Security in Cyber-Physical Systems: Foundations and Applications (Studies in Systems, Decision and Control, 339)

Preface
Contents
About the Editors
Realizing Cyber-Physical Systems Resilience Frameworks and Security Practices
	1 Introduction
	2 Cyber-Physical Systems
		2.1 Primary Differences Between CPS and ITS Security
		2.2 CPS Threats and Vulnerabilities
		2.3 Cyber Resilience: What Does It Mean for CPS?
	3 State-of-the-Art Review of Cybersecurity Frameworks
		3.1 NIST Framework for Improving Critical Infrastructure Cybersecurity
		3.2 NIST Framework for Cyber-Physical Systems
		3.3 NIST Risk Management Framework for Information Systems Cybersecurity
		3.4 MITRE Cyber Resiliency Engineering Framework
		3.5 Comparison of the Frameworks
	4 Cyber Standards and Recommended Practices for CPS
	5 Formal Approaches for Realizing CPS Resilience
		5.1 Cyber Resilience Quantification by Subjective Evaluation Using Analytical Hierarchy Process (AHP)
		5.2 Cyber Resilience Assessment Using Multi-level Directed Acyclic Vulnerability Graph Model
		5.3 Ranking Critical Assets Using TOPSIS Method
	6 Challenges in Mapping of CPS Resilience with Security Concerns and Operational Domains
	7 Conclusions
	References
Key-Establishment Protocols for Constrained Cyber-Physical Systems
	1 Introduction
	2 The Problem of Key Establishment
	3 Security Notions
	4 State of the Art
		4.1 Literature Review
	5 Lightweight Key-Establishment Protocols Based  on Elliptic-Curve Cryptography
		5.1 Problem of Authenticity
		5.2 Lightweight Authenticated Key Establishment
		5.3 Revisiting Ju\'s Protocol
		5.4 Security Analysis of Proposed Elliptic-Curve Protocol
	6 Key Establishment in the Post-quantum World
		6.1 Proposed Approach
		6.2 Protocol Design
		6.3 Security Analysis of Proposed Post-quantum Protocol
		6.4 Application Scope
	7 Conclusions, Final Remarks, and Future Work
	References
Empirical Characterization of Network Traffic for Reliable Communication in IoT Devices
	1 Introduction
		1.1 Motivations
	2 Background Study
		2.1 Tools for Network Traffic Monitoring
		2.2 Statistical Models for Network Traffic Characterization
		2.3 Machine Learning Models for Network Traffic Classification
		2.4 SDN Based Network Traffic Classification
	3 Network Flow Monitoring and Analysis Framework
		3.1 Packet Level Analysis
		3.2 Flow Level Analysis
	4 Applications of Network Traffic Characterization
		4.1 Information Flow Monitoring
		4.2 Efficient Bandwidth Utilization
		4.3 Device and Application Identification
		4.4 Monitoring Network Performance
		4.5 Addressing Security Aspects
		4.6 Role of Network Traffic Analysis for Cyber-Physical Systems
	5 Empirical Results and Discussions
	6 Strengths and Challenges
	7 Future Research Scope
	8 Conclusion
	References
Machine Learning for Fostering Security in Cyber-Physical Systems
	1 Introduction
	2 Machine Learning
		2.1 Overview
		2.2 Important Techniques
	3 Security in the Domain of Cyber-Physical System
	4 Application of ML-Based on Security Type
		4.1 Direct Security Threat Detection
		4.2 Predictive Analysis and Anomalous Behavior
		4.3 Risk Assessment Using Machine Learning
	5 Application of ML-Based on System Design
		5.1 Application Layer
		5.2 Network Layer
		5.3 Physical Layer
	6 Limitations of Machine Learning Based Security in CPS
	7 Guidelines for Application of Machine Learning in Cyber-Physical Security Systems
		7.1 Use-Case Analysis
		7.2 Scope of Implementation
		7.3 Balancing Error Rates
		7.4 Dataset Selection
	8 Conclusion
	References
A Model for Auditing Smart Intrusion Detection Systems (IDSs) and Log Analyzers in Cyber-Physical Systems (CPSs)
	1 Introduction
	2 Background Information on Audit of Smart IDSs and Log Analyzers in Cyber-Physical Systems (CPSs)
	3 The Scope of Audit of Smart IDSs and Log Analyzers in Cyber-Physical Systems (CPSs)
	4 Auditors’ Challenges in Auditing Smart IDSs in Cyber-Physical Systems (CPSs)
		4.1 Research and Audit Issues on Smart IDSs in Cyber-Physical Systems
		4.2 Issues with Detection Rules or Policies of Smart IDSs in Cyber-Physical Systems
		4.3 Issues with Maintenance of Smart IDSs in Cyber-Physical Systems
		4.4 Issues with Configurations of Smart IDSs in Cyber-Physical Systems
		4.5 Issues with IDS Policy and Security Policy in Cyber-Physical Systems
		4.6 Research and Audit Issues with Log Analyzers in Cyber-Physical Systems
		4.7 Issues with Theoretical Frameworks for Designing Log Analyzers in Cyber-Physical Systems
		4.8 Issues with Metrics for Designing Log Analyzers in Cyber-Physical Systems
	5 Methodology for Auditing Smart IDSs and Log Analyzers in Cyber-Physical Systems (CPSs)
		5.1 A Model for Auditing Smart IDSs and Log Analyzers in Cyber-Physical Systems
		5.2 Results and Discussions
		5.3 Suggestions for Improving Security in Cyber-Physical Systems
	6 Conclusion
	References
Model-Based CPS Attack Detection Techniques: Strengths and Limitations
	1 Introduction
	2 Related Work
	3 Testbeds: Our Playground
		3.1 SWaT: A Secure Water Treatment Testbed
		3.2 WADI: A Water Distribution Plant
	4 System Models
		4.1 System Modelling Using Sub-space System Identification
		4.2 System Modelling Using First Principles
		4.3 Validation of the System Models
	5 Attack Detection Framework
		5.1 Kalman Filter
		5.2 Residuals and Hypothesis Testing
		5.3 Cumulative Sum (CUSUM) Detector
		5.4 Bad-Data Detector
		5.5 NoisePrint (Residual and Noise Fingerprint)
		5.6 Design of
	6 Attacker and Attack Model
		6.1 Attacker Model
		6.2 Attack Scenarios
		6.3 Attack Execution
	7 Performance Evaluation
		7.1 Performance Metrics
		7.2 Normal Operation
		7.3 Attack Detection
	8 Conclusions
	References
Security of Cyber-Physical Monitoring and Warning Systems for Natural and Technological Threats
	1 Introduction
	2 Monitoring Information Conditions
		2.1 The Concept of Environmental Monitoring
		2.2 A Formal Description of the Monitoring Process
	3 Organizational and Architectural Conditions of Monitoring
		3.1 Classic Environmental Monitoring Systems
		3.2 Multi-level Sensor Monitoring Networks
		3.3 Regional Monitoring Systems
	4 Threats to Information Security in Monitoring
		4.1 Technical and Organizational Conditions for Monitoring
		4.2 General Threats Classification
		4.3 Special Types of Threats
	5 Monitoring System Architecture
	6 Resident Alert Subsystem
	7 Summary
	References
Risk Identification and Risk Assessment of Communication Networks in Smart Grid Cyber-Physical Systems
	1 Introduction and Motivation
		1.1 Introduction
		1.2 Motivation
	2 cyber-Physical System for the Smart Grid
		2.1 Overview of the Smart Grid Power System
		2.2 Smart Grid Cyber-Physical System
	3 Communication Networks for SGCPS
	4 Applications of Smart Grid CPS
		4.1 SGCPS for Synchrophasor Applications
		4.2 SGCPS for Advanced Metering Applications
		4.3 SGCPS for Electrical Vehicular Applications
	5 Risk Identification and Risk Assessment of SGCPS
		5.1 Synchrophasor Application
		5.2 Advanced Metering Application
		5.3 Electric Vehicular Application
	6 Case Studies
		6.1 Synchrophasor Applications of SGCPS
		6.2 Advanced Metering Application of SGCPS
		6.3 Electric Vehicular Application of SGCPS
	7 Conclusion
	References
An Overview of Cybersecurity for Natural Gas Networks: Attacks, Attack Assessment, and Attack Detection
	1 Introduction and Background
	2 Physical Structure of Natural Gas System
	3 Natural Gas Market Overview
	4 Gas Pipeline Dynamics
	5 Gas System Steady-State Operation Model
	6 Categorization of Cyber-Physical-Attacks on Natural Gas Systems
	7 An Overview of Cyber-Physical-Attack Detection  on Natural Gas Networks
		7.1 Data-Based Approaches
		7.2 Model-Based Approaches
		7.3 Combined Approaches
	8 Models and Theory of Cyber-Physical Attacks  and Illustrative Detection Algorithms
		8.1 Sensor Measurement Model
		8.2 Topology Attack
	9 Numerical Examples
		9.1 Example Natural Gas System
		9.2 MiMA/Spoofing Attacks: False Compression Boost Ratio Attack
		9.3 MiMA/Spoofing Attacks: False Pressure and Flow Values
		9.4 Topology Attacks
	10 Conclusion
	11 Proof of Theorem 1
	References
Secure Dynamic Nonlinear Heterogeneous Vehicle Platooning: Denial-of-Service Cyber-Attack Case
	1 Introduction
		1.1 State-of-the-Art
		1.2 Related Work
		1.3 Contributions
		1.4 Chapter Organization
	2 System Modeling
		2.1 Platoon Model
		2.2 Platoon Control Objectives
		2.3 Attack Description
	3 Secure Controller Design for Dynamic Heterogeneous Platooning
		3.1 Overview
		3.2 Design of the Secure Controller
		3.3 Stability Analysis of Secure–DNMPC
	4 Dynamic Platoon Control: Handling Cut-in/Cut-out Maneuvers
	5 Simulation Results
		5.1 DoS Attack Modeled as a Network Blocker
		5.2 DoS Attack Modeled as an Exceeding Time Delay Injection in the Data Transmission
	6 Conclusion and Future Directions
	References