Deep CYBERIA

Deep CYBERIA is a novel system focused on Detecting Sensors Deeply Embedded in Cyber-Physical Systems via novel machine learning and passive/active/hybrid probing techniques on complex operational technology (OT) networks.

Overview

Deep CYBERIA is designed to address the critical capability gap identified by USAF in discovering, identifying and mapping the edge devices and physical sensors connected to those edge devices. The effort is aimed at the outcome of providing situational awareness of Industrial Control Systems/Supervisory Control and Data Acquisition (ICS/SCADA) traffic and devices operating in a network. The situational awareness will support the requirement of performing deep dive filtering analysis and enumeration of ICS traffic.

Demonstration

Organization

• Sponsor: US Department of Defense
• Prime: Oak Ridge National Laboratory (ORNL)
  • Subcontract: MIT Lincoln Laboratory (MIT-LL)
• Period: 2019-2025

Gallery

Related Publications

Trust-but-Verify in Cyber-Physical Systems

Cyber-physical systems span a wide spectrum, from long-lived legacy systems to more modern installations. Trust is an issue that arises across the spectrum, albeit with different variants of goals and constraints. On the one end of the spectrum, legacy systems are characterized by function-based designs in which trust is an implicitly in-built concept…

Kalyan Perumalla

PDF Cite Slides DOI

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

In this paper, we present our research and development efforts aimed at addressing the gap in discovering sensors at level 0 in industrial CPS by building a system called Deep-cyberia (Deep Cyber-Physical System Interrogation and Analysis) that incorporates algorithms and interfaces aimed at uncovering sensors and computing estimates of correlations among them.

Kalyan Perumalla, Srikanth Yoginath, Juan Lopez

PDF Cite Slides DOI

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Our focus is to extract volatile and dynamically changing internal information form CPS 0-1 level devices, and design preliminary schemes to exploit that extracted information. As a case study, we apply the proposed methodology to Modicon PLC using Modbus protocol. We extract the memory layout and subject the device to read operations at the most critical regions of memory. This capability of generating a sequence of volatile memory snapshots for offline, detailed and sophisticated analysis opens a new class of cyber security schemes for CPS forensic analysis, taint analysis and watermarking.

Rima Asmar Awad, Juan Lopez, Michael Rogers, Kalyan Perumalla

PDF Cite