Towards distinguishing between cyber-attacks and faults in cyber-physical systems

Abstract

Cyber-physical systems (CPS) can be affected by different events or circumstances. These circumstances include the following: (1) faults, which are accidental in nature and may involve degradation of equipment and (2) cyber-attacks, which were created by a malicious and conscious entity. Both of these can have similar effects on the CPS as well as different effects. The goal of this work is to be able to understand the differences between the two in their symptoms for the physical system and network. It is desired to be able to distinguish one from the other so that a diagnosis can be made. The reason that this is desired is to allow an appropriate response. In this thesis, a set of experiments are conducted. Specifically, a model of a networked control system (NCS) is used and is subject to normal operating conditions, faults, and attacks. Simulations with these circumstances involve special network simulation tools: Omnet++ and INET. A simple network with several routers was created. Two nodes of the network have applications that implement the behavior of the plant and the controller. The network facilitates communication between these two nodes. The results of this set of simulations are studied so that insight can be gained from the various scenarios. Also experiments are performed with a well-known machine learning algorithm-a naïve Bayes classifier-to gauge how well a distinction can be made between faults and attacks. Questions of how the problem is generalized and why it is important to consider are also addressed and discussed.