Biblio

Trustworthy and secure operation of the cyber-power system calls for resilience against malicious and accidental failures. The objective of a resilient system is to withstand and recover operation of the system to supply critical loads despite multiple contingencies in the system. To take timely actions, we need to continuously measure the cyberphysical security of the system. We propose a cyber-physical security assessment metric (CP-SAM) based on quantitative factors affecting resiliency and utilizing concepts from graph theoretic analysis, probabilistic model of availability, attack graph metrics, and vulnerabilities across different layers of the microgrid system. These factors are integrated into a single metric using a multi-criteria decision making (MCDM) technique, Choquet Integral to compute CP-SAM. The developed metric will be valuable for i) monitoring the microgrid resiliency considering a holistic cyber-physical model; and ii) enable better decision-making to select best possible mitigation strategies towards resilient microgrid system. Developed CP-SAM can be extended for active distribution system and has been validated in a real-world power-grid test-bed to monitor the microgrid resiliency.

Recent cyber attacks on the power grid have been of increasing complexity and sophistication. In order to understand the impact of cyber-attacks on the power system resiliency, it is important to consider an holistic cyber-physical system specially with increasing industrial automation. In this study, device-level resilience properties of the various controllers and their impact on the microgrid resiliency is studied. In addition, a cyber-physical resiliency metric considering vulnerabilities, system model, and device-level properties is proposed. Resiliency is defined as the system ability to provide energy to critical loads even in extreme contingencies and depends on system ability to withstand, predict, and recover. A use case is presented inspired by the recent Ukraine cyber-attack. A use case has been presented to demonstrate application of the developed cyber-physical resiliency metric to enhance situational awareness of the operator, and enable better proactive or remedial control actions to improve resiliency.

The advent of machine learning has made it a popular tool in various areas. It has also been applied in network intrusion detection. However, machine learning hasn't been sufficiently explored in the cyberphysical domains such as smart grids. This is because a lot of factors weigh in while using these tools. This paper is about intrusion detection in smart grids and how some machine learning techniques can help achieve this goal. It considers the problems of feature and classifier selection along with other data ambiguities. The goal is to apply the machine learning ensemble classifiers on the smart grid traffic and evaluate if these methods can detect anomalies in the system.

Implementing a secure development lifecycle (SDL) presents increasing challenges to software developers as they must ensure software correctly integrates both underlying operating system security features while also managing dependencies on third-party libraries or executables. There are a growing number of security functions that require a close integration between the OS security features and software builds to ensure strong protection. Furthermore, as software platforms grow in complexity, they present many opportunities for misconfigurations and inadequate defenses. This challenge is especially prevalent for industrial control systems (ICS), which oten depend on both legacy sotware platforms, or out of date operating systems. This paper presents the AttackSurface Host Analyzer (AHA) tool, which is used to assess the security of a software platform through its integration with a host operating system. The tool collects data from the various platforms running on an OS, evaluates an array of security properties, and then introduces metrics and visualizations to provide feedback on the system's attack surface based on the external interconnections and the completeness of the available security protections. The paper then explores the attack surface of a variety of industry-standard ICS platforms to provide insight into the current degree of protection enabled by them.