Resilient operation of cyber-physical infrastructures in adversarial environments requires i) toughness: maintenance of core crucial sub-functionalities despite ongoing intrusions, and ii) elasticity: recovery of the normal system operation in a timely manner. Put in other words, it does not require unrealistic assumptions about absolute preventative protection of complex cyber-physical platforms that would disable any type of malicious penetration and damage against the physical plant at the first place. Instead, resilience is based on the assumption that a sophisticated intrusion may succeed to evade the deployed protection and runtime detection mechanisms and impact the underlying system services and assets partially (except the core sub-functionalities). The resilient system fights back through reactive and proactive intrusion tolerance mechanisms to respond to ongoing misbehaviors and recover the affected system services and components within a reasonable time interval. In this paper, we present a formal definition of resilience and assessment metric for resilience. Our resilience metric quantifies the ability of the system to recover from an attack provided the attack is discovered within a fixed time interval, as well as the cost of recovery. We analyze the metric properties for linear systems and linear systems with actuator saturation. We then formulate cyber defense policies that ensure the resilience conditions are satisfied and validate our approach using a power system case study.

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skew-based intrusion detection systems (IDSs) that detect masquerade attacks in the controller area network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used network time protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

Advanced Persistent Threats (APTs) infiltrate cyber systems and compromise specifically targeted data and/or resources through a sequence of stealthy attacks consisting of multiple stages. Dynamic information flow tracking has been proposed to detect APTs. In this paper, we develop a dynamic information flow tracking game for resource-efficient detection of APTs via multi-stage dynamic games. The game evolves on an information flow graph, whose nodes are processes and objects (e.g., file, network endpoints) in the system and the edges capture the interaction between different processes and objects. Each stage of the game has pre-specified targets that are characterized by a set of nodes of the graph. The goal of the APT is to evade detection and reach a target node of each stage. The goal of the defender is to maximize the detection probability while minimizing performance overhead on the system. The resource costs of the players are different and the information structure is asymmetric, resulting in a nonzero-sum imperfect information game. We first calculate the best responses of the players and then compute Nash equilibrium for single stage attacks. We then provide a polynomial-time algorithm to compute a correlated equilibrium for the multi-stage attack case. Finally, we simulate our model and algorithm on real-world nation state attack data obtained from the Refinable Attack INvestigation (RAIN) system.

Safety is a critical property for control systems in medicine, transportation, manufacturing, and other applications, and can be defined as ensuring positive invariance of a predefined safe set. This article investigates the problems of verifying positive invariance of a semialgebraic set as well as synthesizing sets that can be made positive invariant through control barrier function (CBF)-based control. The key to our approach consists of mapping conditions for positive invariance to sum-of-squares constraints via the Positivstellensatz from real algebraic geometry. Based on these conditions, we propose a framework for verifying safety of CBF-based control including single CBFs, high-order CBFs, multi-CBFs, and systems with trigonometric dynamics and actuation constraints. In the area of synthesis, we propose algorithms for constructing CBFs, namely, an alternating-descent approach and a local CBF approach. We evaluate our approach through case studies on quadrotor UAV and power converter test systems.