Digital Twins for Cyber-Physical Systems Security

In this talk we discuss the differences between IT and OT security, and how digital twins for physical systems are a natural component to address the new challenges of OT security.

Then we discuss our work on how digital twins can help in security by:

• $\mathrm{■}$

  Deploy new defenses such as attack recovery

• $\mathrm{■}$

  Understand the consequences of attacks and risks of CPS

• $\mathrm{■}$

  Interact with the adversary (Through honeypots or by executing malware in a contained setting)

• $\mathrm{■}$

  Finding new attacks in a principled manner (e.g., fuzzing the physical system).

The term “digital twin” is one of the latest technology buzzwords that has emerged along with the digital transformation that is taking place in CPS domains. Since there is no generally accepted definition of this term yet, the understanding of the digital-twin concept is often limited to the notion that a cyber-physical system is replicated in a digitally-enhanced way. This talk provides one interpretation of digital twins by breaking down the concept into four components that are required to implement them, viz., i) system emulation or via system containers, including I/O simulation, ii) network emulation, iii) interactive, real-time simulation of the physical process, and iv) synchronization with the physical counterparts. After putting the digital-twin concept into context, we present our current progress on developing a framework named CPS Twinning that integrates these four components for the purpose of generating such digital twins, so that security applications (e.g., intrusion detection) can be built on top. The talk concludes with an overview of open challenges and research opportunities in this area.

Digital twin technology today is diverse and emerging and its full potential is not yet widely understood. The concept of a digital twin allows for the analysis, design, optimisation and evolution of systems to take place fully digital, or in conjunction with a cyber-physical system to improve speed, accuracy and efficiency when compared to traditional engineering approaches. Digital Twin technology is mainly used today as a digital replica of a physical system with the generated and observed data being used for applications such as predictive maintenance, fault analysis and optimisation. This is predominantly a data-driven approach that uses modern machine learning technologies to maximise the benefit of the available data. This talk proposes the semantic markup of digital twins to unlock the benefits of other aspects of Artificial Intelligence, namely semantic reasoning, to broaden the application facilitate deeper analysis of systems and their properties than can be achieved by analysing their data and behaviours through observation. The talk will explore potential synergies and barriers that need to be overcome for this approach to unlock future digital twin applications.

Novel IIoT architectures such as NOA (NAMUR Open Architecture) allow for delivery of raw or high-resolution IIoT data via dedicated data highways. This data is used for various purposes such as developing digital twin models, predictive maintenance and augmented reality applications, etc. These data can also be used as a source of forensic artefacts or even evidence when investigating cyber-physical attacks. In this talk we will show a specific example of how IIoT data is used to detect an ongoing attack on an industrial pump and determine its root cause. We will leave the audience with an open question about the requirement to the collection, transport and storage of IoT data to ensure their utility to incident response and admissibility as legal evidence.

Embedded systems and cyber-physical controllers have been proven vulnerable to security attacks of various nature, including man-in-the-middle attacks that alter sensor data and actuator commands, and attacks that disrupt the calculation of the control signals. While attack detection has been widely studied, countermeasures are scarce at best. We propose and implement a defence technique, based on executing the controller code in a trusted execution environment.

In this talk I give an overview of the work done in one of the three tracks within the Swedish research centre on Resilient Information and Control Systems (RICS) [2]. The three tracks involve a) Data emulation b) Attack modelling and risk analysis, and c) Anomaly detection. The work on the Data emulation part has resulted in a national virtual testbed RICS-el for Supervisory Control and Data Acquisition (SCADA) security analysis in an electricity distribution network with a commercial SCADA software, some 20 emulated substations connected with wide area networks, OT, DMZ and IT segments. It has so far been exposed in two published works in collaboration with several colleagues [3, 1]. This talk focuses on the latest publication where 12 attacks were performed in the testbed and the outcomes documented. The dataset from the attack scenarios and the baseline (no-attack) counterpart is available for sharing.

Digital twins aim to provide an extensive and scalable means to model and evaluate properties of real-world systems. Developing such digital twins for cyber-physical systems is non-trivial even more so at a high enough fidelity in order to suitably replicate behaviours of real-world systems when compromised or under attack. In this talk, I will reflect on experiences of over 8 years of research building cyber-physical systems security testbeds particularly those to support security analyses of industrial control systems. I will discuss challenges arising from the need to represent a diversity of devices, networking mechanisms and software platforms as well as scalability of experimentation and managing the complexity of the testbed environment itself. I will reflect on what research on digital twins can learn from these experiences and the potential for “physical” testbed environments to work in tandem with digital twins.

Within smart grids the safe and dependable distribution of electric power highly depends on the security of Supervisory Control and Data Acquisition (SCADA) systems and their underlying communication protocols. Existing network-based intrusion detection systems for Industrial Control Systems (ICS) are usually centrally applied at the SCADA server and do not take the underlying physical process into account. A recent line of work proposes an additional layer of security via a process-aware approach applied locally at the field stations. Currently, we broaden the scope of process-aware monitoring by considering the interaction between neighboring field stations, which facilitates upcoming trends of decentralized energy management (DEM). Local security monitoring is lifted to monitoring neighborhoods of field stations, therefore achieving a broader grid coverage w.r.t. security. We provide a distributed monitoring algorithm of the generated sensory readings for this extended setting. The feasibility of the approach is shown via a prototype simulation testbed and a scenario with two subgrids.

In this talk, we discuss two aspects of model- and data-based intrusion detection. First, we show how a centralized model- and data-based intrusion detector in an industrial control system can use analytical redundancy to first detect and then reconstruct attacked signals in local feedback loops, to achieve resilience. We discuss pros and cons of the model- and data-based detection schemes. Second, we discuss a necessary and sufficient condition for an adversary with access to sensor data to replicate the state of the control system, and in extension the intrusion detection system. Advanced adversaries use such state information to launch stealthy attacks, and our condition gives insights as to how to block such attacks. The condition also provides insights on the possibilities for adversaries to replicate and synchronize with the state of digital twins.

The talk is based on the following papers: [1, 2].

In this talk, we reflect on our research journey in the area of cybersecurity for industrial control systems. During our work on GPS spoofing [1], we noted two main challenges for precise GPS spoofing: i) the attacker needs to accurately create spoofed GPS signals (i.e., their signal strength, timing, etc), and ii) the attacker needs to carefully start the attack to slowly divert the victim’s state estimation (assuming prior synchronization to legitimate GPS signals) from the legitimate to the manipulated state. Such challenges that introduce control theoretic approaches to cybersecurity motivated us to further investigate cybersecurity for general Cyber-Physical Systems, in particular industrial control systems. To understand and experiment with such systems, we built several testbeds at SUTD in Singapore [2], and designed the MiniCPS framework [3] to emulate those environments. The resulting datasets turned out to be very useful for training and evaluation of process-aware attack detection systems [4, 5]. We also realized that tools such as MiniCPS could enable the construction of to digital twins – for example to be used as Honeynets, reference in anomaly detection, and for attack development and verification.