With the increasing deployment of data network technologies in industrial control systems (ICSs), cybersecurity becomes a challenging problem in ICSs. Dynamic cybersecurity risk assessment plays a vital role in ICS cybersecurity protection. However, it is difficult to build a risk propagation model for ICSs due to the lack of sufficient historical data. In this paper, a fuzzy probability Bayesian network (FPBN) approach is presented for dynamic risk assessment. Firstly, an FPBN is established for analysis and prediction of the propagation of cybersecurity risks. To overcome the difficulty of limited historical data, the crisp probabilities used in standard Bayesian networks (BNs) are replaced in our approach by fuzzy probabilities. Then, an approximate dynamic inference algorithm is developed for dynamic assessment of ICS cybersecurity risk. It is embedded with a noise evidence filter in order to reduce the impact from noise evidence caused by system faults. Experiments are conducted on a simplified chemical reactor control system to demonstrate the effectiveness of the presented approach.

Industrial cyber-physical systems (ICPSs) are widely applied in critical infrastructures such as chemical plants, water distribution networks, and power grids. However, they face various cyberattacks, which may cause physical damage to these industrial facilities. Therefore, ensuring the security of ICPSs is of paramount importance. For this purpose, a new risk assessment method is presented in this paper to quantify the impact of cyberattacks on the physical system of ICPSs. This method helps carry out appropriate attack mitigation measures. The method uses a Bayesian network to model the attack propagation process and infers the probabilities of sensors and actuators to be compromised. These probabilities are fed into a stochastic hybrid system (SHS) model to predict the evolution of the physical process being controlled. Then, the security risk is quantified by evaluating the system availability with the SHS model. The effectiveness of the proposed method is demonstrated with a case study on a hardware-in-the-loop simulation test bed.

With the rapid development of functional requirements in the emerging Industry 4.0 era, modern industrial control systems (ICSs) are no longer isolated islands, making them more vulnerable to various cyberattack threats. Cyberattacks on ICSs may have disruptive consequences, such as significant social and economic losses. To proactively address the security issue of ICSs, this article presents a unified architectural approach from the perspectives of cyberthreats on ICSs, security-related ICS technologies, and methods for ICSs. It incorporates secure networks, secure control systems, secure physical processes, and their interactions seamlessly into a unified framework. To increase the resistance of ICSs against intrusions, the network security in our architectural approach is to secure the data in motion through the integration of secure network architecture, secure industrial network protocols, and secure end-to-end communications. The protection of control systems in our architectural approach is risk-based and hierarchical and encompasses prevention- and tolerance-centric defenses. It provides a layer-by-layer defense so that an acceptable level of cybersecurity risk is achieved and maintained. Aiming to maintain the stable operation of physical ICS processes, the secure control in our architectural approach implements a security process against process-aware attacks through a resilient safety control scheme. The global and systematic architectural approach presented in this article for the ICS cybersecurity will help facilitate the design and implementation of cyberattack-resilient ICSs in the networked world. For further development of ICS security technologies, emerging challenges are identified and discussed to motivate future research efforts.

A developing trend of traditional industrial systems is the integration of the cyber and physical domain to improve flexibility and the efficiency of supervision, management, and control. But, the deep integration of these industrial cyber-physical systems (ICPSs), increases the potential for security threats. Attack detection, which forms initial protective barrier, plays an important role in overall security protection. However, most traditional methods focused on cyber information and ignored any limitations that might arise from the characteristics of the physical domain. In this paper, an anomaly detection approach based on zone partition is designed for ICPSs. In detail, initially an automated zone partition method, ensuring crucial system states can be observed in more than one zone, is designed. Then, methods of building zone function model, which do not require any prior knowledge of the physical system are presented before analyzing the anomaly based on zone information. Finally, an experimental rig is constructed to verify the effectiveness of the proposed approach. The results demonstrate that the approach presents a high-accuracy solution, which also performs effectively in real time.

Multimicrogrid (MMG) systems have the potential to play an increasingly important role in the transformation of existing power grid to smart grid. However, the open and distributed connectivity of MMGs exposes the systems into various cyber-attacks, which may cause serious failures or physical damages, such as power supply interruption and human casualties. Therefore, ensuring the security of MMGs is of paramount importance. To address this issue, a new collaborative intrusion detection (CID) approach using blockchain is proposed in this paper for MMG systems in smart grid. Due to the consensus mechanism of blockchain, the approach is designed without the need of a trusted authority or central server while improving the accuracy of intrusion detection in a collaborative way. It is equipped with a proposal generation method that combines periodic and trigger patterns to generate the detection target of CID, i.e., a proposal. From the generated proposals together with the correlation model of MMGs, a CID is achieved by using the consensus mechanism. The final detection results of CID are stored on blockchain in sequence. The use of an incentive mechanism motivates a single microgrid to participate in consensus. The effectiveness of the presented approach is demonstrated through a case study on an MMG system.

Visual sensor networks (VSNs) are highly vulnerable to attacks due to their open deployment in possibly unattended environments. To improve the network security of VSNs, an intrusion detection system (IDS) is an effective countermeasure. However, as visual sensors can produce big and dynamic video data, it is a tough task to rapidly and effectively detect attacks in VSNs. Moreover, attack samples in VSNs are generally too rare for IDSs to fully understand the behaviors of attacks. Facing these difficulties, in this paper, we propose an efficient intrusion detection approach for VSNs, which is based on traffic pattern learning. In the proposed approach, a traffic model is developed to describe the dynamic characteristics of network traffic in VSNs. Based on this model, the optimal feature set for traffic pattern learning can be extracted. Then a hierarchical self-organizing map (HSOM) is employed to learn traffic patterns and detect intrusions. Furthermore, an active learning strategy is devised to accelerate the training process of the HSOM and better learn the patterns of attacks. Experimental results show that the proposed approach has high detection accuracy and good real-time performance.