Attack Path Analysis for Cyber Physical Systems

As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can be followed to compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and also identify the minimum possible network securing options for a given attack graph in an automated fashion. The identified network securing options are exhaustive and the proposed approach aims at detecting cycles in forward reachable attack graphs. As a whole, the chapter deals with identification of probable attack path and risk mitigation which may facilitate in improving the overall security of an enterprise network.

Developing mission-centric impact assessment techniques to address cyber resiliency in the cyber-physical systems (CPSs) requires integrating system inter-dependencies to the risk and resilience analysis process. Generally, network administrators utilize attack graphs to estimate possible consequences in a networked environment. Attack graphs lack to incorporate the operations-specific dependencies. Localizing the dependencies among operational missions, tasks, and the hosting devices in a large-scale CPS is also challenging. In this work, we offer a graphical modeling technique to integrate the mission-centric impact assessment of cyberattacks by relating the effect to the operational resiliency by utilizing a combination of the logical attack graph and mission impact propagation graph. We propose formal techniques to compute cyberattacks’ impact on the operational mission and offer an optimization process to minimize the same, having budgetary restrictions. We also relate the effect to the system functional operability. We illustrate our modeling techniques using a SCADA (supervisory control and data acquisition) case study for the cyber-physical power systems. We believe our proposed method would help evaluate and minimize the impact of cyber attacks on CPS’s operational missions and, thus, enhance cyber resiliency.

Against the background of the construction of new power systems, power generation, transmission, distribution, and dispatching services are open to the outside world for interaction, and the accessibility of attack paths has been significantly enhanced. We are facing cyber-physical cross-domain attacks with the characteristics of strong targeting, high concealment, and cross-space threats. This paper proposes a quantitative analysis method for the influence of power cyber-physical cross-domain attack paths based on graph knowledge. First, a layered attack graph was constructed based on the cross-space and strong coupling characteristics of the power cyber-physical system business and the vertical architecture of network security protection focusing on border protection. The attack graph included cyber-physical cross-domain attacks, control master stations, measurement and control equipment failures, transient stable node disturbances, and other vertices, and achieved a comprehensive depiction of the attack path. Second, the out-degree, in-degree, vertex betweenness, etc., of each vertex in the attack graph were comprehensively considered to calculate the vertex vulnerability, and by defining the cyber-physical coupling degree and edge weights, the risk of each attack path was analyzed in detail. Finally, the IEEE RTS79 and RTS96 node systems were selected, and the impact of risk conduction on the cascading failures of the physical space system under typical attack paths was analyzed using examples, verifying the effectiveness of the proposed method.

Vulnerabilities do enormous harm to personal computers. What is worse, with emergence of much more applications of computer networks nowadays, network security caused by vulnerabilities has become an important issue. And attacks turned more proficient, making it much more difficult to protect our computer networks. In view of the security issue of complex network, effective identification of attack paths contributes to network security defense a lot. In order to obtain the paths, attack graphs are used. And to construct it requires preconditions like vulnerabilities information, network configuration, and etc. In this paper, we present a simplified model to construct the attack paths. We discuss the construction of attack paths taking advantage of logic programming and corresponding preconditions generated by the logic rule and facts.

Attack graphs are important tools for analyzing network security vulnerabilities. Recently, the generation method of attack graphs is a hot topic to the security researchers. As previous works encounter the scalability problem and inaccurate input information problem, we propose a novel method to automatic construction of attack graphs based on probability. After introducing prior-probability, match-probability,and transition-probability into attack graphs generation process, we develop a new attack model and relevant generation algorithms. Our method uses threshold and key states to control the scale of result attack graphs with important attack paths reserved. The following experiments show our approach could get meaningful results with less time and space, especially when one wants to get a few shortest attack paths quickly.

Attack Graphs have been widely used by the network security administrators to gain an understanding of possible attack paths, an attacker may follow to compromise critical resources. As networks get larger and more complex, one needs to use databases to perform iterative, interactive analysis tasks with attack graphs. In this paper we investigate how property graph based graph databases like Neo4j can be effectively used towards this application. We show that extending the standard property graph model with a constraint specification mechanism aids attack graph modeling and interactive analytics. We briefly sketch a preliminary attempt to implement a constraint layer over Neo4j and show how attack graph generation and analysis can be performed faithfully in Neo4j using the extended model.

The increasing integration of information technology with operational technology leads to the formation of Cyber-Physical Systems (CPSs) that intertwine physical and cyber components and connect to each other. This interconnection enables the offering of functionality beyond the combined offering of each individual component, but at the same time increases the cyber risk of the overall system, as such risk propagates between and aggregates at component systems. The complexity of the resulting systems in many cases leads to difficulty in analyzing cyber risk. Additionally, the selection of cybersecurity controls that will effectively and efficiently treat the cyber risk is commonly performed manually, or at best with limited automated decision support. In this paper, we extend our previous work in [1] to analyze attack paths between CPSs on one hand, and we improve the method proposed therein for selecting a set of security controls that minimizes both the residual risk and the cost of implementation. We use the DELTA demand-response management platform for the energy market stakeholders such as Aggregators and Retailers [2] as a use case to illustrate the workings of the proposed approaches. The results are sets of cybersecurity controls applied to those components of the overall system that have been identified to lie in those attack paths that have been identified as most critical among all the identified attack paths. KeywordsAttack pathsCyber risk aggregationCyber security controlsPower grid

The complex nature of recent attacks on cyber-physical systems calls for more expressive models for contingency prediction and response. In this paper, in an attempt to address the primary difficulties facing the design of models for cyber-physical systems security, we propose a general model, termed secure contingency prediction and response (SCPR), that explicitly links the security status of the cyber layer with the operational status of the physical system. This is achieved by describing the security status of the cyber layer as the progression of an attacker through an attack graph and drawing a correspondence between compromised nodes in the attack graph and attacker capabilities in the physical layer. Using the proposed model, we formulate a novel cyber-physical systems security problem, termed control-aware intrusion response, in which actions in the cyber layer take into account the structural controllability of the physical system. The expressiveness of the proposed model is further illustrated by briefly discussing its applicability to some foundational cyber-physical systems security problems.

The ever-evolving capabilities of cyber attackers force security\nadministrators to focus on the early identification of emerging threats.\nTargeted cyber attacks usually consist of several phases, from initial\nreconnaissance of the network environment to final impact on objectives. This\npaper investigates the identification of multi-step cyber threat scenarios\nusing kill chain and attack graphs. Kill chain and attack graphs are threat\nmodeling concepts that enable determining weak security defense points. We\npropose a novel kill chain attack graph that merges kill chain and attack\ngraphs together. This approach determines possible chains of attacker's actions\nand their materialization within the protected network. The graph generation\nuses a categorization of threats according to violated security properties. The\ngraph allows determining the kill chain phase the administrator should focus on\nand applicable countermeasures to mitigate possible cyber threats. We\nimplemented the proposed approach for a predefined range of cyber threats,\nespecially vulnerability exploitation and network threats. The approach was\nvalidated on a real-world use case. Publicly available implementation contains\na proof-of-concept kill chain attack graph generator.\n

A Cyber-Physical System (CPS) is usually composed of subnetworks where each subnetwork is under ownership of one defender. Security threats on such CPS can be represented by an attack graph where the defenders are required to invest wisely their limited budget in order to protect their critical assets from being compromised. We model such CPS using hybrid input/output automaton (HIOA) where each subnetwork is represented by a HIOA module. We first establish the building blocks needed in our setting. We then present our model that characterizes the continuous time evolution of the investments and discrete transitions between different system's states (where each state represents a different condition within the system). Finally, we provide a representative real-world CPS to validate our modeling and show its benefit for CPS security.

The significant expansion in network size to support new paradigms such as cloud computing, IoT (Internet of Things), etc. together with the exponential increase in vulnerabilities has challenged the existing security mechanisms greatly. These challenges have opened many avenues for research in network security. However, while attack graphs play an important role in analyzing vulnerabilities, analyzing large attack graphs itself is a major issue. Therefore, it is necessary to extract only the critical part of the attack graph. Although technologies have been developed for attack path characterization, there is a lack of hybrid technology that can differentiate between similar behavior attack paths. We have proposed a cost-based path characterization technique that takes the attack node's vulnerability complexity into account and significantly reduces the number of vulnerabilities that need to be patched to avoid the major segment of attack graph. Moreover, we have used a real network prototype to validate the performance of the proposed scheme. The proposed scheme works well in cases where some vulnerabilities have similar risk scores. To the best of our knowledge, this is the first time that a cost-effective approach for attack path analysis has been proposed.

In view of the characteristics of large-scale, coordinated and multi-stage network attacks, a network security situation assessment method based on attack Graph model was proposed. Firstly, the network attack behavior characteristics are constructed by integrating the spatio-temporal characteristics of attack events and multi-source alarm data. Secondly, attack nodes are mapped based on alarm information to associate multi-step attack paths. Thirdly, on the basis of constructing the attack Graph, the transfer probability table of attack nodes is constructed combining with the transfer sequence, and the transfer probability is introduced into the attack graph to infer the attack intention of the attacker. Finally, according to the maximum possible attack path, the security situation of attack nodes with high probability is evaluated, and the security situation of potential attack nodes after network attack is scientifically quantified, providing theoretical support and scientific basis for network security management personnel to do a good job of protection in advance.

Cyber-attacks threaten the safety of cyber physical systems (CPSs) as a result of the existence of weaknesses in the multiple structural units constituting them. In this paper, three cyber physical systems case studies of a pressurized water nuclear power plant (NPP), an industrial control system (ICS), and a vehicular network system (VNS) are examined, formally presented, and implemented utilizing Architecture Analysis and Design Language, determining system design, links, weaknesses, resources, potential attack instances, and their pre-and post-conditions. Then, the developed plant models are checked with a security property using JKind model checker embedded software. The attack graphs causing plants disruptions for the three applications are graphically visualized using a new graphical user interface (GUI) windows application.

Initiated and financed by the Canadian Space Agency, Micro-Rover Platform with Tooling Arm (MRPTA) project has targeted the development of a robotic system with remote control and autonomous navigation capabilities for testing a large variety of analogous planetary missions. Although developed for planetary exploration, the navigation system is highly suitable to such areas of application as construction and in mining. Autonomous navigation system is capable of moving the platform to predefined position(s)/orientation(s) while continuously mapping the terrain, assessing its traversability and choosing most appropriate path to follow. Designed according to the JAUS (Joint Architecture for Unmanned Systems) framework, the system consists of several interconnected components. Following components are of particular importance: Pose Estimator (PE), Terrain Evaluator (TE), Map Manager (MP), and Path Planner (PP). The PE uses a minimal sensor configuration consisting of an azimuth gyroscope, inclinometer and wheel odometry. The PE provides reliable pose estimates in spite of pronounced slippage by employing extensive use of fused data. The TE uses a nodding laser scanner which continuously sweeps the area in front of the platform and constructs a “traversability grid” (TG) of the surrounding area. Multiple TGs are constantly constructed along the platform motion path are combined into a terrain map maintained by the MP. The PP uses this map to compute a motion path Obtained path is executed by the motion controller and remains current until it is contradicted by the most recent map – at which point it is re-planned. This paper addresses integration issues, lessons learned and also outlines the possible applications for construction and mining.

Cyber-physical systems (CPS), such as power plants and critical infrastructure, face growing safety and security risks due to increased interconnectivity and automation. To address these challenges, we propose a framework that combines deep reinforcement learning (DRL) and Bayesian probability to model and assess vulnerabilities and attack paths. Leveraging Deep Q-Learning Networks (DQN) and cumulative probability, our method improves the identification and prioritization of effective attack paths. We also introduce the attack-fault tree (AFT) model to evaluate interactions between safety and security events. Using Uppaal SMC and statistical timed automata, we simulate dynamic scenarios and generate probabilistic estimates of metrics such as attack cost, duration, and impact. By analyzing both current and hypothetical scenarios, our approach supports informed, adaptive defense strategies for resilient CPS.