The introduction of communication technology into the electric power grid has made the grid more reliable. Power system operators gain visibility over the power system and are able to resolve operational issues remotely via Supervisory Control And Data Acquisition (SCADA) technology. This reduces outage periods. Nonetheless, the remote-control capability has rendered the power grid vulnerable to cyberattacks. In December 2015, over 200,000 people in Ukraine became victims of the first publicly reported cyberattack on the power grid. Consequently, cyber-physical security research for the power system as a critical infrastructure is in critical need. Research on cybersecurity for power grids has produced a diverse literature; the multi-faceted nature of the grid makes it vulnerable to different types of cyberattacks, such as direct power grid, supply chain and ransom attacks. The attacks may also target different levels of grid operation, such as the transmission system, distribution system, microgrids, and generation. As these levels are characterized by varying operational constraints, the literature may be categorized not only according to the type of attack it targets, but also according to the level of power system operation under consideration. It is noteworthy that cybersecurity research for the transmission system dominates the literature, although the distribution system is noted to have a larger attack surface. For the distribution system, a notable attack type is the so-called direct switching attack, in which an attacker aims to disrupt power supply by compromising switching devices that connect equipment such as generators, and power grid lines. To maximize the damage, this attack tends to be coordinated as the attacker optimally selects the nodes and switches to attack. This decision-making process is often a bi- or tri-level optimization problem which models the interaction between the attacker and the power system defender. It is necessary to detect attacks and establish coordination/correlation among them. Determining coordination is a necessary step to predict the targets of an attack before attack completion, and aids in the mitigation strategy that ensues. While the literature has addressed the direct switching attack on the distribution system in different ways, there are also shortcomings. These include: (i) techniques to establish coordination among attacks are centralized, making them prone to single-point failures; (ii) techniques to establish coordination among attacks leverage only power system models, ignoring the influence of communication network vulnerabilities and load criticality in the decisions of the attacker; (iii) attacker-defender optimization models assume specific knowledge of the attacker resources and constraints by the defender, a strong unrealistic assumption that reduces their usability; (iv) and, mitigation strategies tend to be static and one-sided, being implemented only at the physical level, or at the communication network level. In light of this, this dissertation culminates in major contributions concerning real-time decentralized correlation of detected direct switching attacks and hybrid mitigation for electric power distribution systems. Concerning this, four novel contributions are presented: (i) a framework for decentralized correlation of attacks and mitigation; (ii) an attacker-defender optimization model that accounts for power system laws, load criticality, and cyber vulnerabilities in the decision-making process of the attacker; (iii) a real-time learning-based mechanism for determining correlation among detected attacks and predicting attack targets, and which does not assume knowledge of the attacker's resources and constraints by the power system defender; (iv) a hybrid mitigation strategy optimized in real-time based on information learned from detected attacks, and which combines both physical level and communication network level mitigation. Since the execution of intrusion detection systems and mechanisms such as the ones proposed in this dissertation may deter attackers from directly attacking the power grid, attackers may perform a supply chain cyberattack to yield the same results. Although, supply chain cyberattacks have been acknowledged as potentially far-reaching, and compliance directives put forward for this, the detection of supply chain cyberattacks is in a nascent stage. Consequently, this dissertation also proposes a novel method for detecting supply chain cyberattacks. To the best of the knowledge of the author, this work is the first preliminary work on supply chain cyberattack detection. / Doctor of Philosophy / The electric power grid is the network that transports electricity from generation to consumers, such as homes and factories. The power grid today is highly remote-monitored and controlled. Should there be a fault on the grid, the human operator, often remotely located, may only need to resolve it by sending a control signal to telemetry points, called nodes, via a communication network. This significantly reduces outage periods and improves the reliability of the grid. Nonetheless, the high level connectivity also exposes the grid to cyberattacks. The cyber connectivity between the power grid and the human operator, like all communication networks, is vulnerable to cyberattacks that may allow attackers to gain control of the power grid. If and when successful, wide-spread and extended outages, equipment damage, etc. may ensue. Indeed, in December 2015, over 200,000 people in Ukraine became victims to the first publicly reported cyberattack on a power grid. As a critical infrastructure, cybersecurity for the power grid is, therefore, in critical need. Research on cybersecurity for power grids has produced a diverse literature; the multi-faceted nature of the grid makes it vulnerable to different types of cyberattacks, such as direct power grid, supply chain and ransom attacks. Notable is the so-called direct switching attack, in which an attacker aims to compromise the power grid communication network in order to toggle switches that connect equipment such as generators, and power grid lines. The aim is to disrupt electricity service. To maximize the damage, this attack tends to be coordinated; the attacker optimally selects several grid elements to attack. Thus, it is necessary to both detect attacks and establish coordination among them. Determining coordination is a necessary step to predict the targets of an attack before attack completion. This aids the power grid owner to intercept and mitigate attacks. While the literature has addressed the direct switching attack in different ways, there are also shortcomings. Three outstanding ones are: (i) techniques to determine coordination among attacks and predict attack targets are centralized, making them prone to single-point failures; (ii) techniques to establish coordination among attacks leverage only power system physical laws, ignoring the influence of communication network vulnerabilities in the decisions of the attacker; (iii) and, studies on the interaction between the attacker and the defender (i.e., power grid owner) assume specific knowledge of the attacker resources and constraints by the defender, a strong unrealistic assumption that reduces their usability. This research project addresses several of the shortcomings in the literature, particularly the aforementioned. The work focuses on the electric distribution system, which is the power grid that connects directly to consumers. Indeed, this choice is ideal, as the distribution system has a larger attack surface than other parts of the grid and is characterized by computing devices with more constrained computational capability. Thus, adaptability to simple computing devices is a priority. The contributions of this dissertation provide leverage to the power grid owner to intercept and mitigate attacks in a resilient manner. The original contributions of the work are: (i) a novel realistic model that shows the decision making process of the attacker and their interactions with the defender; (ii) a novel decentralized mechanism for predicting the targets of coordinated cyberattacks on the electric distribution grid in real-time and which is guided by the attack model, (iii) and a novel hybrid optimized mitigation strategy that provides security to the power grid at both the communication network level and the physical power grid level. Since the power grid is constructed with smart equipment from various vendors, attackers may launch effective attacks by compromising the devices deployed in the power grid through a compromised supply chain. By nature, such an attack is evasive to traditional intrusion detection systems and algorithms such as the aforementioned. Therefore, this work also provides a new method to defend the grid against supply chain attacks, resulting in a mechanism for its detection in a critical power system communication device.

Spacecraft fulfill a myriad of critical functions on orbit, from defense and intelligence to science, navigation, and telecommunication. Spacecraft can also cost several hundred millions of dollars to design and launch, and given that physical access for maintenance remains difficult if not impossible to date, designing high reliability and survivability into these systems is an engineering and financial imperative. While reliability is recognized as an essential attribute for spacecraft, little analysis has been done pertaining to actual field reliability of spacecraft and their subsystems. This thesis consists of two parts. The first part fills the gap in the current understanding of spacecraft failure behavior on orbit through extensive statistical analysis and modeling of anomaly and failure data of Earth-orbiting spacecraft. The second part builds on these results to develop a novel theoretical basis (interdependent multi-layer network approach) and algorithmic tools for the analysis of survivability of spacecraft and space-based networks. Space-based networks (SBNs) allow the sharing of on-orbit resources, such as data storage, processing, and downlink. Results indicate and quantify the incremental survivability improvement of the SBN over the traditional monolith architecture. A trade-space analysis is then conducted using non-descriptive networkable subsystems/technologies to explore survivability characteristics of space-based networks and help guide design choices.

STG decomposition is a promising approach to tackle the complexity problems arising in logic synthesis of speed independent circuits, a robust asynchronous (i.e. clockless) circuit type. Unfortunately, STG decomposition can result in components that in isolation have irreducible CSC conflicts. Generalising earlier work, it is shown how to resolve such conflicts by introducing internal communication between the components via structural techniques only. / STG-Dekomposition ist ein bewährter Ansatz zur Bewältigung der Komplexitätsprobleme bei der Logiksynthese von SI (speed independent) Schaltungen – ein robuster asynchroner (d.h. ohne Taktsignal arbeitender digitaler) Schaltungstyp. Allerdings können dabei Komponenten mit irreduziblen CSC-Konflikten entstehen. Durch Verallgemeinerung früherer Arbeiten wird gezeigt, wie solche Konflikte durch Einführung interner Kommunikation zwischen den Komponenten gelöst werden können, und zwar ausschließlich durch Verwendung an der Graphenstruktur ansetzender Verfahren.

Configurable process models are integrated representations of multiple variants of a process model in a given domain, e.g. multiple variants of a shipment-to-delivery process in the logistics domain. Configurable process models provide a basis for managing variability and for enabling reuse of process models in Process-Aware Information Systems. Rather than designing process models from scratch, analysts can derive process models by configuring existing ones, thereby reusing proven practices. This thesis starts with the observation that existing approaches for capturing and managing configurable process models suffer from three shortcomings that affect their usability in practice. Firstly, configuration in existing approaches is performed manually and as such it is error-prone. In particular, analysts are left with the burden of ensuring the correctness of the individualized models. Secondly, existing approaches suffer from a lack of decision support for the selection of configuration alternatives. Consequently, stakeholders involved in the configuration of process models need to possess expertise both in the application domain and in the modeling language employed. This assumption represents an adoption obstacle in domains where users are unfamiliar with modeling notations. Finally, existing approaches for configurable process modeling are limited in scope to control-flow aspects, ignoring other equally important aspects of process models such as object flow and resource management. Following a design science research method, this thesis addresses the above shortcomings by proposing an integrated framework to manage the configuration of process models. The framework is grounded on three original and interrelated contributions: (i) a conceptual foundation for correctness-preserving configuration of process models; (ii) a questionnaire-driven approach for process model configuration, providing decision support and abstraction from modeling notations; (iii) a meta-model for configurable process models covering control-flow, data objects and resources. While the framework is language-independent, an embodiment of the framework in the context of a process modeling language used in practice is also developed in this thesis. The framework was formally defined and validated using four scenarios taken from different domains. Moreover, a comprehensive toolset was implemented to support the validation of the framework.

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / This work formalizes four methods based on Linear Logic for the verification of interorganizational workflow processes modelled by Interorganizational Workflow nets, which are Petri nets that model such processes. The first method is related to the verification of the Soundness criteria for interorganizational workflow processes. The method is based on the construction and analysis of Linear Logic proof trees, which represent the local processes as much as they do the global processes. The second and third methods are related, respectively to Soundness criteria verification, Relaxed Soundness and Weak Soundness for the interorganizational workflow processes. These are obtained through the analysis of reutilized Linear Logic proof trees that have been constructed for the verification of the Soundness criteria. However, the fourth method has the objective of detecting the deadlock free scenarios in interorganizational workflow and is based on the construction and analysis of Linear Logic proof trees, which initially takes into consideration the local processes and communication between such, and thereafter the candidate scenarios. A case study is carried out in the context of a Web services composition check, since there is a close correlation between the modelling of the interorganizational workflow process and a Web services composition. Therefore, the four methods proposed in the interorganizational workflow process context, are applied to a Web services composition. The evaluation of the obtained results shows that the reutilization of Linear Logic proof trees initially constructed for verifying the Soundness criteria, in fact occurs in the context of verifying the Relaxed Soundness andWeak Soundness criteria. In addition, the evaluation shows how the Linear Logic sequents and their proof trees explicitly show the possibilities for existing collaborations in a Web service composition. An evaluation that takes into account the number of constructed linear logic proof trees shows that this number can be significantly reduced in the deadlock-freeness scenarios detection method. An approach for resource planning based on the symbolic date calculation, which considers data extracted from Linear Logic proof trees is presented and validated through simulations performed on the CPN tools simulator. Two approaches for the monitoring of deadlockfreeness scenarios are introduced and show how data obtained from the Linear Logic proof trees can be used to guide the execution of such scenarios. / Este trabalho formaliza quatro métodos baseados na Lógica Linear para verificação de processos de workflow interorganizacionais modelados por WorkFlow nets interorganizacionais, que são redes de Petri que modelam tais processos. O primeiro método está relacionado com a verificação do critério de correção Soundness para processos de workflow interorganizacionais. O método é baseado na construção e análise de árvores de prova da Lógica Linear que representam tanto os processos locais quanto o processo global. O segundo e terceiro métodos estão relacionados, respectivamente, com a verificação dos critérios de correção Relaxed Soundness e Weak Soundness para processos de workflow interorganizacionais, e são obtidos através da análise de árvores de prova da Lógica Linear reutilizadas, construídas para a prova do critério de correção Soundness. Já o quarto método tem por objetivo a detecção dos cenários livres de deadlock em processos de workflow interorganizacionais e é baseado na construção e análise de árvores de prova da Lógica Linear que consideram, inicialmente, os processos locais e as comunicações entre estes e, posteriormente, os cenários candidatos. Um estudo de caso é realizado no contexto da verificação de composições de serviços Web, uma vez que há uma relação estreita entre a modelagem de um processo de workflow interorganizacional e uma composição de serviços Web. Assim, os quatro métodos propostos no contexto dos processos de workflow interorganizacionais são aplicados a uma composição de serviços Web. A avaliação dos resultados mostra que o reuso de árvores de prova da Lógica Linear construídas inicialmente para a prova do critério de correção Soundness de fato ocorre no contexto da verificação dos critérios de correção Relaxed Soundness e Weak Soundness. Além disso, a avaliação mostra como os sequentes da Lógica Linear e suas árvores de prova explicitam as possibilidades de colaboração existentes em uma composição de serviços Web. Uma avaliação que leva em conta o número de árvores de prova da Lógica Linear construídas mostra que este número pode ser significativamente reduzido no método para detecção de cenários livres de deadlock. Uma abordagem para planejamento de recursos, baseada no cálculo de datas simbólicas, que considera dados extraídos de árvores de prova da Lógica Linear, é apresentada e validada através de simulações realizadas no simulador CPN Tools. Duas abordagens para a monitoração dos cenários livres de deadlock são introduzidas e mostram como dados obtidos nas árvores de prova da Lógica Linear podem ser utilizados para guiar a execução de tais cenários. / Doutor em Ciência da Computação

Cette thèse s'intéresse à l'étude des problèmes de diagnostic des fautes sur les systèmes à événements discrets en utilisant les modèles réseau de Petri. Des techniques d'exploration incrémentale et à-la-volée sont développées pour combattre le problème de l'explosion de l'état lors de l'analyse de la diagnosticabilité. Dans le contexte atemporel, la diagnosticabilité de modèles RdP-L est abordée par l'analyse d'une série de problèmes K-diagnosticabilité. L'analyse de la diagnosticabilité est effectuée sur la base de deux modèles nommés respectivement FM-graph et FM-set tree qui sont développés à-la-volée. Un diagnostiqueur peut être dérivé à partir du FM-set tree pour le diagnostic en ligne. Dans le contexte temporel, les techniques de fractionnement des intervalles de temps sont élaborées pour développer représentation de l'espace d'état des RdP-LT pour laquelle des techniques d'analyse de la diagnosticabilité peuvent être utilisées. Sur cette base, les conditions nécessaires et suffisantes pour la diagnosticabilité de RdP-LT ont été déterminées. En pratique, l'analyse de la diagnosticabilité est effectuée sur la base de la construction à-la-volée d'une structure nommée ASG et qui contient des informations relatives à l'occurrence de fautes. D'une manière générale, l'analyse effectuée sur la base des techniques à-la-volée et incrémentale permet de construire et explorer seulement une partie de l'espace d'état, même lorsque le système est diagnosticable. Les résultats des simulations effectuées sur certains benchmarks montrent l'efficacité de ces techniques en termes de temps et de mémoire par rapport aux approches traditionnelles basées sur l'énumération des états / This PhD thesis deals with fault diagnosis of discrete event systems using Petri net models. Some on-the-fly and incremental techniques are developed to reduce the state explosion problem while analyzing diagnosability. In the untimed context, an algebraic representation for labeled Petri nets (LPNs) is developed for featuring system behavior. The diagnosability of LPN models is tackled by analyzing a series of K-diagnosability problems. Two models called respectively FM-graph and FM-set tree are developed and built on the fly to record the necessary information for diagnosability analysis. Finally, a diagnoser is derived from the FM-set tree for online diagnosis. In the timed context, time interval splitting techniques are developed in order to make it possible to generate a state representation of labeled time Petri net (LTPN) models, for which techniques from the untimed context can be used to analyze diagnosability. Based on this, necessary and sufficient conditions for the diagnosability of LTPN models are determined. Moreover, we provide the solution for the minimum delay ∆ that ensures diagnosability. From a practical point of view, diagnosability analysis is performed on the basis of on-the-fly building of a structure that we call ASG and which holds fault information about the LTPN states. Generally, using on-the-fly analysis and incremental technique makes it possible to build and investigate only a part of the state space, even in the case when the system is diagnosable. Simulation results obtained on some chosen benchmarks show the efficiency in terms of time and memory compared with the traditional approaches using state enumeration

High power dissipation and on-chip temperature limit performance and affect reliability in modern microprocessors. For servers and data centers, they determine the cooling cost, whereas for handheld and mobile systems, they limit the continuous usage of these systems. For mobile systems, energy consumption affects the battery life. It can not be ignored for desktop and server systems as well, as the contribution of energy continues to go up in organizations’ budgets, influencing strategic decisions, and its implications on the environment are getting appreciated. Intelligent trade-offs involving these quantities are critical to meet the performance demands of many modern applications. Dynamic Voltage and Frequency Scaling (DVFS) offers a huge potential for designing trade-offs involving energy, power, temperature and performance of computing systems. In our work, we propose and evaluate DVFS schemes that aim at minimizing energy consumption while meeting a performance constraint, for both sequential and parallel applications. We propose a Petri net based program performance model, parameterized by application properties, microarchitectural settings and system resource configuration, and use this model to find energy efficient DVFS settings. We first propose a DVFS scheme using this model for sequential programs running on single core multiple clock domain (MCD) processors, and evaluate this on a MCD processor simulator. We then extend this scheme for data parallel (Single Program Multiple Data style) applications, and then generalize it for stream applications as well, and evaluate these two schemes on a full system CMP simulator. Our experimental evaluation shows that the proposed schemes achieve significant energy savings for a small performance degradation.

The Wireless Sensor Networks (WSN) are self-organized systems made by nodes that communicate each other changing information and giving support in many fields. But, these networks have some limitations because the lack of resources, especially power supply. This limitation it is because, in general, the sensors have limited power supply on their battery and there is no possibility of reload this energy. But to garantee its purpose the WSN should have effective communication. The choice of a wrong routing protocol on a WSN can lead to a bad use of network resources, which leads to a less time of live and/or reducing the quality of data transmitted. Among the existing routing protocols in the literature, highlight the Leach. In this work, we performed the modeling and analysis of Leach routing protocol using Petri Nets. Simulations were performed with the NS for its validation. To analyze the performance metrics are studied as: energy savings of each node, lifetime and throughput. From the analysis of the results was possible to propose improvements to the protocol, resulting in the implementation of a new routing protocol for WSN, Leach Lua. The results showed that the Leach Lua is able to provide improvements in the metrics studied when applied in scenarios that include the use of WSNs for monitoring of fires, oil fields and vital signs of medical patients. / As Redes de Sensores Sem Fio (RSSF) são sistemas auto-organizáveis formadas por nós sensores que comunicam-se entre si trocando informações e auxiliando as mais diversas áreas. Porém, essas redes possuem grandes limitações devido à escassez de recursos, principalmente energético. Essa limitação se deve ao fato de que, em geral, os sensores possuem baterias limitadas e não há possibilidade de recarga de energia. Porém, para garantia de sua empregabilidade as RSSF devem possuir uma comunicação não somente e?caz, mas também e?ciente. Para alcançar uma comunicação e?ciente é necessário o uso de protocolos que priorizem as limitações enfrentadas por uma RSSF. A escolha equivocada de protocolos de roteamento em RSSF pode levar a uma utilização inadequada dos recursos da rede, acarretando a diminuição do seu tempo de vida e/ou diminuindo a qualidade dos dados capturados. Para o presente trabalho foi selecionado o protocolo de roteamento Leach (Low Energy Adaptive Clustering Hierarchy), para realizar através das Redes de Petri uma análise de desempenho dos componentes e fases existentes nele e posterior aplicação de melhorias. Para realizar a análise de desempenho, são estudadas métricas como: economia de energia de cada nó, tempo de vida da rede, atraso médio na entrega de pacotes, e escalabilidade. A partir do exame dessas métricas em cada uma das fases presentes no protocolo Leach, são propostas melhorias no protocolo e analisada sua empregabilidade.

Cílem této práce je vyvinout metody simulací poškozování otisků prstů. V první části je kladen důraz na shrnutí stávajících znalostí v oblasti generování syntetických otisků prstů a jejich poškozování. Dále jsou uvedeny informace o otiscích prstů obecně, jejich rozpoznávání a vlivy, které otisky poškozují, včetně onemocnění kůže. Práce obsahuje návrh a implementaci aplikace SyFDaS pro generování a modulární poškozování otisků prstů. Další částí je popis metod pro poškozování vlivem průtahového režimu, zúženého snímače, poškozeného snímače, přítlaku a vlhkosti, zkreslení pokožky, bradavic, atopického ekzému a lupénky. Dále je analyzováno několik dalších typů poškození včetně falzifikátů otisků prstů. Celkově je uvedeno 43 základních poškození, která jsou vizuálně verifikována. Díky kombinování poškození je využito 1 171 typů poškození a vygenerováno 348 300 obrázků otisků prstů, které jsou vyhodnoceny čtyřmi různými metodami posuzování kvality.

This thesis deals with the designing of a garbage collector for the PNtalk virtual machine. It describes and rates the approaches and algorithms for an automatic memory management. Four algorithm families ale presented: mark-sweep, mark-compact, copying algorithms and reference counting. At first it describes sequential forms, that pauses running of the main program (mutator), then it describes parallel and concurent forms, that do not pauses the mutator. The thesis also presents generational model of garbage collecting. The following sections briefly introduces object orientated Petri nets. The result of this thesis is the design of the generational garbage collector for the PNtalk virtual machine.