Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This article proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon.” To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Although wireless control is one of the key technologies for future industries, most wireless networks are only used for monitoring. When wireless networks are applied to transmit control commands, the uncertain link qualities and limited network resources may destroy the performance of multi-loop control systems. Hence, it is critical to allocate these resources to optimize the control performance as the network condition changes and plants evolve. This article presents comprehensive optimal scheduling strategies for wireless control systems based on adaptive dynamic programming. First, we propose an effective adaptive dynamic programming scheduling (ADPS) strategy to solve the optimal scheduling problem based on the single-step control performance at runtime while significantly reducing computational complexity. Moreover, to overcome the “short-sightedness” of single-step performance prediction, we extend ADPS to ADPS-m ( m ulti-step prediction), which optimizes multi-step performance by incorporating a longer-horizon evolution of the plants. Furthermore, we propose ADPS-H ( H eterogeneous flow scheduling) to support heterogeneous flows with different data rates and sizes and ADPS-H-m ( m ulti-step prediction for H eterogeneous flow scheduling), which schedules heterogeneous flows in a longer prediction horizon. We prove that all these scheduling strategies can achieve optimality and stability under mild assumptions. Extensive experiments integrating TOSSIM and MATLAB/Simulink are performed to evaluate all of the proposed methods in case studies of four- and ten-loop control systems. The simulation results demonstrate that these strategies can effectively improve the control performance at lower computing costs under both cyber and physical disturbances. Under the noise level of \(-\) 76 dBm, for the four-loop case, ADPS achieves the same control performance as the linear programming while saving 99.5% of the execution time. ADPS-m further improves the control performance by up to 27.0% compared with ADPS at the prediction horizon of 3, and ADPS-H-m improves the performance by up to 32.3% and 8.4% compared with round-robin and ADPS-H, respectively. The ten-loop case indicates the effectiveness and scalability of the proposed approaches.

Uncertainty in the predictions of learning-enabled components hinders their deployment in safety-critical cyber-physical systems (CPS). A shift from the training distribution of a learning-enabled component (LEC) is one source of uncertainty in the LEC’s predictions. Detection of this shift or out-of-distribution (OOD) detection on individual datapoints has therefore gained attention recently. But in many applications, inputs to CPS form a temporal sequence. Existing techniques for OOD detection in time-series data for CPS either do not exploit temporal relationships in the sequence or do not provide any guarantees on detection. We propose using deviation from the in-distribution temporal equivariance as the non-conformity measure in conformal anomaly detection framework for OOD detection in time-series data for CPS. Computing independent predictions from multiple conformal detectors based on the proposed measure and combining these predictions by Fisher’s method leads to the proposed detector CODiT with bounded false alarms. CODiT performs OOD detection on fixed-length windows of consecutive time-series datapoints by using Fisher value of the input window. We further propose performing OOD detection on real-time time-series traces of variable lengths with bounded false alarms. This can be done by using CODiT to compute Fisher values of the sliding windows in the input trace and combining these values by a merging function. Merging functions such as Harmonic Mean, Arithmetic Mean, Geometric Mean, Bonferroni Method, and so on, can be used to combine Fisher values of the sliding windows in the input trace, and the combined value can be used for OOD detection on the trace with bounded false alarm rate guarantees. We illustrate the efficacy of CODiT by achieving state-of-the-art results in two case studies for OOD detection on fixed-length windows. The first one is on an autonomous driving system with perception (or vision) LEC. The second case study is on a medical CPS for walking pattern or GAIT analysis where physiological (non-vision) data is collected with force-sensitive resistors attached to the subject’s body. For OOD detection on variable length traces, we consider the same case studies on the autonomous driving system and medical CPS for GAIT analysis. We report our results with four merging functions on the Fisher values computed by CODiT on the sliding windows of the input trace. We also compare the false alarm rate guarantees by these four merging functions in the autonomous driving system case study. Code, data, and trained models are available at https://github.com/kaustubhsridhar/time-series-OOD .

Partially autonomous driving systems may require the human driver to take control at any moment, yet by their design, they often cause difficulty with attention management. In this preliminary study, we propose a data- and dynamics-driven approach to characterize driving performance in a partially autonomous vehicle during a manual braking event, under attentive or mind wandering states. A 10-participant experiment was completed in an advanced driving simulator. We employ a non-parametric learning technique, conditional distribution embeddings, to the driving simulator data, to evaluate likelihood of successfully completing the braking maneuver, under both attentive and mind wandering states. Our approach shows a statistically significant difference in braking profiles during mind wandering and non-mind wandering episodes for each participant. Our results reveal that heterogeneity in driving performance may have important implications for the design of autonomy that is responsive to attentional states. Data-driven tools, such as the one proposed here, may be useful in designing participant-specific alerts and warnings for control handovers and other safety-critical maneuvers, because of their potential to accommodate heterogeneous response.

Extreme outside temperatures resulting from heat waves, winter storms, and similar weather-related events trigger the Heating Ventilation and Air Conditioning (HVAC) systems, resulting in challenging, and potentially catastrophic, peak loads. As a consequence, such extreme outside temperatures put a strain on power grids and may thus lead to blackouts. To avoid the financial and personal repercussions of peak loads, demand response and power conservation represent promising solutions. Despite numerous efforts, it has been shown that the current state-of-the-art fails to consider (1) the complexity of human behavior when interacting with power conservation systems and (2) realistic home-level power dynamics. As a consequence, this leads to approaches that are (1) ineffective due to poor long-term user engagement and (2) too abstract to be used in real-world settings. In this article, we propose an auction theory-based power conservation framework for HVAC designed to address such individual human component through a three-fold approach: personalized preferences of power conservation, models of realistic user behavior , and realistic home-level power dynamics . In our framework, the System Operator sends Load Serving Entities (LSEs) the required power saving to tackle peak loads at the residential distribution feeder. Each LSE then prompts its users to provide bids , i.e., personalized preferences of thermostat temperature adjustments, along with corresponding financial compensations. We employ models of realistic user behavior by means of online surveys to gather user bids and evaluate user interaction with such system. Realistic home-level power dynamics are implemented by our machine learning-based Power Saving Predictions (PSP) algorithm, calculating the individual power savings in each user’s home resulting from such bids. A machine learning-based PSPs algorithm is executed by the users’ Smart Energy Management System (SEMS). PSP translates temperature adjustments into the corresponding power savings. Then, the SEMS sends bids back to the LSE, which selects the auction winners through an optimization problem called POwer Conservation Optimization (POCO). We prove that POCO is NP-hard, and thus provide two approaches to solve this problem. One approach is an optimal pseudo-polynomial algorithm called DYnamic programming Power Saving (DYPS), while the second is a heuristic polynomial time algorithm called Greedy Ranking AllocatioN (GRAN). EnergyPlus, the high-fidelity and gold-standard energy simulator funded by the U.S. Department of Energy, was used to validate our experiments, as well as to collect data to train PSP. We further evaluate the results of the auctions across several scenarios, showing that, as expected, DYPS finds the optimal solution, while GRAN outperforms recent state-of-the-art approaches.

Systems offering fault-resilient, energy-efficient, soft real-time data communication have wide applications in Industrial Internet-of-Things (IIoT). While there have been extensive studies for fault resilience in real-time embedded systems, investigations from the cyber-physical systems (CPS) perspective are still much needed, as CPS faults occur not just from abnormal conditions in the software/hardware of the system but also from the physical environment in which the system operates. At the same time, in addition to conventional fault-tolerance strategies embedded in the software/hardware of the target system, CPS faults could be mitigated via some strategic systems re-configuration made available by the physical environment. This article presents a design and implementation for CPS fault-resilient data communication in the context of IIoT networks running LoRaWAN, a low-power wide-area networking standard. The proposed design combines collaborative IIoT end devices plus a network gateway piggybacked on a third-party cruising object that is part of the environment. With the focus on data communication, the study illustrates challenges and opportunities to address CPS fault resilience while meeting the needs for energy efficiency and communication timeliness that are common to IIoT systems. The implementation of the design is based on ChirpStack, a widely used open source framework for LoRaWAN. The results from experiment and simulation both show that the proposed scheme can tolerate limited errors of data communication while saving operating energy and maintaining timeliness of data communication to some extent.

Cyber-physical systems (CPS) are used in various safety-critical domains such as robotics, industrial manufacturing systems, and power systems. Faults and cyber attacks have been shown to cause safety violations, which can damage the system and endanger human lives. Traditional resiliency techniques fall short of protecting against cyber threats. In this article, we show how to extend resiliency to cyber resiliency for CPS using a specific combination of diversification, redundancy, and the physical inertia of the system.

Machine learning (ML)-based intrusion detection system (IDS) approaches have been significantly applied and advanced the state-of-the-art system security and defense mechanisms. In smart grid computing environments, security threats have been significantly increased as shared networks are commonly used, along with the associated vulnerabilities. However, compared to other network environments, ML-based IDS research in a smart grid is relatively unexplored, although the smart grid environment is facing serious security threats due to its unique environmental vulnerabilities. In this article, we conducted an extensive survey on ML-based IDS in smart grids based on the following key aspects: (1) The applications of the ML-based IDS in transmission and distribution side power components of a smart power grid by addressing its security vulnerabilities; (2) dataset generation process and its usage in applying ML-based IDSs in the smart grid; (3) a wide range of ML-based IDSs used by the surveyed papers in the smart grid environment; (4) metrics, complexity analysis, and evaluation testbeds of the IDSs applied in the smart grid; and (5) lessons learned, insights, and future research directions.

The articles in this special section are based on selected papers presented at the 2021 ACM/IEEE International Conference on Cyber-Physical Systems (ICCPS 2021), a premier single-track conference that promotes development of fundamental principles that underpin the integration of cyber and physical elements, as well as the development of technologies, tools, architectures, and infrastructure for the design and implementation of CPS. ICCPS 2021 focused on contributions related to smart and connected cities, autonomous CPS, verification and control, security and privacy, and human health and biomedical CPS.

There has been significant interest within the offshore oil and gas industry to utilise Industrial Internet of Things (IIoT) and Industrial Cyber-Physical Systems (ICPS) . There has also been a corresponding increase in cyberattacks targeted at oil and gas companies. Offshore oil production requires remote access to and control of large and complex hardware resources. This is achieved by integrating ICPS, Supervisory, Control and Data Acquisition (SCADA) systems, and IIoT technologies. A successful cyberattack against an oil and gas (O&G) offshore asset could have a major impact on the environment, marine ecosystem and safety of personnel. Any disruption to the world’s supply of O&G can also have an effect on oil prices and the global economy. We describe the cyberattack surface within the oil and gas industry, discussing emerging trends in the offshore sub-sector and provide a historical perspective of known cyberattacks. We also present a case study of a subsea control system architecture typically used in offshore O&G operations and highlight potential vulnerabilities affecting the components of the system. This study is the first to provide a detailed analysis of attack vectors in a subsea control system. The analysis provided can be used to understand key vulnerabilities in such systems and may be used to implement efficient mitigation methods.