Cyber-Physical Security for Critical Infrastructures Protection: First International Workshop, CPS4CIP 2020, Guildford, UK, September 18, 2020, ... Papers (Lecture Notes in Computer Science)

This book constitutes the refereed proceedings of the First International Workshop on Cyber-Physical Security for Critical Infrastructures Protection, CPS4CIP 2020, which was organized in conjunction with the European Symposium on Research in Computer Security, ESORICS 2020, and held online on September 2020. The 14 full papers presented in this volume were carefully reviewed and selected from 24 submissions. They were organized in topical sections named: security threat intelligence; data anomaly detection: predict and prevent; computer vision and dataset for security; security management and governance; and impact propagation and power traffic analysis. The book contains 6 chapters which are available open access under a CC-BY license. Preface 6 Organization 8 Contents 10 Security Threat Intelligence 12 Privacy-Preserving CCTV Analytics for Cyber-Physical Threat Intelligence 13 1 Introduction 13 1.1 Object Detection 14 1.2 Human Pose Detection 15 2 CCTV Analytics Technology Description 16 2.1 Detection 17 2.2 Tracking 18 2.3 Event Generation 19 3 Application to Common Physical Security Scenarios 21 3.1 Scenario Data Centre 21 3.2 Scenario ATMs 22 3.3 Application to Other Segments 23 4 Deployment – from Server to Edge Computing 23 5 Conclusion 24 References 25 TLSAssistant Goes FINSEC A Security Platform Integration Extending Threat Intelligence Language 26 1 Introduction 26 2 Assisted Hardening of TLS Configuration 27 2.1 Vulnerabilities on TLS 28 2.2 TLSAssistant 28 2.3 TLS and Financial API 29 3 FINSEC Platform Overview 31 4 Integration with FINSEC Platform 32 4.1 STIX Output In TLSAssistant 32 4.2 FINSEC Connector 34 4.3 API and Queue Handling 35 5 Integration with Risk Assessment 36 6 Conclusions and Future Work 38 References 39 Cyber Threat Monitoring Systems - Comparing Attack Detection Performance of Ensemble Algorithms 41 1 Introduction 41 2 Cyber Threat Monitoring System 42 3 Ensemble Methods in Intrusion Detection 44 4 Datasets 44 5 Ensemble Optimization 45 5.1 Random Forest and Balanced Random Forest 46 5.2 Decision Tree 48 5.3 Adaboost and Rusboost 49 5.4 LightGBM 53 5.5 Experimental Results and Analysis 54 6 Conclusion 55 References 56 FINSTIX: A Cyber-Physical Data Model for Financial Critical Infrastructures 58 1 Introduction 58 2 Background 59 2.1 FINSEC Reference Architecture 59 2.2 STIX - Structured Threat Information eXpression 61 2.3 State of the Art on the Use of STIX 62 3 FINSTIX Cyber-Physical Data Model 63 3.1 Data Flow 66 4 Conclusions and Discussions 70 References 71 Data Anomaly Detection: Predict and Prevent 74 Inferring Anomaly Situation from Multiple Data Sources in Cyber Physical Systems 75 1 Introduction 75 2 Proposed Method 77 3 Case Study 79 4 Conclusions 83 References 83 Fusing RGB and Thermal Imagery with Channel State Information for Abnormal Activity Detection Using Multimodal Bidirectional LSTM 85 1 Introduction 85 2 Fusion of RGB and Thermal Imagery with Channel State Information 86 2.1 RGB Imagery 86 2.2 Thermal Imagery 87 2.3 Channel State Information 87 2.4 Fusion of RGB, Thermal and CSI Modalities 88 3 Bayesian Optimized Multimodal Bidirectional LSTM 88 3.1 Bidirectional LSTM 88 3.2 Bayesian Optimization 89 4 Experimental Evaluation 90 4.1 Experimental Setup 90 4.2 Experimental Results 90 5 Conclusion 92 References 93 A Cloud-Based Anomaly Detection for IoT Big Data 95 1 Introduction 95 1.1 Challenges and Our Contribution 96 1.2 Related Work 97 2 Cloud-Based Architecture 98 2.1 Anomaly Detection Unit 100 2.2 Anomaly Scoring 101 2.3 Generic Architecture 103 3 Exponential Smoothing Averages 103 3.1 Smoothing Average Behavior 104 4 Alert Budgeting 105 4.1 High-Level Budgeting Flow 107 4.2 Scalability 108 5 Results 109 6 Summary 110 References 111 Computer Vision and Dataset for Security 113 An Advanced Framework for Critical Infrastructure Protection Using Computer Vision Technologies 114 1 Introduction 115 2 Literature Review 116 2.1 Person Detection and Person Re-identification 116 2.2 Face Recognition 117 3 Critical Infrastructure Protection Framework 118 3.1 Computer Vision Technologies 118 3.2 Temporal Smoothing 121 3.3 Encrypted Media Repository 121 3.4 Privacy Preserving Technologies 121 3.5 Knowledge Model 122 3.6 Threat Evaluator 123 3.7 Command Centre 123 4 Experimental Results 124 5 Conclusion and Future Work 127 References 127 A Comprehensive Dataset from a Smart Grid Testbed for Machine Learning Based CPS Security Research 130 1 Introduction 130 1.1 Motivation 132 2 EPIC Testbed Introduction 133 2.1 Electrical Layout 134 2.2 Communication Network 135 3 Data Collection and Process Scenarios 136 4 Discussion 140 4.1 Normal Data for Real-World Process 140 4.2 Lack of Attack Scenarios on the Process 140 5 Potential Use Cases and Future Work 140 A Supporting Data 141 References 141 Security Management and Governance 143 Cross-Domain Security Asset Management for Healthcare 144 1 Introduction 145 2 Related Work 146 3 SAFECARE Architecture 147 3.1 Threat Detection Systems 147 3.2 Central Database and Decision Modules 148 3.3 Incidents and Impacts Messages 149 4 Hospital Availability Management System (HAMS) 149 4.1 Evaluation of Impact and Asset Availability 149 4.2 Asset-Centric Graph Visualization 150 4.3 Interoperable Information Exchange 150 5 Sample Scenario 151 5.1 Methodology 152 5.2 Scenario Description 152 5.3 Scenario Simulation 153 6 Conclusions and Future Work 158 References 158 Towards a Global CIs’ Cyber-Physical Security Management and Joint Coordination Approach 160 1 Introduction 160 2 Critical Infrastructures Description 161 2.1 Airport Facilities 161 2.2 Gas Infrastructure 162 2.3 Hospitals 163 3 Security and Protection of Critical Infrastructures in EU 163 3.1 Operation and Security Regulatory Framework 163 3.2 Security Measures and Technologies 165 3.3 Security Related Operation Centers 166 3.4 Crisis Management Process and Stakeholders Involved 167 3.5 CIs Security Management Gaps and Best Practices 168 4 Proposed Global CIs Cyber-Physical Security Management and Joint Coordination Approach 169 4.1 CIs Joint Coordination Approach and Structure 170 4.2 Global, Cyber-Physical Crisis Management Process 171 5 Conclusions 173 References 174 Toward a Context-Aware Methodology for Information Security Governance Assessment Validation 176 1 Introduction 176 2 Related Work and Background 178 3 Multi-layer Model 179 4 An Assessment Validation Methodology 182 5 Computing Coverage Validation Factors 184 5.1 Measurement Accuracy 186 6 Usage Scenario 187 7 Conclusion 190 References 190 Impact Propagation and Power Traffic Analysis 193 Impact Propagation in Airport Systems 194 1 Introduction 195 2 Approach 197 2.1 SATIE Toolkit and Ontology 197 2.2 Business Impact Assessment (BIA) 198 2.3 Impact Propagation Simulation (IPS) 199 3 Application 201 3.1 The Test Scenario 201 3.2 IPS Results Based on the Network Model 201 3.3 IPS Results Based on the ABM 203 4 Conclusion 205 References 206 A Comparative Analysis of Emulated and Real IEC-104 Spontaneous Traffic in Power System Networks 210 1 Introduction 210 2 Related Work 211 3 Background on the IEC-60780-5-104 Protocol 212 4 The Studied Datasets 213 5 Data Characterisation Methods 214 5.1 A Review of Potential Characteristics 215 5.2 A Review of Characterization Methods 215 5.3 Methods and Parameter Choices for the Comparative Analysis 217 6 Observations and Discussions 218 6.1 Spiky Distribution 218 6.2 Timing Predictability 220 6.3 Correlation 222 7 Conclusions 222 References 224 Author Index 227