ICSSIM — A framework for building industrial control systems security testbeds

In this paper a Power Hardware in the loop simulation has been realized to test in a safely way the performances and reliability of a device called “PowerCorner” used to supply an islanded microgrid. A real-time model has been developed in order to simulate the microgrid, batteries and photovoltaic panels. Some modeling criterions have been proposed to reduce time-step simulation and enhancing the Power Hardware in the loop simulation stability. Power Hardware in the loop simulation is used to emulate the AC and DC environments around the power inverters. On the DC side, DC power amplifier is used to emulate photovoltaic power plants and storage devices made on Lithium batteries. On the AC side, AC power amplifier is used to emulate the behavior of the microgrid. These two power amplifiers are controlled by a digital real time simulator which embeds the dynamic behavior of both DC and AC sides.

Detecting cyberattacks in industrial control systems using online learning algorithms

항공기 비행제어시스템의 개발기간, 비용 및 위험도를 최소화시키기 위해서는 비행제어 법칙의 적용 및 시험을 효율적으로 수행할 수 있는 통합개발 도구와 Rapid Prototyping 프로세스가 요구된다. 본 논문에서는 Matlab/Simulink 환경을 통해 생성한 제어법칙 자동코드와 비행동역학 해석프로그램(HETLAS: HElicopter Trim, Linearization and Simulation)과의 연동 절차를 개발하여 시뮬레이션 평가를 효율적으로 수행할 수 있는 환경의 구축에 대해 기술하였다. 또한, 본 연구를 통해 제어법칙의 다양한 모드의 조종사 시뮬레이션 평가를 위해 HETLAS를 이용한 데스크탑 시뮬레이션 환경을 개발하고 조종성 시뮬레이터 및 HILS(Hardware In the Loop Simulation) 시험 환경과 효율적으로 연동하여 시험할 수 있는 절차를 개발하였다. 비행제어법칙 개발과정에서 HETLAS를 중심으로 한 해석/시험 환경을 개발함으로써 반복적인 제어법칙의 설계/해석 및 시험 절차를 효율적으로 수행할 수 있도록 하였다. The rapid prototyping process and development tool which enable the control law evaluation efficiently are needed to minimize the development cycle, cost and risk of aircraft flight control system. This paper describes a development process that integrates the designed control law into HETLAS to evaluate simulation effectively using nonlinear mathematical models. The desktop engineering simulator was developed using HETLAS for the piloted simulation evaluation of a various control modes and the procedure was developed, which quickly integrates the HETLAS into HQS(Handling Quality Simulator) and HILS(Hardware In the Loop Simulation) environments. This paper presents a rapid prototyping process using HETLAS that significantly shortens the integration process of the control law into the nonlinear math model, HETLAS, and allows the control law designs to be quickly tested in the piloted simulation and HILS environments.

Hardware in the Loop Simulation(HILS) plays an increasingly important role in the development and test system of missile. This paper describes the structure and function of a typical HILS Platform for missile testing. The platform has a double computers structure, which consists of the control computer and the simulation computer. The paper analyses the hardware and software requirements and gives the simulation workflow chart. Accuracy of the timer is one of the key techniques in the hardware in the loop simulation. Because of the poor real-time performance of Windows system, RTX HAL extension Subsystem is introduced to meet the real-time requirement of the system. This paper also studies the realization of accurate clock in the RTX, introduces the general process of driver development. The results of simulation experiments indicate that the platform has good real-time performance and runs stably and reliably. The flight data do not miss or mismatch in the whole simulation process. The platform fully satisfies the real-time requirements of hardware in the loop simulation for missile guidance and control system.

A vehicle suspension system usually consists of a spring and a damper. These springdamper assemblies in practice have nonlinear features that are difficult to model mathematically. Due to the complexity of modelling these components the application of the Hardware in the Loop simulation (HIL) is recommended. In Hardware in the Loop simulation, one part of the system is computationally simulated (software), and another part, which has the complex characteristics of being modeled, is physically incorporated into the system (hardware). Thus, this dissertation describes the application of the Hardware in the Loop simulation to analyze the dynamic behavior of a vehicle where the two rear suspension are the physical components of the system and all the other parts of the vehicle are simulated.

Cyber-threats are one of the most significant problems faced by modern Industrial Control Systems (ICS), such as SCADA (Supervisory Control and Data Acquisition) systems, as the vulnerabilities of ICS technology become serious threats that can ultimately compromise human lives. This situation demands a domain-specific approach to cyber threat detection within ICS, which is one of the most important contributions of the CockpitCI FP7 project (http://CockpitCI.eu). Specifically, this paper will present the CockpitCI distributed Intrusion Detection System (IDS) for ICS, which provides its core cyber-detection and analysis capabilities, also including a description of its components, in terms of role, operation, integration, and remote management. Moreover, it will also introduce and describe new domain-specific solutions for ICS security such as the SCADA Honeypot and the Shadow Security Unit, which are part of the CockcpitCI IDS framework.

As more and more energy storage systems are applied to support the safe operation of the power grid, it becomes more important to conduct grid connection tests. According to the latest national standards, the grid connection test scheme is studied on the basis of RT-LAB hardware in the loop simulation. Firstly, the structure of the Energy storage system(ESS) based on the energy storage inverter is analyzed, and the strategy of conduct and mathematical model of the energy storage system are introduced; Secondly, based on RT-LAB , conducted with FPGA, hardware in the loop simulation test platform is built to improve the calculation method in the simulation, improve the accuracy and speed of the simulation; Finally, on the basis of the above, the grid connection performance test scheme is introduced, the test method performance is described in detail on the condition of fault ride through of the energy storage system, and the results are analyzed in depth. The results shows that using RT-LAB hardware in the loop simulation can accurately simulate the grid connection test of the energy storage system and provide a reference for the test plan.

This paper presents a Hardware in the loop (HIL) simulation of a microcontroller using non-linear control implemented in PFC (Power Factor Correction) boost, buck and SEPIC converters. This is a non-conventional approach, where libraries are used to directly interface with the Texas's DSP 2812. Initially, the block diagrams that contain the control equations are constructed. Then, the codes are generated automatically. The advantages provided by the proposed method are: security, economy of development cycle time, easy understanding of the control process and programming, standardization and concurrent simulation. Three nonlinear control techniques - state feedback linearization (SFL), passivity based control (PBC) and interconnection and damping assignment passivity-based control (IDA-PBC) has been validated experimentally using HIL simulation for boost, buck and SEPIC converters.

Adversarial attacks targeting industrial control systems, such as the Maroochy wastewater system attack and the Stuxnet worm attack, have caused significant damage to related facilities. To enhance the security of industrial control systems, recent research has focused on not only improving the accuracy of intrusion detection systems but also developing techniques to generate adversarial attacks for evaluating the performance of these intrusion detection systems. In this paper, we propose a deep reinforcement learning-based adversarial attack framework designed to perform man-in-the-middle attacks on industrial control systems. Unlike existing adversarial attack methods, our proposed adversarial attack scheme learns to evade detection by the intrusion detection system based on both the impact on the target and the detection results from previous attacks. For performance evaluation, we utilized a dataset collected from the secure water treatment (SWaT) testbed. The simulation results demonstrated that our adversarial attack scheme successfully executed man-in-the-middle attacks while evading detection by the rule-based intrusion detection system, which was defined based on the analysis of the SWaT dataset.

The three-phase separator has a fundamental role in oil production, due to its multivariable and nonlinear characteristics, controlling it represents a major challenge. In the engineering training academy, having a real industrial process represents a significant cost, however, thanks to technological advances, providing a virtual industrial process is possible. In this research work, a hardware in the loop simulation (HIL) environment is proposed, which includes a three-phase horizontal separator, and its controllers implemented in a physical control device. The proposed system is flexible enough to perform different control algorithms and implement them in any control device. The design methodology of the proposed system includes three sections. In the first section, the nonlinear multivariable mathematical models of the industrial process are obtained. The second section corresponds to the development of the virtual environment, in which the 3D modeling of the industrial process is performed. In the third section, the control strategies are proposed, designed and implemented in a physical control device. To validate the applicability and performance of the variables to be controlled, two control strategies are implemented: a traditional proportional integral derivative (PID) control, and a multivariable model predictive control (MPC). Finally, a comparison of the implemented controllers performance is made for the controlled variables: water level $$h(t)_w$$ , oil level $$h(t)_l$$ and separator pressure P(t).

Cyber-physical systems are realized as those systems where the computation, communication and physical processes interact with each other (e.g., robotic systems, automotives, etc). A large class of cyber-physical systems are associated with strict timeliness requirements. They are known as ‘real-time systems’ (e.g., smart grids, avionics, etc). Industrial control systems (ICS) are real-time systems that consist of several closed-loop controls. The main components of a control loop are — a physical plant, sensors, actuators and a controller. The sensors transmit the measurement data to the controller that generates appropriate control signals to actuate the physical plant. Large-scale wireless sensor actuator networks form the main communication framework among the network devices in ICS. Most of the communications between each of these devices are periodic real-time flows with hard deadlines. To ensure reliability, the communication in these systems are time-division multiple access (TDMA) based. Dedicated network resources (time-slots and frequencies) are allocated to these devices in advance and the communication schedule is pre-computed to satisfy the hard deadlines of the real-time flows. The same schedule is repeated over time which makes the schedule predictable in nature. However, a malicious attacker can exploit this predictable time-slots in the schedules to launch timing attacks. Since these applications are time-critical, timing attacks can completely undermine the system performance leading the system to an unsafe state. Schedule randomization is a popular defense mechanism to mitigate timing attacks. Although a few works exist in the literature that use schedule randomization as a countermeasure against timing attacks in real-time uniprocessor systems, none of them are applicable for real-time wireless networks. Schedule randomization as a countermeasure against timing attacks in real-time wireless networks remained largely unexplored. With this objective in focus, this thesis addresses some schedule randomization techniques to mitigate timing attacks in real-time wireless networks. Among the existing wireless network protocols that are in use, the WirelessHART is the most suitable and widely adopted protocol in ICS. A WirelessHART protocol supports centralized architecture, TDMA based communication, multiple channels, etc. All of these characteristics of a WirelessHART network facilitate reliable and predictable communication with real-time flow guarantees in ICS. However, the predictable communication exposes the system to timing attacks, such as selective jamming attacks. Selective jamming attacks are stealthy attacks, however, it can lead the system to an unstable state and can disrupt the safety of the system. As a countermeasure against such attack in WirelessHART network, we propose a centralized schedule randomization technique that randomizes the time-slots and channels in the schedule over every hyperperiod (least common multiple of the periods of the real-time flows) without violating the hard deadlines of the real-time flows, while still satisfying the feasibility constraints of a schedule in a WirelessHART network. The centralized technique generates the schedules offline and distributes the schedules online, hence, cannot support any change in topology in the network. Further, this technique has energy overheads in distributing the schedules to all the network devices at runtime. Hence, we propose a distributed online schedule randomization technique that can generate random feasible schedules at runtime in each network device without affecting the closed-loop control stability. To increase the extent of randomization of time-slots in the schedules, this online distributed technique adopts a period adaptation strategy that can adjust the transmission periods of the real-time flows at runtime depending on the stability of the closed-loop controls. To support an ever-growing number of devices and dense connectivity, the fifth generation (5G) cellular networks is expected to serve as the main communication standard in the future wireless sensor networks. Among the different service categories supported by 5G, the ultra-reliable low-latency communication (URLLC) is mostly suitable for time-critical applications such as the ICS. The communication in 5G is organized into slots over multiple frequencies. To satisfy the hard deadlines of the URLLC flows in ICS, a part of the resources (slots and frequencies) in 5G are reserved for URLLC traffic and the same schedule is repeated over time. The repetition of the same schedule over time makes the slots in the schedules predictable. This, in turn, makes the 5G networks vulnerable to timing attacks. However, the proposed schedule randomization techniques for WirelessHART networks are not applicable for dynamic networks like 5G where the number of flows and the amount of available network resources for URLLC flows vary at runtime. Moreover, the feasibility of the real-time flows need to be guaranteed at runtime. Hence, we propose an online schedule randomization technique that randomizes the slots and the frequencies of the periodic URLLC flows while guaranteeing the feasibility of the flows at runtime.

Industrial Control Systems (ICS) monitor and control physical processes. The security of ICS has drawn the attention of many researchers since successful cyber-attacks against ICS can cause extensive damage in the physical world. Most of the existing literature describes solutions to protect an ICS against attacks directly targeting its underlying IT infrastructure. However, there are comparatively less works that focus on detecting cyber attacks against the physical process itself. Detection mechanisms that do so are said to be process aware. In this paper, we propose a time-based process aware intrusion detection system (IDS) that detects attacks against a physical process by leveraging its regular nature and temporal properties. The IDS learns the temporal behavior of the process variables and uses it to detect attacks. We evaluate the performance of our IDS on a public SCADA dataset and on a simulated SCADA system developed as part of this study, and we compare it with two other process-aware IDS proposed in the literature. The results show that our solution is able to detect attacks that are not detected by IDS that ignore temporal properties.

Proportional, Integral, Dervative (PID) controller is a simple and very reliable controller, but to determine the optimal control system parameters on the PID controller (Kp, Ki, and Kd) is not easy. This paper aims to determine the optimal parameters of the PID controller using Modified Quantum Behave Particle Swarm Optimization (MQPSO) to regulate the speed control of a DC motor. MQPSO is a method that has particle search behavior that is more detailed than its predecessor methods, namely Particle Swarm Optimization (PSO) and Quantum-Behaved Particle Swarm Optimization (QPSO). The test is done through Software In the Loop Simulation (SILS) by representing a DC motor in the transfer function, after the optimal control parameters are obtained then applied to the Hardware In the Loop Simulation (HILS) test using the actual DC motor. The test results show that the PID controller that has been optimized using MQPSO results in achieving DC motor response under steady conditions and is faster than the PID controller that is optimized using Ziegler-Nichols (ZN), PSO and QPSO. The completion time obtained by MQPSO is 41.0201 ms, which is also faster than using QPSO 42.8276 ms, PSO 43.7008 ms and ZN 61.8571ms.

Rocket flight tests invariably serve a purpose, one of which involves area monitoring or aerial photography. Consequently, the rocket necessitates the installation of a camera that remains consistently oriented toward the Earth's surface throughout its trajectory. Thus, ensuring the rocket's stability and preventing any rotation becomes imperative. To achieve this, the Onboard Attitude Determination Control System (OADCS) was researched and developed, fully controlled by NI myRIO with Labview as the programming language, ensures the rocket's attitude control and maintains a rolling angle of 0 degrees during flight. The MyRIO oversees the retrieval of attitude and position data from the X-Plane flight simulator, offering feedback through actuator control. The development of the OADCS proceeded incrementally through stages utilizing the Software in the Loop Simulation (SILS) and Hardware in the Loop Simulation (HILS) techniques, to ensure the verification of the system's functionality before its application to the rocket for real flight testing. In the OADCS control scheme, Model Predictive Control (MPC) is chosen, and it is compared with a PID controller to serve as a benchmark for processing speed. Because the rocket's flight time is short and its speeds of up to Mach 4. The simulation results indicate that MPC can halt the rocket's rotation 12 times more rapidly than PID control. Additionally, the MPC's ability to maintain a zero-degree rotation can persist throughout the rocket's flight time. Employing SILS and HILS enhances the OADCS rocket development process by incorporating MPC, which holds promise for application in real rockets.

Industrial control systems (ICSs) operate a variety of critical infrastructures such as waterworks and power plants using cyber physical systems (CPSs). Abnormal or malicious behavior in these critical infrastructures can pose a serious threat to society. ICS networks tend to be configured such that specific tasks are performed repeatedly. Further, for a specific task, the resulting pattern in the ICS network traffic does not vary significantly. As a result, most traffic patterns that are caused by tasks that are normally performed in a specific ICS have already occurred in the past, unless the ICS is performing a completely new task. In such environments, anomaly-based intrusion detection system (IDS) can be helpful in the detection of abnormal or malicious behaviors. An anomaly-based IDS learns a statistical model of the normal activities of an ICS. We use the nearest-neighbor search (NNS) to learn patterns caused by normal activities of an ICS and identify anomalies. Our method learns the normal behavior in the overall traffic pattern based on the number of network packets transmitted and received along pairs of devices over a certain time interval. The method uses a geometric noise model with lognormal distribution to model the randomness on ICS network traffic and learns solutions through cross-validation on random samples. We present a fast algorithm, along with its theoretical time complexity analysis, in order to apply our method in real-time on a large-scale ICS. We provide experimental results tested on various types of large-scale traffic data that are collected from real ICSs of critical infrastructures.