Security by Design for Interconnected Critical Infrastructures

Lead Research Organisation: Imperial College London
Department Name: Institute for Security Science and Tech


The objective of the proposed collaborative work is to advance the state of the art in the design of secure
interconnected public infrastructures. The focus is on Security-by-Design. While security-by-design is not a new
concept, the approach proposed here and its context, are and especially so in the context of interconnected
public infrastructure.

The increasing commoditisation of components for critical infrastructures has led to the widespread use
of embedded computers in such systems. These computers are often interconnected using wireless
communications or ethernet. This trend has been accelerated by the need for remote maintenance
capability and regular upgrades of systems. An undesirable consequence has been that critical infrastructures
have become interconnected and interdependent. The result of an attack on one infrastructure may well have
cascading effects on others. Understanding such interdependencies and developing new design
methodologies to avoid the possibility of cascading security failures is central to this proposal.

The objective will be met through the following key steps: (a) modeling based on abstraction from system design
for security analysis, (b) impact and response analysis across interconnected infrastructures using the model, and
(c) upgrading of the initial design to improve system resilience to cyber attacks. A significant outcome of the above
approach will be a software prototype that implements the steps mentioned above and the integration of such tools
with state of the art existing design tools. The methodology and the tools developed will be assessed for their
effectiveness and practical utility through experiments designed jointly by the research teams from Imperial and
SUTD. The experiments will be conducted on state of the art testbeds available at SUTD for power and water.
Generalized attack models, in contrast to specific models that exist today, will be used to create objectively designed
cyber attacks to assess the resilience of interconnected systems when one or multiple systems are under attack.

Planned Impact

The US Computer Emergency Response Team, ICS-CERT, reported 9 incidents in 2005 but this has grown to about 250
per year in recent years. Groups such as Energetic Bear have particularly focussed on gathering configuration information
from companies in the energy sector. We have yet to see major attacks which have aimed at sabotaging such systems
but the German Steel Mill attack from 2014 demonstrates the potential for significant physical damage from cyber
attack. The significance of the threat has been recognised by Governments across the world. The increasing trend to
using digital components with communications capabilities within control systems and critical infrastructures means that
there are substantial inter-connections and inter-dependencies. Understanding these and designing systems to be
protected against cascading failures is therefore an important enterprise.

This proposal will lead to a project which will be associated with the Research Institute in Trustworthy Industrial Control Systems.
As such its results will be communicated to the Advisory Board of the Institute -- this includes members from key
UK Government Departments and Industry. The results will also be accessible to the industrial partners of the projects
in the Institute -- these include infrastructure operators, suppliers and consultancies.

SUTD and Imperial will work together to ensure that the tools produced from this work are widely disseminated.

The wider public will benefit from the production of more secure critical infrastructures.
Description Several novel machine learning methods have been developed during the course of this project related to:

- Advanced machine learning (ML/AI) based Detection of cyber attacks
- Using machine learning to establish baseline normality of complex cyber-physical system operations
- Using adversarial machine learning techniques for the discovery of advanced cyber attack methods

In each case we have contributed novel findings and methods to the field of ML for cyber-security and have developed algorithms that have been demonstrated against well known baseline and novel real-world datasets; the latter being generated using advanced test-beds available to the project partners at SUTD. In each case our work has outperformed leading, previously established, methods and techniques and we have made our findings available on the arxiv portal and have published in leading international conferences in the field:

Cheng Feng (Imperial College London), Venkata Reddy Palleti (Singapore University of Technology and Design), Aditya Mathur (Singapore University of Technology and Design), Deeph Chana (Imperial College London) "A Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems" NDSS 2019

Cheng Feng, Tingting Li, Zhanxing Zhu and Deeph Chana "A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems" arXiv 2017

Cheng Feng, Tingting Li and Deeph Chana "Multi-level Anomaly Detection in Industrial Control Systems via Package Signatures and LSTM Networks"
Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) 2017 47th
Exploitation Route Aspects of our work are now being taken forward through a PhD studentship and RAs that are supported under RITICS and KIOS projects that are held in the Institute for Security Science and Technology (ISST), Imperial

The RA from Imperial College has since secured a job in the private sector with a world leading infrastructure systems company where the team is investigating the potential of commercialising aspects of our work
Sectors Aerospace, Defence and Marine,Chemicals,Construction,Energy,Financial Services, and Management Consultancy,Manufacturing, including Industrial Biotechology,Security and Diplomacy,Transport

Description The PI (D Chana) is one of the founders of the UK Government's funded cyber security research institute on industrial control systems (RITICS). This effort is composed of 5 research projects spread across 5 UK universities, looking at various aspects of industrial control system security. Our early findings have been presented -- by the RA on this project -- to the RITICS stakeholder review group; attended by UK Government cyber security officials, industry stakeholders and others researchers. The PI has also used the research conducted here to present cyber-security developments and outlook to non academic stakeholders in government and industry in the UK, India, Singapore and India. The work undertaken in this project has led the PI to pursue the use of similar techniques for the security of financial systems -- also complex interconnected systems. The RA at Imperial (C Feng) has since taken up a role at a world leading infrastructure technology company, working within a team developing ML/AI for cyber-physical security purposes. The work achieved in this project was central in securing his position in the company and there are possibilities for some of the project outputs being commercialised there.
First Year Of Impact 2017
Sector Aerospace, Defence and Marine,Energy,Financial Services, and Management Consultancy,Security and Diplomacy,Transport
Impact Types Societal,Policy & public services

Description Singapore University of Technology and Design 
Organisation Singapore University of Technology and Design (SUTD)
Country Singapore 
Sector Academic/University 
PI Contribution This award was set-up as a collaboration between the Institute for Security Science and Technology (ISST) at Imperial College London and the iTrust cyber-security team at Singapore University of Technology and Design, Singapore. The project's aim is to advance the state of the art in the design of secure interconnected public infrastructures, such as water and power plants. Our team at Imperial have been responsible for designing advanced experiments to generate data from iTrust's industrial control system test-beds and to use this data to develop advances machine-learning cyber security algorithms and software. In the first phase the work concentrated in developing cyber-physical security detection methods whilst in the second phase the capability for generative adversarial networks to perform machine learning attacks has been the focus at Imperial.
Collaborator Contribution The iTrust team at the Singapore University of Design and Technology has been developing a state-of-the art cyber-physical test-bed facility that includes operational water treatment and distribution testbeds and a connected power testbed. Its novelty lies in the application of security by design - adoption of security features as early as the design and construction stage and it has been the a key source of data for investigating the security of such cyber-physical systems. The team at iTrust have conducted data generation and analysis activities based on joint experimental design and project planning between Imperial and SUTD teams.
Impact 1) D. Chana, The multi-faceted nature of threats and risks, Cyber Security Think-in, SUTD, Singapore, July 2016: An invited talk given to an audience of senior government officials/policy makers, academics and industrialists with national security interests. Amongst others the event was attended by Mr Quek Gim Pew, Chief Defence Scientist of the Ministry of Defence, Singapore. 2) D. Chana acted as observer and panel judge for the first SUTD cyber-physical hackathon that invited teams from around the world (industry and academia) to conduct cyber attacks agains the iTrust test-bed network 3) D. Chana is a founder of the Research Institute in Trustworthy Industrial Control Systems (RITICS) that is funded by the EPSRC. The work in this project has worked in collaboration with the RITICS postdoctoral researcher at Imperial and the outputs of this work have been presented to the RITICS consortium. 4) The work conducted in this project has directly influenced the initiation of an industry funded PhD at Imperial looking at machine learning for industrial control system 5) Aspect of the collaboration initiated by this project will be continued via continued funding of RITICS and a new collaboration on cyber-physical system security with the KIOS Centre of Excellence in Cyprus (both of these having already secured funding).
Start Year 2016
Title Machine learning cyber security algorithm 
Description A new method for detecting anomalous signals in real-world cyber-phsycial systems has been developed and implemented in software. This has resulted in the acceptance of a publication in the well regarded IEEE Dependable Systems and Networks (DSN) conference in 2017 
Type Of Technology Software 
Year Produced 2017 
Open Source License? Yes  
Impact The software produced has demonstrated a capability of detecting anomalous network traffic using a novel two stage machine learning process the utilises bloom filtering followed by the use of a Long Short Term Memory (LSTM) stage. The technique was implemented on real world data -- that is available publicly -- and was shown to outperform a number of known standard detection techniques.