Cyber-Physical

CYVET

Our new Cyber-Physical Security Assurance Framework based on Semi-Supervised Vetting applies the latest AI/ML and NLP technologies on hardware testbeds to advance the resilience of critical cyber-physical assets including electric grids and gas pipelines.
Jan 1, 2022
CYVET
Deep CYBERIA

Deep CYBERIA is a novel system focused on Detecting Sensors Deeply Embedded in Cyber-Physical Systems via novel machine learning and passive/active/hybrid probing techniques on complex operational technology (OT) networks.
Jan 1, 2022
Deep CYBERIA
Digital Twin Framework

Our novel Digital Twin Framework (DTF) is designed to improve resilience of critical infrastructure systems by continuously comparing the infrastructure state with automatically generated, AI/ML-based, real-time digital-twin simulation of the system.
Jan 1, 2022
Digital Twin Framework
Kensor: Coordinated Intelligence from Co-located Sensors

Kensor uncovers coordinated intelligence about normal and abnormal phenomena from multiple sensors co-located in close proximity in secure installations.
Jan 1, 2022
Kensor: Coordinated Intelligence from Co-located Sensors
Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems
This paper presents new methodology and algorithms to automatically identify cybersecurity-related claims expressed in natural language form in ICS device documents. The verification pipeline includes automated vendor identification, device document curation, and feature claim identification via sentiment analysis. Our novel matching engine represents the first automated information system available in the cybersecurity domain to directly aid ICS compliance reporting.
PDF DOI
Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems
An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity
Our classifier of feature claims for cybersecurity literature analytics is introduced in our new model called ClaimsBERT. ClaimsBERT outperforms all other evaluated framework aiming to improve the cybersecurity of industrial control systems (ICS).
PDF Cite DOI
An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity
DarkNet Cyber Resilience
Two key cyber elements affecting the grid’s timing capability are Cyber Resilience and Cyber Trust. The timing services of DarkNet are systematically subjected to a range of cyber phenomena that stress four key performance factors, namely: Accuracy, Manageability, Telemetry, and Visibility. This analysis is designed to provide insights into four important categories of undesirable cyber phenomena: Loss of View (LoV), Loss of Control (LoC), Manipulation of View (MoV), and Manipulation of Control (MoC).
PDF
DarkNet Cyber Resilience
CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model
We introduce CyBERT, a cybersecurity feature claims classifier based on bidirectional encoder representations from transformers and a key component in our semi-automated cybersecurity vetting for industrial control systems (ICS)…The results showed that CyBERT outperforms these models on the validation accuracy and the F1 score, validating CyBERT’s robustness and accuracy as a cybersecurity feature claims classifier.
PDF Cite DOI
CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model
On Some Confluences of Computing and Security in Theory and Practice
We broadly recount some of our research and development efforts spanning new computational paradigms and algorithms, and we will relate …
May 21, 2021 National Security Sciences Directorate
Slides
On Some Confluences of Computing and Security in Theory and Practice
Trust-but-Verify in Cyber-Physical Systems
Dr. Kalyan Perumalla delivered an invited keynote talk at the Association for Computing Machinery (ACM) Workshop on Secure and Trustworthy Cyber-Physical Systems (SaT-CPS)
Apr 28, 2021 Washington, DC, USA
Slides
Trust-but-Verify in Cyber-Physical Systems
Trust-but-Verify in Cyber-Physical Systems
Cyber-physical systems span a wide spectrum, from long-lived legacy systems to more modern installations. Trust is an issue that arises across the spectrum, albeit with different variants of goals and constraints. On the one end of the spectrum, legacy systems are characterized by function-based designs in which trust is an implicitly in-built concept…
PDF Cite Slides DOI
Trust-but-Verify in Cyber-Physical Systems
Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information
A solution is needed for vetting the vendor-supplied feature claims and their adherence to cybersecurity requirements and standards. We are presently engaged in an effort to develop such a system. This paper demonstrates one vital aspect of this effort in proposing an end-to-end framework to accumulate a large repository of ICS device information for this vetting system, curate the dataset, and conduct extensive processing. This framework is designed to use web scraping, data analytics and Natural Language Processing (NLP) techniques to identify vendor websites, automate the collection of website-accessible documents and automatically derive metadata from them for identification of product documents relevant to the repository…
PDF
Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information
R&D Needs for Digital Twins
Dec 3, 2020 Chattanooga, TN, USA
Slides
R&D Needs for Digital Twins
A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems
The cybersecurity auditing for Operation Technology is critical and has been largely missing from the cybersecurity research, especially in the energy sector. In this paper, we present a novel “cybersecurity vetting” approach (CYVET) to the problem of verification and validation of cybersecurity in complex cyber-physical installations underlying modern energy grid systems.
PDF DOI
A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems
A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems
We describe an approach to detecting and preventing cyber attacks by continuously comparing the infrastructure state with a real-time digital-twin simulation of it. Specifically, we describe and demonstrate a Digital Twin Framework (DTF) designed specifically to detect and eventually prevent such attacks. The canal lock system’s digital twin uses a recurrent neural network trained from the experimental data collected via the DTF.
PDF
A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems
Kensor: Coordinated Intelligence from Co-Located Sensors
Here, we focus on coordinated intelligence about normal and abnormal phenomena from multiple sensors geographically co-located, monitoring and controlling a set of co-located devices. Given a set of co-located sensors, we develop an intelligent approach that automatically determines the ’normal’ patterns of behaviors among the correlated sensors. After normal behavior is extracted, later monitoring detects deviant variations over time.
PDF Cite DOI
Kensor: Coordinated Intelligence from Co-Located Sensors
On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems
We empirically study the effectiveness of Recurrent Neural Network (RNN)-based models as the basis of DT-based resilience and uncover the important characteristics of an RNN-based solution with experimentation on a lab-scale Canal Lock CPS emulator with live validations and attack scenarios. For the first time, we demonstrate actual, real-time use of a RNN-based model as a DT for performing live analysis on an operational CPS.
PDF Cite DOI
On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems
Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems
In this paper, we present our research and development efforts aimed at addressing the gap in discovering sensors at level 0 in industrial CPS by building a system called Deep-cyberia (Deep Cyber-Physical System Interrogation and Analysis) that incorporates algorithms and interfaces aimed at uncovering sensors and computing estimates of correlations among them.
PDF Cite Slides DOI
Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems
Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics
Our focus is to extract volatile and dynamically changing internal information form CPS 0-1 level devices, and design preliminary schemes to exploit that extracted information. As a case study, we apply the proposed methodology to Modicon PLC using Modbus protocol. We extract the memory layout and subject the device to read operations at the most critical regions of memory. This capability of generating a sequence of volatile memory snapshots for offline, detailed and sophisticated analysis opens a new class of cyber security schemes for CPS forensic analysis, taint analysis and watermarking.
PDF Cite
Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics