Abstract As the threat of cyber attacks increases, the cyber security sector continues to train professionals as one form of mitigation. Gamification and infrastructure like cyber ranges (CRs) have been proven useful in training cyber security specialists to detect and react to cyber-attacks in information technology. However, a subset of all digital threats target cyber-physical systems (CPS), not just information systems, and these threats have been growing rapidly in recent years. While those threats are increasing, training specific to cyber-physical threats is not growing as quickly as information technology training solutions. While CRs are useful for training and supporting events like cyber defence exercises and capture the flags events, limitations to CRs make it more difficult to make an immersive event for cyber-physical training. This paper demonstrates how to devise a cyber-physical training environment using a combination of CRs and CPS testbeds,and how to devise an accompanying immersive scenario to improve cyber-physical security skills through cooperative learning. To do this, an example training was created and implemented. This paper concludes with the results of running this event four times.

With the exponential rise of internet-connected devices, the number of Internet of Things (IoT) devices has surpassed that of traditional IT devices. This proliferation in IoT adoption can be attributed to the growing demand for manufacturing automation and the desire for enhanced quality of life, leading to the production of smart devices in various industries. However, this rapid adoption has caught the attention of malicious actors, resulting in a significant increase in cyber-attacks targeting IoT devices. In response to this emerging threat landscape, research on IoT security has been active. Nevertheless, the lack of commercial tools specifically designed for IoT device security raises concerns about the ability of security research and adoption to keep pace with the rising number of malicious actors. To address this gap, this study focuses on introducing a novel mechanism for detecting malware in IoT devices. By conducting experiments, we demonstrate that using Hardware Performance Counters (HPCs), complemented by physical features such as power consumption, can improve the current malware detection capabilities. Specifically, we employ Recurrent Neural Networks (RNN) and Multi-Layer Perception Neural Networks (MLP) to achieve a remarkable detection accuracy of 95% within a timeframe of less than 10 seconds from infection.

The notion that ships, marine vessels and off-shore structures are digitally isolated is quickly disappearing. Affordable and accessible wireless communication technologies (e.g., short-range radio, long-range satellite) are quickly removing any air-gaps these entities have. Commercial, defence, and personal ships have a wide range of communication systems to choose from, yet some can weaken the overall ship security. One of the most significant information technologies (IT) being used today is satellite-based communications. While the backbone of this technology is often secure, third-party devices may introduce vulnerabilities. Within maritime industries, the market for satellite communication devices has also grown significantly, with a wide range of products available. With these devices and services, marine cyber-physical systems are now more interconnected than ever. However, some of these off-the-shelf products can be more insecure than others and, as shown here, can decrease the security of the overall maritime network and other connected devices. This paper examines the vulnerability of an existing, off-the-shelf product, how a novel attack-chain can compromise the device, how that introduces vulnerabilities to the wider network, and then proposes solutions to the found vulnerabilities.

In this paper, we present extensive advances in live-fly field experimentation capabilities of large numbers of fixed-wing aerial robots, and highlight both the enabling technologies as well as the challenges addressed in such largescale flight operations. We showcase results from recent field tests, including the autonomous launch, flight, and landing of 50 UAVs, which illuminate numerous operational lessons learned and generate rich multi-UAV datasets. We detail the design and open architecture of the testbed, which intentionally leverages low-cost and open-source components, aimed at promoting continued advances and alignment of multi-robot systems research and practice.

Phase-locking in a charge pump (CP) phase lock loop (PLL) is said to be inevitable if all possible states of the CP PLL eventually converge to the equilibrium where the input and output phases are in lock. We verify this property for a CP PLL using a mixed deductive and bounded verification methodology. This involves a positivity check of polynomial inequalities (which is an NP-Hard problem) so we use the sound but incomplete Sum of Squares (SOS) relaxation algorithm to provide a numerical solution.

Phase-locking in a charge pump (CP) phase lock loop (PLL) is said to be inevitable if all possible states of the CP PLL eventually converge to the equilibrium, where the input and output phases are in lock and the node voltages vanish. We verify this property for a CP PLL using deductive verification. We split this complex property into two sub-properties defined in two disjoint subsets of the state space. We deductively verify the first property using multiple Lyapunov certificates for hybrid systems, and use the Escape certificate for the verification of the second property. Construction of deductive certificates involves positivity check of polynomial inequalities (which is an NP-Hard problem), so we use the sound but incomplete Sum of Squares (SOS) relaxation algorithm to provide a numerical solution.

We present a novel mixed time and frequency domain approach to the formal verification of oscillators properties which are specified in the frequency domain. We use robust periodogram specification to specify the oscillator behaviour in the close vicinity of the limit cycle. Using SAT modulo ODE (SMO) for Bounded Model Checking (BMC) of the non-linear hybrid automata, we show that the oscillator hybrid timed traces satisfy frequency domain specifications.

We are interested in the multiple robot surveillance problem where robots must allocate waypoints to be visited among themselves and plan paths through different waypoints while avoiding obstacles. Furthermore, the robots are allocated specific times to reach their respective goal locations and as a result they have to decide which robots have to visit which waypoints. Such a problem has the challenge of computing the allocation of waypoints across robots, ordering for these waypoints and dynamical feasibility of the paths between waypoints. We present an algorithm that runs a series of graph searches to solve the problem and provide theoretical analysis that our approach yields an optimal solution. We present simulated results as well as experiments on two UAVs that validate the capability of our algorithm. For a single robot, we can solve instances having 10–15 waypoints and for multiple robots, instances having five robots and 10 waypoints can be solved.

This paper describes a noise-based method of estimating the effects of device random mismatch on circuit's transient response, such as delay and frequency. The proposed method models DC mismatch as equivalent AC pseudo-noise and exploits the fast periodic noise analysis (PNOISE) available in RF circuit simulators to compute the resulting variation in the circuit response. While the method relies on Gaussian mismatch distributions and linear perturbation model, it can model and analyze correlations as well as identify the most sensitive design parameter to mismatches with no additional simulation cost. Three benchmarks measuring the variations in the input offset voltage of a comparator, the delay of a logic path, and the frequency of an oscillator demonstrate the speed improvement of 100--1000x compared to a 1000-point Monte-Carlo method.

This paper describes a method to perform linear AC analysis on mixed-signal systems which appear strongly nonlinear in the voltage domain but are linear in other variable domains. Common circuits like phase/delay-locked loops and duty-cycle correctors fall into this category, since they are designed to be linear with respect to phases, delays, and duty-cycles of the input and output clocks, respectively. The method uses variable domain translators to change the variables to which the AC perturbation is applied and from which the AC response is measured. By utilizing the efficient periodic AC (PAC) analysis available in commercial RF simulators, the circuit's linear transfer function in the desired variable domain can be characterized without relying on extensive transient simulations. Furthermore, the variable domain translators enable the circuits to be macromodeled as weakly-nonlinear systems in the chosen domain and then converted to voltage-domain models, instead of being modeled as strongly-nonlinear systems directly.