Many services that make our modern society work, such as communications and transportation, are only possible thanks to Cyber-Physical Systems (CPS).This makes CPS the target of cyberattacks that aim to disrupt our society.One tool that we can leverage to protect CPS is Cyber Threat Intelligence (CTI).CTI is threat information that helps us understand a threat actor's techniques.However, current CTI on CPS is limited as current methods cannot collect and analyze data on the latest cyberattacks against CPS.In this dissertation research description, we address this problem by developing three new methods that advance the state-of-the-art CTI of three different CPS: Industrial Control Systems (ICS), Satellites, and Connected Autonomous Vehicles (CAV).The first research project involves the development of a novel threat taxonomy for programmable logic controllers (PLCs), which are a key part of ICS.The second project is the development of a satellite honeypot to collect data on adversaries' techniques.The third and final project involves the development of a CAV sandbox that allows us to test cyberattacks on CAVs to collect raw threat intelligence.Our preliminary results include a novel ICS threat matrix and a high-interaction satellite honeypot in the literature, which pushes the state of the art of CTI for CPS forward.

Industrial Control Systems (ICS) provide management and control capabilities for mission-critical utilities such as the nuclear, power, water, and transportation grids. Within ICS, Programmable Logic Controllers (PLCs) play a key role as they serve as a convenient bridge between the cyber and the physical worlds, e.g., controlling centrifuge machines in nuclear power plants. The critical roles that ICS and PLCs play have made them the target of sophisticated cyberattacks that are designed to disrupt their operation, which creates both social unrest and financial losses. In this context, honeypots have been shown to be highly valuable tools for collecting real data, e.g., malware payload, to better understand the many different methods and strategies that attackers use. However, existing state-of-the-art honeypots for PLCs lack sophisticated service simulations that are required to obtain valuable data. Worse, they cannot adapt while ICS malware keeps evolving, and attack patterns become more sophisticated. To overcome these shortcomings, we present HoneyPLC, a high-interaction, extensible, and malware collecting honeypot supporting a broad spectrum of PLCs models and vendors. Results from our experiments show that HoneyPLC exhibits a high level of camouflaging: it is identified as real devices by multiple widely used reconnaissance tools, including Nmap, Shodan's Honeyscore, the Siemens Step7 Manager, PLCinject, and PLCScan, with a high level of confidence. We deployed HoneyPLC on Amazon AWS and recorded a large amount of interesting interactions over the Internet, showing not only that attackers are in fact targeting ICS systems, but also that HoneyPLC can effectively engage and deceive them while collecting data samples for future analysis.