Collaborative Research: SaTC: CORE: Medium: Cyber-threat Detection and Diagnosis in Multistage Manufacturing Systems through Cyber and Physical Data Analytics

协作研究：SaTC：核心：中：通过网络和物理数据分析进行多级制造系统中的网络威胁检测和诊断

• 批准号: 2019340
• 负责人: Peng Liu
• 金额: $ 30万
• 依托单位: Pennsylvania State Univ University Park
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2020
• 资助国家: 美国
• 起止时间: 2020-10-01 至 2025-09-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2019340&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

In modern multistage manufacturing systems, with increased software-defined automation and control as well as monitoring of manufacturing assets across networks, exposure to cyber-attacks also grows. The cyber-threats may compromise the integrity of manufacturing assets (manufacturing systems and processes, machine tools, fabricated parts), reduce manufacturing productivity, and increase costs. Some cyber-threats including integrity attacks are only partially observable in cyberspace alone, and therefore need to be detected and diagnosed through inter-dependency analysis of both cyber and physical signals. Thus, there is a significant opportunity in exploring physical signals, together with cyber signals, to advance trustworthy manufacturing system research and design. This project brings together leading researchers from manufacturing systems, computer security, and electrical drives to develop and demonstrate a new methodology and tool for cyber-threat detection and diagnosis in multistage manufacturing systems. The cyber-security tool will monitor a variety of cyber and physical signals and perform cyber-threat detection and root cause diagnosis through advanced cyber-physical data fusion and taint analysis. The goal is to enable the prevention and mitigation of potential harms at the early stage, proactive and predictive maintenance, and countermeasures. This project attempts to integrate and analyze the process and quality signals, and the signals from the power networks and cyber networks of multistage manufacturing systems to detect and diagnose cyber-threats. This new systematic approach expects to capture new cyber-threats, especially data integrity attacks, that traditional cyber-security approaches may not capture. The proposed data analytics and methodology for integrating cyber and physical signals will advance a fundamental understanding of cyber-threat detection and diagnosis in multistage manufacturing systems and can broadly apply to other cyber-physical systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

在现代多级制造系统中，随着软件定义的自动化和控制以及跨网络制造资产监控的增加，遭受网络攻击的风险也在增加。网络威胁可能会损害制造资产（制造系统和流程、机床、制造零件）的完整性、降低制造生产率并增加成本。包括完整性攻击在内的一些网络威胁仅在网络空间中只能部分观察到，因此需要通过网络信号和物理信号的相互依赖性分析来检测和诊断。因此，探索物理信号和网络信号是推进值得信赖的制造系统研究和设计的重要机会。该项目汇集了来自制造系统、计算机安全和电气驱动领域的领先研究人员，开发并演示了一种用于多级制造系统中网络威胁检测和诊断的新方法和工具。该网络安全工具将监控各种网络和物理信号，并通过先进的网络物理数据融合和污点分析来执行网络威胁检测和根本原因诊断。目标是能够在早期阶段预防和减轻潜在危害、主动和预测性维护以及对策。 该项目试图集成和分析过程和质量信号，以及来自多级制造系统的电力网络和网络网络的信号，以检测和诊断网络威胁。这种新的系统方法有望捕获传统网络安全方法可能无法捕获的新网络威胁，尤其是数据完整性攻击。拟议的用于集成网络和物理信号的数据分析和方法将促进对多级制造系统中网络威胁检测和诊断的基本理解，并且可以广泛应用于其他网络物理系统。该奖项反映了 NSF 的法定使命，并被认为是值得的通过使用基金会的智力优势和更广泛的影响审查标准进行评估来获得支持。

项目成果

What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation

固件告诉您的并不是您应该如何模拟它：一种规范引导的固件模拟方法

• DOI: 10.1145/3548606.3559386
• 发表时间: 2022-01
• 期刊: Proc. ACM CCS 2022
• 作者: Zhou, Wei;Zhang, Lan;Guan, Le;Liu, Peng;Zhang, Yuqing
• 通讯作者: Zhang, Yuqing

A co-design adaptive defense scheme with bounded security damages against Heartbleed-like attacks

一种针对类似 Heartbleed 的攻击具有有限安全损害的协同设计自适应防御方案

• DOI: 10.1109/tifs.2021.3113512
• 发表时间: 2021-01
• 期刊: IEEE Transactions on Information Forensics and Security
• 影响因子: 6.8
• 作者: Hu, Zhisheng;Chen, Ping;Zhu, Minghui;Liu, Peng
• 通讯作者: Liu, Peng

Identifying Channel Related Vulnerabilities in Zephyr Firmware

识别 Zephyr 固件中与通道相关的漏洞

• DOI: 10.1109/ithings-greencom-cpscom-smartdata-cybermatics55523.2022.00055
• 发表时间: 2022-08
• 期刊: IEEE International Conference on Internet of Things (IEEE iThings
• 作者: Rajgarhia, Devansh;Liu, Peng;Sural, Shamik
• 通讯作者: Sural, Shamik

Analyzing the Overhead of File Protection by Linux Security Modules

分析 Linux 安全模块的文件保护开销

• DOI: 10.1145/3433210.3453078
• 发表时间: 2021-05
• 期刊: 2021 ACM Asia Conference on Computer and Communications Security
• 作者: Zhang, Wenhui;Liu, Peng;Jaeger, Trent
• 通讯作者: Jaeger, Trent

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

与物理设备无关的物联网固件混合模糊测试

• DOI: 10.1109/jiot.2023.3303780
• 发表时间: 2023-12-01
• 期刊: IEEE Internet of Things Journal
• 影响因子: 10.6
• 作者: Lingyun Situ;Chi Zhang;Le Guan;Zhiqiang Zuo;Linzhang Wang;Xu;ong Li;ong;Peng Liu;Jin Shi
• 通讯作者: Jin Shi