PLC program code without connecting to the underlying physical process or only address time-related physical safety issues neglecting other vital physical features.</p><p dir="ltr">This dissertation introduces two novel frameworks, ATLAS and ARCHPLC, to address the aforementioned challenges, offering a synergistic approach to fortifying cybersecurity in the face of evolving APT and ICS threats. ATLAS, an effective and efficient multi-host attack investigation framework, constructs end-to-end APT attack stories from audit logs by combining causality analysis, Natural Language Processing (NLP), and machine learning. Identifying key attack patterns, ATLAS proficiently analyzes and pinpoints attack events, minimizing alert fatigue for cyber analysts. During evaluations involving ten real-world APT attacks executed in a realistic virtual environment, ATLAS demonstrated an ability to recover attack steps and construct attack stories with an average precision of 91.06%, a recall of 97.29%, and an F1-score of 93.76%, providing a robust framework for understanding and mitigating cyber threats.</p><p dir="ltr">Concurrently, ARCHPLC, an advanced approach for enhancing ICS security, combines static analysis of PLC code and data mining from ICS data traces to derive accurate invariants, providing a comprehensive understanding of ICS behavior. ARCHPLC employs physical causality graph analysis techniques to identify cause-effect relationships among plant components (e.g., sensors and actuators), enabling efficient and quantitative discovery of physical causality invariants. Supporting patching and run-time monitoring modes, ARCHPLC inserts derived invariants into PLC code using program synthesis in patching mode and inserts invariants into a dedicated monitoring program for continuous safety checks in run-time monitoring mode. ARCHPLC adeptly detects and mitigates run-time anomalies, providing exceptional protection against cyber-physical attacks with minimal overhead. In evaluations against 11 cyber-physical attacks on a Fischertechnik manufacturing plant and a chemical plant simulator, ARCHPLC protected the plants without any false positives or negatives, with an average run-time overhead of 14.31% in patching mode and 0.4% in run-time monitoring mode.</p><p dir="ltr">In summary, this dissertation provides invaluable solutions that equip cybersecurity professionals to enhance APT attack investigation, enabling them to identify and comprehend complex attacks with heightened accuracy. Moreover, these solutions significantly bolster the safety and security of ICS infrastructure, effectively protecting critical systems and strengthening defenses against cyber-physical attacks, thereby contributing substantially to the field of cybersecurity.</p>

In this dissertation research, we design and analyze resilient cyber-physical systems (CPSs) under high network dynamics, adversarial attacks, and various uncertainties. We focus on three key system attributes to build resilient CPSs by developing a suite of the autonomous cyber defense mechanisms. First, we consider network adaptability to achieve the resilience of a CPS. Network adaptability represents the network ability to maintain its security and connectivity level when faced with incoming attacks. We address this by network topology adaptation. Network topology adaptation can contribute to quickly identifying and updating the network topology to confuse attacks by changing attack paths. We leverage deep reinforcement learning (DRL) to develop CPSs using network topology adaptation. Second, we consider the fault-tolerance of a CPS as another attribute to ensure system resilience. We aim to build a resilient CPS under severe resource constraints, adversarial attacks, and various uncertainties. We chose a solar sensor-based smart farm as one example of the CPS applications and develop a resource-aware monitoring system for the smart farms. We leverage DRL and uncertainty quantification using a belief theory, called Subjective Logic, to optimize critical tradeoffs between system performance and security under the contested CPS environments. Lastly, we study system resilience in terms of system recoverability. The system recoverability refers to the system's ability to recover from performance degradation or failure. In this task, we mainly focus on developing an automated intrusion response system (IRS) for CPSs. We aim to design the IRS with effective and efficient responses by reducing a false alarm rate and defense cost, respectively. Specifically, We build a lightweight IRS for an in-vehicle controller area network (CAN) bus system operating with DRL-based autonomous driving. / Doctor of Philosophy / In this dissertation research, we design and analyze resilient cyber-physical systems (CPSs) under high network dynamics, adversarial attacks, and various uncertainties. We focus on three key system attributes to build resilient CPSs by developing a suite of the autonomous cyber defense mechanisms. First, we consider network adaptability to achieve the resilience of a CPS. Network adaptability represents the network ability to maintain its security and connectivity level when faced with incoming attacks. We address this by network topology adaptation. Network topology adaptation can contribute to quickly identifying and updating the network topology to confuse attacks by changing attack paths. We leverage deep reinforcement learning (DRL) to develop CPSs using network topology adaptation. Second, we consider the fault-tolerance of a CPS as another attribute to ensure system resilience. We aim to build a resilient CPS under severe resource constraints, adversarial attacks, and various uncertainties. We chose a solar sensor-based smart farm as one example of the CPS applications and develop a resource-aware monitoring system for the smart farms. We leverage DRL and uncertainty quantification using a belief theory, called Subjective Logic, to optimize critical tradeoffs between system performance and security under the contested CPS environments. Lastly, we study system resilience in terms of system recoverability. The system recoverability refers to the system's ability to recover from performance degradation or failure. In this task, we mainly focus on developing an automated intrusion response system (IRS) for CPSs. We aim to design the IRS with effective and efficient responses by reducing a false alarm rate and defense cost, respectively. Specifically, We build a lightweight IRS for an in-vehicle controller area network (CAN) bus system operating with DRL-based autonomous driving.

No description available.

No description available.