The Internet of Things (IoT) paradigm is gradually becoming more prevalent through numerous devices and technologies, including sensors, actuators, microcontrollers, cloud-enabled services, and analytics. IoT objects gain intelligence by integrating with wireless sensor networks (WSNs), mobile computing and communication, and others. With sensors, smart things can be enabled by monitoring and identifying environmental changes related to motion, temperature, humidity, pressure, light, vibration, etc. To timely keep track of state changes, researchers are considering developing a cyber replicator, denoted as Digital Twin (DT), of real physical systems as a way to visualize, model, and work with complex cyber-physical systems (CPS). In this paper, we first refine the dataset to a format that can be easily used for deep learning (DL) experiments, IoT data pipeline development, data modeling and simulation, data aggregation, etc. We then demonstrate that DT data can be used to determine space occupancy based on the ambient light sensor, which tends to indicate occupancy in particular spaces because the building has smart lighting that will switch off when rooms are unoccupied after a certain time. Given the apparent developments in machine learning technology, it is clear that machine learning-based prediction has the ability to enhance resource utilization and further forecast future events. Particularly, we use a DT-based dataset and Long-Short-Term Memory (LSTM) neural network architecture to forecast the campus building’s internal temperature.

The applications of machine learning (ML) in cyber-physical systems (CPS), such as the smart energy grid has increased significantly. While ML technology can be integrated into CPS, the security risk of ML technology has to be considered. In particular, adversarial examples provide inputs to a ML model with intentionally attached perturbations (noise) that could pose the model to make incorrect decisions. Perturbations are expected to be small or marginal so that adversarial examples could be invisible to humans, but can significantly affect the output of ML models. In this paper, we design a taxonomy to provide the problem space for investigating the adversarial example generation techniques based on state-of-the-art literature. We propose a three-dimensional framework containing three dimensions for adversarial attack scenarios (i.e., black-box, white-box, and gray-box), target type, and adversarial examples generation methods (gradient-based, score-based, decision-based, transfer- based, and others). Based on the designed taxonomy, we systematically review the existing research efforts on adversarial ML in representative CPS (i.e., transportation, healthcare, and energy). Furthermore, we provide one case study to demonstrate the impact of adversarial examples of attacks on a smart energy CPS deployment. The results indicate that the accuracy can decrease significantly from 92.62% to 55.42% with a 30% adversarial sample injection. Finally, we discuss potential countermeasures and future research directions for adversarial ML.

Traditionally, Android malware is analyzed using static or dynamic analysis. Although static techniques are often fast; however, they cannot be applied to classify obfuscated samples or malware with a dynamic payload. In comparison, the dynamic approach can examine obfuscated variants but often incurs significant runtime overhead when collecting every important malware behavioral data. This paper conducts an exploratory analysis of memory forensics as an alternative technique for extracting feature vectors for an Android malware classifier. We utilized the reconstructed per-process object allocation network to identify distinguishable patterns in malware and benign application. Our evaluation results indicate the network structural features in the malware category are unique compared to the benign dataset, and thus features extracted from the remnant of in-memory allocated objects can be utilized for robust Android malware classification algorithm.

As IT/OT convergence continues to evolve, the traditionally isolated ICS/OT systems are increasingly exposed to a myriad of online and offline threats. Although IIoT enhances the reachability in ICS, improved data analytics, ensuring ease of access and decision making, it unwittingly opens the ICS environment to attackers. The design of IIoT introduces multiple entry points to an isolated system, which is used to protect itself via air-gapping and risk avoidance strategies. This study explores a comprehensive mapping of threats and risks for IT/OT convergence. Additionally, we propose IIoT-ARAS - an automated risk assessment system based on OCTAVE Allegro and ISO/IEC 27030 methodologies. The design of IIoT-ARAS is aimed to be agentless, with minimum interruptions to the OT environment. Furthermore, the system performs automated regular asset inventory checks, threshold optimization, probability computation, risk evaluations, and contingency plan configuration.