arXiv subjects

Tawfeeq Shawly

Publications and source records attributed to Tawfeeq Shawly.

2 recordsLinked to original sources

arXiv2019

A Partition-Driven Integrated Security Architecture for Cyber-Physical Systems

Emerging cyber-physical systems incorporate systems of systems that have functional interdependencies. With the increase in complexity of the cyber-physical systems, the attack surface also expands, making cyber-physical systems more vulnerable to cyber-attacks. The functional interdependencies exacerbate the security risk as a cyber-attack that compromises one constituent system of a cyber-physical system can disseminate to others. This can result in a cascade effect that can impair the operability of the whole cyber-physical system. In this article, we present a novel security architecture that localizes the cyber-attack in a timely manner, and simultaneously recovers the affected cyber-physical system functionality. We have evaluated the performance of the architecture for advanced metering infrastructure-based pricing cyber-attacks scenario. The simulation results exhibit the effectiveness of the proposed architecture in containing the attack in terms of system availability and its impact on the electric load distribution in the power grid.

eess.SY↗

arXiv2018

Architectures for Detecting Interleaved Multi-stage Network Attacks Using Hidden Markov Models

With the growing amount of cyber threats, the need for development of high-assurance cyber systems is becoming increasingly important. The objective of this paper is to address the challenges of modeling and detecting sophisticated network attacks, such as multiple interleaved attacks. We present the interleaving concept and investigate how interleaving multiple attacks can deceive intrusion detection systems. Using one of the important statistical machine learning (ML) techniques, Hidden Markov Models (HMM), we develop two architectures that take into account the stealth nature of the interleaving attacks, and that can detect and track the progress of these attacks. These architectures deploy a database of HMM templates of known attacks and exhibit varying performance and complexity. For performance evaluation, in the presence of multiple multi-stage attack scenarios, various metrics are proposed which include (1) attack risk probability, (2) detection error rate, and (3) the number of correctly detected stages. Extensive simulation experiments are used to demonstrate the efficacy of the proposed architectures.

cs.CR↗