Cyber-Physical | Kalyan Perumalla

CYVET

Sat, 01 Jan 2022 00:00:00 +0000

Our new Cyber-Physical Security Assurance Framework based on Semi-Supervised Vetting applies the latest AI/ML and NLP technologies on hardware testbeds to advance the resilience of critical cyber-physical assets including electric grids and gas pipelines.

CYVET Pipeline

Overview

Organization

Sponsor: US Department of Energy (DOE)
- Office: Cybersecurity, Energy Security, and Emergency Response (CESER)
- Program: Cybersecurity for Energy Delivery Systems (CEDS)
- Award: CESER
Prime: Oak Ridge National Laboratory (ORNL)
- Subcontract: University of Nebraska-Lincoln (UNL)
Period: 2019-2023

Gallery

OSTI.gov: https://www.osti.gov/servlets/purl/1661247

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

We introduce CyBERT, a cybersecurity feature claims classifier based on bidirectional encoder representations from transformers and a key component in our semi-automated cybersecurity vetting for industrial control systems (ICS)…The results showed that CyBERT outperforms these models on the validation accuracy and the F1 score, validating CyBERT’s robustness and accuracy as a cybersecurity feature claims classifier.

Kimia Ameri, Michael Hempel, Hamid Sharif, Juan Lopez, Kalyan Perumalla

PDF Cite DOI

Trust-but-Verify in Cyber-Physical Systems

Cyber-physical systems span a wide spectrum, from long-lived legacy systems to more modern installations. Trust is an issue that arises across the spectrum, albeit with different variants of goals and constraints. On the one end of the spectrum, legacy systems are characterized by function-based designs in which trust is an implicitly in-built concept…

Kalyan Perumalla

PDF Cite Slides DOI

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

A solution is needed for vetting the vendor-supplied feature claims and their adherence to cybersecurity requirements and standards. We are presently engaged in an effort to develop such a system. This paper demonstrates one vital aspect of this effort in proposing an end-to-end framework to accumulate a large repository of ICS device information for this vetting system, curate the dataset, and conduct extensive processing. This framework is designed to use web scraping, data analytics and Natural Language Processing (NLP) techniques to identify vendor websites, automate the collection of website-accessible documents and automatically derive metadata from them for identification of product documents relevant to the repository…

Kimia Ameri, Michael Hempel, Hamid Sharif, Juan Lopez, Kalyan Perumalla

PDF

A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems

The cybersecurity auditing for Operation Technology is critical and has been largely missing from the cybersecurity research, especially in the energy sector. In this paper, we present a novel “cybersecurity vetting” approach (CYVET) to the problem of verification and validation of cybersecurity in complex cyber-physical installations underlying modern energy grid systems.

Kalyan Perumalla, Juan Lopez, Maksudul Alam, Olivera Kotevska, Michael Hempel, Hamid Sharif

PDF DOI

Additional Background

The cybersecurity auditing for Operation Technology (OT) is critical and has been largely missing from the cybersecurity research, especially in the energy sector. CYVET is a novel “cybersecurity vetting” approach (CYVET) to the problem of verification and validation of cybersecurity in complex cyber-physical installations underlying modern energy grid systems.

In Information Technology (IT), cybersecurity auditing is a widespread practice to ensure privacy, security, and trust. However, for the field of Operation Technology (OT) as used in electric energy systems, this is a relatively novel concept. In fact, OT itself only recently began to embrace IT principles, with the push for automation and centralized control driving this development. OT operators are simply not yet used to the idea of cybersecurity. To ameliorate the gap, product vendors for field devices are advancing the field by incorporating more and more security features into their products. However, customers are often either unaware of them, or do not use them, or cannot use them because of unsatisfied device ecosystem dependencies. There is thus a disconnect between what is offered, what is possible post-deployment, and what the customer expects.

There is a vast lack of cybersecurity oversight and insight, from a certification and a customer perspective alike, for OT systems in the energy sector. With new features constantly being added to new and existing products, customers are predominantly unaware what their purchased solutions are capable of, or not capable of. They often do not know if their current systems meet their own cybersecurity requirements as well as industry standards. Many of these facets not only indirectly depend on device capabilities, but also on device deployment decisions – Does a newly added feature work in an existing context? Can it be used as envisioned? Does it interfere with other cybersecurity requirements? Does it produce side effects that may interfere with other requirements?

Hence, what is needed is a security vetting system designed to provide insight into deployed systems, the match of capabilities to requirements, adherence to certification requirements, and so forth. There are few systems currently available that provide these energy grid security capabilities. OT systems are increasingly cyber-enabled, increasingly complex, and increasingly interdependent. This rapidly accelerating trend poses a clear risk for asset owners to lose confidence and for cybersecurity risk to go undiscovered until exploited by malicious parties.

Deep CYBERIA

Sat, 01 Jan 2022 00:00:00 +0000

Deep CYBERIA is a novel system focused on Detecting Sensors Deeply Embedded in Cyber-Physical Systems via novel machine learning and passive/active/hybrid probing techniques on complex operational technology (OT) networks.

Overview

Deep CYBERIA is designed to address the critical capability gap identified by USAF in discovering, identifying and mapping the edge devices and physical sensors connected to those edge devices. The effort is aimed at the outcome of providing situational awareness of Industrial Control Systems/Supervisory Control and Data Acquisition (ICS/SCADA) traffic and devices operating in a network. The situational awareness will support the requirement of performing deep dive filtering analysis and enumeration of ICS traffic.

Demonstration

Organization

Sponsor: US Department of Defense
Prime: Oak Ridge National Laboratory (ORNL)
- Subcontract: MIT Lincoln Laboratory (MIT-LL)
Period: 2019-2025

Gallery

Trust-but-Verify in Cyber-Physical Systems

Kalyan Perumalla

PDF Cite Slides DOI

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

In this paper, we present our research and development efforts aimed at addressing the gap in discovering sensors at level 0 in industrial CPS by building a system called Deep-cyberia (Deep Cyber-Physical System Interrogation and Analysis) that incorporates algorithms and interfaces aimed at uncovering sensors and computing estimates of correlations among them.

Kalyan Perumalla, Srikanth Yoginath, Juan Lopez

PDF Cite Slides DOI

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Our focus is to extract volatile and dynamically changing internal information form CPS 0-1 level devices, and design preliminary schemes to exploit that extracted information. As a case study, we apply the proposed methodology to Modicon PLC using Modbus protocol. We extract the memory layout and subject the device to read operations at the most critical regions of memory. This capability of generating a sequence of volatile memory snapshots for offline, detailed and sophisticated analysis opens a new class of cyber security schemes for CPS forensic analysis, taint analysis and watermarking.

Rima Asmar Awad, Juan Lopez, Michael Rogers, Kalyan Perumalla

PDF Cite

Digital Twin Framework

Sat, 01 Jan 2022 00:00:00 +0000

Our novel Digital Twin Framework (DTF) is designed to improve resilience of critical infrastructure systems by continuously comparing the infrastructure state with automatically generated, AI/ML-based, real-time digital-twin simulation of the system.

Team

Digital Twin Framework Software Architecture

Overview

As the level of automation in critical infrastructure increases, the ability to detect cyber intrusions becomes more crucial and extremely challenging. Recent cyber attacks demonstrate the devastating and widespread affects they can have on critical infrastructure.

DTF is designed specifically to detect and eventually prevent such attacks, with models validated against experimental data from two critical infrastructure experimental emulators – a canal lock system and an electric distribution system – exhibiting very different dynamics. The canal lock system’s digital twin uses a recurrent neural network trained from the experimental data collected via the DTF. A digital twin of the transmission system is created using a commercial real-time power systems simulator and integrated into our DTF along with the hardware, embedded controllers, and live sensor data using the Open Field Message Bus data model, and publish/subscribe communication protocols. A cyber attack is used on both systems to demonstrate the DTF’s detection capability.

Organization

Sponsor: Lab Directed Research and Development, Oak Ridge National Laboratory
Period: 2018-2020

Gallery

On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems

We empirically study the effectiveness of Recurrent Neural Network (RNN)-based models as the basis of DT-based resilience and uncover the important characteristics of an RNN-based solution with experimentation on a lab-scale Canal Lock CPS emulator with live validations and attack scenarios. For the first time, we demonstrate actual, real-time use of a RNN-based model as a DT for performing live analysis on an operational CPS.

Srikanth Yoginath, Varisara Tansakul, Supriya Chinthavali, Curtis Taylor, Joshua Hambrick, Philip Irminger, Kalyan Perumalla

PDF Cite DOI

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

We describe an approach to detecting and preventing cyber attacks by continuously comparing the infrastructure state with a real-time digital-twin simulation of it. Specifically, we describe and demonstrate a Digital Twin Framework (DTF) designed specifically to detect and eventually prevent such attacks. The canal lock system’s digital twin uses a recurrent neural network trained from the experimental data collected via the DTF.

Raymond Hink, Mark Buckner, Supriya Chinthavali, Chris Craig, Timothy Daniel, Joel Dawson, Milton Ericson, Joshua Hambrick, Philip Irminger, Ryan Kerekes, Juan Lopez, Kalyan Perumalla, Nicholas Peters, Stacy Prowell, Varisara Tansakul, Curtis Taylor, Bailu Xiao, Srikanth Yoginath

PDF

Kensor: Coordinated Intelligence from Co-located Sensors

Sat, 01 Jan 2022 00:00:00 +0000

Kensor uncovers coordinated intelligence about normal and abnormal phenomena from multiple sensors co-located in close proximity in secure installations.

Kensor

Overview

Given a set of co-located sensors, we seek an intelligent approach that would automatically determine the “normal” patterns of behaviors among the correlated sensors.

After normal behavior is extracted, later monitoring should detect any deviant variations over time.

An example application is an entry monitoring and alert system for facilities such as nuclear reactors, where badge readers, door locks, lights, weight trackers and other co-located sensors at the entry point are collectively tracked.

Gallery

Organization

Sponsor: Nuclear Safety
Period: 2019-2020

Kensor: Coordinated Intelligence from Co-Located Sensors

Here, we focus on coordinated intelligence about normal and abnormal phenomena from multiple sensors geographically co-located, monitoring and controlling a set of co-located devices. Given a set of co-located sensors, we develop an intelligent approach that automatically determines the ’normal’ patterns of behaviors among the correlated sensors. After normal behavior is extracted, later monitoring detects deviant variations over time.

Olivera Kotevska, Kalyan Perumalla, Juan Lopez

PDF Cite DOI

A Flexible OT Testbed for Evaluating On-Device Implementations of IEC-61850 GOOSE

Fri, 01 Sep 2023 00:00:00 +0000

Open Access:
- Journal: https://www.sciencedirect.com/science/article/pii/S1874548223000318.
- PDF: https://www.sciencedirect.com/science/article/pii/S1874548223000318/pdfft?md5=4606c01cd9fbd3efc0e6b73a074b8910&pid=1-s2.0-S1874548223000318-main.pdf.

Impact of Grammar on Language Model Comprehension

Mon, 20 Feb 2023 00:00:00 +0000

https://www.computer.org/csdl/proceedings-article/icnc/2023/10074239/1LKwLebVPGw

A Testbed for Evaluating Performance and Cybersecurity Implications of IEC-61850 GOOSE Hardware Implementations

Sun, 08 Jan 2023 00:00:00 +0000

Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid

Thu, 20 Oct 2022 00:00:00 +0000

Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems

Wed, 22 Jun 2022 00:00:00 +0000

Article is available as Open Access

An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity

Wed, 15 Jun 2022 00:00:00 +0000

Open Access: https://www.mdpi.com/2624-800X/1/4/31.

DarkNet Cyber Resilience

Tue, 22 Mar 2022 00:00:00 +0000

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

Thu, 04 Nov 2021 00:00:00 +0000

Open Access: https://www.mdpi.com/2624-800X/1/4/31.
This article belongs to the Special Issue Machine Learning and Data Analytics for Cyber Security.

On Some Confluences of Computing and Security in Theory and Practice

Fri, 21 May 2021 00:00:00 +0000

Trust-but-Verify in Cyber-Physical Systems

Wed, 28 Apr 2021 00:00:00 +0000

Trust-but-Verify in Cyber-Physical Systems

Kalyan Perumalla

PDF Cite Slides DOI

Trust-but-Verify in Cyber-Physical Systems

Wed, 28 Apr 2021 00:00:00 +0000

https://dl.acm.org/doi/abs/10.1145/3445969.3450434

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

Mon, 01 Feb 2021 00:00:00 +0000

R&D Needs for Digital Twins

Thu, 03 Dec 2020 00:00:00 +0000

A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems

Mon, 13 Jul 2020 00:00:00 +0000

https://www.osti.gov/servlets/purl/1661247

https://ieeexplore.ieee.org/abstract/document/9167562

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

Wed, 01 Jan 2020 00:00:00 +0000

Kensor: Coordinated Intelligence from Co-Located Sensors

Mon, 09 Dec 2019 00:00:00 +0000

https://ieeexplore.ieee.org/abstract/document/9006318

On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems

Mon, 11 Nov 2019 00:00:00 +0000

https://ieeexplore.ieee.org/abstract/document/9065023

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

Tue, 05 Nov 2019 00:00:00 +0000

https://ieeexplore.ieee.org/abstract/document/9032891

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Fri, 01 Nov 2019 00:00:00 +0000

https://www.osti.gov/biblio/1606814

Cyber-Physical | Kalyan Perumalla

CYVET

Overview

Organization

Gallery

Related Publications

Additional Background

Deep CYBERIA

Overview

Demonstration

Organization

Gallery

Related Publications

Digital Twin Framework

Overview

Organization

Gallery

Related Publications

Kensor: Coordinated Intelligence from Co-located Sensors

Overview

Gallery

Organization

Related Publications

A Flexible OT Testbed for Evaluating On-Device Implementations of IEC-61850 GOOSE

Impact of Grammar on Language Model Comprehension

A Testbed for Evaluating Performance and Cybersecurity Implications of IEC-61850 GOOSE Hardware Implementations

Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid

Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems

An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity

DarkNet Cyber Resilience

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

On Some Confluences of Computing and Security in Theory and Practice

Trust-but-Verify in Cyber-Physical Systems

Trust-but-Verify in Cyber-Physical Systems

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

R&D Needs for Digital Twins

A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

Kensor: Coordinated Intelligence from Co-Located Sensors

On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics