Recent work proposed to improve the security of CPSs by authenticating the CPS devices through the device operation times in the response packets from the devices, due to the strong correlation between the timing fingerprints and the physics of the devices. Although such a technique may be effective in defending against naive attackers, an advanced attacker may monitor the operation of the CPS before launching a device physics aware mimicry attack. In this paper, we show how the spoofed response packets can be crafted by an attacker to deceive the CPS device authentication method based on the device operation times. Specifically, we use the timing and physical measurements embedded in the packets to reconstruct the devices in the physical system, which can be used to spoof response packets corresponding to the actual model and configuration of the devices in the CPS. We demonstrate the performance of our technique in realistic testbeds with real devices. Finally, we propose an upgraded defense mechanism that may be used against such mimicry attacks.

Programmable logic controllers (PLCs) make up the majority of endpoints on industrial control system (ICS) networks and are the vital bridge between the cyber and physical worlds. Although these devices are critical, they are often insecure by design: communicating over unauthenticated protocols, failing to provide standard password protection, and using trivially spoofed checksums for detecting program changes instead of cryptographic hashes. Furthermore, extreme resource limitations, long life cycles, and strict downtime requirements make it difficult to patch existing devices in the field and virtually impossible to install any kind of endpoint protection. While these limitations have traditionally been considered a security weakness, they may also be leveraged for change and anomaly detection. Specifically, this research proposes to leverage these resource limitations for continuous behavior anomaly detection for the PLCs themselves, using program execution times to detect single-instruction changes to control programs from both the network and local access. The basic techniques are extended to include white box modeling for estimating rare execution behavior from source code, and proof-of-work functions are utilized to increase the techniques' resiliency against mimicry attacks.

The future electrical grid, i.e., smart grid, is envisioned to use appliance-level control to provide sustainable power usage and flexible energy utilization. However, load trace monitoring for appliance-level control poses privacy concerns given that private behaviors can be inferred by electricity utilization levels. In this paper, we introduce a privacy-preserving and fine-grained power load data analysis mechanism Di-PriDA for appliance-level peak-time load balancing control in the smart grid. Di-PriDA achieved 3ε-differential privacy, which provided indistinguishable application power consumption data to protect against eavesdroppers. The proposed technique explores a new differential privacy problem: the distributed top-k problem without a trusted third party, and provides both rigorous provable privacy and an accuracy guarantee based on distributed differential privacy. We implement a prototype of Di-PriDA on an external microcontroller device used for smart meters, and evaluate its performance under two real-world power usage datasets, as well as a synthetic dataset through a combination of experiments and simulations. We find that Di-PriDA effectively achieves confidentiality for the appliance-level peak-time load balancing control while guaranteeing a good quality-of-service to the various stakeholders of the power grid.

Historically, robotics systems have not been built with an emphasis on security. Their main purpose has been to complete a specific objective, such as to deliver the correct dosage of a drug to a patient, perform a swarm algorithm, or safely and autonomously drive humans from point A to point B. As more and more robotic systems become remotely accessible through networks, such as the Internet, they are more vulnerable to various attackers than ever before. To investigate remote attacks on networked robotic systems we have leveraged HoneyPhy, a physics-aware honeypot framework, to create the HoneyBot. The HoneyBot is the first software hybrid interaction honeypot specifically designed for networked robotic systems. By simulating unsafe actions and physically performing safe actions on the HoneyBot we seek to fool attackers into believing their exploits are successful, while logging all the communication to be used for attacker attribution and threat model creation. In this paper, we present the HoneyBot and discuss our proof of concept implementation. Our HoneyBot prototype swaps between physical actuation and using prebuilt models of sensor behavior for simulation at runtime given user input commands.

The future electrical grid, i.e., smart grid, will utilize appliance-level control to provide sustainable power usage and flexible energy utilization. However, load trace monitoring for appliance-level control poses privacy concerns with inferring private information. In this paper, we introduce a privacy-preserving and fine-grained power load data analysis mechanism for appliance-level peak-time load balance control in the smart grid. The proposed technique provides rigorous provable privacy and an accuracy guarantee based on distributed differential privacy. We simulate the scheme as privacy modules in the smart meter and the concentrator, and evaluate its performance under a real-world power usage dataset, which validates the efficiency and accuracy of the proposed scheme.