NeTS: Small: Collaborative Research: Measurement and Modeling of Industrial Control Networks

NeTS：小型：协作研究：工业控制网络的测量和建模

• 批准号: 1929406
• 负责人: Alvaro Cardenas
• 金额: $ 24.73万
• 依托单位: University of California-Santa Cruz
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-01-01 至 2022-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1929406&HistoricalAwards=false
• 关键词: NeTS; Small; Collaborative; Research; Measurement

Operators of industrial control systems have limited software tools for obtaining situational awareness of their networks and processes. This project seeks to characterize network traffic for a rich variety of industrial control networks. Because the research community lacks access to (mostly proprietary) data sets from operating control systems, our ability to identify anomalous behavior and protect weaknesses is a concern for critical U.S. infrastructure. The research team has obtained a collection of network data sets that will allow them to study the performance (and security) properties of various types of industrial control systems, including wastewater treatment, power, and solar energy. By examining the similarities and differences of these data sets, this analysis will yield models of critical infrastructure control system traffic that will aid in anomaly detection and further our understanding of these networks in general.The project will characterize network flows, and perform deep-packet inspection in a protocol- and process-aware fashion. The project will develop open-source tools implementing anomaly detection algorithms to be used by researchers and the process control industry. Since the anomaly detection tools are passive, they can ultimately be deployed in the operational environments of industrial partners to help them improve the visibility and understanding of their control networks. This work will be performed in collaboration with researchers in Israel under the US-Israel Binational Science Foundation joint funding program.

工业控制系统运营商用于获取其网络和流程态势感知的软件工具有限。该项目旨在表征各种工业控制网络的网络流量。 由于研究界无法访问操作控制系统中的（大部分是专有的）数据集，因此我们识别异常行为和保护弱点的能力是美国关键基础设施的一个问题。 研究团队获得了一系列网络数据集，使他们能够研究各种类型工业控制系统的性能（和安全）特性，包括废水处理、电力和太阳能。通过检查这些数据集的相似性和差异，该分析将产生关键基础设施控制系统流量的模型，这将有助于异常检测并进一步加深我们对这些网络的总体理解。该项目将描述网络流的特征，并执行深度数据包分析以协议和流程感知的方式进行检查。 该项目将开发实施异常检测算法的开源工具，供研究人员和过程控制行业使用。由于异常检测工具是被动的，因此它们最终可以部署在工业合作伙伴的操作环境中，以帮助他们提高对其控制网络的可见性和理解。这项工作将在美国-以色列两国科学基金会联合资助计划下与以色列的研究人员合作进行。

项目成果

You Can’t Protect What You Don’t Understand: Characterizing an Operational Gas SCADA Network

您无法保护您不了解的内容：描述正在运行的天然气 SCADA 网络

• DOI: 10.1109/spw54247.2022.9833864
• 发表时间: 2022
• 期刊: IEEE SafeThings 2022
• 作者: Qin, Xi;Rosso, Martin;Cardenas, Alvaro A.;Etalle, Sandro;den Hartog, Jerry;Zambon, Emmanuele
• 通讯作者: Zambon, Emmanuele

MaMIoT: Manipulation of Energy Market Leveraging High Wattage IoT Botnets

MaMIoT：利用高功率物联网僵尸网络操纵能源市场

• DOI: 10.1145/3460120.3484581
• 发表时间: 2021
• 期刊: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
• 作者: Shekari, Tohid;Irvene, Celine;Cardenas, Alvaro A.;Beyah, Raheem
• 通讯作者: Beyah, Raheem

Uncharted Networks: A First Measurement Study of the Bulk Power System

未知网络：大容量电力系统的首次测量研究

• DOI: 10.1145/3419394.3423630
• 发表时间: 2020
• 期刊: ACM Internet Measurement Conference (IMC'20
• 作者: Mai, Kelvin;Qin, Xi;Ortiz, Neil;Molina, Jason;Cardenas, Alvaro A.
• 通讯作者: Cardenas, Alvaro A.

You Make Me Tremble: A First Look at Attacks Against Structural Control Systems

• DOI: 10.1145/3460120.3485386
• 发表时间: 2021-11
• 期刊: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
• 作者: Abel Zambrano;Alejandro Betancur;Luis Burbano;Andres Felipe Niño;L. F. Giraldo;Mariantonieta Gutierrez Soto-Mariantonieta-G

Enhancing the Resiliency of Cyber-Physical Systems with Software-Defined Networks

通过软件定义网络增强网络物理系统的弹性

• DOI: 10.1145/3338499.3357356
• 发表时间: 2019
• 期刊: CPS-SPC'19: Proceedings of the ACM Workshop on Cyber-Physical Systems Security & Privacy
• 作者: Salazar, Luis E.;Cardenas, Alvaro A.
• 通讯作者: Cardenas, Alvaro A.