System Identification Attacks, Model-based Offensives and Countermeasures in Networked Control Systems

Abstract

The advantages of using communication networks to interconnect controllers and physical plants motivate the increasing number of Networked Control Systems (NCS) in industrial facilities and critical infrastructures. However, this integration also exposes such control systems to new threats, typical of the cyber domain. In this context, studies have been conducted aiming to explore vulnerabilities and propose security solutions for NCSs. The present work, firstly, proposes two system identification attacks: a passive attack; and an active attack. These attacks, which use bioinspired metaheuristics to estimate the models of the attacked NCS, are studied and evaluated as an attack tool to support the design of covert/model-based offensives. Then, this work presents three model-based attacks: a novel attack that operates causing controlled data loss in the NCS; and two attacks that operate through the injection of false data into the system. The simulation results show that the information provided by these System Identification attacks allow the effective design of the referred covert/model-based offensives. To support the discussion regarding the relationship between System Identification attacks and covert/model-based offensives, this work required the formalization of a number of concepts related to covertness and intelligence in the context of the security of NCSs. Thus, an additional contribution of this work is the proposition of a terminology that encompasses a whole new class of attacks in cyber-physical systems. Finally, this thesis proposes two countermeasures intended to contribute to the security of NCSs in case of failure or absence of other conventional security mechanisms – such as encryption, authentication, and network segmentation. The first countermeasure aims to hinder the system identification attacks through a switching control strategy. The results indicate that this countermeasure is able to mitigate the proposed System Identification attacks – discouraging the implementation of covert/model-based attacks – at the same time that it performs a satisfactory plant control. The second countermeasure aims to detect/identify linear time-invariant (LTI) functions executed by controlled data injection attacks in NCSs. To increase the accuracy of this countermeasure, it is proposed the Noise Impulse integration technique, which was developed using the radar pulse integration technique as inspiration. The results demonstrate that this countermeasure is able to accurately identify LTI attack functions, without interfering with the NCS behavior when the system is in its normal operation.