<p>Highly intelligent and technically savvy people are employed to hack data systems throughout the world for prominence or monetary gain. Organizations must combat these criminals with people of equal or greater ability. There have been reports of heightened threats from cyber criminals focusing upon the energy sector, with recent attacks upon natural gas pipelines and payment centers. The Center for Innovative and Strategic Transformation of Alkane Resources (CISTAR) working collaboratively with the Purdue Process Safety and Assurance Center (P2SAC) reached out to the Computer and Information Technology Department to assist with analysis of the current cybersecurity posture of the companies involved with the CISTAR initiative. This cybersecurity research project identifies the overall defensive cyber posture of CISTAR companies and provides recommendations on how to bolster internal cyberspace defenses through the identification of gaps and shortfalls, which aided the compilation of suggestions for improvement. Key findings include the correlation of reduced cybersecurity readiness to companies founded less than 10 years ago, cybersecurity professionals employed by all CISTAR companies and all CISTAR companies implementing basic NIST cybersecurity procedures.</p>

<p>Advances in Artificial Intelligence (AI), or more precisely on Neural Networks (NNs), and fast processing technologies (e.g. Graphic Processing Units or GPUs) in recent years have positioned NNs as one of the main machine learning algorithms used to solved a diversity of problems in both academia and the industry. While they have been proved to be effective in solving many tasks, the lack of security guarantees and understanding of their internal processing disrupts their wide adoption in general and cybersecurity-related applications. In this dissertation, we present the findings of a comprehensive study aimed to enable the absorption of state-of-the-art NN algorithms in the development of enterprise solutions. Specifically, this dissertation focuses on (1) the development of defensive mechanisms to protect NNs against adversarial attacks and (2) application of NN models for anomaly detection in enterprise networks.</p><p>In this state of affairs, this work makes the following contributions. First, we performed a thorough study of the different adversarial attacks against NNs. We concentrate on the attacks referred to as trojan attacks and introduce a novel model hardening method that removes any trojan (i.e. misbehavior) inserted to the NN models at training time. We carefully evaluate our method and establish the correct metrics to test the efficiency of defensive methods against these types of attacks: (1) accuracy with benign data, (2) attack success rate, and (3) accuracy with adversarial data. Prior work evaluates their solutions using the first two metrics only, which do not suffice to guarantee robustness against untargeted attacks. Our method is compared with the state-of-the-art. The obtained results show our method outperforms it. Second, we proposed a novel approach to detect anomalies using LSTM-based models. Our method analyzes at runtime the event sequences generated by the Endpoint Detection and Response (EDR) system of a renowned security company running and efficiently detects uncommon patterns. The new detecting method is compared with the EDR system. The results show that our method achieves a higher detection rate. Finally, we present a Moving Target Defense technique that smartly reacts upon the detection of anomalies so as to also mitigate the detected attacks. The technique efficiently replaces the entire stack of virtual nodes, making ongoing attacks in the system ineffective.</p><p> </p>

<div>The Internet-of-Things (IoT) is one of the fastest-growing technologies in computing, revolutionizing several application domains such as wearable computing, home automation, industrial manufacturing, <i>etc</i>. This rapid proliferation, however, has given rise to a plethora of new security and privacy concerns. For example, IoT devices frequently access sensitive and confidential information (<i>e.g.,</i> physiological signals), which has made them attractive targets for various security attacks. Moreover, with the hardware components in these systems sourced from manufacturers across the globe, instances of counterfeiting and piracy have increased steadily. Security mechanisms such as device authentication and key exchange are attractive options for alleviating these challenges.</div><div><br></div><div>In this dissertation, we address the challenge of enabling low-cost and low-overhead device authentication and key exchange in off-the-shelf embedded systems. The first part of the dissertation focuses on a hardware-intrinsic mechanism and proposes the design of two Physically Unclonable Functions (PUFs), which leverage the memory (DRAM, SRAM) in the system, thus, requiring minimal (or no) additional hardware for operation. Two lightweight authentication and error-correction techniques, which ensure robust operation under wide environmental and temporal variations, are also presented. Experimental results obtained from prototype implementations demonstrate the effectiveness of the design. The second part of the dissertation focuses on the application of these techniques in real-world systems through a new end-to-end authentication and key-exchange protocol in the context of an Implantable Medical Device (IMD) ecosystem. Prototype implementations exhibit an energy-efficient design that guards against security and privacy attacks, thereby making it suitable for resource-constrained devices such as IMDs.</div><div><br></div>

<p>The detection of anomalies in real-world networks is applicable in different domains; the application includes, but is not limited to, credit card fraud detection, malware identification and classification, cancer detection from diagnostic reports, abnormal traffic detection, identification of fake media posts, and the like. Many ongoing and current researches are providing tools for analyzing labeled and unlabeled data; however, the challenges of finding anomalies and patterns in large-scale datasets still exist because of rapid changes in the threat landscape. </p><p>In this study, I implemented a novel and robust solution that combines data science and cybersecurity to solve complex network security problems. I used Long Short-Term Memory (LSTM) model, Louvain algorithm, and PageRank algorithm to identify and group anomalies in large-scale real-world networks. The network has billions of packets. The developed model used different visualization techniques to provide further insight into how the anomalies in the network are related. </p><p>Mean absolute error (MAE) and root mean square error (RMSE) was used to validate the anomaly detection models, the results obtained for both are 5.1813e-04 and 1e-03 respectively. The low loss from the training phase confirmed the low RMSE at loss: 5.1812e-04, mean absolute error: 5.1813e-04, validation loss: 3.9858e-04, validation mean absolute error: 3.9858e-04. The result from the community detection shows an overall modularity value of 0.914 which is proof of the existence of very strong communities among the anomalies. The largest sub-community of the anomalies connects 10.42% of the total nodes of the anomalies. </p><p>The broader aim and impact of this study was to provide sophisticated, AI-assisted countermeasures to cyber-threats in large-scale networks. To close the existing gaps created by the shortage of skilled and experienced cybersecurity specialists and analysts in the cybersecurity field, solutions based on out-of-the-box thinking are inevitable; this research was aimed at yielding one of such solutions. It was built to detect specific and collaborating threat actors in large networks and to help speed up how the activities of anomalies in any given large-scale network can be curtailed in time.</p><div><div><div> </div> </div> </div> <br>

<div> The Unmanned Aerial Vehicles (UAV) technology has evolved exponentially in recent years. Smaller and less expensive devices allow a world of new applications in different areas, but as this progress can be beneficial, the use of UAVs with malicious intentions also poses a threat. UAVs can carry weapons or explosives and access restricted zones passing undetected, representing a real threat for civilians and institutions. Acoustic detection in combination with machine learning models emerges as a viable solution since, despite its limitations related with environmental noise, it has provided promising results on classifying UAV sounds, it is adaptable to multiple environments, and especially, it can be a cost-effective solution, something much needed in the counter UAV market with high projections for the coming years. The problem addressed by this project is the need for a real-world adaptable solution which can show that an array of acoustic sensors can be implemented for the detection and localization of UAVs with minimal cost and competitive performance.<br><br></div><div> In this research, a low-cost acoustic detection system that can detect, in real time, about the presence and direction of arrival of a UAV approaching a target was engineered and validated. The model developed includes an array of acoustic sensors remotely connected to a central server, which uses the sound signals to estimate the direction of arrival of the UAV. This model works with a single microphone per node which calculates the position based on the acoustic intensity change produced by the UAV, reducing the implementation costs and being able to work asynchronously. The development of the project included collecting data from UAVs flying both indoors and outdoors, and a performance analysis under realistic conditions. <br><br></div><div> The results demonstrated that the solution provides real time UAV detection and localization information to protect a target from an attacking UAV, and that it can be applied in real world scenarios. </div><div><br></div>

Although many counter-drone systems such as drone jammers and anti-drone guns have been implemented, drone incidents are still increasing. These incidents are categorized as deviant act, a criminal act, terrorist act, or an unintentional act (aka system failure). Examples of reported drone incidents are not limited to property damage, but include personal injuries, airport disruption, drug transportation, and terrorist activities. Researchers have examined only drone incidents from a technological perspective. The variance in drone architectures poses many challenges to the current investigation practices, including several operation approaches such as custom commutation links. Therefore, there is a limited research background available that aims to study the intercomponent mapping in unmanned aircraft system (UAS) investigation incorporating three critical investigative domains---behavioral analysis, forensic intelligence (FORINT), and unmanned aerial vehicle (UAV) forensic investigation. The UAS forensic intelligence-led taxonomy (U-FIT) aims to classify the technical, behavioral, and intelligence characteristics of four UAS deviant actions --- including individuals who flew a drone too high, flew a drone close to government buildings, flew a drone over the airfield, and involved in drone collision. The behavioral and threat profiles will include one criminal act (i.e., UAV contraband smugglers). The UAV forensic investigation dimension concentrates on investigative techniques including technical challenges; whereas, the behavioral dimension investigates the behavioral characteristics, distinguishing among UAS deviants and illegal behaviors. Moreover, the U-FIT taxonomy in this study builds on the existing knowledge of current UAS forensic practices to identify patterns that aid in generalizing a UAS forensic intelligence taxonomy. The results of these dimensions supported the proposed UAS forensic intelligence-led taxonomy by demystifying the predicted personality traits to deviant actions and drone smugglers. The score obtained in this study was effective in distinguishing individuals based on certain personality traits. These novel, highly distinguishing features in the behavioral personality of drone users may be of particular importance not only in the field of behavioral psychology but also in law enforcement and intelligence.

<p><em>Imbulgoda Liyangahawatte, Gihan Janith Mendis Ph.D., Purdue University, May</em></p> <p><em>2023. Deep learning for securing critical infrastructure with the emphasis on power</em></p> <p><em>systems and wireless communication. Major Professor: Dr. Jin Kocsis.</em></p> <p><br></p> <p><em>Critical infrastructures, such as power systems and communication</em></p> <p><em>infrastructures, are of paramount importance to the welfare and prosperity of</em></p> <p><em>modern societies. Therefore, critical infrastructures have a high vulnerability to</em></p> <p><em>attacks from adverse parties. Subsequent to the advancement of cyber technologies,</em></p> <p><em>such as information technology, embedded systems, high-speed connectivity, and</em></p> <p><em>real-time data processing, the physical processes of critical infrastructures are often</em></p> <p><em>monitored and controlled through cyber systems. Therefore, modern critical</em></p> <p><em>infrastructures are often viewed as cyber-physical systems (CPSs). Incorporating</em></p> <p><em>cyber elements into physical processes increases efficiency and control. However, it</em></p> <p><em>also increases the vulnerability of the systems to potential cybersecurity threats. In</em></p> <p><em>addition to cyber-level attacks, attacks on the cyber-physical interface, such as the</em></p> <p><em>corruption of sensing data to manipulate physical operations, can exploit</em></p> <p><em>vulnerabilities in CPSs. Research on data-driven security methods for such attacks,</em></p> <p><em>focusing on applications related to electrical power and wireless communication</em></p> <p><em>critical infrastructure CPSs, are presented in this dissertation. As security methods</em></p> <p><em>for electrical power systems, deep learning approaches were proposed to detect</em></p> <p><em>adversarial sensor signals targeting smart grids and more electric aircraft.</em></p> <p><em>Considering the security of wireless communication systems, deep learning solutions</em></p> <p><em>were proposed as an intelligent spectrum sensing approach and as a primary user</em></p> <p><em>emulation (PUE) attacks detection method on the wideband spectrum. The recent</em></p> <p><em>abundance of micro-UASs can enable the use of weaponized micro-UASs to conduct</em></p> <p><em>physical attacks on critical infrastructures. As a solution for this, the radio</em></p> <p><em>frequency (RF) signal-analyzing deep learning method developed for spectrum</em></p> <p><em>sensing was adopted to realize an intelligent radar system for micro-UAS detection.</em></p> <p><em>This intelligent radar can be used to provide protection against micro-UAS-based</em></p> <p><em>physical attacks on critical infrastructures.</em></p>

The smart grid is forecasted to be the future of the grid by integrating the traditional grid with information and communication technology. However, the use of this technology has not only brought its benefits but also the vulnerability to cyber-attacks. False data injection (FDI) attacks are a new category of attacks targeting the smart grid that manipulates the state estimation process to trigger a chain of incorrect control decisions leading to severe impacts. This research proposes the use of cognitive dynamic systems (CDS) to address the cyber-security issue and improve state estimation. CDS is a powerful research tool inspired by certain features of the brain that can be used to study complex systems. As two of its special features, Cognitive Control (CC) is concerned with control in the absence of uncertainty, Cognitive Risk Control (CRC) uses the concept of predictive adaptation to bring risk under control in the presence of unexpected uncertainty. The primary research objective of this thesis is to apply the CDS for the SG with emphasis on state estimation and cyber-security. The main objective of CC is to improve the state estimation process while CRC is concerned with mitigating cyber-attacks. Simulation results show that the proposed methods have robust performance for both state estimation and cyber-attack mitigation under various challenging scenarios. This thesis contributes to the body of knowledge by achieving the following objectives: proposes the first theoretical work that integrates the CDS with the DC model of the SG for control and cyber-attack detection; demonstrates the first experimental work that brings a new concept of CRC for cyber-attack mitigation for the DC state estimator; introduces a new CDS architecture adapted for the AC model of the SG for state estimation and cyber-attack mitigation which builds upon all the research efforts made previously. / Thesis / Doctor of Philosophy (PhD) / The smart grid is forecasted to be the future of the grid by integrating the traditional grid with information and communication technology. However, the use of this technology has not only brought its benefits but also the vulnerability to cyber-attacks. False data injection attacks is a new category of attacks targeting the smart grid that can cause serious damage by manipulating the state estimation process and starting a chain of incorrect control decisions. The cognitive dynamic system is a powerful research tool inspired by the brain that can be used to study real time cyber physical systems. The key goal of this thesis is to apply cognitive dynamic systems to the smart grid to improve the state estimation process, detect cyber-attacks and mitigate their effects. Simulation results show that the proposed methods have robust performance in both state estimation and cyber-attack mitigation under various challenging scenarios.

<p dir="ltr">In recent years, a surge in data-driven computation has significantly impacted security analysis in cyber-physical systems (CPSs), especially in decentralized environments. This transformation can be attributed to the remarkable computational power offered by high-performance computers (HPCs), coupled with advancements in distributed computing techniques and sophisticated learning algorithms like deep learning and reinforcement learning. Within this context, wireless communication systems and decentralized computing systems emerge as highly suitable environments for leveraging data-driven computation in security analysis. Our research endeavors have focused on exploring the vast potential of various deep learning algorithms within the CPS domains. We have not only delved into the intricacies of existing algorithms but also designed novel approaches tailored to the specific requirements of CPSs. A pivotal aspect of our work was the development of a comprehensive decentralized computing platform prototype, which served as the foundation for simulating complex networking scenarios typical of CPS environments. Within this framework, we harnessed deep learning techniques such as restricted Boltzmann machine (RBM) and deep convolutional neural network (DCNN) to address critical security concerns such as the detection of Quality of Service (QoS) degradation and Denial of Service (DoS) attacks in smart grids. Our experimental results showcased the superior performance of deep learning-based approaches compared to traditional pattern-based methods. Additionally, we devised a decentralized computing system that encompassed a novel decentralized learning algorithm, blockchain-based learning automation, distributed storage for data and models, and cryptography mechanisms to bolster the security and privacy of both data and models. Notably, our prototype demonstrated excellent efficacy, achieving a fine balance between model inference performance and confidentiality. Furthermore, we delved into the integration of domain knowledge from CPSs into our deep learning models. This integration shed light on the vulnerability of these models to dedicated adversarial attacks. Through these multifaceted endeavors, we aim to fortify the security posture of CPSs while unlocking the full potential of data-driven computation in safeguarding critical infrastructures.</p>

The objective of an Energy Control Center (ECC) is to ensure secure and economic operation of power system. The challenge to optimize power system operation, while maintaining system security and quality of power supply to customers, is increasing. Growing demand without matching expansion of generation and transmission facilities and more tightly interconnected power systems contribute to the increased complexity of system operation. Rising costs due to inflation and increased environmental concerns has made transmission, as well as generation systems to be operated closure to design limits, with smaller safety margins and hence greater exposure to unsatisfactory operating conditions following a disturbance. Investigations of recent blackouts indicate that the root cause of most of these major power system disturbances is voltage collapse. Information gathered and preliminary analysis, from the most recent blackout incident in North America on 14th August 2003, is pointing the finger on voltage instability due to some unexpected contingency. In this incident, reports indicate that approximately 50 million people were affected interruption from continuous supply for more than 15 hours. Most of the incidents are related to heavily stressed system where large amounts of real and reactive power are transported over long transmission lines while appropriate real and reactive power resources are not available to maintain normal system conditions. Hence, the problem of voltage stability and voltage collapse has become a major concern in power system planning and operation. Reliable operation of large scale electric power networks requires that system voltages and currents stay within design limits. Operation beyond those limits can lead to equipment failures and blackouts. In the last few decades, the problem of reactive power control for improving economy and security of power system operation has received much attention. Generally, the load bus voltages can be maintained within their permissible limits by reallocating reactive power generations in the system. This can be achieved by adjusting transformer taps, generator voltages, and switchable Ar sources. In addition, the system losses can be minimized via redistribution of reactive power in the system. Therefore, the problem of the reactive power dispatch can be optimized to improve the voltage profile and minimize the system losses as well. The Instability in power system could be relieved or at least minimized with the help of most recent developed devices called Flexible AC Transmission System (FACTS) controllers. The use of Flexible AC Transmission System (FACTS) controllers in power transmission system have led to many applications of these controllers not only to improve the stability of the existing power network resources but also provide operating flexibility to the power system. In the past, transmission systems were owned by regulated, vertically integrated utility companies. They have been designed and operated so that conditions in close proximity to security boundaries are not frequently encountered. However, in the new open access environment, operating conditions tend to be much closer to security boundaries, as transmission use is increasing in sudden and unpredictable directions. Transmission unbundling, coupled with other regulatory requirements, has made new transmission facility construction more difficult. In fact, there are numerous technical challenges emerging from the new market structure. There is an acute need for research work in the new market structure, especially in the areas of voltage security, reactive power support and congestion management. In the last few decades more attention was paid to optimal reactive power dispatch. Since the problem of reactive power optimization is non-linear in nature, nonlinear programming methods have been used to solve it. These methods work quite well for small power systems but may develop convergence problems as system size increases. Linear programming techniques with iterative schemes are certainly the most promising tools for solving these types of problems. The thesis presents efficient algorithms with different objectives for reactive power optimization. The approach adopted is an iterative scheme with successive power-flow analysis using decoupled technique, formulation and solution of the linear-programmingproblem with only upper-bound limits on the state variables. Further the thesispresents critical analysis of the three following objectives, Viz., •Minimization of the sum of the squares of the voltage deviations (Vdesired) •Minimization of sum of the squares of the voltage stability L indices (Vstability) •Minimization of real power losses (Ploss) Voltage stability problems normally occur in heavily stressed systems. While the disturbance leading to voltage collapse may be initiated by a variety of causes, the underlying problem is an inherent weakness in the power system. The factors contributing to voltage collapse are the generator reactive power /voltage control limits, load characteristics, characteristics of reactive compensation devices, and the action of the voltage control devices such as transformer On Load Tap Changers (OLTCs). Power system experiences abnormal operating conditions following a disturbance, and subsequently a reduction in the EHV level voltages at load centers will be reflected on the distribution system. The OLTCs of distribution transformers would restore distribution voltages. With each tap change operation, the MW and MVAR loading on the EHV lines would increase, thereby causing great voltage drops in EHV levels and increasing the losses. As a result, with each tap changing operation, the reactive output of generators throughout the system would increase gradually and the generators may hit their reactive power capability limits, causing voltage instability problems. Thus, the operation of certain OLTCs has a significant influence on voltage instability under some operating conditions. These transformers can be made manual to avoid possible voltage instability due to their operation during heavy load conditions. Tap blocking, based on local measurement of high voltage side of load tap changers, is a common practice of power utilities to prevent voltage collapse. The great advantage of this method is that it can be easily implemented, but does not guarantee voltage stability. So a proper approach for identification of critical OLTC s based on voltage stability criteria is essential to guide the operator in ECC, which has been proposed in this thesis. It discusses the effect of OLTCs with different objectives of reactive power dispatch and proposes a technique to identify critical OLTCs based on voltage stability criteria. The fast development of power electronics based on new and powerful semiconductor devices has led to innovative technologies, such as High Voltage DC transmission (HVDC) and Flexible AC Transmission System (FACTS), which can be applied in transmission and distribution systems. The technical and economicalBenefits of these technologies represent an alternative to the application in AC systems. Deregulation in the power industry and opening of the market for delivery of cheaper energy to the customers is creating additional requirements for the operation of power systems. HVDC and FACTS offer major advantages in meeting these requirements. .A method for co-ordinated optimum allocation of reactive power in AC/DC power systems by including FACTS controller UPFC, with an objective of minimization of the sum of the squares of the voltage deviations of all the load buses has been proposed in this thesis. The study results show that under contingency conditions, the presence of FACTS controllers has considerable impact on over all system voltage stability and also on power loss minimization.minimization of the sum of the squares of the voltage deviations of all the load buses has been proposed in this thesis. The study results show that under contingency conditions, the presence of FACTS controllers has considerable impact on over all system voltage stability and also on power loss minimization. As power systems grow in their size and interconnections, their complexity increases. For secure operation and control of power systems under normal and contingency conditions, it is essential to provide solutions in real time to the operator in ECC. For real time control of power systems, the conventional algorithmic software available in ECC are found to be inadequate as they are computationally very intensive and not organized to guide the operator during contingency conditions. Artificial Intelligence (AI) techniques such as, Expert systems, Neural Networks, Fuzzy systems are emerging decision support system tools which give fast, though approximate, but acceptable right solutions in real time as they mostly use symbolic processing with a minimum number of numeric computations. The solution thus obtained can be used as a guide by the operator in ECC for power system control. Optimum real and reactive power dispatch play an important role in the day-to-day operation of power systems. Existing conventional Optimal Power Flow (OPF) methods use all of the controls in solving the optimization problem. The operators can not move so many control devices within a reasonable time. In this context an algorithm using fuzzy-expert approach has been proposed in this thesis to curtail the number of control actions, in order to realize real time objectives in voltage/reactive power control. The technique is formulated using membership functions of linguistic variables such as voltage deviations at all the load buses and the voltage deviation sensitivity to control variables. Voltage deviations and controlling variables are translated into fuzzy set notations to formulate the relation between voltage deviations and controlling ability of controlling devices. Control variables considered are switchable VAR compensators, OLTC transformers and generator excitations. A fuzzy rule based system is formed to select the critical controllers, their movement direction and step size. Results show that the proposed approach is effective for improving voltage security to acceptable levels with fewer numbers of controllers. So, under emergency conditions the operator need not move all the controllers to different settings and the solution obtained is fast with significant speedups. Hence, the proposed method has the potential to be integrated for on-line implementation in energy management systems to achieve the goals of secure power system operation. In a deregulated electricity market, it may not be always possible to dispatch all of the contracted power transactions due to congestion of the transmission corridors. System operators try to manage congestion, which otherwise increases the cost of the electricity and also threatens the system security and stability. An approach for alleviation of network over loads in the day-to-day operation of power systems under deregulated environment is presented in this thesis. The control used for overload alleviation is real power generation rescheduling based on Relative Electrical Distance (RED) concept. The method estimates the relative location of load nodes with respect to the generator nodes. The contribution of each generator for a particular over loaded line is first identified , then based on RED concept the desired proportions of generations for the desired overload relieving is obtained, so that the system will have minimum transmission losses and more stability margins with respect to voltage profiles, bus angles and better transmission tariff. The results obtained reveal that the proposed method is not only effective for overload relieving but also reduces the system power loss and improves the voltage stability margin. The presented concepts are better suited for finding the utilization of resources generation/load and network by various players involved in the day-to-day operation of the system under normal and contingency conditions. This will help in finding the contribution by various players involved in the congestion management and the deviations can be used for proper tariff purposes. Suitable computer programs have been developed based on the algorithms presented in various chapters and thoroughly tested. Studies have been carried out on various equivalent systems of practical real life Indian power networks and also on some standard IEEE systems under simulated conditions. Results obtained on a modified IEEE 30 bus system, IEEE 39 bus New England system and four Indian power networks of EHV 24 bus real life equivalent power network, an equivalent of 36 bus EHV Indian western grid, Uttar Pradesh 96 bus AC/DC system and 205 Bus real life interconnected grid system of Indian southern region are presented for illustration purposes.