A language for describing attacks on cyber-physical systems

International Journal of Critical Infrastructure Protection

Volumn 8, Issue , 2015, Pages 40-52

  Yampolskiy, Mark ^a   Horváth, Péter ^b   Koutsoukos, Xenofon D ^c   Xue, Yuan ^c   Sztipanovits, Janos ^c  

^a Mobile   (United States)

^b BUDAPEST UNIVERSITY OF TECHNOLOGY AND ECONOMICS   (Hungary)

^c VANDERBILT UNIVERSITY   (United States)

Author keywords

Attack description language; Cross domain attacks; Cyber physical systems; Security; Taxonomy

Indexed keywords

COMPUTER CRIME; EMBEDDED SYSTEMS; KNOWLEDGE BASED SYSTEMS; TAXONOMIES;

COMPLEX RELATIONSHIPS; CROSS-DOMAIN; CYBER PHYSICAL SYSTEMS (CPSS); CYBER PHYSICALS; DESCRIPTION LANGUAGES; KNOWLEDGE BASE; QUANTITATIVE AND QUALITATIVE ANALYSIS; SECURITY;

SECURITY OF DATA;

EID: 84922266749     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2014.09.003     Document Type: Article

References (20)

1. D. Albright, P. Brannan, C. Walrond, Did Stuxnet Take Out 1000 Centrifuges at the Natanz Enrichment Plant? Institute for Science and International Security, Washington, DC (url: 〈〉), 2010. http://isis-online.org/uploads/isis-reports/documents/stuxnet_FEP_22Dec2010.pdf.
2. J. Baker, M. Hansbury, D. Haynes, The OVAL Language Specification, MITRE, Bedford, Massachusetts (url: 〈〉), 2011. http://ebookbrowsee.net/oval-language-specification-08-08-2011-pdf-d222972411.
3. E. Byres, J. Lowe, The myths and facts behind cyber security risks for industrial control systems, in: Proceedings of the VDE Kongress, 2004.
4. S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, S. Savage, K. Koscher, A. Czeskis, F. Roesner, T. Kohno, Comprehensive experimental analyses of automotive attack surfaces, in: Proceedings of the Twentieth USENIX Conference on Security, 2011.
5. N. Falliere, L. O'Murchu, E. Chien, W32.Stuxnet Dossier, Version 1.4, Symantec, Mountain View, California, 2011.
6. L. Forbes, H. Vu, B. Udrea, H. Hagar, X. Koutsoukos, M. Yampolskiy, SecureCPS: defending a nanosatellite cyber-physical system, in: Proceedings of the SPIE, 9085, 2014.
7. S. Hansman, R. Hunt; Ataxonomy of network and computer attacks Comput. Secur. 241 2005, 3143.
8. Y. Huang, A. Cardenas, S. Amin, Z. Lin, H. Tsai, S. Sastry; Understanding the physical and economic consequences of attacks on control systems Int. J. Crit. Infrastruct. Prot.232009, 7383.
9. International Telecommunications Union, ITU-T Recommendation X.1520, Geneva, Switzerland (url: 〈〉), 2014. http://www.itu.int/rec/T-REC-X.1520-201104-I/en.
10. K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, S. Savage, Experimental security analysis of a modern automobile, in: Proceedings of the IEEE Symposium on Security and Privacy, 2010, 447-462.
11. G. McDonald, L.O Murchu, S. Doherty, E. Chien, Stuxnet 0.5: The Missing Link, Symantec, Mountain View, California, 2013.
12. MITRE, Common Vulnerabilities and Exposures, Bedford, Massachusetts (url: 〈〉). http://cve.mitre.org.
13. MITRE, OVAL Language, Bedford, Massachusetts (url: 〈〉). http://oval.mitre.org/language.
14. National Institute of Standards and Technology, CVE XML Schema, Gaithersburg, Maryland (url: 〈〉). http://nvd.nist.gov/schema/nvd-cve-feed_2.0.xsd.
15. National Institute of Standards and Technology, National Vulnerability Database, Gaithersburg, Maryland (url: 〈〉). http://nvd.nist.gov.
16. S. Rinaldi, J. Peerenboom, T. Kelly, Identifying, understanding and analyzing critical infrastructure interdependencies, IEEE Control Systems 21(6), pp. 11-25.
17. J. Slay, M. Miller; Lessons learned from the Maroochy water breach E. GoetzS. Shenoi Critical Infrastructure Protection 2007,Springer, Boston, Massachusetts 7382.
18. United States Computer Emergency Readiness Team, 2014 Alerts, Washington, DC (url: 〈〉), 2014. http://www.us-cert.gov/ncas/alerts.
19. M. Yampolskiy, P. Horvath, X. Koutsoukos, Y. Xue, J. Sztipanovits, Systematic analysis of cyber-attacks on CPS-evaluating applicability of DFD-based approach, in: Proceedings of the Fifth International Symposium on Resilient Control Systems, 2012, pp. 55-62.
20. M. Yampolskiy, P. Horvath, X. Koutsoukos, Y. Xue, J. Sztipanovits, Taxonomy for descriptions of cross-domain attacks on CPSs, in: Proceedings of the Second ACM International Conference on High Confidence Networked Systems, 2013, pp. 135-142.