Cyber-Physical System Risk Assessment
Yong Peng
1
, Tianbo Lu
2,3
, Jingli Liu
2
, Yang Gao
1
, Xiaobo Guo
2
, Feng Xie
1
1
China Information Technology Security Evaluation Center, Beijing, China
2
School of Software Engineering, Beijing University of Posts and Telecommunications, Beijing, China
3
Information Technology ResearchBaseof Civil Aviation Administration of China, Civil Aviation University of China
lutb@bupt.edu.cn; pengy@itsec.gov.cn;gxbbest@email.buptsse.cn
Abstract—Cyber Physical System (CPS) is a combination of
physical systems with cyber systems, where there is a tight
coupling between the two systems. It is widely used in critical
national infrastructure, such as electric power, petroleum and
chemical industries. Once an attack against the CPS obtains
success, the consequence will be unimaginable. A well-designed
risk assessment of CPS will provide an overall view of CPS
security status and support efficient allocations of safeguard
resources. Though there is much relationship between CPS
and IT system, they are still different in various aspects,
especially the requirement for real-time. Therefore, traditional
risk assessment method for IT system can’t be directly applied
in CPS. New ideas on CPS risk assessment are in urgent need
and one idea about this is addressed in this paper. Firstly, it
presents a depict description of a three-level CPS architecture
and makes an analysis on the corresponding security features
in each level. Secondly, it sums up traditional risk assessment
methods analyzes the differences between cyber physical
system security and traditional IT system security. Finally, the
authors blaze a trail under the new perspective of CPS after
breaking the restriction of traditional risk assessment methods
and propose a risk assessment idea for CPS.
Keywords-CPS; risk assessment; simulation; attack tree
I. INTRODUCTION
Cyber-physical system (CPS) is a combination of
physical process and cyber capabilities. It is an emerging
area in 21st century, as most of the world’s leading
economies are seeking competitiveness in this technology.
CPS is basically a control system with distributed-
networked, adapted and predictable, real-time, intelligent
characteristics, where human-computer interaction may
exist. It is widely used in critical national infrastructure, such
as electric power, petroleum and chemical and so on. Once
an attack against the CPS obtains success, the consequences
will be unimaginable.
In power industry, the monitoring system of a power
plant was attacked by unknown sources in 2010, which
leaded to 900MW load loss in 7 seconds. In energy industry,
the computer system of Iran Bushehr nuclear power plant
was invaded by “Stuxnet” in 2010, leading a serious chaos in
the automated operation of the nuclear facilities and a serious
setback of Iran’s nuclear program. In transport service, in the
network for managing and monitoring the operation of the
Shinkansen, due to an exception in the management system
of control schedule, signaling and line switching point in
2011, Japan's 5 Shinkansen operation management system
encountered failure, 15 trains were in outage, 124 trains were
delayed and 8.12 million people’s travel were affected. In
water Industry, in 2011, Illinois water system was hacked
and a malfunction occurred in the water pump SCADA,
which leading to the pump’s damage and scrap. In this way,
we can conclude that CPS security is so important that risk
incidents in the system may affect national security and
stability. In 2007, U.S. President’s Council of Advisors on
Science and Technology (PCAST) ranked CPS as a national
priority for Federal R&D.
Industrial Control System (ICS), which is a good
example of CPS, is used to be isolated from the outside with
proprietary protocol and operating systems. Nowadays, these
kinds of system are more and more interconnected in this
way or another to the Internet in order to increase the
functionality and automation. Widespread connectivity
between cyber world and physical world poses great security
issue to CPS. These above security incidents in critical
infrastructure proof a fact that attacks on the cyber layer of
CPS may cause serious damage in physical world.
CPS is facing a huge security risk. A well-designed risk
assessment of CPS will provide an overall view of CPS
security status and support efficient allocations of safeguard
resources. Though traditional IT system risk assessment is
quite mature, a distinct risk assessment method for CPS is
needed to cover the growing security issues due to the large
differences between IT system and CPS.
This paper proposes a risk assessment idea which
combines attack tree and CPS simulation. The following
sections of this paper will be organized as follows. Section II
presents a depict description of three-level CPS architecture
and makes an analysis on the corresponding security features
in each level. Section III sums up traditional risk assessment
methods and analyzes the differences between cyber physical
system security and traditional IT system security. Section
IV presents a risk assessment idea for CPS, including asset
identification, threat identification, vulnerability
identification, modeling and simulation. Section V is the
conclusion.
2013 Ninth International Conference on Intelligent Information Hiding and Multimedia Signal Processing
978-0-7695-5120-3/13 $26.00 © 2013 IEEE
DOI 10.1109/IIH-MSP.2013.116
442
2013 Ninth International Conference on Intelligent Information Hiding and Multimedia Signal Processing
978-0-7695-5120-3/13 $26.00 © 2013 IEEE
DOI 10.1109/IIH-MSP.2013.116
442
资源评论
weixin_38593380
- 粉丝: 4
- 资源: 964
最新资源
- 小熊汉字笔顺学习软件 v2.0
- 毕业设计基于Python+vue的共享单车时空数据分析与管理系统源码.zip
- 读取LA25K30 10N3-R485数据的C#上位机程序
- Python网络爬虫技术实现淘宝商品图片自动抓取
- 1960-2023年世界各国人均国民总收入数据
- 通过rest api调用iServer自动化处理建模GPA工具
- axure121212
- 2025年粉红色玫瑰花朵浪漫婚礼邀请函模板.pptx
- 2025年婚礼邀请函快闪模板.pptx
- 2025年蓝色简约时尚婚礼邀请函模板.pptx
- 2025年心中有您浪漫婚礼活动策划方案.pptx
- 内、外盘期货量化交易系统源码
- 红色金飘带玫瑰花瓣婚礼策划活动方案模板.pptx
- 软件测试流程3.0规范模版文档
- 红色双喜字玫瑰花浪漫婚礼邀请函模板.pptx
- 深红色庄严吉祥2025年婚礼邀请函模板.pptx
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
