روشی برای ارزیابی کمّی مخاطره امنیتی در سامانه‌های سایبر-فیزیکی

نوع مقاله : مقاله پژوهشی

نویسنده

استادیار، گروه مهندسی کامپیوتر، دانشگاه فنی و حرفه‌ای، تهران، ایران

چکیده

با ورود بخش سایبری به سامانه‌های فیزیکی و ظهور صنعت 4.0، سامانه‌های سایبر-فیزیکی معرفی شدند. اگر چه هدف اصلی این ترکیب افزایش کارایی و پایداری و مدیریت‌پذیری سامانه‌های فیزیکی بوده است، اما این ترکیب و یکپارچه‌سازی تهدیدات بسیار جدّی را برای سامانه‌های فیزیکی ایجاد کرده است. حملات موفق به این سامانه‌ها ممکن است منجر به اختلال یا خرابی فیزیکی مانند ایجاد آسیب به تجهیزات، تولیدات یا حتی آسیب به انسان‌ها گردد. از این رو امنیت سامانه‌های سایبر-فیزیکی به یکی از موضوعات مهم پژوهشی تبدیل شده است. در این مقاله، روشی برای ارزیابی کمّی مخاطره امنیتی در سامانه‌های سایبر-فیزیکی ارائه شده است. این روش، مؤلفه‌های مهم و حیاتی موثر در مخاطرات امنیتی سامانه‌های سایبر-فیزیکی را به دو دسته نمایه مهاجم و نمایه سیستم تقسیم‌بندی می‌کند و مخاطره را بر اساس مؤلفه‌های شاخص این دو دسته نمایه به صورت کمّی تخمین می‌زند. این مؤلفه‌ها شامل امکان حمله، کشف حمله، دانش مهاجم از سامانه مورد هدف، زمان تا خرابی، هزینه وارده به سامانه، هزینه بازیابی و ترمیم سامانه و نرخ آسیب‌پذیری هستند. نهایتاً به منظور نمایش کاربردپذیری، روش پیشنهادی بر یک سیستم سایبر-فیزیکی اعمال شده و مخاطره امنیتی ارزیابی شده است.

کلیدواژه‌ها


عنوان مقاله [English]

A method for quantitative evaluation of security risk in cyber-physical systems

نویسنده [English]

  • Hamed Sepehrzadeh
Assistant Professor, Department of Computer Engineering, Technical and Vocational University (TVU), Tehran, Iran.
چکیده [English]

Cyber-physical systems were introduced with the introduction of the cyber sector into physical systems and the emergence of Industry 4.0. Although the main purpose of this combination has been to increase the efficiency, stability and manageability of physical systems, but this combination and integration has created very serious threats to physical systems. Successful attacks on these systems may lead to disruption or physical damage such as damage to equipment, products or even damage to humans. Therefore, the security of cyber-physical systems has become one of the important research topics. In this article, a method for quantitative assessment of security risk in cyber-physical systems is presented. This method divides the important and vital components affecting the security risks of cyber-physical systems into two categories: attacker profile and system profile, and quantitatively estimates the risk based on the index components of these two profile categories. These components include attack possibility, attack detection, attacker's knowledge of the target system, time to failure, system cost, system recovery and repair cost, and vulnerability rate. Finally, in order to demonstrate the applicability, the proposed method has been applied to a cyber-physical system and the security risk has been evaluated.

کلیدواژه‌ها [English]

  • Cyber-physical systems (CPSs)
  • Security
  • Risk
  • Evaluation

Smiley face

[1]      F. Hu, Y.  Lu, A.V. Vasilakos, Q. Hao, R. Ma, Y. Patil, ... & N.N. Xiong, “Robust cyber–physical systems: Concept, models, and implementation,” FUTURE GENER COMP SY, vol. 56, pp. 449-475, 2016.
[2]      J. P. A. Yaacoub, O. Salman, H. N. Noura, N. Kaaniche, A. Chehab, and M. Malli, “Cyber-physical systems security: Limitations, issues and future trends.” MICROPROCESS MICROSY, vol. 77, p.103201, 2020.
[3]      Y. Ashibani, Q. H. Mahmoud, “Cyber physical systems security: Analysis, challenges and solutions.” COMPUT SECUR, vol. 68, pp.81-97, 2017
[4]      X. Lyu, Y. Ding, S.H. Yang, “Safety and security risk assessment in cyber‐physical systems.” IET Cyber‐Physical Systems: Theory & Applications, vol. 4, pp.221-232 2019.
[5]      Bernardi, S., Gentile, U., Marrone, S., Merseguer, J., & Nardone, R. (2021). Security modelling and formal verification of survivability properties: Application to cyber–physical systems. Journal of Systems and Software, 171, 110746.
[6]      H. Kopetz, Real-Time Systems: Design Principles for Distributed Embedded Applications, 2d. ed., Real-Time Systems Series, 2011.
[7]      H. Orojloo, M. Abdollahi Azgomi, Predicting the behavior of attackers and the consequences of attacks against cyber‐physical systems. Security and Communication Networks, vol. 9, pp. 6111-6136, 2016.
[8]      H. Orojloo, M. Abdollahi Azgomi, “A stochastic game model for evaluating the impacts of security attacks against cyber-physical systems.” Journal of Network and Systems Management, vol. 26, pp.929-965, 2018.
[9]      M. Krotofil and et.al., "Vulnerabilities of cyber-physical systems to stale data-Determining the optimal time to launch attacks," International Journal of Critical Infrastructure Protection, vol. 7, pp. 213-232, 2014.
[10]   B. Potteiger, A. Dubey, F. Cai, X. Koutsoukos, Z. Zhang, “Moving target defense for the security and resilience of mixed time and event triggered cyber–physical systems.” J SYST ARCHITECT”, vol. 125, p.102420, 2022.
[11]   A. Makkar, J. H. Park, “SecureCPS: Cognitive inspired framework for detection of cyber attacks in cyber–physical systems.” INFORM PROCESS MANAG, vol. 59, p.102914, 2022.
[12]   M. Krotofil and et.al., "CPS: Driving cyber-physical systems to unsafe operating conditions by timing DoS attacks on sensor signals," in 30th Annual Computer Security Applications Conference, 2014, pp. 146-155.
[13]   C. Barreto, G. Schwartz, A.A. Cardenas, “Cyber-Risk: Cyber-Physical Systems Versus Information Technology Systems.” In Safety, Security and Privacy for Cyber-Physical Systems (pp. 319-345). Springer, Cham.
[14]   A. Humayed, J. Lin, F. Li, B. Luo, “Cyber-physical systems security—A survey”. IEEE Internet of Things Journal, vol. 4, pp.1802-1831, 2017.
[15]   H. Orojloo, M. Abdollahi Azgomi, “A method for evaluating the consequence propagation of security attacks in cyber–physical systems,” Future Generation Computer Systems, vol. 67, pp. 57-71, 2017.
[16]   A. Yeboah-Ofori, S. Islam, “Cyber Security Threat Modeling for Supply Chain Organizational Environments”. Future Internet, vol. 11, 2019.
[17]   R. Schlegel, S. Obermeier, and J. Schneider, Structured system threat modeling and mitigation analysis for industrial automation systems. In 2015 IEEE 13th International Conference on Industrial Informatics (INDIN) (pp. 197-203). IEEE, 2015.
[18]   D.G. Rosado, A. Santos-Olmo, L.E., Sánchez, M.A. Serrano, et. all, “Managing cybersecurity risks of cyber-physical systems: The MARISMA-CPS pattern”. COMPUT IND, vol. 142, p.103715, 2022.
[19]   A. Tantawy, S. Abdelwahed, A. Erradi, and K. Shaban, “Model-based risk assessment for cyber physical systems security”. COMPUT SECUR, vol. 96, p.101864, 2020.
[20]   W. Wu, R. Kang, & Z. Li, “Risk assessment method for cyber security of cyber physical systems. In 2015 first international conference on reliability systems engineering (ICRSE) (pp. 1-5). IEEE, 2015.
[21]   K. Huang, C. Zhou, Y.C. Tian, S. Yang, Y. Qin, “Assessing the physical impact of cyberattacks on industrial cyber-physical systems”. IEEE T IND ELECTRON, vol. 65, pp. 8153-8162, 2018.
[22]   X. Lyu, Y. Ding, S.H. Yang, “Bayesian network based C2P risk assessment for cyber-physical systems”. IEEE Access, vol. 8, pp. 88506-88517, 2020.
[23]   H. A. Kholidy, “Autonomous mitigation of cyber risks in the Cyber–Physical Systems”. FUTURE GENER COMP SY, vol. 115, pp.171-187, 2021.
[24]   H. Sepehrzadeh, “A method for assessing the security risk in cyber-physical systems with incomplete information using Bayesian game theory,” Karafan Quarterly Research Journal, DOI:10.48301/KSSA.2022.320681.1909. in Persian, 2021.
[25]   NCCIC, Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). ⟨https://us-cert.cisa.gov/ics⟩ (accessed 19 August 2022).
[26]   M. Yampolskiy, P. Horváth, X.D. Koutsoukos, Y. Xue, and J. Sztipanovits, “A language for describing attacks on cyber-physical systems.” International Journal of Critical Infrastructure Protection, vol. 8, pp.40-52, 2015.
[27]   R. Alguliyev, Y. Imamverdiyev, L. and Sukhostat, “Cyber-physical systems and their security issues.” COMPUT IND, 100, pp.212-223, 2018.
[28]   M. Krotofil, J. and Larsen,. Are you threatening my hazards?. In International Workshop on Security. Springer, Cham, 2014, pp. 17-32.
دوره 11، شماره 2 - شماره پیاپی 42
شماره پیاپی 42، فصلنامه تابستان
تیر 1402
صفحه 71-80
  • تاریخ دریافت: 29 مرداد 1401
  • تاریخ بازنگری: 27 آذر 1401
  • تاریخ پذیرش: 27 اردیبهشت 1402
  • تاریخ انتشار: 01 تیر 1402