The electric power grid, as a critical national infrastructure, is under constant threat from cyber-attacks. State estimation (SE) is at the foundation of a series of critical control processes in a power transmission system. A false data injection (FDI) attack against SE can disrupt these control processes, crippling a power system and wreaking havoc in a region. With knowledge of the system topology, a cyber-attacker can formulate and execute stealthy FDI attacks that are very difficult to detect. Statistical and, more recently, machine learning approaches have been undertaken to detect FDI attacks on SE of the power grid. In this paper, we propose a Deep Learning (DL) based method to accurately detect stealthy FDI attacks on the SE of power grid. We compare the performance of the DL method with three popular machine learning algorithms, which are: gradient boosting machines (GBM), generalized linear modelings (GLM) and distributed random forests (DRF). All four algorithms analyze a dataset simulating the IEEE 14-bus system. The results demonstrate that these algorithms perform well in accurately and precisely detecting stealthy FDI attacks on the smart grid, with the DL-based approach showing best results.

Due to the characteristics and connectivity of today's Cyber-Physical Control Systems (CPCS) and critical infrastructures, cyber-attacks on these systems are currently difficult to prevent in an efficient and sustainable manner. Prevention and mitigation need accurate identification and evaluation of: system vulnerabilities, likely threats and attacks, and applicable hardening measures. Furthermore, the ability to prioritize hardening measures based on accurate assessments of threat risk and consequence and mitigation availability, applicability, and cost is also needed. To address this challenge we created HESTIA: High-level and Extensible System for Training and Infrastructure risk Assessment. In this paper, we describe the latest architecture and working principles of HESTIA. When fully developed, the HESTIA process and tool-set will enable CPCS engineers to, iteratively: 1) specify a CPCS, 2) select applicable attacks and hardening measures from a library, 3) check specifications for consistency and applicability, and 4) merge attack and hardening specifications into a new CPCS model. In addition, we add support for device specification templates. HESTIA enables the discovery of attack-defend scenarios through simulation and the design of optimal hardening strategies for a given CPCS. This paper is a shortened and updated version of a journal article entitled An architecture for HESTIA to appear in the International Journal of Internet of Things and Cyber-Assurance.

Hands-on tutorials and exercises are recognized as an effective means for gaining much needed cybersecurity and communication and information technology skills. These exercises must be performed in dedicated and virtually isolated computing environments or laboratories, most of which make use of virtualization technology. Building, modifying, and deploying the virtual environments that enable hands-on instruction is currently very time consuming. A new complete exercise instance must be deployed and configured for each course or module, tutorial or exercise, and student. In addition, efficient sharing and reuse of hands-on exercises between organizations is currently extremely difficult, unless the computing resources and virtualization environment are also shared. ADLES is a specification language and associated deployment system created to address these issues up-front. ADLES enables: (1) the formal specification of hands-on virtual computing, networking, and cybersecurity exercises, (2) the automated deployment of specified exercises, and (3) the efficient sharing of such exercises and their computing environment. In this article, we describe in detail the ADLES specification language and deployment system. We also demonstrate ADLES capabilities using two case studies: a pentesting tutorial and a cyber defense competition. The ADLES system is open source and available for all educators to use and improve.

Cyber-attacks and intrusions in cyber-physical control systems are, currently, difficult to reliably prevent. Knowing a system's vulnerabilities and implementing static mitigations is not enough, since threats are advancing faster than the pace at which static cyber solutions can counteract. Accordingly, the practice of cybersecurity needs to ensure that intrusion and compromise do not result in system or environment damage or loss. In a previous paper [2], we described the Cyberspace Security Econometrics System (CSES), which is a stakeholder-aware and economics-based risk assessment method for cybersecurity. CSES allows an analyst to assess a system in terms of estimated loss resulting from security breakdowns. In this paper, we describe two new related contributions: 1) We map the Cyberspace Security Econometrics System (CSES) method to the evaluation and mitigation steps described by the NIST Guide to Industrial Control Systems (ICS) Security, Special Publication 800-82r2. Hence, presenting an economics-based and stakeholder-aware risk evaluation method for the implementation of the NIST-SP-800-82 guide; and 2) We describe the application of this tailored method through the use of a fictitious example of a critical infrastructure system of an electric and gas utility.

Unforeseen safety and security failures in complex software-intensive systems arise due to hidden dependencies between system components and artifacts. These stem from stakeholder misunderstanding of system artifact and component interactions. In most systems, artifacts are defined and described, and components are designed, implemented, and combined by engineers in multiple disciplines. Also, artifacts are described in places separated by hundreds of pages or files and in different domain and description languages, including natural, graphical, and domain-specific languages. Hence, it is of primary importance, but also currently extremely difficult, to discover these hidden dependencies. To help engineers find these dependencies, and hence better foresee erroneous interactions, an approach that enables and promotes a holistic, hierarchical, and incremental description of a system is needed. In this article, we introduce EXMPLRAD. EXMPLRAD is a human-centered language that enables the description and integration of informal and formal requirements, architectural and design descriptions, source code, and configuration artifacts, and their relationships in a format that resembles code. A holistic system model described using EXMPLRAD enables the creation and application of methods for the automatic discovery of hidden dependencies. We demonstrate this with a case study that analyzes the seL4 microkernel's Inter- Process Communication subsystem including the modeling of its requirements, architecture, and source code in C.

Critical and catastrophic failures in high assurance and critical computing systems can arise from unfounded assumptions of independence between system components, requirements, and constraints (work product sections), which can stem from misunderstandings and miscommunication between system engineers, managers, and operators and from inadequate or incomplete traceability between system work products. In this article, we propose a formal framework for the effective implementation of traceability between work product sections along with a technique for discovering potential causes of critical failures in high assurance and critical computing system models. We introduce a new abstraction of interrelated work product sections called implementation meta-work product and describe how our technique finds these meta-work products. We also demonstrate how this technique can be used to help analysts discover potential causes of safety-related errors in high assurance and critical computing systems by applying it to one case study of a known critical error and to one case study where we anticipate potential safety hazards.