Multi-step attacks challenge security analysts in reconstructing attack sequences from extensive multi-host log data. Existing attack reconstruction approaches rely heavily on computationally intensive audit logs and provenance analysis, limiting their practicality in multi-host environments. We present MuSAR, a framework for real-time reconstruction of multi-step attacks in multi-host environments using lightweight security logs (network alarms and application logs). First, security logs are consolidated into inter-host and intra-host security events through semantic analysis, respectively. Then, these security events are mapped to unified attack lifecycle stages through MITRE ATT&CK framework integration. Finally, a heuristic algorithm is implemented to identify potential multi-step attacks and reconstruct complete attack sequences based on event-level semantic associations. Evaluation on the CPTC2018 dataset and a multi-step attack simulation dataset demonstrates MuSAR’s effectiveness in identifying attack-related traces and reconstructing multi-step attacks, achieving an average recall of $93.48 \%$ and F1-score of $94.39 \%$, respectively, outperforming state-of-the-art methods in attack investigation and reconstruction in multi-host environments.

Distribution grid with electric vehicle (EV) charging infrastructure can be modeled as a coupled network consisting of the cyber network, distribution grid and traffic network. The interconnection of the coupled network allows attackers to launch cyber attacks and control numerous EVs to cause severe load fluctuations, thereby affecting the normal operation of the distribution grid and the traffic flow. To evaluate the cyber-physical security of the coupled network, we present a security assessment model formulated as a coupled Discrete Event System Specification (DEVS). In this model, the evolution of the coupled network is represented as state transitions triggered by events in a discrete-time process, while the interaction is achieved through event transmission, reception and processing. To determine the redistribution of states influenced by the selection of EV charging stations and moving paths, we propose a spatial-temporal evolution mechanism. Based on the assessment model, we propose an event-triggered simulation method. The efficiency of the proposed simulation method is evaluated by comparing it with the multi-layer synchronous simulation method. Compared with the existing security assessment models, the simulation results of our model are more accurate.

Fieldbus is widely used for real-time distributed control in Industrial Control Systems (ICSs) due to its simplicity and stability. The real-world fieldbus network contains hundreds of interconnected devices, presenting a widespread network layout. Attackers can attach external intrusion devices to these communication lines to launch various attacks. In this paper, we model the fieldbus network’s channel fingerprint based on the signal’s amplitude and propose a detection method to identify potential attackers (silent intrusion devices that are eavesdropping) via channel fingerprint differences. Leveraging the passive fail-safe biasing voltage in the fieldbus network such as RS485, we can still detect the intrusion device when the fieldbus is idle (i.e., no devices are transmitting commands), which can significantly reduce the detection delay with lower sampling costs. Moreover, our method can adapt to environmental changes with little computational overhead by generating dynamic thresholds. Using a monitoring unit with stored channel fingerprints, our method can be easily deployed in fieldbus networks without occupying communication resources. The effectiveness and robustness of the proposed method have been demonstrated via extensive experiments on two real-world scenarios and one simulation scenario, where we can achieve 100% accuracy and 0% false alarm rates against various intrusion devices. Note to Practitioners—This paper is motivated by a practical need for detecting unauthorized intrusion devices in fieldbus networks. Existing detection methods face several challenges: active detection methods based on traffic analysis may disrupt normal bus communication, and it is hard to identify silent intrusion devices that are eavesdropping. Moreover, adapting these methods to changing environments is still challenging and costly. To address these issues, we leverage the inevitable amplitude differences in fail-safe biasing voltage signals and benign devices’ communication voltage signals to detect intrusion devices passively. Furthermore, to adapt to rapidly changing environments, we generate the detection thresholds dynamically based on the hypothesis testing theory. Extensive physical and simulation experiments demonstrate that the detection method against physical intrusion attacks is accurate and robust.

Thermal energy equipment, a critical component for transferring and utilizing thermal energy derived from primary energy sources, is indispensable in Industrial Control Systems (ICSs). With the deep integration of information technologies, ICSs are threatened by new cyber-physical security risks, where the physical systems could be influenced by attacks from the cyber network. While cyber-physical security risks in ICSs have been well studied in various domains, such as power systems and smart structural systems, little attention has been paid to the cyber-physical security of thermal energy equipment. In this paper, we propose a novel cyber-physical threat against thermal energy equipment, namely the Network-Energy-Stress Threat (NEST), which reveals attacks from the cyber network could induce an inhomogeneous distribution of thermal energy, thus causing remarkable thermal stress that can induce physical damage to the thermal energy equipment. From the attacker’s perspective, we propose an inherent vulnerability-based algorithm to explore the threat space of potential attack strategies and find an approximately optimal attack strategy utilizing the nonlinear NEST model. Then, we propose a cyber-physical defense method to detect anomalous states stemming from the NEST. Experimental results on a simulated Solar Power Tower (SPT) plant have validated the existence of the NEST against thermal energy equipment and demonstrated the effectiveness of the proposed algorithm and the proposed detector. Note to Practitioners— This paper is motivated by the practical threat of physical damage to Industrial Control Systems (ICSs) caused by cyber-physical attacks. While cyber-physical security risks in ICSs have been well studied across plenty of types of ICS and physical infrastructures, there is a lack of a framework to describe cyber-physical threats to thermal energy equipment. To address this issue, we propose the Network-Energy-Stress Threat (NEST) to reveal how cyber attacks can induce abnormal thermal stress, causing physical damage to thermal energy equipment—a critical component widely deployed in ICSs. The existence of the NEST has been demonstrated through experimental results on a simulated Solar Power Tower (SPT) plant.

In the security operation center, false positive alerts generated by security devices overwhelm security operators, leading to alert fatigue and inefficiency in identifying real threats. This paper introduces DEEPDRAC, a disposition recommendation method for alert clusters that is based on security event patterns. Our main idea is to reconstruct isolated alerts into security events and capture their essential threat characteristics as patterns. By recommending pattern information, we enable batch interpretable disposal of alerts. First, DEEPDRAC aggregates correlated alerts to a graph, representing a security event. Then, it extracts the features of the security event from two aspects: basic features via statistical methods and detailed features via a carefully designed Graph Neural Network (GNN) that focuses on edge features. Since many false alerts triggered by the same cause often recur in a fixed pattern, DEEPDRAC translates basic features into interpretable descriptors to define the basic pattern, whereas GNN embeddings complement detailed semantic information, serving as the detailed pattern, together forming the pattern of the security event. The pattern describes the critical information of the security event, so security events with the same pattern are clustered for batch processing. Finally, with few manually labeled security events, DEEPDRAC can conduct automatic disposition recommendations for newly arrived alerts, significantly reducing the workload of alert analysis. We evaluate our approach on two benchmark datasets (i.e., DARPA 1999 and CIC-IDS2017) and a real-world dataset from a large power company. The extensive experimental results demonstrate that our approach can alleviate alert fatigue more efficiently and accurately than the two state-of-the-art defense approaches can.

Over the past two decades, frequent blackouts have highlighted the critical importance of ensuring the security of power grid. The integration of cyber and physical domains through intelligent devices has increased the risk of asynchronous attacks that can trigger cascading failures. One effective approach to mitigating this threat is to identify vulnerable sequences, which are sequences of transmission lines that can cause large-scale failures in the power grid. This article proposes an event-triggered hybrid system model to characterize the generation and propagation mechanism of sequential cascading failures. In addition, the problem of identifying vulnerable sequences is formulated as a Markov decision process. To solve the sequential decision problem in approximately contiguous states, a vulnerable sequence identification method based on reinforcement learning is designed. Furthermore, a topological feature embedding algorithm based on matrix decomposition is proposed to improve identification performance. To evaluate the effectiveness of the proposed method, various numerical experiments are conducted on IEEE 30-bus and ACTIVSg 200-bus systems. The results of these experiments demonstrate the excellent performance of the proposed method.

Consensus-based distributed economic dispatch (ED) algorithms are promising solutions to the smart grid ED problem. However, distributed algorithms necessitate data sharing among system nodes, potentially compromising node privacy. This study proposes a privacy-preserving method based on state decomposition. By introducing random noises, the shared data of a node is decomposed into several parts, and each neighbor of the node receives only a random subset of the original data, thereby increasing the difficulty of inferring the node’s privacy from its shared data. It is theoretically proved that the method can preserve privacy without compromising the algorithm optimality. Compared to existing works, the method simultaneously achieves privacy preservation, optimality, low cost, and does not require extra communication. Moreover, the method is developed in a challenging scenario, where adversaries know the connection weights between each pair of nodes, ensuring no privacy is disclosed even if weight information is leaked. The effectiveness is validated on the IEEE 57-bus and IEEE 300-bus systems through comparisons with existing privacy-preserving methods.

In industrial control systems, terminal devices in fieldbus networks are vulnerable to physical intrusion attacks, where attackers can directly install external intrusion devices. Currently, the localization capabilities of existing methods for intrusion devices are limited. As the reflection signals in transmitted signals are imperceptible and difficult to extract, many methods focus on actively transmitting pulse signals to locate intrusion devices. In this article, we enhance the reflection signals in transmitted signals by parallel connection of an appropriate resistor with the gateway and propose a localization method based on the collaboration of multiple devices' reflection signals. This method can significantly improve localization precision while reducing the sampling rate and does not occupy communication bandwidth. Experimental results on a real-world controller area network testbed demonstrate that our method can achieve a localization precision of 5 cm when locating intrusion devices under a sampling rate of 50 MS/s.

Recent studies have proposed moving target defense (MTD) to detect false data injection (FDI) attacks in power grids. To hide the activation of MTD from attackers, a hidden MTD (HMTD) has been proposed, which keeps the system power flow after MTD unchanged. It has been proved that HMTD cannot detect all FDI attacks because of its stealthiness requirements. However, the mathematical mechanism of MTD's stealthiness has yet to be revealed. The maximum detection capability of HMTD is also unclear. To address the abovementioned issues, we first analyze the maximum detection capability of HMTD based on graph theory and propose the topological condition to achieve it. Moreover, we study the essential characteristics of HMTD and find that all HMTD schemes are in a space spanned by branch parameters. We further propose a multistage HMTD (MHMTD) method to select multiple HMTD schemes in this space to maximize the detection capability. Experiments show that the MHMTD can maximize the detection capability of HMTD in all test systems with high stealthy probability.

Recent advances in deep learning have greatly facilitated the automated segmentation of ultrasound images, which is essential for nodule morphological analysis. Nevertheless, most existing methods depend on extensive and precise annotations by domain experts, which are labor-intensive and time-consuming. In this study, we suggest using simple aspect ratio annotations directly from ultrasound clinical diagnoses for automated nodule segmentation. Especially, an asymmetric learning framework is developed by extending the aspect ratio annotations with two types of pseudo labels, i.e., conservative labels and radical labels, to train two asymmetric segmentation networks simultaneously. Subsequently, a conservative-radical-balance strategy (CRBS) strategy is proposed to complementally combine radical and conservative labels. An inconsistency-aware dynamically mixed pseudo-labels supervision (IDMPS) module is introduced to address the challenges of over-segmentation and under-segmentation caused by the two types of labels. To further leverage the spatial prior knowledge provided by clinical annotations, we also present a novel loss function namely the clinical anatomy prior loss. Extensive experiments on two clinically collected ultrasound datasets (thyroid and breast) demonstrate the superior performance of our proposed method, which can achieve comparable and even better performance than fully supervised methods using ground truth annotations.

The rapid development of distributed control technologies has made Fieldbus networks widely used in industrial control systems (ICSs). Meanwhile, the weak security protection of Fieldbus networks exposes potential attack paths for attackers. Attackers can tap covert and unauthorized external devices (i.e., intrusion devices) into the network to launch attacks. As the intrusion device can remain silent when eavesdropping, there is no detectable abnormal traffic in the network to detect the intrusion device. In this paper, we analytically prove that the observed signals sent from any benign device will inevitably change when the intrusion device is tapped into the Fieldbus network. With this knowledge, we construct the channel-state group fingerprint from the communication signals of each benign device and propose a collaborative intrusion detection mechanism for physical access, PhyCID, to passively detect the covert intrusion device. Detection results on a real power distribution cabinet, an RS485 bus testbed, and a controller area network (CAN) bus testbed indicate that PhyCID is purely passive, environmentally adaptive, and protocol-independent in most Fieldbus networks, including RS485 and CAN. Furthermore, extensive experiments under different scenarios demonstrate the effectiveness and robustness of PhyCID.

Consensus-based distributed energy management (DEM) algorithm is a promising approach to manage distributed energy resources in microgrids. However, it introduces new risks of cyber-attacks to microgrids. This article proposes a new data integrity attack against consensus-based DEM algorithm, which enables the attacker to manipulate the power scheduling result of the attacked node and ultimately compromise its economic benefits. Specifically, we design a method to infer the privacy data of the attacked node from its broadcast information, and then use the inferred privacy data to design the false data that can manipulate the power scheduling result of the attacked node. The proposed method includes an analysis of the relationship between the difficulty of launching such an attack and the system topology, some findings contribute to designing a more secure communication topology. The attack offers higher stealthiness as it does not break power balance and the consistency of consensus variables, its effectiveness is verified on a 16-node microgird.

In recent studies, moving target defense (MTD) has been applied to detect false data injection (FDI) attacks using distributed flexible ac transmission system (D-FACTS) devices. However, the inherent conflict between the security goals of MTD (i.e., detecting FDI attacks) and the economic goals of D-FACTS devices (i.e., reducing power losses) would impede the application of MTD in real systems. Moreover, the detection capabilities of existing MTDs are often insufficient. This article proposes a multistage MTD (MMTD) approach to resolve these two issues by adding a group of designed security-oriented schemes before D-FACTS’ economy-oriented scheme to detect FDI attacks. We keep these security-oriented schemes for a very short time interval and then revert to the economy-oriented scheme for the remaining time to ensure the economic requirements. We prove that a designed MMTD can significantly improve the detection capability compared to existing one-stage MTDs. We find the supremum of MMTD’s detection capability and study its relationship with system topology and D-FACTS deployment. Meanwhile, a greedy algorithm is proposed to search the MMTD strategy to reach this supremum. Simulation results show that the proposed MMTD can achieve the supremum against FDI attacks while outperforming current MTD strategies on economic indicators.

It is hard to conduct cyberattacks in industrial control systems (ICSs) because most underlying networks of ICS like the field bus network are isolated from the internet. However, attackers can physically connect the intrusive device into the target network to launch various attacks, which bypasses the security protection mechanisms between the ICS and the internet. Currently, no effective measures could defend against such unauthorized physical access attacks. In this article, a reflection-based channel fingerprint is proposed to detect and locate these physically intrusive devices in the field bus network. We theoretically analyze the signal reflection characteristics and utilize inevitable changes in the channel fingerprint to detect the intrusive device. Besides, the detected anomaly features could be used to accurately estimate the intrusive device's location. In the end, the proposed method's effectiveness is validated through extensive simulation experiments.

The development of Industrial Internet of Things has made industrial control systems more vulnerable to cyber attacks. Many defense measures have been proposed to prevent attacks in upper IP-based networks. However, the security of underlying field bus networks has not received enough attention. Adversaries could tap intrusive devices into the field bus network via unauthorized physical access. As adversaries’ behaviors could be highly concealed when they are eavesdropping or camouflaging, it is challenging and costly to identify these inactive intrusive devices through the network traffic. However, inevitable changes in channel state caused by intrusive devices could be leveraged to detect unauthorized physical access. This article theoretically proves that the transmitted signal’s voltage amplitude would vary after tapping intrusive devices into the field bus network. Leveraging the signal’s variation, we propose an unauthorized physical access detection method via fingerprinting the channel state. Specifically, we adopt weak signal processing technologies to recover the signal’s weak variation and extract its features for detection. The effectiveness of the proposed detection method is validated based on a real testbed. Moreover, simulation experiments with diverse settings demonstrate that the proposed detection method could successfully detect intrusive devices under different scenarios.

Concurrent programs with multiple threads executing in parallel are widely used to unleash the power of multicore computing systems. Owing to their complexity, a lot of research focuses on testing and debugging concurrent programs. Besides correctness, we find that security can also be compromised by concurrency. In this article, we present concurrent program spectre (ConcSpectre), a new security threat that hides malware in nondeterministic thread interleavings. To demonstrate such threat, we have developed a stealth malware technique called concurrent logic bomb by partitioning a piece of malicious code and injecting its components separately into a concurrent program. The malicious behavior can be triggered by certain thread interleavings that rarely happen (e.g.,$< $1%) under a normal execution environment. However, with a new technique called controllable probabilistic activation, we can activate such ConcSpectre malware with a very high probability (e.g.,$>$90%) by remotely disturbing thread scheduling. In the evaluation, more than 1000 ConcSpectre samples are generated, which bypassed most of the antivirus engines in VirusTotal and four well-known online dynamic malware analysis systems. We also demonstrate how to remotely trigger a ConcSpectre sample on a web server and control its activation probability. Our work shows an urgent need for new malware analysis methods for concurrent programs.

With the development of demand response technologies, the pricing scheme in smart grids is moving from flat pricing to multiple pricing (MP), which facilitates the energy saving at the consumer side. However, the flexible pricing policy may be exploited for the stealthy reduction of utility bills. In this paper, we present a hidden electricity theft (HET) attack by exploiting the emerging MP scheme. The basic idea is that attackers can tamper with smart meters to cheat the utility that some electricity is consumed under a lower price. To construct the HET attack, we propose an optimization problem aiming at maximizing the attack profits while evading current detection methods, and design two algorithms to conduct the attack on smart meters. Moreover, we disclose and exploit several new vulnerabilities of smart meters to demonstrate the feasibility of HET attacks. To protect smart grids against HET attacks, we propose several defense and detection countermeasures, including selective protection on smart meters, limiting the attack cycle, and updating the billing mechanism. Extensive experiments on a real data set demonstrate that the attack could cause high economic losses, and the proposed countermeasures could effectively mitigate the attack's impact at a low cost.

Numerous smart devices are deployed in smart grid for state measurement, decision-making and remote control. The security issues of smart devices attract more and more attention. In our work, the communication protocol, storage mechanism and authentication of smart devices are analyzed and a toolbox is developed to evaluate the security risks of smart devices. In this demo, our toolbox is applied to scan 3 smart meters/power monitor systems. A potential risk list is generated and the vulnerabilities are further verified.