CAREER: PARP: Mislead Physical-Disruption Attacks by Preemptive Anti-Reconnaissance for Power Grids Cyber-Physical Infrastructures

University Of Rhode Island, Kingston RI

Investigators

Abstract

Cyberattacks targeting industrial control systems like power grids present unique features compared to attacks in general computing environments. Because physical processes operate under complicated physical models, adversaries perform in-depth reconnaissance on both cyber and physical infrastructures after penetrating internal control networks. The comprehensive reconnaissance enables them to cause rapid and possibly irreversible damage like power outages, economic losses, and even human casualties. This CAREER project aims to design and quantify preemptive anti-reconnaissance techniques that will mislead adversaries about power grids’ cyber-physical infrastructures. Toward the objective of preventing physical damage, this project will introduce clear benefits. First, it will mislead attacks before malicious activities are launched, removing potential threats in advance and thus preventing damage. Second, preventing reconnaissance on a critical set of physical data can protect against a wide spectrum of attacks, including unknown ones. To achieve this objective, this project will advance existing anti-reconnaissance approaches with two critical research thrusts. The first research thrust aims to mislead adversaries about cyber infrastructures by an original control function virtualization. Leveraging network programmability enabled by software-defined networking, this technique virtualizes network communications that deliver control functions in power grids without building virtual machines for each physical device. While preserving the performance of control functions, virtualization neutralizes communication patterns from various physical devices and spoof nodes based on the neutralized patterns. This consequently removes device-specific features from communication channels and delivers misleading information by the spoofed nodes, preventing adversaries from pinpointing vulnerable devices to target. The second research thrust seeks to mislead adversaries about physical infrastructure by creating an electrical-model-guided generative adversarial network. Specifically, this method advances the current design of generative adversarial networks by integrating electrical models into their internal structures and crafting power grids that generate real and decoy data. The combination of real and decoy data will conform to electrical models but present a different picture from the actual power grid. Consequently, decoys mislead adversaries into designing ineffective attack strategies that avert damage to the actual grid, while real data continues to serve legitimate control applications. The research thrusts will be evaluated in a hardware-in-the-loop power system testbed, which can integrate real-time operations of physical devices with high-fidelity simulators to quantify power system runtime reactions to external events. This project is jointly funded by the Secure and Trustworthy Cyberspace (SaTC) program and the Established Program to Stimulate Competitive Research (EPSCoR). This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.