Improving the resilience of cyber-physical systems under strategic adversaries

225 Pages·2017·3.25 MB·English

Purdue University
Purdue e-Pubs
Open Access Dissertations Theses and Dissertations
8-2016
Improving the resilience of cyber-physical systems
under strategic adversaries
Paul Wood
Purdue University
Follow this and additional works at:https://docs.lib.purdue.edu/open_access_dissertations
Part of theComputer Engineering Commons, and theElectrical and Computer Engineering
Commons
Recommended Citation
Wood, Paul, "Improving the resilience of cyber-physical systems under strategic adversaries" (2016).Open Access Dissertations. 882.
https://docs.lib.purdue.edu/open_access_dissertations/882
This document has been made available through Purdue e-Pubs, a service of the Purdue University Libraries. Please contact [email protected] for
additional information.
Graduate School Form
30Updated
PURDUE UNIVERSITY
GRADUATE SCHOOL
Thesis/Dissertation Acceptance
This is to certify that the thesis/dissertation prepared
By п«´É±±¼
Entitled
×ÓÐÎÑÊ×ÒÙÌØÛÎÛÍ×Ô×ÛÒÝÛÑÚÛÒÛÎÙÇóÞßÍÛÜÝÇÞÛÎóÐØÇÍ×ÝßÔÍÇÍÌÛÓÍËÒÜÛÎÍÌÎßÌÛÙ×Ý
ßÜÊÛÎÍßÎ×ÛÍ
ܱ½¬±®±ºÐ¸·´±­±°¸§
For the degree of
Is approved by the final examining committee:
Í¿«®¿¾¸ Þ¿¹½¸·
ݸ¿·®
Ó·´·²¼ Õ«´µ¿®²·
ݸ¿®´»­ßòÞ±«³¿²
ß´»º·§¿ Ø«­­¿·²
To the best of my knowledge and as understood by the student in the Thesis/Dissertation
Agreement, Publication Delay, and Certification Disclaimer (Graduate School Form 32),
this thesis/dissertation adheres to the provisions of Purdue University’s“Policy of
Integrity in Research” and the use of copyright material.
Í¿«®¿¾¸Þ¿¹½¸·
Approved by Major Professor(s):
Ê»²µ¿¬¿®¿³¿²¿²Þ¿´¿µ®·­¸²¿² éñîîñîðïê
Approved by:
Head of the Departmental Graduate Program Date

IMPROVING THE RESILIENCE OF
CYBER-PHYSICAL SYSTEMS UNDER STRATEGIC ADVERSARIES
A Dissertation
Submitted to the Faculty
of
Purdue University
by
Paul Wood
In Partial Fulfillment of the
Requirements for the Degree
of
Doctor of Philosophy
August 2016
Purdue University
West Lafayette, Indiana
ii
To my family who provided me with the tools to start this journey.
To my girlfriend Vy who provided me with the endurance to complete it.
iii
ACKNOWLEDGMENTS
IwouldliketoacknowledgethemanydiscussionsandfeedbackthatIhavereceived
throughout my time at Purdue. First, I would like to thank my advisor Dr. Saurabh
Bagchi who provided me with pivotal feedback throughout my thesis process. His
thought-provoking criticisms and suggestions immensely strengthened my technical
writing skills, idea presentation, and the technical quality of the solutions in this
thesis. Second, I would like to thank Dr. Alefiya Hussain who supported me as a
visiting research assistant at USC/ISI. Her mentorship and guidance helped tailor
my thesis toward concrete cyber-physical system problems. I would also like to thank
Tom Nudell and Dylan Shiltz for providing technical feedback on the power and
control system aspects of CPS and Chris Gutierrez for many discussions about my
thesis and goals at Purdue. I would also like to thank the other members of the
Dependable Computing Systems Lab (DCSL) for broad feedback and support in all
aspects of my thesis.
This thesis would not be possible without the financial support that I received
from several sources throughout my time at Purdue: the Missile Defense Agency
supported my graduate studies for many semesters in System of Systems Analytics,
the Andrews Fellowship allowed me to pursue my unique thesis, the DETER project
supported my time at USC/ISI, and the Frederic Miller scholarship and REACH
fellowship supported many of the additional costs of pursuing my degree.
I am privileged to have worked with such a great group of individuals.
iv
TABLE OF CONTENTS
Page
LIST OF TABLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x
LIST OF FIGURES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Contributions and Outline . . . . . . . . . . . . . . . . . . . . . . . 3
1.2.1 Energy CPS Models and Attack Strategies . . . . . . . . . . 3
1.2.2 Energy CPS Operation . . . . . . . . . . . . . . . . . . . . . 4
1.2.3 CPS Attacks and Market Manipulations . . . . . . . . . . . 5
1.2.4 Low Cost DDoS Defense . . . . . . . . . . . . . . . . . . . . 5
1.3 Work Publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2 ENERGY-BASEDCPSMODELSANDHIGH-LEVELATTACKSTRATE-
GIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1 A Profit-Oriented Model for Energy CPS . . . . . . . . . . . . . . . 8
2.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.1.3 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.1.4 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.1.5 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1.6 Experimental Model . . . . . . . . . . . . . . . . . . . . . . 25
2.1.7 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.1.8 Security Strategy Analysis . . . . . . . . . . . . . . . . . . . 34
2.1.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
2.2 High-Level Adversarial Strategies . . . . . . . . . . . . . . . . . . . 37
v
Page
2.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
2.2.2 Model Overview . . . . . . . . . . . . . . . . . . . . . . . . . 39
2.2.3 Attacker Strategy . . . . . . . . . . . . . . . . . . . . . . . . 40
2.2.4 Defense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
2.2.5 Experimentation . . . . . . . . . . . . . . . . . . . . . . . . 45
2.2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
2.3 Model and Attacks Conclusions, Insights, and Future Work . . . . . 53
3 ENERGY CPS OPERATION . . . . . . . . . . . . . . . . . . . . . . . . 55
3.1 A Framework for Evaluating the Resilience of Dynamic Real-Time
Market Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.1.2 Dynamic Real-Time Market Mechanisms . . . . . . . . . . . 60
3.1.3 Modeling Latency in Communication Networks . . . . . . . 64
3.1.4 Resilience Metric . . . . . . . . . . . . . . . . . . . . . . . . 68
3.1.5 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . 69
3.1.6 Experimental Results . . . . . . . . . . . . . . . . . . . . . . 73
3.1.7 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
3.2 Dynamic Pricing for Smart Grids in the Presence of Non-Linear Net-
work Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
3.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
3.2.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
3.2.3 Real-Time Communication . . . . . . . . . . . . . . . . . . . 83
3.2.4 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . 85
3.2.5 Existing DSM Techniques . . . . . . . . . . . . . . . . . . . 85
3.2.6 Existing Latency Studies . . . . . . . . . . . . . . . . . . . . 86
3.2.7 Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
3.3 Networking and DSM . . . . . . . . . . . . . . . . . . . . . . . . . . 91
3.3.1 Latency Influences in DSM . . . . . . . . . . . . . . . . . . . 91
3.4 Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . 94
vi
Page
3.4.1 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . 94
3.4.2 Load and Generation Model . . . . . . . . . . . . . . . . . . 95
3.4.3 Experiment 1: Analysis under Normal Conditions . . . . . . 96
3.4.4 Experiment 2: Unpredictable Step Change . . . . . . . . . . 98
3.4.5 Experiment 3: Sensitivity to β . . . . . . . . . . . . . . . . . 99
3.4.6 Experiment 4: Networking Impacts . . . . . . . . . . . . . . 101
3.4.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
3.4.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
3.5 Technical Market Conclusion . . . . . . . . . . . . . . . . . . . . . . 104
VOLUME 2
4 MARKET MANIPULATION . . . . . . . . . . . . . . . . . . . . . . . . 105
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
4.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
4.2.1 Electric Power Grids . . . . . . . . . . . . . . . . . . . . . . 108
4.2.2 Power Markets . . . . . . . . . . . . . . . . . . . . . . . . . 109
4.2.3 Profit Manipulation . . . . . . . . . . . . . . . . . . . . . . . 111
4.3 Attack and Defense Strategy . . . . . . . . . . . . . . . . . . . . . . 111
4.3.1 Players and Definitions . . . . . . . . . . . . . . . . . . . . . 113
4.3.2 Attacker’s Incentive . . . . . . . . . . . . . . . . . . . . . . . 113
4.3.3 Defensive Maneuvers . . . . . . . . . . . . . . . . . . . . . . 114
4.3.4 Defensive System Overview . . . . . . . . . . . . . . . . . . 115
4.4 Multiple Knowledge Levels . . . . . . . . . . . . . . . . . . . . . . . 117
4.4.1 Multiple Underlying Games . . . . . . . . . . . . . . . . . . 117
4.4.2 Perfect Information Game . . . . . . . . . . . . . . . . . . . 118
4.4.3 Imperfect Attack Strategies . . . . . . . . . . . . . . . . . . 118
4.4.4 Multiple Defender Optimization . . . . . . . . . . . . . . . . 119
4.5 Experimentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
4.5.1 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . 120
vii
Page
4.5.2 Experiment 1: The Attacker’s Incentive . . . . . . . . . . . . 121
4.5.3 Experiment 2: Collaborating Defenders . . . . . . . . . . . . 122
4.6 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
4.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
5 NETWORK ATTACKS IN MARKETS . . . . . . . . . . . . . . . . . . . 128
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
5.2 Background and Market Operations . . . . . . . . . . . . . . . . . . 132
5.2.1 Real-time Markets . . . . . . . . . . . . . . . . . . . . . . . 132
5.2.2 Demand-Side Management . . . . . . . . . . . . . . . . . . . 132
5.2.3 Real-Time Communication . . . . . . . . . . . . . . . . . . . 133
5.3 Strategic Adversary . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
5.3.1 Strategy Summary . . . . . . . . . . . . . . . . . . . . . . . 135
5.3.2 Capabilities and Resources . . . . . . . . . . . . . . . . . . . 135
5.3.3 Strategy Definition . . . . . . . . . . . . . . . . . . . . . . . 137
5.3.4 Price Manipulation . . . . . . . . . . . . . . . . . . . . . . . 137
5.3.5 Attack Strategy . . . . . . . . . . . . . . . . . . . . . . . . . 139
5.3.6 Integrity Attacks . . . . . . . . . . . . . . . . . . . . . . . . 140
5.4 Defender Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
5.4.1 Moving Target Defense . . . . . . . . . . . . . . . . . . . . . 142
5.4.2 Detection via Deception . . . . . . . . . . . . . . . . . . . . 143
5.5 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.5.1 Overview of RTP Controller . . . . . . . . . . . . . . . . . . 144
5.5.2 Load and Generation Model . . . . . . . . . . . . . . . . . . 144
5.5.3 Real-World Dataset . . . . . . . . . . . . . . . . . . . . . . . 146
5.6 Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . 146
5.6.1 Experiment I: Baseline Profits . . . . . . . . . . . . . . . . . 147
5.6.2 Experiment II: Impact of DoS Attacks . . . . . . . . . . . . 147
5.6.3 Experiment III: Impact of Integrity Attacks . . . . . . . . . 149