Team for Research in
Ubiquitous Secure Technology

Citation
Julian L. Rrushi, Kyoung-Don Kang. "CyberRadar: A Regression Analysis Approach to the Identification of Cyber-Physical Mappings in Process Control Systems". Proceedings of the IEEE/ACM Workshop on Embedded Systems Security, Catherine Gebotys, Dimitrios Serpanos (eds.), October, 2008.

Abstract
One of the attack requirements for maximizing physical damage to digitally controlled infrastructures is the identification of a mapping between program variables in a compromised control system and physical parameters related to physical processes or physical equipment. A cyber-physical mapping is quite critical from the offensive perspective as physical parameters are affected via modification of the associated program variables. The difficulty of such a reconnaissance challenge is acknowledged by control system security analysts as what they're presented with during experimental attacks is comprised of long series of random looking bytes or variable names. In this paper we provide a formal and thorough formulation of the cyber-physical mapping problem, propose a statistical approach to the identification of a cyber-physical mapping in large sets of scanning data, and further develop and demonstrate the proposed approach by applying it on a practical example, namely a network inertial attack on an electric motor.

Electronic downloads

• WESS08-JRrushi-KDKang.pdf · application/pdf · 257 kbytes

• HTML

  Julian L. Rrushi, Kyoung-Don Kang. <a
  href="http://www.truststc.org/pubs/467.html"
  >CyberRadar: A Regression Analysis Approach to the
  Identification of Cyber-Physical Mappings in Process Control
  Systems</a>, Proceedings of the IEEE/ACM Workshop on
  Embedded Systems Security, Catherine Gebotys, Dimitrios
  Serpanos (eds.), October, 2008.

• Plain text

  Julian L. Rrushi, Kyoung-Don Kang. "CyberRadar: A
  Regression Analysis Approach to the Identification of
  Cyber-Physical Mappings in Process Control Systems".
  Proceedings of the IEEE/ACM Workshop on Embedded Systems
  Security, Catherine Gebotys, Dimitrios Serpanos (eds.),
  October, 2008.

• BibTeX

  @inproceedings{RrushiKang08_CyberRadarRegressionAnalysisApproachToIdentification,
      author = {Julian L. Rrushi and Kyoung-Don Kang},
      title = {CyberRadar: A Regression Analysis Approach to the
                Identification of Cyber-Physical Mappings in
                Process Control Systems},
      booktitle = {Proceedings of the IEEE/ACM Workshop on Embedded
                Systems Security},
      editor = {Catherine Gebotys, Dimitrios Serpanos},
      month = {October},
      year = {2008},
      abstract = {One of the attack requirements for maximizing
                physical damage to digitally controlled
                infrastructures is the identification of a mapping
                between program variables in a compromised control
                system and physical parameters related to physical
                processes or physical equipment. A cyber-physical
                mapping is quite critical from the offensive
                perspective as physical parameters are affected
                via modification of the associated program
                variables. The difficulty of such a reconnaissance
                challenge is acknowledged by control system
                security analysts as what they're presented with
                during experimental attacks is comprised of long
                series of random looking bytes or variable names.
                In this paper we provide a formal and thorough
                formulation of the cyber-physical mapping problem,
                propose a statistical approach to the
                identification of a cyber-physical mapping in
                large sets of scanning data, and further develop
                and demonstrate the proposed approach by applying
                it on a practical example, namely a network
                inertial attack on an electric motor.},
      URL = {http://www.truststc.org/pubs/467.html}
  }
  

Posted by Julian L. Rrushi on 29 Aug 2008.
For additional information, see the Publications FAQ or contact webmaster at www truststc org.