Security for industrial control systems: the plants that move water, power and chemicals under the control of programmable logic controllers. Much of it uses a real water treatment testbed, so every attack and every defence has a physical process behind it. After eight years at iTrust this was familiar ground, seen from the student’s side for once.
Main ideas
- How PLCs are programmed, and how they talk to sensors and actuators over industrial protocols.
- Attack models: what an adversary can read, write or spoof, and where in the control loop.
- Detection, from thresholds and CUSUM to process invariants and learned anomaly detectors.
- Enough control theory to say what the plant should be doing.
- Formal models of plant behaviour with timed automata, and resilience assessment: how much an attack degrades the process, and how quickly it recovers.
The SWaT testbed was the running example.
Project
In a team of four, both sides of one problem on a water treatment testbed. On the attack side we studied a slow, coordinated bias across several treatment stages, where every reading stays in its normal range and below the usual alarms while the real process drifts. On the defence side we derived invariants from the plant’s design and from its operating history, checked them while the plant ran, and pointed to the stage where the physics and the reported state stopped agreeing.
Detectors tuned for sudden changes miss a slow bias. Invariants from the physics catch what a threshold on any single signal misses, and checking one stage against its neighbours says where the problem is as well as that there is one.
Relevance to my research
A robot is a control system with the same failure modes, so this carries over to robust robotics almost unchanged. Invariants checked at runtime are a form of runtime monitoring, and slow drift that builds up over time is the kind of fault long-term autonomy has to catch early. My older work on this is in cyber-physical security.