Cyber-attack on synchrophasor data has become a widely explored area. However, GPS-spoofing and FDIA attacks require different responsive actions. State-estimation based attack detection method works similar way for both types of attacks. It implies that using state-estimation based detection alone doesn’t give the control center enough information about the attack type. This scenario is specifically more critical for those attack detection methods which consider GPS-spoofing attack as another FDIA with falsified phase angle data. Since identifying correct attack type is paramount, we have attempted to develop an algorithm to distinguish these two attacks. Previous researchers exploited low-rank approximation of Hankel Matrix to differentiate between FDIA and physical events. We have demonstrated that, together with angle unwrapping algorithm, low-rank approximation of Hankel Matrix can help us separating GPS-spoofing attack with FDIA. The proposed method is verified with simulation result. It has been demonstrated that the GSA with 3 second time-shift creates a low-rank approximation error 700% higher than that of normal condition, whereas FDIA doesn’t produce any significant change in low-rank approximation error from that of normal condition. Finally, we have proposed a real-time method for successful identification of event, FDIA and GSA. / M.S. / Cyber-attack on synchrophasor data has become a widely explored area. However, GPS-spoofing and FDIA attacks require different responsive actions. State-estimation based attack detection method works similar way for both types of attacks. It implies that using state-estimation based detection alone doesn’t give the control center enough information about the attack type. This scenario is specifically more critical for those attack detection methods which consider GPS-spoofing attack as another FDIA with falsified phase angle data. Since identifying correct attack type is paramount, we have attempted to develop an algorithm to distinguish these two attacks. Previous researchers exploited low-rank approximation of Hankel Matrix to differentiate between FDIA and physical events. We have demonstrated that, together with angle unwrapping algorithm, low-rank approximation of Hankel Matrix can help us separating GPS-spoofing attack with FDIA. The simulation result verifies the next chapter discusses our proposed algorithm on GPS-spoofing attack detection and its ability to distinguish this type of attack from conventional FDIA. The proposed method is verified with simulation result. It has been demonstrated that the GSA with 3 second time-shift creates a low-rank approximation error 700% higher than that of normal condition, whereas FDIA doesn’t produce any significant change in low-rank approximation error from that of normal condition. Finally, we have proposed a real-time method for successful identification of event, FDIA and GSA.

Massive GPS navigation services are used by billions of people in their daily lives. GPS spoofing is quite a challenging problem nowadays. Existing Anti-GPS spoofing systems primarily focus on expensive equipment and complicated algorithms, which are not practical and deployable for most of the users. In this thesis, we explore the feasibility of a simple text-based system design for Anti-GPS spoofing. The goal is to use the lower cost and make the system more effective and robust for general spoofing attack detection. Our key idea is to only use the textual information from the physical world and build a real-time system to detect GPS spoofing. To demonstrate the feasibility, we first design image processing modules to collect sufficient textual information in panoramic images. Then, we simulate real-world spoofing attacks from two cities to build our training and testing datasets. We utilize LSTM to build a binary classifier which is the key for our Anti-GPS spoofing system. Finally, we evaluate the system performance by simulating driving tests. We prove that our system can achieve more than 98% detection accuracy when the ratio of attacked points in a driving route is more than 50%. Our system has a promising performance for general spoofing attack strategies and it proves the feasibility of using textual information for the spoofing attack detection. / Master of Science / Nowadays, people are used to using GPS navigation services in their daily lives. However, GPS can be easily spoofed and the wrong GPS information will mislead victims to an unknown place. There are some existing methods that can defend GPS spoofing attacks, but all of them have significant shortcomings. Our goal is to design a novel system, which is cheap, effective, and robust, to detect general GPS spoofing attacks in real-time. In this thesis, we propose a complete system design and evaluations for performance. Our system only uses textual information from the real physical world and virtual maps. To get more accurate textual information, we use state of the art techniques for image processing and text recognition. We also use a neural network to help with detection. By testing with datasets in two cities, we confirm the promising performance of our system for general GPS spoofing attack strategies. We believe that textual information can be further developed in the Anti-GPS spoofing systems.

No description available.

The Phasor Measurement Unit provides clear data for ease of grid visibility. A major component of the device is the Global Positioning System (GPS) for time synchronization across the board. However, this device has become more susceptible to cyber-attacks such as spoofing. This paper constructs an opensource testbed for the playback of PMU data and testing of cyberattacks on PMUs. Using a local GPS device to simulate what is done in the PMU, MATLAB for data conversion, and Linux operating system running on Ubuntu, the simulator can be constructed. The spoofing attack is done by adding a phase shift of the incoming data to simulate that the data is coming from a different time stamp and shifts between the original. Finally, it is all brought together by viewing the output in an open source Phasor Data Concentrator (PDC) to validate the process. / Master of Science / To monitor the bulk electrical grid, devices used to calculate at what level the grid is at and what point in time as well. These devices that are called Phasor Measurement Units and send this data to the control center for engineers to process and make decisions. Within each device is a Global Positioning System (GPS) to tell which device is sending data and at what time. The GPS device is what is susceptible to be entered by malicious individuals. To better prepare and prevent this, a testbed would be a good solution to test if the preventative measure works. However, the best of the best costs too much money, so the next best solution is an open source test bed that could be implemented anyway. The work in this paper constructs an opensource testbed and simulates a full GPS spoofing attack.

No description available.

This work explores two areas of research. The first is the development of a video utility metric for use in aerial surveillance and reconnaissance tasks. To our knowledge, metrics that compute how useful aerial video is to a human in the context of performing tasks like detection, recognition, or identification (DRI) do not exist. However, the Targeting Task Performance (TTP) metric was previously developed to estimate the usefulness of still images for DRI tasks. We modify and extend the TTP metric to create a similar metric for video, called Video Targeting Task Performance (VTTP). The VTTP metric accounts for various things like the amount of lighting, motion blur, human vision, and the size of an object in the image. VTTP can also be predictively calculated to estimate the utility that a proposed flight path will yield. This allows it to be used to help automate path planning so that operators are able to devote more of their attention to DRI. We have used the metric to plan and fly actual paths. We also carried out a small user study that verified that VTTP correlates with subjective human assessment of video. The second area of research explores a new method of detecting GPS spoofing on an unmanned aerial system (UAS) equipped with a camera and a terrain elevation map. Spoofing allows an attacker to remotely tamper with the position, time, and velocity readings output by a GPS receiver. This tampering can throw off the UAS's state estimates, but the optical flow through the camera still depends on the actual movement of the UAS. We develop a method of detecting spoofing by calculating the expected optical flow based on the state estimates and comparing it against the actual optical flow. If the UAS is successfully spoofed to a different location, then the detector can also be triggered by differences in the terrain between where the UAS actually is and where it thinks it is. We tested the spoofing detector in simulation, and found that it works well in some scenarios.

As traditional wireless systems that only operate on fixed frequency bands are reaching their capacity limits, advanced frequency-agile radio systems are developed for more efficient spectrum utilization. For example, white space radios dynamically leverage locally unused TV channels to provide high-speed long-distance connectivity. They have already been deployed to connect the unconnected in rural areas and developing countries. However, such application scenarios are still limited due to low commercial demand. Hence, exploring better applications for white space radios needs more effort. With the benefits come the threats. As frequency-agile radio systems (e.g., software-defined radios) are flexible and become extremely low-cost and small-sized, it is very convenient for attackers to build attacking tools and launch wireless attacks using these radios. For example, civilian GPS signals can be easily spoofed by low-cost portable spoofers built with frequency-agile radio systems. In this dissertation, we study both the threat and application of frequency-agile radio systems. Specifically, our work focuses on the spoofing threat of frequency-agile radio towards GPS-based systems and the application of TV white space radio for ocean communications. Firstly, we explore the feasibility of using frequency-agile radio to stealthily manipulate GPS-based road navigation systems without alerting human drivers. A novel attacking algorithm is proposed, where the frequency-agile radio transmits fake GPS signals to lead the victim to drive on a wrong path that looks very similar with the navigation route on the screen. The attack's feasibility is demonstrated with real-world taxi traces in Manhattan and Boston. We implement a low-cost portable GPS spoofer using an off-the-shelf frequency-agile radio platform to perform physical measurements and real-world driving tests, which shows the low level of difficulty of launching the attack in real road environment. In order to study human-in-the-loop factor, a deceptive user study is conducted and the results show that 95% of the users do not recognize the stealthy attack. Possible countermeasures are summarized and sensor fusion defense is explored with preliminary tests. Secondly, we study similar GPS spoofing attack in database-driven cognitive radio networks. In such a network, a secondary user queries the database for available spectrum based on its GPS location. By manipulating GPS locations of surrounding secondary users with a frequency-agile radio, an attacker can potentially cause serious primary user interference and denial-of-service to secondary users. The serious impact of such attacks is examined in simulations based on the WhiteSpaceFinder spectrum database. Inspired by the characteristics of the centralized system and the receiving capability of cognitive radios, a combination of three defense mechanisms are proposed to mitigate the location spoofing threat. Thirdly, we explore the feasibility of building TV white space radio based on frequency-agile radio platform to provide connectivity on the ocean. We design and implement a low-cost low-power white space router ($523, 12 watts) customized for maritime applications. Its communication capability is confirmed by field link measurements and ocean-surface wave propagation simulations. We propose to combine this radio with an energy harvesting buoy so that the radio can operate independently on the ocean and form a wireless mesh network with other similar radios. / PHD / As traditional wireless systems, such as mobile phones and WiFi access points, only operate on some fixed frequency bands, it becomes increasingly crowded for those popular bands. Hence, for more efficient frequency resource utilization, frequency-agile radio systems that can dynamically operate on different frequency bands are developed. With these new technologies come new threats and applications, which are the focus of our work. On the one hand, as frequency-agile radio systems become low-cost and portable, attackers can easily launch wireless attacks with them. For example, we explored the feasibility, impact, and countermeasures for GPS spoofing attacks using frequency-agile radio systems in different scenarios. In a GPS spoofing attack, an attacker transmits false GPS signals to manipulate users’ GPS receivers. This kind of attack can be very dangerous and even life-threatening if it is launched against critical GPS-based applications. For example, once GPS-based navigation systems in self-driving cars are stealthily manipulated by remote attackers, attackers can divert self-driving cars to pre-defined destinations or dangerous situations like wrong-way driving on highway. On the other hand, since there is rich under-utilized spectrum resource in remote areas with no broadband connection yet, frequency-agile radio systems can be used to provide broadband internet connectivity there. For example, based on frequency-agile radio platform, we developed a low-cost low-power wireless router that can dynamically operate on TV broadcasting band. It is able to provide high-speed wireless connection to a large area on the ocean. This technology has the potential to bring low-cost high-speed connection to people and industry on the ocean, which will facilitate various maritime applications.

Traditionally, power system protection describes detecting, clearing, and locating faults in the power system. Traditional methods for detecting and locating faults may not be sufficient for inverter-based resources (IBR) as the fault response of an IBR differs from the response of a synchronous generator. As the composition of the power grid continues to evolve to integrate more IBRs that employ communication-based control algorithms; the power system is also exposed to cyberattacks. Undetected cyberattacks can disrupt normal system operation causing local outages. Therefore, power system protection must evolve with the changes in the grid to not only detect, locate, and clear faults with IBR generation but also detect and mitigate cyberattacks on IBR controllers. This thesis proposes methods for protecting an IBR-based transmission system from: (i) GPS spoofing cyberattacks on a power sharing controller; (ii) open-circuit faults. The GPS spoofing detection algorithm is a decision tree that enables either the proposed state observer--based mitigation technique or the proposed long short-term memory (LSTM)-based mitigation algorithm. The proposed logic for detecting open-circuit faults addresses each subcategory of open-circuit faults: breaker malfunctions, broken conductors, and series arc faults. PSCAD/EMTDC simulations are performed to test the effectiveness of the proposed methods. / Master of Science / The desire to reduce carbon emissions from electric power generation is resulting in the simultaneous retirement of fossil-fuel-burning electric power generation and increase in the number of renewable energy resources. These renewable energy resources, or inverter-based resources, respond differently to disturbances than traditional generators, and; therefore, require the development of new strategies to improve the disturbance response of an inverter-based resource. Disturbances in the power system can be divided into two types: (i) normal disturbances; (ii) abnormal disturbances. The response of an IBR to normal disturbances is improved with reliable control, further improved with communication, which ensures the stable operation of the power system. The abnormal conditions can also be split into two categories: (i) cyberattacks; (ii) faults. A cyberattack is when an adversary gains access a system with the goal of causing harm. In IBRs, cyberattacks can degrade power quality and lead to local outages. Faults are events that cause a change in the normal current flow in the power system. Undetected faults can cause local outages, lead to forest fires, and personnel injury; therefore, must be detected, located, can cleared in a timely manner. This work explores methods for detecting and mitigating cyberattacks and detecting faults in the presence of inverter-based resources.

The usage of drones is steadily increasing as drones are becoming more available and useful to the general public, but drone usage also leads to problems as for example airports have had to shutdown due to drone sightings. It has become clear that a counter-drone system must be in place to neutralize intruding drones. However, neutralizing a drone is not an easy task, the risk of causing collateral damage and interfering with other radio systems must be highly considered when designing a counter-drone system. In this thesis a set of consumer drones was selected based on market popularity. By studying the wireless communication links of the selected drones a set of drone neutralization methods was identified. For each neutralization method a set of jamming and spoofing techniques was selected from current research. The techniques was used in practise by subjecting the drones to the techniques in a series of drone behaviour experiments. The results was used to evaluate the techniques in four criteria based on avoiding collateral damage, mitigating radio interference, identification requirement and handling multiple intruding drones. The evaluation was then summarized to discuss suitable drone neutralization methods and jamming & spoofing techniques. The results showed that there are neutralization methods that could potentially avoid causing col- lateral damage for certain drones. A full-band barrage jamming technique was shown to best the best performing based on the evaluation criteria, but was also the technique that theoretically induced the most radio interference. Furthermore, drones operating in way-point mode can only be neutralized using a GNSS jamming or spoofing neutralization method. Also using a GPS spoofing neutralization method was shown to be difficult to implement in practise. / Populariteten av att flyga drönare ökar stadigt i och med att drönartekniken blir mer tillgänglig och an- vändbart för allmänheten. Men användningen av drönare leder också till problem när till exempel flyg- platser har varit tvungna att stänga av på grund av drönar observationer. Det har blivit tydligt att ett anti-drönarsystem måste vara på plats för att neutralisera inkräktande drönare. Men att neutralisera en drönare är inte en enkel uppgift, risken för att orsaka sido-skador på personer, byggander eller objekt; eller störa andra radiosystem måste beaktas starkt när man utformar ett anti-drönarsystem. I detta examensarbete valdes en uppsättning konsumentdrönare ut baserat på marknadens popularitet. Genom att studera de trådlösa kommunikationslänkarna för de valda drönarna identifierades en uppsättning av drönar-neutraliseringsmetoder. För varje neutraliseringsmetod valdes en uppsättning av störnings- och spoofing-tekniker ut från aktuell forskning. Teknikerna användes i praktiken genom att utsätta drönarna för teknikerna i en serie drönar-beteendeexperiment. Resultaten användes sedan för att utvärdera teknikerna i fyra utvärderingskriterier baserade på att undvika sido-skador, mildra radiostörningar, identifieringsbehov och hantering av flera inkräktande drönare. Utvärderingen sammanfattades sedan för att diskutera lämpliga drönar-neutraliseringsmetoder och störnings- spoofing-tekniker. Resultaten visade att det finns neutraliseringsmetoder som potentiellt kan undvika att orsaka sido- skador eller radio-störningar för vissa typer av drönare. En full-bands störningsteknik visade sig vara bäst presterande baserat på utvärderingskriterierna, men var också den teknik som teoretiskt inducerade mest radiostörningar. Dessutom visades det att drönare som flyger i navigeringsläge endast kan neutraliseras med hjälp av en GNSS-störnings- eller spoofing metoder. Att använda en GPS-spoofing metod visade sig också vara svår att implementera i praktiken.

The Internet of things (IoT) device has been widely used in various fields, and its market is expanding rapidly. However, the growing usage of IoT devices also brings more security concerns. The smart door lock is one of the smart home IoT devices that need to be designed securely. This thesis work aims to evaluate and investigate the security aspect of the newest smart door lock. This thesis first provides an introduction and background of penetration testing and creates the threat model. Based on the threat model, some testings are conducted, including state consistency, Man-In-The-Middle (MITM) attack, replay attack, reverse engineering, GPS spoofing, Denial of service (DoS) attack. The result indicates that penetration tests reveal some security problems on the tested device, especially in the access log, traffic between application and server, and the ability of resistance disruption on the WiFi access point. / IoT-enheten har använts i stor utsträckning inom olika områden och dess marknad expanderar snabbt. Den ökande användningen av IoT-enheter medför dock också fler säkerhetsproblem. Det smarta dörrlåset är en av de smarta hem IoT-enheterna som måste utformas säkert. Detta examensarbete syftar till att utvärdera och undersöka säkerhetsaspekten av det nyaste smarta dörrlåset. Denna avhandling ger först en introduktion och bakgrund av penetrationstestning och skapar hotmodellen. Baserat på hotmodellen genomförs vissa tester, inklusive tillståndskonsistens, MITM attack, replay attack, reverse engineering, GPS spoofing, DoS attack. Resultatet indikerar att penetrationstester avslöjar vissa sårbarheter på den testade enheten, särskilt i åtkomstloggen, trafik mellan applikation och server och förmågan till motståndsavbrott på WiFi-åtkomstpunkten.