Current analytical methods are inadequate in uncovering the internal propagation mechanisms of disturbances and the interconnections between subsystems in the wind turbine-storage integrated grid connected system, which faces stability issues. Therefore, this paper employs a damping module modelling approach to conduct a dynamic analysis of the dynamic interactions in wind turbine-storage storage integrated systems, focusing on the damping path analysis with the phase-locked loop (PLL) as the oscillation mode. The research initiates with the linearisation of the doubly-fed induction generator (DFIG) and energy storage system (ESS) models. The closed-loop structure of the system is then presented to expose the disturbance propagation paths between subsystems. Subsequently, the damping coefficients of the second-order dynamic equation are expanded to include the dynamic equations of the most prominent oscillation mode, which establishes stability criteria for the system. Finally, by performing damping decomposition and reconstruction, the damping coefficients of each subsystem as well as the total damping coefficient of the interconnection system are obtained. An analysis is conducted on how the proportional-integral parameters of the PLL affect the damping of the interconnection system. The results suggest that the damping paths of the DFIG and the ESS can be expressed as a closed-loop structure diagram. By decreasing the proportional or integral coefficients of the PLL, the overall damping coefficient is increased, resulting in an enhancement of the stability of the grid-connected system.
{"title":"Analysis of Damping Characteristics in Wind Turbine-Energy Storage Hybrid Systems Based on Path Module","authors":"Shanshan Cheng, Haixin Wang, Jing Li, Shengyang Lu, Xinyi Lu, Junyou Yang, Zhe Chen","doi":"10.1049/cps2.70006","DOIUrl":"https://doi.org/10.1049/cps2.70006","url":null,"abstract":"<p>Current analytical methods are inadequate in uncovering the internal propagation mechanisms of disturbances and the interconnections between subsystems in the wind turbine-storage integrated grid connected system, which faces stability issues. Therefore, this paper employs a damping module modelling approach to conduct a dynamic analysis of the dynamic interactions in wind turbine-storage storage integrated systems, focusing on the damping path analysis with the phase-locked loop (PLL) as the oscillation mode. The research initiates with the linearisation of the doubly-fed induction generator (DFIG) and energy storage system (ESS) models. The closed-loop structure of the system is then presented to expose the disturbance propagation paths between subsystems. Subsequently, the damping coefficients of the second-order dynamic equation are expanded to include the dynamic equations of the most prominent oscillation mode, which establishes stability criteria for the system. Finally, by performing damping decomposition and reconstruction, the damping coefficients of each subsystem as well as the total damping coefficient of the interconnection system are obtained. An analysis is conducted on how the proportional-integral parameters of the PLL affect the damping of the interconnection system. The results suggest that the damping paths of the DFIG and the ESS can be expressed as a closed-loop structure diagram. By decreasing the proportional or integral coefficients of the PLL, the overall damping coefficient is increased, resulting in an enhancement of the stability of the grid-connected system.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-03-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70006","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143571232","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kavita Bhatia, Santosh K. Pandey, Vivek K. Singh, Deena Nath Gupta
XSPA vulnerability can be attacked by stealing the cookie's information. In this case, it becomes utmost necessary to secure the information written in a cookie. A cookie contains a session ID that is a unique number generated by the server. This session ID must be a large random number so that no one can guess a valid session ID in real-time. Numerous research studies have been accomplished on the same but the area still persist gaps in view of emerging threats, such as phishing, pharming, and DoS. This paper proposes a new random-number generator that produces unique numbers in bulk. This helps the server to match the high demand of unique session IDs from different clients. The proposed generator is suitable for all types of web applications, because it requires the smallest area of only 134 Gate Equivalent on the application specific integrated circuit (ASIC) for its execution. Additionally, the proposed generator passed all tests of EPCglobal. Total time delay of digital circuit and power analysis results presented in the subsequent sections are also in the favour of proposed generator. With the implementation of this proposed technique cookies are expected to be more secure as evident from try-out results.
{"title":"Securing Ports of Web Applications Against Cross Site Port Attack (XSPA) by Using a Strong Session Identifier (Session ID)","authors":"Kavita Bhatia, Santosh K. Pandey, Vivek K. Singh, Deena Nath Gupta","doi":"10.1049/cps2.70005","DOIUrl":"https://doi.org/10.1049/cps2.70005","url":null,"abstract":"<p>XSPA vulnerability can be attacked by stealing the cookie's information. In this case, it becomes utmost necessary to secure the information written in a cookie. A cookie contains a session ID that is a unique number generated by the server. This session ID must be a large random number so that no one can guess a valid session ID in real-time. Numerous research studies have been accomplished on the same but the area still persist gaps in view of emerging threats, such as phishing, pharming, and DoS. This paper proposes a new random-number generator that produces unique numbers in bulk. This helps the server to match the high demand of unique session IDs from different clients. The proposed generator is suitable for all types of web applications, because it requires the smallest area of only 134 Gate Equivalent on the application specific integrated circuit (ASIC) for its execution. Additionally, the proposed generator passed all tests of EPCglobal. Total time delay of digital circuit and power analysis results presented in the subsequent sections are also in the favour of proposed generator. With the implementation of this proposed technique cookies are expected to be more secure as evident from try-out results.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-02-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70005","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143481347","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A surge of digital technologies adopted into Industrial Control Systems (ICS) exposes critical infrastructures to increasingly hostile and well-organised cybercrime. The increased need for flexibility and convenient administration expands the attack surface. Likewise, an insider with authorised access reveals a difficult-to-detect attack vector. Because of the range of critical services that ICS provide, disruptions to operations could have devastating consequences making ICS an attractive target for sophisticated threat actors. Hence, the authors introduce a novel anomalous behaviour detection model for ICS data streams from physical plant sensors. A model for one-class classification is developed, using stream rebalancing followed by adaptive machine learning algorithms coupled with drift detection methods to detect anomalies from physical plant sensor data. The authors’ approach is shown on ICS datasets. Additionally, a use case illustrates the model's applicability to post-incident investigations as part of a defence-in-depth capability in ICS. The experimental results show that the proposed model achieves an overall Matthews Correlation Coefficient score of 0.999 and Cohen's Kappa score of 0.9986 on limited variable single-type anomalous behaviour per data stream. The results on wide data streams achieve an MCC score of 0.981 and a K score of 0.9808 in the prevalence of multiple types of anomalous instances.
{"title":"Adaptive learning anomaly detection and classification model for cyber and physical threats in industrial control systems","authors":"Gabriela Ahmadi-Assalemi, Haider Al-Khateeb, Vladlena Benson, Bogdan Adamyk, Meryem Ammi","doi":"10.1049/cps2.70004","DOIUrl":"https://doi.org/10.1049/cps2.70004","url":null,"abstract":"<p>A surge of digital technologies adopted into Industrial Control Systems (ICS) exposes critical infrastructures to increasingly hostile and well-organised cybercrime. The increased need for flexibility and convenient administration expands the attack surface. Likewise, an insider with authorised access reveals a difficult-to-detect attack vector. Because of the range of critical services that ICS provide, disruptions to operations could have devastating consequences making ICS an attractive target for sophisticated threat actors. Hence, the authors introduce a novel anomalous behaviour detection model for ICS data streams from physical plant sensors. A model for one-class classification is developed, using stream rebalancing followed by adaptive machine learning algorithms coupled with drift detection methods to detect anomalies from physical plant sensor data. The authors’ approach is shown on ICS datasets. Additionally, a use case illustrates the model's applicability to post-incident investigations as part of a defence-in-depth capability in ICS. The experimental results show that the proposed model achieves an overall Matthews Correlation Coefficient score of 0.999 and Cohen's Kappa score of 0.9986 on limited variable single-type anomalous behaviour per data stream. The results on wide data streams achieve an MCC score of 0.981 and a K score of 0.9808 in the prevalence of multiple types of anomalous instances.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-02-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70004","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143404626","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
There are complex correlations between facial expression and facial landmarks in facial images. The facial landmarks detection technology is more mature than the facial expression recognition methods. Considering this, in order to better address the problem of interclass similarity and intraclass discrepancy in facial expressions recognition (FER), facial landmarks are used to supervise the learning of facial expression features in our work, and a multiscale and multilevel fusion network based on ResNet and MobileFaceNet (MMFRM) is proposed for FER. Specifically, the authors designed a triple CBAM feature fusion module (TCFFM) that characterises the correlation between facial expression and facial landmarks to better guide the learning of expression features. Furthermore, the proposed loss function of removing facial residual features (RFLoss) can suppress facial features and highlight expression features. We extensively validate our proposed MMFRM on two public facial expression datasets, demonstrating the effectiveness of our method.
{"title":"A multiscale and multilevel fusion network based on ResNet and MobileFaceNet for facial expression recognition","authors":"Jiao Ding, Tianfei Zhang, Li Yang, Tianhan Hu","doi":"10.1049/cps2.70003","DOIUrl":"https://doi.org/10.1049/cps2.70003","url":null,"abstract":"<p>There are complex correlations between facial expression and facial landmarks in facial images. The facial landmarks detection technology is more mature than the facial expression recognition methods. Considering this, in order to better address the problem of interclass similarity and intraclass discrepancy in facial expressions recognition (FER), facial landmarks are used to supervise the learning of facial expression features in our work, and a multiscale and multilevel fusion network based on ResNet and MobileFaceNet (MMFRM) is proposed for FER. Specifically, the authors designed a triple CBAM feature fusion module (TCFFM) that characterises the correlation between facial expression and facial landmarks to better guide the learning of expression features. Furthermore, the proposed loss function of removing facial residual features (RFLoss) can suppress facial features and highlight expression features. We extensively validate our proposed MMFRM on two public facial expression datasets, demonstrating the effectiveness of our method.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-02-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70003","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143379956","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Coupled multidisciplinary systems are fundamental to many complex engineering systems, such as those in cyber–physical systems, aerospace engineering, automotive systems, energy networks, and robotics. Accurate analysis, control, and monitoring of these systems depend on effectively inferring their inherent uncertainties. However, the dynamic nature of these systems, along with the interconnectivity of various disciplines, poses significant challenges for uncertainty estimation. This paper presents a framework for learning uncertainty distributions in partially observed coupled multidisciplinary systems. By employing a non-linear/non-Gaussian hidden Markov model (HMM) representation, the authors capture the stochastic nature of system states and observations. The proposed methodology leverages particle filtering techniques and Bayesian optimisation for efficient parameter estimation, accounting for the inherent uncertainties in input statistics. Numerical experiments on a coupled aerodynamics-structures system and a power converter system demonstrate the efficacy of the proposed method in estimating input distribution statistics. The results highlight the critical importance of accounting for non-stationary behaviours in coupled multidisciplinary systems for capturing the true variability of input statistics and showcase the superiority of our method over approaches that assume data derive from the stationary state of the system.
{"title":"Efficient learning of uncertainty distributions in coupled multidisciplinary systems through sensory data","authors":"Negar Asadi, Seyede Fatemeh Ghoreishi","doi":"10.1049/cps2.70000","DOIUrl":"https://doi.org/10.1049/cps2.70000","url":null,"abstract":"<p>Coupled multidisciplinary systems are fundamental to many complex engineering systems, such as those in cyber–physical systems, aerospace engineering, automotive systems, energy networks, and robotics. Accurate analysis, control, and monitoring of these systems depend on effectively inferring their inherent uncertainties. However, the dynamic nature of these systems, along with the interconnectivity of various disciplines, poses significant challenges for uncertainty estimation. This paper presents a framework for learning uncertainty distributions in partially observed coupled multidisciplinary systems. By employing a non-linear/non-Gaussian hidden Markov model (HMM) representation, the authors capture the stochastic nature of system states and observations. The proposed methodology leverages particle filtering techniques and Bayesian optimisation for efficient parameter estimation, accounting for the inherent uncertainties in input statistics. Numerical experiments on a coupled aerodynamics-structures system and a power converter system demonstrate the efficacy of the proposed method in estimating input distribution statistics. The results highlight the critical importance of accounting for non-stationary behaviours in coupled multidisciplinary systems for capturing the true variability of input statistics and showcase the superiority of our method over approaches that assume data derive from the stationary state of the system.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-02-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70000","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143111841","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Shaurya Purohit, Manimaran Govindarasu, Benjamin Blakely
With the ongoing development of Distributed Energy Resources (DER) communication networks, the imperative for strong cybersecurity and data privacy safeguards is increasingly evident. DER networks, which rely on protocols such as Distributed Network Protocol 3 and Modbus, are susceptible to cyberattacks such as data integrity breaches and denial of service due to their inherent security vulnerabilities. This paper introduces an innovative Federated Learning (FL)-based anomaly detection system designed to enhance the security of DER networks while preserving data privacy. Our models leverage Vertical and Horizontal Federated Learning to enable collaborative learning while preserving data privacy, exchanging only non-sensitive information, such as model parameters, and maintaining the privacy of DER clients' raw data. The effectiveness of the models is demonstrated through its evaluation on datasets representative of real-world DER scenarios, showcasing significant improvements in accuracy and F1-score across all clients compared to the traditional baseline model. Additionally, this work demonstrates a consistent reduction in loss function over multiple FL rounds, further validating its efficacy and offering a robust solution that balances effective anomaly detection with stringent data privacy needs.
{"title":"FL-ADS: Federated learning anomaly detection system for distributed energy resource networks","authors":"Shaurya Purohit, Manimaran Govindarasu, Benjamin Blakely","doi":"10.1049/cps2.70001","DOIUrl":"https://doi.org/10.1049/cps2.70001","url":null,"abstract":"<p>With the ongoing development of Distributed Energy Resources (DER) communication networks, the imperative for strong cybersecurity and data privacy safeguards is increasingly evident. DER networks, which rely on protocols such as Distributed Network Protocol 3 and Modbus, are susceptible to cyberattacks such as data integrity breaches and denial of service due to their inherent security vulnerabilities. This paper introduces an innovative Federated Learning (FL)-based anomaly detection system designed to enhance the security of DER networks while preserving data privacy. Our models leverage Vertical and Horizontal Federated Learning to enable collaborative learning while preserving data privacy, exchanging only non-sensitive information, such as model parameters, and maintaining the privacy of DER clients' raw data. The effectiveness of the models is demonstrated through its evaluation on datasets representative of real-world DER scenarios, showcasing significant improvements in accuracy and F1-score across all clients compared to the traditional baseline model. Additionally, this work demonstrates a consistent reduction in loss function over multiple FL rounds, further validating its efficacy and offering a robust solution that balances effective anomaly detection with stringent data privacy needs.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-01-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.70001","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143120821","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Leen Al Homoud, Namrata Barpanda, Vinicius Bobato, Ana Goulart, Kate Davis, Mark Rice
Electric power systems are composed of physical and cyber sub-systems. The sub-systems depend on each other. If the cyber sub-system is compromised by a cyber threat, what is the impact on the physical system? This paper presents a case study that shows the steps of a multi-stage cyber threat involving a database injection attack, and what happens to the power system if this threat is not detected in its early stages. The threat first affects one utility but it can spread to the balancing authority, which is responsible for keeping the voltage and frequency stable in the power grid. During the cyber threat, the authors also show defence tools, such as a cyber-physical data fusion tool that displays and analyses power and cyber telemetry.
{"title":"Analysing a multi-stage cyber threat and its impact on the power system","authors":"Leen Al Homoud, Namrata Barpanda, Vinicius Bobato, Ana Goulart, Kate Davis, Mark Rice","doi":"10.1049/cps2.12107","DOIUrl":"https://doi.org/10.1049/cps2.12107","url":null,"abstract":"<p>Electric power systems are composed of physical and cyber sub-systems. The sub-systems depend on each other. If the cyber sub-system is compromised by a cyber threat, what is the impact on the physical system? This paper presents a case study that shows the steps of a multi-stage cyber threat involving a database injection attack, and what happens to the power system if this threat is not detected in its early stages. The threat first affects one utility but it can spread to the balancing authority, which is responsible for keeping the voltage and frequency stable in the power grid. During the cyber threat, the authors also show defence tools, such as a cyber-physical data fusion tool that displays and analyses power and cyber telemetry.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2025-01-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12107","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143118620","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hamed M. Binqadhi, Mohammed M. AlMuhaini, H. Vincent Poor, David Flynn, Hao Huang
Cyber-physical power systems (CPPS) are integral to meeting society's demand for secure, sustainable, affordable and resilient critical networks and services. Given the convergence of decarbonising, heating, cooling, and transportation networks onto cyber-physical power systems (CPPS), this takes on increased significance. This paper introduces an innovative approach to the open challenge of how we evaluate CPPS resilience, presenting the use of network motifs and Monte Carlo simulations. We demonstrate how our methodology enables a comprehensive analysis of CPPS by capturing the interdependence between cyber and physical networks and by accounting for inherent uncertainties in cyber and physical components. Specifically, this method incorporates the dynamic interplay between the physical and cyber networks, presenting a time-dependent motif-based resilience metric. This metric evaluates CPPS performance in maintaining critical loads during and after diverse extreme events in cyber and/or physical layers. The resilience status of the system is determined using the prevalence of 4-node motifs within the system's network, offering valuable redundant paths for critical load supply. The study models a variety of natural events, including earthquakes, windstorms, and tornadoes, along with cyber-attacks while accounting for their inherent uncertainties using Monte Carlo simulation. The proposed approach is demonstrated through two test CPPS, specifically the IEEE 14-bus and IEEE 30-bus test systems, affirming its effectiveness in quantifying CPPS resilience. By comprehensively addressing system dynamics, interdependencies, and uncertainties, the proposed technique advances our understanding of CPPS and supports resilient system design.
{"title":"Motif-based resiliency assessment for cyber-physical power systems under various hazards","authors":"Hamed M. Binqadhi, Mohammed M. AlMuhaini, H. Vincent Poor, David Flynn, Hao Huang","doi":"10.1049/cps2.12103","DOIUrl":"https://doi.org/10.1049/cps2.12103","url":null,"abstract":"<p>Cyber-physical power systems (CPPS) are integral to meeting society's demand for secure, sustainable, affordable and resilient critical networks and services. Given the convergence of decarbonising, heating, cooling, and transportation networks onto cyber-physical power systems (CPPS), this takes on increased significance. This paper introduces an innovative approach to the open challenge of how we evaluate CPPS resilience, presenting the use of network motifs and Monte Carlo simulations. We demonstrate how our methodology enables a comprehensive analysis of CPPS by capturing the interdependence between cyber and physical networks and by accounting for inherent uncertainties in cyber and physical components. Specifically, this method incorporates the dynamic interplay between the physical and cyber networks, presenting a time-dependent motif-based resilience metric. This metric evaluates CPPS performance in maintaining critical loads during and after diverse extreme events in cyber and/or physical layers. The resilience status of the system is determined using the prevalence of 4-node motifs within the system's network, offering valuable redundant paths for critical load supply. The study models a variety of natural events, including earthquakes, windstorms, and tornadoes, along with cyber-attacks while accounting for their inherent uncertainties using Monte Carlo simulation. The proposed approach is demonstrated through two test CPPS, specifically the IEEE 14-bus and IEEE 30-bus test systems, affirming its effectiveness in quantifying CPPS resilience. By comprehensively addressing system dynamics, interdependencies, and uncertainties, the proposed technique advances our understanding of CPPS and supports resilient system design.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2024-12-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12103","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143362384","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Demand for autonomous protection in computing devices cannot go unnoticed, considering the rapid proliferation of deployed devices and escalating cyberattacks. Consequently, cybersecurity measures with an improved generalisation that can proactively determine the indicators of compromises to predict 0-day threats or previously unseen malware together with known malware are highly desirable. In this article, the authors present a novel concept of autonomous device protection based on behavioural profiling by continuously monitoring internal resource usage and leveraging generative artificial intelligence (genAI) to distinguish between benign and malicious behaviour. The authors design a proof-of-concept for Windows-based computing devices relying on a built-in event tracing mechanism for log collection that is converted into structured data using a graph data structure. The authors extract graph-level features, that is, graph depth, nodes count, number of leaf nodes, node degree statistics, and events count and node-level features (NLF), that is, process start, file create and registry events details for each graph. Further, the authors investigate the use of genAI exploiting a pre-trained large language network—a simple contrastive sentence embedding framework to extract strong features, that is, dense vectors from event graphs. Finally, the authors train a random forest classifier using both the graph-level features and NLF to obtain classification models that are evaluated on a collected dataset containing one thousand benign and malicious samples achieving accuracy up to 99.25%.
{"title":"Towards autonomous device protection using behavioural profiling and generative artificial intelligence","authors":"Sandeep Gupta, Bruno Crispo","doi":"10.1049/cps2.12102","DOIUrl":"https://doi.org/10.1049/cps2.12102","url":null,"abstract":"<p>Demand for autonomous protection in computing devices cannot go unnoticed, considering the rapid proliferation of deployed devices and escalating cyberattacks. Consequently, cybersecurity measures with an improved generalisation that can proactively determine the indicators of compromises to predict 0-day threats or previously unseen malware together with known malware are highly desirable. In this article, the authors present a novel concept of autonomous device protection based on behavioural profiling by continuously monitoring internal resource usage and leveraging generative artificial intelligence (genAI) to distinguish between benign and malicious behaviour. The authors design a proof-of-concept for Windows-based computing devices relying on a built-in event tracing mechanism for log collection that is converted into structured data using a graph data structure. The authors extract graph-level features, that is, <i>graph depth, nodes count, number of leaf nodes, node degree statistics, and events count</i> and node-level features (NLF), that is, <i>process start, file create and registry events details</i> for each graph. Further, the authors investigate the use of genAI exploiting a pre-trained large language network—<i>a simple contrastive sentence embedding framework</i> to extract strong features, that is, dense vectors from event graphs. Finally, the authors train a random forest classifier using both the graph-level features and NLF to obtain classification models that are evaluated on a collected dataset containing one thousand benign and malicious samples achieving accuracy up to 99.25%.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"10 1","pages":""},"PeriodicalIF":1.7,"publicationDate":"2024-12-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12102","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143362801","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
The modern Industrial Control System (ICS) environment now combines information technology (IT), operational technology, and physical processes. This digital transformation enhances operational efficiency, service quality, and physical system capabilities enabling systems to measure and control the physical world. However, it also exposes ICS to new and evolving cybersecurity threats that were once confined to the IT domain. As a result, identifying cyber risks in ICS has become more critical, leading to the development of new methods and tools to tackle these emerging threats. This study reviews some of the latest tools for cyber-risk identification in ICS. It empirically analyses each tool based on specific attributes: focus, application domain, core risk management concepts, and how they address current cybersecurity concerns in ICS.
{"title":"Winning the battle with cyber risk identification tools in industrial control systems: A review","authors":"Ayo Rotibi, Neetesh Saxena, Pete Burnap","doi":"10.1049/cps2.12105","DOIUrl":"https://doi.org/10.1049/cps2.12105","url":null,"abstract":"<p>The modern Industrial Control System (ICS) environment now combines information technology (IT), operational technology, and physical processes. This digital transformation enhances operational efficiency, service quality, and physical system capabilities enabling systems to measure and control the physical world. However, it also exposes ICS to new and evolving cybersecurity threats that were once confined to the IT domain. As a result, identifying cyber risks in ICS has become more critical, leading to the development of new methods and tools to tackle these emerging threats. This study reviews some of the latest tools for cyber-risk identification in ICS. It empirically analyses each tool based on specific attributes: focus, application domain, core risk management concepts, and how they address current cybersecurity concerns in ICS.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":"9 4","pages":"350-365"},"PeriodicalIF":1.7,"publicationDate":"2024-11-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12105","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143252763","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}