arXiv subjects

Alessandro Erba

Publications and source records attributed to Alessandro Erba.

14 recordsLinked to original sources

arXiv2024

Sensor Deprivation Attacks for Stealthy UAV Manipulation

Unmanned Aerial Vehicles autonomously perform tasks with the use of state-of-the-art control algorithms. These control algorithms rely on the freshness and correctness of sensor readings. Incorrect control actions lead to catastrophic destabilization of the process. In this work, we propose a multi-part \emph{Sensor Deprivation Attacks} (SDAs), aiming to stealthily impact process control via sensor reconfiguration. In the first part, the attacker will inject messages on local buses that connect to the sensor. The injected message reconfigures the sensors, e.g.,~to suspend the sensing. In the second part, those manipulation primitives are selectively used to cause adversarial sensor values at the controller, transparently to the data consumer. In the third part, the manipulated sensor values lead to unwanted control actions (e.g. a drone crash). We experimentally investigate all three parts of our proposed attack. Our findings show that i)~reconfiguring sensors can have surprising effects on reported sensor values, and ii)~the attacker can stall the overall Kalman Filter state estimation, leading to a complete stop of control computations. As a result, the UAV becomes destabilized, leading to a crash or significant deviation from its planned trajectory (over 30 meters). We also propose an attack synthesis methodology that optimizes the timing of these SDA manipulations, maximizing their impact. Notably, our results demonstrate that these SDAs evade detection by state-of-the-art UAV anomaly detectors. Our work shows that attacks on sensors are not limited to continuously inducing random measurements, and demonstrate that sensor reconfiguration can completely stall the drone controller. In our experiments, state-of-the-art UAV controller software and countermeasures are unable to handle such manipulations. Hence, we also discuss new corresponding countermeasures.

cs.CR↗

arXiv2024

Anharmonic Vibrational States of Double-Well Potentials in the Solid State from DFT Calculations

We introduce a general approach for the simulation of quantum vibrational states of (symmetric and asymmetric) double-well potentials in molecules and materials for thermodynamic and spectroscopic applications. The method involves solving the nuclear Schr\"odinger equation associated with a one-mode potential of the type $V (Q) = aQ^2 + bQ^3 + cQ^4$ (with $a < 0$ and $c > 0$), and thus explicitly includes nuclear quantum effects. The potential, $V (Q)$, is obtained from density functional theory (DFT) calculations performed at displaced nuclear configurations along the selected normal mode, $Q$. The strategy has been implemented into the CRYSTAL electronic structure package and allows for i) the use of many density functional approximations, including hybrid ones, and ii) integration with a quasi-harmonic module. The method is applied to the spectroscopic characterization of soft lattice modes in two phases of the molecular crystal of thiourea: a low-temperature ferroelectric phase and a high-temperature paraelectric phase. Signature peaks associated to structural changes between the two phases are found in the terahertz region of the electromagnetic spectrum, which exhibit strong anharmonic character in their thermal evolution, as measured by temperature-dependent terahertz time-domain spectroscopy.

cond-mat.mtrl-sci↗

arXiv2024

Meta-Generalized-Gradient Approximation made Magnetic

The Jacob's ladder of density functional theory (DFT) proposes the compelling view that by extending the form of successful approximations -- being guided by exact conditions and selected (least empirical) norms -- upper rungs will do better than the lower, thus allowing to balance accuracy and computational effort. Meta-generalized-gradient-approximations (MGGAs) belong to the last rung of the semi-local approximations before hybridization with non-local wave function theories. Among the MGGAs, the Strongly Constrained and Appropriately Normed Approximation (SCAN) greatly improves upon GGAs from the lower rung. But the over magnetized solutions of SCAN make GGAs more reliable for magnetism. Here, we provide a solution that satisfies the most pressing {\em desiderata} for density functional approximations for ferromagnetic, antiferromagnetic and non-collinear states. The approach is available in an implementation in the \textsc{Crystal} electronic structure package.

cond-mat.mtrl-sci↗

arXiv2024

Electron localization function for non-collinear spins

Understanding of bonding is key to modelling materials and predicting properties thereof. A widely adopted indicator of bonds and atomic shells is the electron localization function (ELF). The building blocks of the ELF are also used in the construction of modern density functional approximations. Here we demonstrate that the ELF breaks down when applied beyond regular non-relativistic quantum states. We show that for tackling general non-collinear open-shell solutions, it is essential to address both the U(1) gauge invariance -- i.e., invariance under a multiplication by a position dependent phase factor -- and SU(2) gauge invariance -- i.e. invariance under local spin rotations -- {\em conjointly}. Remarkably, we find that the extended ELF also improves the description of paradigmatic collinear states.

cond-mat.mtrl-sci↗

arXiv2024

Spin-currents via the gauge-principle for meta-generalized-gradient exchange-correlation functionals

The prominence of density functional theory (DFT) in the field of electronic structure computation stems from its ability to usefully balance accuracy and computational effort. At the base of this ability is a functional of the electron density: the exchange-correlation energy. This functional satisfies known exact conditions that guide the derivation of approximations. The strongly-constrained-appropriately-normed (SCAN) approximation stands out as a successful, modern, example. In this work, we demonstrate how the SU(2) gauge-invariance of the exchange-correlation functional in spin current density functional theory allows us to add an explicit dependence on spin currents in the SCAN functional (here called JSCAN) -- and similar meta-generalized-gradient functional approximations -- solely invoking first principles. In passing, a spin-current dependent generalization of the electron localization function (here called JELF) is also derived. The extended forms are implemented in a developer's version of the \textsc{Crystal23} program. Applications on molecules and materials confirm the practical relevance of the extensions.

cond-mat.mtrl-sci↗

arXiv2023

Generalized Kohn-Sham Approach for the Electronic Band Structure of Spin-Orbit Coupled Materials

Spin-current density functional theory (SCDFT) is a formally exact framework designed to handle the treatment of interacting many-electron systems including spin-orbit coupling at the level of the Pauli equation. In practice, robust and accurate calculations of the electronic structure of these systems call for functional approximations that depend not only on the densities, but also on spin-orbitals. Here we show that the call can be answered by resorting to an extension of the Kohn-Sham formalism, which admits the use of non-local effective potentials, yet it is firmly rooted in SCDFT. The power of the extended formalism is demonstrated by calculating the spin-orbit-induced band-splittings of inversion-asymmetric MoSe$_2$ monolayer and inversion-symmetric bulk $\alpha$-MoTe$_2$. We show that quantitative agreement with experimental data is obtainable via global hybrid approximations by setting the fraction of Fock exchange at the same level which yields accurate values of the band gap. Key to these results is the ability of the method to self-consistently account for the spin currents induced by the spin-orbit interaction. The widely used method of refining spin-density functional theory by a second-variational treatment of spin-orbit coupling is unable to match our SCDFT results.

cond-mat.mtrl-sci↗

arXiv2023

Structural Relaxation of Materials with Spin-Orbit Coupling: Analytical Forces in Spin-Current DFT

Analytical gradients of the total energy are provided for local density and generalized-gradient hybrid approximations to generalized Kohn-Sham spin-current density functional theory (SCDFT). It is shown that gradients may be determined analytically, in a two-component framework, including spin-orbit coupling (SOC), with high accuracy. We demonstrate that renormalization of the electron-electron potential by SOC-induced spin-currents can account for considerable modification of crystal structures. In the case of Iodine-based molecular crystals, the effect may amount to more than half of the total modification of the structure by SOC. Such effects necessitate an SCDFT, rather than DFT, formulation, in which exchange-correlation functionals are endowed with an explicit dependence on spin-current densities. An implementation is presented in the \textsc{Crystal} program.

cond-mat.mtrl-sci↗

arXiv2023

Anharmonic Terms of the Potential Energy Surface: A Group Theoretical Approach

In the framework of density functional theory (DFT) simulations of molecules and materials, anharmonic terms of the potential energy surface are commonly computed numerically, with an associated cost that rapidly increases with the size of the system. Recently, an efficient approach to calculate cubic and quartic interatomic force constants in the basis of normal modes [Theor. Chem. Acc., 120, 23 (2008)] was implemented in the Crystal program [J. Chem. Theory Comput., 15, 3755-3765 (2019)]. By applying group theory, we are able to further reduce the associated computational cost, as the exploitation of point symmetry can significantly reduce the number of distinct atomically displaced nuclear configurations to be explicitly explored for energy and forces calculations. Our strategy stems from Wigner's theorem and the fact that normal modes are bases of the irreducible representations (irreps) of the point group. The proposed group theoretical approach is implemented in the Crystal program and its efficiency assessed on six test case systems: four molecules (methane, CH4; tetrahedrane, C4H4; cyclo-exasulfur, S6; cubane, C8H8), and two three-dimensional crystals (Magnesium oxide, MgO; and a prototypical Zinc-imidazolate framework, ZIF-8). The speedup imparted by this approach is consistently very large in all high-symmetry molecular and periodic systems, peaking at 76% for MgO.

cond-mat.mtrl-sci↗

arXiv2023

Perturbation Theory Treatment of Spin-Orbit Coupling. III: Coupled Perturbed Method for Solids

A previously proposed non-canonical coupled-perturbed Kohn-Sham density functional theory (KS-DFT)/Hartree-Fock (HF) treatment for spin-orbit coupling is here generalized to infinite periodic systems. The scalar-relativistic periodic KS-DFT/HF solution, obtained with a relativistic effective core potential, is taken as the zeroth-order approximation. Explicit expressions are given for the total energy through 3rd-order, which satisfy the 2N + 1 rule (i.e. requiring only the 1st-order perturbed wave function for determining the energy through 3rd-order). Expressions for additional 2nd-order corrections to the perturbed wave function (as well as related one-electron properties) are worked out at the uncoupled-perturbed level of theory. The approach is implemented in the \textsc{Crystal} program and validated with calculations of the total energy, electronic band structure, and density variables of spin-current DFT on the tungsten dichalcogenide hexagonal bilayer series (i.e. WSe$_2$, WTe$_2$, WPo$_2$, WLv$_2$), including 6p and 7p elements as a stress test. The computed properties through second- or third-order match well with those from reference two-component self-consistent field (2c-SCF) calculations. For total energies, $E^{(3)}$ was found to consistently improve the agreement against the 2c-SCF reference values. For electronic band structures, visible differences w.r.t. 2c-SCF remained through second-order in only the single-most difficult case of WLv$_2$. As for density variables of spin-current DFT, the perturbed electron density, being vanishing in first-order, is the most challenging for the perturbation theory approach. The visible differences in the electron densities are, however, largest close to the core region of atoms and smaller in the valence region. Perturbed spin-current densities, on the other hand, are well reproduced in all tested cases.

cond-mat.mtrl-sci↗

arXiv2023

Efficient Calculation of Derivatives of Integrals in a Basis of Non-Separable Gaussians Through Exploitation of Sparsity

A computational procedure is developed for the efficient calculation of derivatives of integrals over non-separable Gaussian-type basis functions, used for the evaluation of gradients of the total energy in quantum-mechanical simulations. The approach, based on symbolic computation with computer algebra systems and automated generation of optimized subroutines, takes full advantage of sparsity and is here applied to first energy derivatives with respect to nuclear displacements and lattice parameters of molecules and materials. The implementation in the \textsc{Crystal} code is presented and the considerably improved computational efficiency over the previous implementation is illustrated. To this purpose, three different tasks involving the use of analytical forces are considered: i) geometry optimization; ii) harmonic frequency calculation; iii) elastic tensor calculation. Three test case materials are selected as representatives of different classes: i) a metallic 2D model of the Cu (111) surface; ii) a wide-gap semiconductor ZnO crystal, with a wurtzite-type structure; and iii) a porous metal-organic crystal, namely the ZIF-8 Zinc-imidazolate framework. Finally, it is argued that the present symbolic approach is particularly amenable to generalizations, and its potential application to other derivatives is sketched.

cond-mat.mtrl-sci↗

arXiv2022

Spin Current Density Functional Theory of the Quantum Spin-Hall Phase

The spin current density functional theory (SCDFT) is the generalization of the standard DFT to treat a fermionic system embedded in the effective external field produced by the spin-orbit coupling interaction. Even in the absence of a spin polarization, the SCDFT requires the electron-electron potential to depend on the spin currents $\mathbf{J}^x$, $\mathbf{J}^y$ and $\mathbf{J}^z$, which only recently was made possible for practical relativistic quantum-mechanical simulations [Phys. Rev. B {\bf 102}, 235118 (2020)]. Here, we apply the SCDFT to the quantum spin-Hall phase and show how it improves (even qualitatively) the description of its electronic structure relative to the DFT. We study the Bi (001) 2D bilayer and its band insulator to topological insulator phase transition (via $s+p_z \leftrightarrow p_x +ip_y$ band inversion) as a function of mechanical strain. We show that the explicit account of spin currents in the electron-electron potential of the SCDFT is key to the appearance of a Dirac cone at the $\Gamma$ point in the valence band structure at the onset of the topological phase transition. Finally, the valence band structure of this system is rationalized using a simple first-order $\mathbf{k} \cdot \mathbf{p}$ quasi-degenerate perturbation theory model.

cond-mat.mtrl-sci↗

arXiv2021

Security Analysis of Vendor Implementations of the OPC UA Protocol for Industrial Control Systems

The OPC UA protocol is an upcoming de-facto standard for building Industry 4.0 processes in Europe, and one of the few industrial protocols that promises security features to prevent attackers from manipulating and damaging critical infrastructures. Despite the importance of the protocol, challenges in the adoption of OPC UA's security features by product vendors, libraries implementing the standard, and end-users were not investigated so far. In this work, we systematically investigate 48 publicly available artifacts consisting of products and libraries for OPC UA and show that 38 out of the 48 artifacts have one (or more) security issues. In particular, we show that 7 OPC UA artifacts do not support the security features of the protocol at all. In addition, 31 artifacts that partially feature OPC UA security rely on incomplete libraries and come with misleading instructions. Consequently, relying on those products and libraries will result in vulnerable implementations of OPC UA security features. To verify our analysis, we design, implement, and demonstrate attacks in which the attacker can steal credentials exchanged between victims, eavesdrop on process information, manipulate the physical process through sensor values and actuator commands, and prevent the detection of anomalies.

cs.CR↗

arXiv2020

No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems

In recent years, a number of process-based anomaly detection schemes for Industrial Control Systems were proposed. In this work, we provide the first systematic analysis of such schemes, and introduce a taxonomy of properties that are verified by those detection systems. We then present a novel general framework to generate adversarial spoofing signals that violate physical properties of the system, and use the framework to analyze four anomaly detectors published at top security conferences. We find that three of those detectors are susceptible to a number of adversarial manipulations (e.g., spoofing with precomputed patterns), which we call Synthetic Sensor Spoofing and one is resilient against our attacks. We investigate the root of its resilience and demonstrate that it comes from the properties that we introduced. Our attacks reduce the Recall (True Positive Rate) of the attacked schemes making them not able to correctly detect anomalies. Thus, the vulnerabilities we discovered in the anomaly detectors show that (despite an original good detection performance), those detectors are not able to reliably learn physical properties of the system. Even attacks that prior work was expected to be resilient against (based on verified properties) were found to be successful. We argue that our findings demonstrate the need for both more complete attacks in datasets, and more critical analysis of process-based anomaly detectors. We plan to release our implementation as open-source, together with an extension of two public datasets with a set of Synthetic Sensor Spoofing attacks as generated by our framework.

cs.CR↗

arXiv2019

Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems

Recently, reconstruction-based anomaly detection was proposed as an effective technique to detect attacks in dynamic industrial control networks. Unlike classical network anomaly detectors that observe the network traffic, reconstruction-based detectors operate on the measured sensor data, leveraging physical process models learned a priori. In this work, we investigate different approaches to evade prior-work reconstruction-based anomaly detectors by manipulating sensor data so that the attack is concealed. We find that replay attacks (commonly assumed to be very strong) show bad performance (i.e., increasing the number of alarms) if the attacker is constrained to manipulate less than 95% of all features in the system, as hidden correlations between the features are not replicated well. To address this, we propose two novel attacks that manipulate a subset of the sensor readings, leveraging learned physical constraints of the system. Our attacks feature two different attacker models: A white box attacker, which uses an optimization approach with a detection oracle, and a black box attacker, which uses an autoencoder to translate anomalous data into normal data. We evaluate our implementation on two different datasets from the water distribution domain, showing that the detector's Recall drops from 0.68 to 0.12 by manipulating 4 sensors out of 82 in WADI dataset. In addition, we show that our black box attacks are transferable to different detectors: They work against autoencoder-, LSTM-, and CNN-based detectors. Finally, we implement and demonstrate our attacks on a real industrial testbed to demonstrate their feasibility in real-time.

cs.CR↗