Cybersecurity | Kalyan Perumalla

DarkNet Cyber Resilience

Tue, 22 Mar 2022 00:00:00 +0000

DarkNet Cyber Resilience investigates the impacts of cyber stress and its thresholds of impact on alternative timing signals for the US national energy grid.

Cyber Resilience of Alternative Timing for Energy Grids

Overview

This project is focused on performing a systematic evaluation of the impacts of cyber stress on the system. It is developing tools that enable early detection of performance issues and rapid recovery from cyber-related events. A unique advancement of the project lies in going beyond general cybersecurity vulnerabilities and exposures (CVE). This is achieved by evaluating their implications to the cyber resilience specifically with regard to precise effects on the transmission and receipt of timing signals over the complex networks connecting the timing sources to the geographically-distant subscribers.

Key Links

DarkNet Website

Gallery

Organization

Sponsor: US Department of Energy (DOE)
- Office: Office of Electricity (OE)
- Program: DarkNet
Prime: Oak Ridge National Laboratory (ORNL)

Selected Publications

DarkNet Cyber Resilience

Two key cyber elements affecting the grid’s timing capability are Cyber Resilience and Cyber Trust. The timing services of DarkNet are systematically subjected to a range of cyber phenomena that stress four key performance factors, namely: Accuracy, Manageability, Telemetry, and Visibility. This analysis is designed to provide insights into four important categories of undesirable cyber phenomena: Loss of View (LoV), Loss of Control (LoC), Manipulation of View (MoV), and Manipulation of Control (MoC).

Kalyan Perumalla, Juan Lopez

PDF

CYVET

Sat, 01 Jan 2022 00:00:00 +0000

Our new Cyber-Physical Security Assurance Framework based on Semi-Supervised Vetting applies the latest AI/ML and NLP technologies on hardware testbeds to advance the resilience of critical cyber-physical assets including electric grids and gas pipelines.

CYVET Pipeline

Overview

Organization

Sponsor: US Department of Energy (DOE)
- Office: Cybersecurity, Energy Security, and Emergency Response (CESER)
- Program: Cybersecurity for Energy Delivery Systems (CEDS)
- Award: CESER
Prime: Oak Ridge National Laboratory (ORNL)
- Subcontract: University of Nebraska-Lincoln (UNL)
Period: 2019-2023

Gallery

OSTI.gov: https://www.osti.gov/servlets/purl/1661247

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

We introduce CyBERT, a cybersecurity feature claims classifier based on bidirectional encoder representations from transformers and a key component in our semi-automated cybersecurity vetting for industrial control systems (ICS)…The results showed that CyBERT outperforms these models on the validation accuracy and the F1 score, validating CyBERT’s robustness and accuracy as a cybersecurity feature claims classifier.

Kimia Ameri, Michael Hempel, Hamid Sharif, Juan Lopez, Kalyan Perumalla

PDF Cite DOI

Trust-but-Verify in Cyber-Physical Systems

Cyber-physical systems span a wide spectrum, from long-lived legacy systems to more modern installations. Trust is an issue that arises across the spectrum, albeit with different variants of goals and constraints. On the one end of the spectrum, legacy systems are characterized by function-based designs in which trust is an implicitly in-built concept…

Kalyan Perumalla

PDF Cite Slides DOI

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

A solution is needed for vetting the vendor-supplied feature claims and their adherence to cybersecurity requirements and standards. We are presently engaged in an effort to develop such a system. This paper demonstrates one vital aspect of this effort in proposing an end-to-end framework to accumulate a large repository of ICS device information for this vetting system, curate the dataset, and conduct extensive processing. This framework is designed to use web scraping, data analytics and Natural Language Processing (NLP) techniques to identify vendor websites, automate the collection of website-accessible documents and automatically derive metadata from them for identification of product documents relevant to the repository…

Kimia Ameri, Michael Hempel, Hamid Sharif, Juan Lopez, Kalyan Perumalla

PDF

A Novel Vetting Approach to Cybersecurity Verification in Energy Grid Systems

The cybersecurity auditing for Operation Technology is critical and has been largely missing from the cybersecurity research, especially in the energy sector. In this paper, we present a novel “cybersecurity vetting” approach (CYVET) to the problem of verification and validation of cybersecurity in complex cyber-physical installations underlying modern energy grid systems.

Kalyan Perumalla, Juan Lopez, Maksudul Alam, Olivera Kotevska, Michael Hempel, Hamid Sharif

PDF DOI

Additional Background

The cybersecurity auditing for Operation Technology (OT) is critical and has been largely missing from the cybersecurity research, especially in the energy sector. CYVET is a novel “cybersecurity vetting” approach (CYVET) to the problem of verification and validation of cybersecurity in complex cyber-physical installations underlying modern energy grid systems.

In Information Technology (IT), cybersecurity auditing is a widespread practice to ensure privacy, security, and trust. However, for the field of Operation Technology (OT) as used in electric energy systems, this is a relatively novel concept. In fact, OT itself only recently began to embrace IT principles, with the push for automation and centralized control driving this development. OT operators are simply not yet used to the idea of cybersecurity. To ameliorate the gap, product vendors for field devices are advancing the field by incorporating more and more security features into their products. However, customers are often either unaware of them, or do not use them, or cannot use them because of unsatisfied device ecosystem dependencies. There is thus a disconnect between what is offered, what is possible post-deployment, and what the customer expects.

There is a vast lack of cybersecurity oversight and insight, from a certification and a customer perspective alike, for OT systems in the energy sector. With new features constantly being added to new and existing products, customers are predominantly unaware what their purchased solutions are capable of, or not capable of. They often do not know if their current systems meet their own cybersecurity requirements as well as industry standards. Many of these facets not only indirectly depend on device capabilities, but also on device deployment decisions – Does a newly added feature work in an existing context? Can it be used as envisioned? Does it interfere with other cybersecurity requirements? Does it produce side effects that may interfere with other requirements?

Hence, what is needed is a security vetting system designed to provide insight into deployed systems, the match of capabilities to requirements, adherence to certification requirements, and so forth. There are few systems currently available that provide these energy grid security capabilities. OT systems are increasingly cyber-enabled, increasingly complex, and increasingly interdependent. This rapidly accelerating trend poses a clear risk for asset owners to lose confidence and for cybersecurity risk to go undiscovered until exploited by malicious parties.

Deep CYBERIA

Sat, 01 Jan 2022 00:00:00 +0000

Deep CYBERIA is a novel system focused on Detecting Sensors Deeply Embedded in Cyber-Physical Systems via novel machine learning and passive/active/hybrid probing techniques on complex operational technology (OT) networks.

Overview

Deep CYBERIA is designed to address the critical capability gap identified by USAF in discovering, identifying and mapping the edge devices and physical sensors connected to those edge devices. The effort is aimed at the outcome of providing situational awareness of Industrial Control Systems/Supervisory Control and Data Acquisition (ICS/SCADA) traffic and devices operating in a network. The situational awareness will support the requirement of performing deep dive filtering analysis and enumeration of ICS traffic.

Demonstration

Organization

Sponsor: US Department of Defense
Prime: Oak Ridge National Laboratory (ORNL)
- Subcontract: MIT Lincoln Laboratory (MIT-LL)
Period: 2019-2025

Gallery

Trust-but-Verify in Cyber-Physical Systems

Kalyan Perumalla

PDF Cite Slides DOI

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

In this paper, we present our research and development efforts aimed at addressing the gap in discovering sensors at level 0 in industrial CPS by building a system called Deep-cyberia (Deep Cyber-Physical System Interrogation and Analysis) that incorporates algorithms and interfaces aimed at uncovering sensors and computing estimates of correlations among them.

Kalyan Perumalla, Srikanth Yoginath, Juan Lopez

PDF Cite Slides DOI

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Our focus is to extract volatile and dynamically changing internal information form CPS 0-1 level devices, and design preliminary schemes to exploit that extracted information. As a case study, we apply the proposed methodology to Modicon PLC using Modbus protocol. We extract the memory layout and subject the device to read operations at the most critical regions of memory. This capability of generating a sequence of volatile memory snapshots for offline, detailed and sophisticated analysis opens a new class of cyber security schemes for CPS forensic analysis, taint analysis and watermarking.

Rima Asmar Awad, Juan Lopez, Michael Rogers, Kalyan Perumalla

PDF Cite

ZeroIn

Sat, 01 Jan 2022 00:00:00 +0000

Our formulation of a new AI/ML-based, real-time computational framework aims to learn and flag defects in software as early as the time of commit in the developers’ repositories.

ZeroIn Network

Overview

Using novel AI/ML techniques, ZeroIn zeroes-in onto problems in software repositories and aims to identify code vulnerabilities at their very origin, namely, at the time at which developers commit their codes into their repositories.

ZeroIn: Characterizing the Data Distributions of Commits in Software Repositories

A characterization of the software development metadata is presented in terms of distributions of data that best captures the trends in the datasets, to feed into the machine learning components of ZeroIn to exploit connectivity among the sets of repositories, commits, and developers.

Kalyan Perumalla, Aradhana Soni, Rupam Dey, Steven Rich

PDF

Using Machine Learning Towards Early Flagging of Potentially Buggy Software Commits

Using multiple classifiers we verify the feasibility of using metadata from synthetic datasets modeled by a characterization of a few large software repositories and developer profiles. Results show that the metadata-based learning approach appears promising towards early flagging of potentially buggy commits in software repositories.

Aradhana Soni, Kalyan Perumalla

PDF

Characterizing the Distributions of Commits in Large Source Code Repositories

We present preliminary results from characterizing the distribution of 452 million commits in a metadata listing from GitHub repositories. Based on multiple distributions, we find the best fits and second best fits across different ranges in the data. The characterization is aimed at synthetic repository generation suitable for use in simulation and machine learning.

Aradhana Soni, Kalyan Perumalla, Rupam Dey

PDF

Organization

Sponsor: Industry
Institutions: University of Tennessee, Knoxville
Period: 2021-2024

Gallery

Digital Twin Framework

Sat, 01 Jan 2022 00:00:00 +0000

Our novel Digital Twin Framework (DTF) is designed to improve resilience of critical infrastructure systems by continuously comparing the infrastructure state with automatically generated, AI/ML-based, real-time digital-twin simulation of the system.

Team

Digital Twin Framework Software Architecture

Overview

As the level of automation in critical infrastructure increases, the ability to detect cyber intrusions becomes more crucial and extremely challenging. Recent cyber attacks demonstrate the devastating and widespread affects they can have on critical infrastructure.

DTF is designed specifically to detect and eventually prevent such attacks, with models validated against experimental data from two critical infrastructure experimental emulators – a canal lock system and an electric distribution system – exhibiting very different dynamics. The canal lock system’s digital twin uses a recurrent neural network trained from the experimental data collected via the DTF. A digital twin of the transmission system is created using a commercial real-time power systems simulator and integrated into our DTF along with the hardware, embedded controllers, and live sensor data using the Open Field Message Bus data model, and publish/subscribe communication protocols. A cyber attack is used on both systems to demonstrate the DTF’s detection capability.

Organization

Sponsor: Lab Directed Research and Development, Oak Ridge National Laboratory
Period: 2018-2020

Gallery

On the Effectiveness of Recurrent Neural Networks for Live Modeling of Cyber-Physical Systems

We empirically study the effectiveness of Recurrent Neural Network (RNN)-based models as the basis of DT-based resilience and uncover the important characteristics of an RNN-based solution with experimentation on a lab-scale Canal Lock CPS emulator with live validations and attack scenarios. For the first time, we demonstrate actual, real-time use of a RNN-based model as a DT for performing live analysis on an operational CPS.

Srikanth Yoginath, Varisara Tansakul, Supriya Chinthavali, Curtis Taylor, Joshua Hambrick, Philip Irminger, Kalyan Perumalla

PDF Cite DOI

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

We describe an approach to detecting and preventing cyber attacks by continuously comparing the infrastructure state with a real-time digital-twin simulation of it. Specifically, we describe and demonstrate a Digital Twin Framework (DTF) designed specifically to detect and eventually prevent such attacks. The canal lock system’s digital twin uses a recurrent neural network trained from the experimental data collected via the DTF.

Raymond Hink, Mark Buckner, Supriya Chinthavali, Chris Craig, Timothy Daniel, Joel Dawson, Milton Ericson, Joshua Hambrick, Philip Irminger, Ryan Kerekes, Juan Lopez, Kalyan Perumalla, Nicholas Peters, Stacy Prowell, Varisara Tansakul, Curtis Taylor, Bailu Xiao, Srikanth Yoginath

PDF

Kensor: Coordinated Intelligence from Co-located Sensors

Sat, 01 Jan 2022 00:00:00 +0000

Kensor uncovers coordinated intelligence about normal and abnormal phenomena from multiple sensors co-located in close proximity in secure installations.

Kensor

Overview

Given a set of co-located sensors, we seek an intelligent approach that would automatically determine the “normal” patterns of behaviors among the correlated sensors.

After normal behavior is extracted, later monitoring should detect any deviant variations over time.

An example application is an entry monitoring and alert system for facilities such as nuclear reactors, where badge readers, door locks, lights, weight trackers and other co-located sensors at the entry point are collectively tracked.

Gallery

Organization

Sponsor: Nuclear Safety
Period: 2019-2020

Kensor: Coordinated Intelligence from Co-Located Sensors

Here, we focus on coordinated intelligence about normal and abnormal phenomena from multiple sensors geographically co-located, monitoring and controlling a set of co-located devices. Given a set of co-located sensors, we develop an intelligent approach that automatically determines the ’normal’ patterns of behaviors among the correlated sensors. After normal behavior is extracted, later monitoring detects deviant variations over time.

Olivera Kotevska, Kalyan Perumalla, Juan Lopez

PDF Cite DOI

NetWarp

Sat, 01 Jan 2022 00:00:00 +0000

NetWarp is a novel time-synchronized virtual machine(VM)-based parallel simulation framework that accurately lifts the devices and the network communications to a virtual time plane while retaining full fidelity.

NetWarp

Organization

Sponsors: US Department of Defense
- Office: Army Research Laboratory (ARL)
- Office: Missile Defense Agency (MDA)
- Programs: Computational Sciences, STTR
Prime: Oak Ridge National Laboratory (ORNL)

Gallery

summary: Secure Virtual Environment for Cyber Resiliency Validation building on NetWarp technology for cybersecurity in hardware and software of missile defense systems

Virtual Machine-Based Simulation Platform For MANET-Based Cyber Infrastructure

In modeling and simulating complex systems such as mobile ad-hoc networks (MANETs) in defense communications, …

Srikanth Yoginath, Kalyan Perumalla, Brian Henz

PDF Cite DOI

Taming Wild Horses: The Need for Virtual Time-based Scheduling of VMs in Network Simulations

The next generation of scalable network simulators employ virtual machines (VMs) to act as high-fidelity models of traffic producer/consumer nodes…

Srikanth Yoginath, Kalyan Perumalla, Brian Henz

PDF Cite

Optimized Hypervisor Scheduler for Parallel Discrete Event Simulations on Virtual Machine Platforms

With the advent of virtual machine (VM)-based platforms for parallel computing, it is now possible to execute parallel discrete event simulations (PDES)…

Srikanth Yoginath, Kalyan Perumalla

PDF Cite

A Flexible OT Testbed for Evaluating On-Device Implementations of IEC-61850 GOOSE

Fri, 01 Sep 2023 00:00:00 +0000

Open Access:
- Journal: https://www.sciencedirect.com/science/article/pii/S1874548223000318.
- PDF: https://www.sciencedirect.com/science/article/pii/S1874548223000318/pdfft?md5=4606c01cd9fbd3efc0e6b73a074b8910&pid=1-s2.0-S1874548223000318-main.pdf.

Impact of Grammar on Language Model Comprehension

Mon, 20 Feb 2023 00:00:00 +0000

https://www.computer.org/csdl/proceedings-article/icnc/2023/10074239/1LKwLebVPGw

A Testbed for Evaluating Performance and Cybersecurity Implications of IEC-61850 GOOSE Hardware Implementations

Sun, 08 Jan 2023 00:00:00 +0000

Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid

Thu, 20 Oct 2022 00:00:00 +0000

Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems

Wed, 22 Jun 2022 00:00:00 +0000

Article is available as Open Access

An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity

Wed, 15 Jun 2022 00:00:00 +0000

Open Access: https://www.mdpi.com/2624-800X/1/4/31.

ZeroIn: Characterizing the Data Distributions of Commits in Software Repositories

Sat, 16 Apr 2022 00:00:00 +0000

Using Machine Learning Towards Early Flagging of Potentially Buggy Software Commits

Fri, 08 Apr 2022 00:00:00 +0000

DarkNet Cyber Resilience

Tue, 22 Mar 2022 00:00:00 +0000

Characterizing the Distributions of Commits in Large Source Code Repositories

Wed, 15 Dec 2021 00:00:00 +0000

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

Thu, 04 Nov 2021 00:00:00 +0000

Open Access: https://www.mdpi.com/2624-800X/1/4/31.
This article belongs to the Special Issue Machine Learning and Data Analytics for Cyber Security.

On Some Confluences of Computing and Security in Theory and Practice

Fri, 21 May 2021 00:00:00 +0000

Trust-but-Verify in Cyber-Physical Systems

Wed, 28 Apr 2021 00:00:00 +0000

Trust-but-Verify in Cyber-Physical Systems

Kalyan Perumalla

PDF Cite Slides DOI

Trust-but-Verify in Cyber-Physical Systems

Wed, 28 Apr 2021 00:00:00 +0000

https://dl.acm.org/doi/abs/10.1145/3445969.3450434

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

Mon, 01 Feb 2021 00:00:00 +0000

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

Wed, 01 Jan 2020 00:00:00 +0000

Kensor: Coordinated Intelligence from Co-Located Sensors

Mon, 09 Dec 2019 00:00:00 +0000

https://ieeexplore.ieee.org/abstract/document/9006318

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

Tue, 05 Nov 2019 00:00:00 +0000

https://ieeexplore.ieee.org/abstract/document/9032891

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Fri, 01 Nov 2019 00:00:00 +0000

https://www.osti.gov/biblio/1606814

Design of A High-Fidelity Testing Framework for Secure Electric Grid Control

Wed, 01 Jan 2014 00:00:00 +0000

[Pub 144]

http://wintersim.org

Cybersecurity | Kalyan Perumalla

DarkNet Cyber Resilience

Overview

Key Links

Gallery

Organization

Selected Publications

CYVET

Overview

Organization

Gallery

Related Publications

Additional Background

Deep CYBERIA

Overview

Demonstration

Organization

Gallery

Related Publications

ZeroIn

Overview

Related Publications

Organization

Gallery

Digital Twin Framework

Overview

Organization

Gallery

Related Publications

Kensor: Coordinated Intelligence from Co-located Sensors

Overview

Gallery

Organization

Related Publications

NetWarp

Organization

Gallery

Related Publications

A Flexible OT Testbed for Evaluating On-Device Implementations of IEC-61850 GOOSE

Impact of Grammar on Language Model Comprehension

A Testbed for Evaluating Performance and Cybersecurity Implications of IEC-61850 GOOSE Hardware Implementations

Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid

Design of a Novel Information System for Semi-Automated Management of Cybersecurity in Industrial Control Systems

An Accuracy-Maximization Approach for Claims Classifiers in Document Content Analytics for Cybersecurity

ZeroIn: Characterizing the Data Distributions of Commits in Software Repositories

Using Machine Learning Towards Early Flagging of Potentially Buggy Software Commits

DarkNet Cyber Resilience

Characterizing the Distributions of Commits in Large Source Code Repositories

CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model

On Some Confluences of Computing and Security in Theory and Practice

Trust-but-Verify in Cyber-Physical Systems

Trust-but-Verify in Cyber-Physical Systems

Smart Semi-Supervised Accumulation of Large Repositories for Industrial Control Systems Device Information

A Digital Twin Framework for Testing, Evaluation and Deployment of Resilient Cyber-physical Systems

Kensor: Coordinated Intelligence from Co-Located Sensors

Detecting Sensors and Inferring their Relations at Level-0 in Industrial Cyber-Physical Systems

Volatile Memory Extraction-Based Approach for Level 0-1 CPS Forensics

Design of A High-Fidelity Testing Framework for Secure Electric Grid Control