Data-Driven Approaches for Cyber Security of Critical Infrastructures

关键基础设施网络安全的数据驱动方法

• 批准号: RGPIN-2020-06482
• 负责人: Shi, Wei
• 金额: $ 2.11万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=757255
• 关键词: Data; Driven; Approaches; Cyber; Security

A distributed system is a system whose components are located on different networked entities (e.g., computers, sensors) that communicate and coordinate their actions by exchanging messages. These entities have a shared state, operate concurrently and can fail independently without affecting the whole system's uptime. With the ever-growing technological expansion of the world, distributed systems are becoming more and more widespread. In past years, I have addressed the protection and resilience of distributed systems such as Clouds, Data Centres, Mobile Agent and Actuator Networks, Vehicular and Wireless Sensor Networks. Building on this expertise, in the medium term, I plan to address various cyber security issues and develop attack resilient solutions for a very important type of distributed systems, namely the industrial automated control systems and networks that are monitoring and controlling the operation of critical infrastructures in different sectors. These include the Energy sector (e.g., oil pipelines, nuclear plants), the Financial sector, Government Operations, Water Supply, Health Systems and more. Cyber-attacks against critical infrastructures have increased significantly in the last decade and caused serious damage with very important social and economic losses. However, research on protecting the control systems of critical infrastructures against cyber-attacks is still at an early stage and faces many open technical challenges. For this current research plan proposal, I will address a specific critical energy infrastructure, namely Electrical Power Systems (EPSs). The facilities of an EPS are often scattered over thousands of square kilometres. SCADA is a tool to control such a geographically dispersed system. The focus of my research over the next five years will be on the following three objectives: 1)Mitigate cyber-attacks against SCADA-based EPS systems by developing new data-driven security analysis and vulnerability assessment methods to understand and monitor the tight interaction between software events/behaviors resulting from attacks and the events/behaviors observable at the network level of an EPS. It is the consideration of the close relationship between the cyber and the physical level that sets my research apart from existing approaches (which often overlook the physical level). Moreover, I have the necessary equipment to monitor this relationship in an EPS. 2)Protect against and respond to malicious attacks by developing new real-time machine-learning-based intrusion detection techniques for monitoring both cyber-layer data and data describing the physical behavior of EPSs. 3)Recover from attacks on EPSs by building a data-driven attack-resilient SCADA-based system that can maintain its normal functions even when under attack. Ultimately, my proposal aligns well with the mandate of Natural Resources Canada to protect critical energy infrastructures and DND's interest in resilient networked systems.

分布式系统是其组件位于不同网络实体（例如计算机、传感器）上的系统，这些实体通过交换消息来通信和协调其操作。这些实体具有共享状态、并发操作并且可以独立发生故障，而不会影响整个系统的正常运行时间。随着世界技术的不断发展，分布式系统变得越来越普遍。 在过去的几年中，我讨论了分布式系统的保护和弹性，例如云、数据中心、移动代理和执行器网络、车辆和无线传感器网络。基于这种专业知识，从中期来看，我计划解决各种网络安全问题，并为一种非常重要的分布式系统开发抗攻击解决方案，即监视和控制关键基础设施运行的工业自动化控制系统和网络在不同的部门。其中包括能源部门（例如石油管道、核电站）、金融部门、政府运营、供水、卫生系统等。过去十年，针对关键基础设施的网络攻击大幅增加，造成严重破坏，造成非常严重的社会和经济损失。然而，保护关键基础设施控制系统免受网络攻击的研究仍处于早期阶段，并面临许多开放的技术挑战。对于当前的研究计划提案，我将讨论一个特定的关键能源基础设施，即电力系统（EPS）。 EPS 的设施通常分散在数千平方公里的范围内。 SCADA 是控制这种地理上分散的系统的工具。未来五年我的研究重点将集中在以下三个目标： 1）通过开发新的数据驱动的安全分析和漏洞评估方法来理解和监控各系统之间的紧密交互，从而减轻针对基于 SCADA 的 EPS 系统的网络攻击。由攻击引起的软件事件/行为以及在 EPS 的网络级别可观察到的事件/行为。正是对网络和物理层面之间密切关系的考虑，使我的研究与现有方法（通常忽视物理层面）区分开来。此外，我有必要的设备来监控 EPS 中的这种关系。 2）通过开发新的基于实时机器学习的入侵检测技术来监控网络层数据和描述 EPS 物理行为的数据，防御和响应恶意攻击。 3）通过构建数据驱动的、基于 SCADA 的抗攻击系统，即使受到攻击也能保持正常功能，从而从 EPS 的攻击中恢复。最终，我的提案与加拿大自然资源部保护关键能源基础设施的使命以及 DND 对弹性网络系统的兴趣完全一致。