Search

The industrial control system (ICS) inherits the attributes of the traditional information system, but because it has its own characteristics that availability of triad (CIA) of information security should be a top priority, it needs to be set differently from the traditional information security requirements. In response to the issue, TTAK.KO-12.0307 (Standard for Industrial Control System Information Security Requirements) proposed by the National Security Research Institute (NSRI) and established by the Telecommunications Technology Association (TTA) is being used. However, it is difficult to apply security requirements of TTAK.KO-12.0307 uniformly because of the reason that the characteristics of the ICS in each layer are different. There is also a limit to invest the security resources with equivalent priority for all requirements and ICS layers. It is still unresolved in the previous research studies which are related to information security resources, for example, Choi (2013), Ko et al. (2013), and Nah et al.’s (2016) studies. Therefore, this study tried to focus on what a top priority of information security requirements by the ICS in each layer is, using the analytic hierarchy process. As a result, we derived that the top priority requirement in the operation layer is “Identification Authentication Access Control,” in the control layer is “Event Response,” and in the field device layer is “Physical Interface Protection” with the highest importance. The results of this study can be utilized as a guideline for the security strategy and policy design by determining security requirements that should be prioritized in each layer of the ICS.

The introduction of Smart Grid systems has raised many new security concerns. If an attacker can compromise components of the Smart Grid communication network, they can fabricate malicious messages to interfere with the grid and ultimately cause outages. One method to address this concern is to conduct network audits by logging network traffic into dedicated servers in order to detect malicious messages. This may be done by using switches’ or routers’ ability to duplicate packets they receive with minimal overhead. The question of how many and which switches/routers to select for this task naturally follows. This paper considers the problem of finding minimal set of routers/switches in a Smart Grid communication network to use for auditing traffic. Accordingly, we devise three algorithms: the first one is highly effective with an approximation ratio of $(2+\theta)(\ln |V| + 1)$ . The second method is a highly scalable algorithm with a constant performance ratio. And the last one is a dynamic algorithm which can efficiently update its solution in response to changes to critical traffic. We experimentally evaluate our solutions and compare them to an optimal Integer Programming formulation, finding that they perform near-optimally and significantly outperform a simple heuristic in all cases.

As a primitive function of location-based services (LBSs), the location sharing aims to provide a user's current location information to other designated users. In recent years, LBSs have become one of the most popular services provided by mobile online social networks (mOSNs). As LBSs actively exploit the users’ identity and current location information, appropriate approaches have to be utilized to protect the location privacy of the users. Several recent reports have discussed the significance of friendship privacy protection with the goal of hiding the friendship relation of users from unintended entities. However, to the best of our knowledge, there hasn't been an approach for protecting the location sharing with complete privacy of location and friendship connections. To address this issue, we propose a new cryptographic primitive, functional pseudonym, for location sharing in mOSNs that ensures both of them. Unlike many of the existing solutions, our approach does not require a fully trusted server and does not assume pre-established secrets among friends, and therefore is highly practical. Also, the proposed approach significantly reduces computational overhead of users by delegating part of the computations for location sharing to a server, therefore it is highly sustainable. Our primitive can be widely used in many mOSNs to enable LBSs with improved privacy and sustainability. Consequently, it will contribute to proliferate LBSs by eliminating users privacy concerns.

This paper introduces a new fog-assisted cloud storage which can achieve much higher throughput compared to the traditional cloud-only storage architecture by reducing the traffics toward the cloud storage. The fog-storage service providers are transparency to end-users and therefore, no modification on the end-user devices is necessary. This new system is featured with (1) a stronger audit scheme which is naturally coupled with the proposed architecture and does not suffer from the replay attack and (2) a transparent and efficient compensation mechanism for the fog-storage service providers. We provide rigorous theoretical analysis on the correctness and soundness of the proposed system. To the best of our knowledge, this is the first paper to discuss about a storage data audit scheme for fog-assisted cloud storage as well as the compensation mechanism for the service providers of the fog-storage service providers.

Aerial-terrestrial cloud networks (ATCNs), global integration of air and ground communication systems, pave a way for a large set of applications such as surveillance, on-demand transmissions, data-acquisition, and navigation. However, such networks suffer from crucial challenges of secure and reliable resource allocation and content-caching as the involved entities are highly dynamic and there is no fine-tuned strategy to accommodate their connectivity. To resolve this quandary, cog-chain, a novel paradigm for secure and reliable resource allocation and content-caching in ATCNs, is presented. Various requirements, key concepts, and issues with ATCNs are also presented along with basic concepts to establish a cog-chain in ATCNs. Feed and fetch modes are utilized depending on the involved entities and caching servers. In addition, a cog-chain communication protocol is presented which avails to evaluate the formation of a virtual cog-chain between the nodes and the content-caching servers. The efficacy of the proposed solution is demonstrated through consequential gains observed for signaling overheads, computational time, reliability, and resource allocation growth. The proposed approach operates with the signaling overheads ranging between 30.36 and 303.6 bytes?hops/sec and the formation time between 186 and 195 ms. Furthermore, the overall time consumption is 83.33% lower than the sequential-verification model and the resource allocation growth is 27.17% better than the sequential-verification model. - 2019 IEEE. This work was supported in part by the Institute for Information and Communications Technology Promotion (IITP) grant through the Korean Government (MSIT) (Rule Specification-Based Misbehavior Detection for IoT-Embedded Cyber-Physical Systems) under Grant 2017-0-00664, and in part by the Soonchunhyang University Research Fund. Scopus

Recently 1, cyber attacks targeting Industrial Control Systems (ICS) have been increasing rapidly; accordingly, cyber security applications and security evaluations of ICS are becoming very important. Technical Assessment Methodology (TAM) is a method developed by the Electric Power Research Institute (EPRI) in the United States for assessing and applying security control methods for power plants. By applying TAM, limitations of cyber security application and security evaluation of existing nuclear facilities are able to address. In this study, a virtual test bed was composed for one of the safety systems of APR1400, and the TAM was applied and analyzed to derive two advantages and five features of TAM. Based on this, the rationale for using TAM for the application and assessment of security control methods in nuclear facilities was explained, including five considerations for the better application of TAM. Finally, we propose future work for applying TAM.

In recent years, various decentralized web services have emerged. Note, however, that websites that can be connected using decentralized web services are difficult to access through the use of general search engines. In this paper, ZeroNet, one of the decentralized web services, is analyzed to verify the information generated when used. The analyzed information is used in the digital forensic method to show an example of how to apply the method by presenting a scenario.

In recent years, 1 a large number of studies have been conducted on cybersecurity for Programmable Logic Controllers (PLCs) to cope with cyberattacks on Industrial Control Systems(ICS). However, few studies have been conducted on ensuring cybersafety for control logics running inside PLCs. In this study, a technique for detecting an attack on PLC control logic change was proposed by analyzing the network protocol data and project file structure. Based on the analysis results for the proposed technique, a tool was implemented to detect an manipulation attack on control logic, and whether such attack was detected or not was verified through experiments.

With the advancement of information and communication technology, online file exchange such as document delivery, business reporting, and submission of reports within or between companies has been widely used. With the increase in convenience, however, security threats have also increased due to the high risk of external leak of files exchanged online. Although companies employ network separation by building an internal corporate network, this has a drawback, i.e., files cannot be used outside such as a work-from-home environment. To solve this problem, this paper proposes a secure file sharing system using the Fast IDentify Online (FIDO) technique. This service is expected to contribute to the improvement of file sharing security because it can encrypt and decrypt files through FIDO authentication when viewing internal files from outside.

This study proposed an anomaly detection technique in an industrial control system using supervised and unsupervised machine learning algorithms. For the dataset for learning, the HIL-based Augmented ICS (HAI) dataset provided for the study on security in industrial control systems was used. For the learning model, Light Gradient Boosted Machine -- a supervised learning algorithm and One-Class Support Vector Machine and Isolation Forest as unsupervised learning algorithms were employed. The proposed technique is presented in this paper, which is organized as follows: Feature selection, Data preprocessing, Hyperparameter optimization and verification, and Experiment and analysis of results. The performance difference according to the algorithm and model configuration was exhibited through the experimental results. In addition, issues to be considered in model configuration and future study directions for anomaly detection techniques in industrial control systems were presented based on the experimental results.

Compared to the past infrastructure networks, the current smart grid network can improve productivity and management efficiency. However, as the Industrial Internet of Things (IIoT) and Internet-based standard communication protocol is used, external network contacts are created, which is accompanied by security vulnerabilities from various perspectives. Accordingly, it is necessary to develop an appropriate cybersecurity guideline that enables effective reactions to cybersecurity threats caused by the abuse of such defects. Unfortunately, it is not easy for each organization to develop an adequate cybersecurity guideline. Thus, the cybersecurity checklist proposed by a government organization is used. The checklist does not fully reflect the characteristics of each infrastructure network. In this study, we proposed a cybersecurity framework that reflects the characteristics of a microgrid network in the IIoT environment, and performed an analysis to validate the proposed framework.

This paper introduces a new maximum fault-tolerance barrier-coverage problem in hybrid sensor network, which consists of a number of both static ground sensors and fully-controllable mobile sensors. The problem aims to relocate the mobile sensor nodes so that the fault-tolerance of the barrier-coverage of the hybrid sensor network is maximized. The main contribution of this paper is the polynomial time exact algorithm for this new problem.

Smart grid addresses the problem of existing power grid’s increasing complexity, growing demand, and requirement for greater reliability through two-way communication and automated residential load control among others. These features also make the smart grid a target for a number of cyber attacks. In this paper, we study the problem of price modification attack (PMA) through fabrication of price messages, which induces changes in load profiles of individual users and eventually causes major alteration in the load profile of the entire network. Combining with cascading failure, it ends up with a highly damaging attack. We prove that the problem is nondeterministic polynomial-time-complete and provide its inapproximability. We devise two approaches for the problem, the former deals with maximizing failure of lines with the given resource and then extending the effect with cascading failure, while the later takes cascading potential into account while choosing the lines to fail. We formulate new protection strategy against PMA and this includes two new algorithms, namely bi-level programming with new branching method and an effective heuristic to improve the running time. Empirical results on both IEEE bus data and real network help us evaluate our approaches under various settings of grid parameters.

A very important target of Instrumentation & Control System used in nuclear power plants is to ensure the safe operation of these plants. Until recently, an analog technology has been used for this purpose; however, this is now being replaced by the digital technology. Such replacement is facilitated by the wide use of real-time distribution of data that are collected by sensor devices of machine-to-machine technology. This, however, provides possibility of exposing Instrumentation & Control System to cyber-attack, as was the case for the Iranian Bushehr nuclear power plant, which the centrifuge was destroyed by the malicious code, Stuxnet. Therefore, security products which are exclusively developed for the prevention of cyber-attack on nuclear power plants are particularly needed in the development and operation of Instrumentation & Control System. However, the currently available security guidelines for such Instrumentation & Control System cover only security policies and protocols, without any specific reference urgent issues of cyber-attack. This paper proposes an implementable Instrumentation & Control System analysis model having focus on cyber security and technology evaluation. The model has been already implemented in reactor protection systems that is operating in Republic of Korea.

Social Networks (SNs) have been gradually applied by utility companies as an addition to smart grid and are proved to be helpful in smoothing load curves and reducing energy usage. However, SNs also bring in new threats to smart grid: misinformation in SNs may cause smart grid users to alter their demand, resulting in transmission line overloading and in turn leading to catastrophic impact to the grid. In this paper, we discuss the interdependency in the social network coupled smart grid and focus on its vulnerability. That is, how much can the smart grid be damaged when misinformation related to it diffuses in SNs? To analytically study the problem, we propose the Misinformation Attack Problem in Social-Smart Grid (MAPSS) that identifies the top critical nodes in the SN, such that the smart grid can be greatly damaged when misinformation propagates from those nodes. This problem is challenging as we have to incorporate the complexity of the two networks concurrently. Nevertheless, we propose a technique that can explicitly take into account information diffusion in SN, power flow balance and cascading failure in smart grid integratedly when evaluating node criticality, based on which we propose various strategies in selecting the most critical nodes. Also, we introduce controlled load shedding as a protection strategy to reduce the impact of cascading failure. The effectiveness of our algorithms are demonstrated by experiments on IEEE bus test cases as well as the Pegase data set., 16 pages

In recent years, nations have been establishing policies to construct smart cities and promote their operation at the national level and competing with one another through the support of the required resources. Smart cities are futuristic state-of-the-art cities wherein all components of the urban infrastructure are inter-operated through networks using the core technologies in the Fourth Industrial Revolution and ICT(Information and Communication Technology). Various kinds of on-site state information are collected and monitored by installing sensors that are IoT(Internet of Things) devices in various services, and on-site controlling devices are controlled remotely if needed. Smart cities face increasing cyber security threats compared to existing cities as advanced technologies are utilized, so the importance of cyber security and user privacy has increased. In this study, security threats against the smart city architecture are analyzed, and possible cyber-attack scenarios in the construction of services and operation environment are identified and analyzed. The ripple effects of each attack are also analyzed. The analysis results in this study can be utilized in security technology research and development and applications in the future.

Smart homes can improve the quality of life and be implemented by Internet of Things (IoT) technologies. However, security is a very important issue in smart homes. For this reason, we propose a secrecy transmission protocol for primary user (PU) by selecting friendly jammer in cognitive IoT model. In particular, a secondary transmitter (ST) is selected to transmit secondary signals by the PU&rsquo, s frequency spectrum, while another ST is chosen to transmit artificial noise to protect the transmission confidentiality of the PU against eavesdropping. Moreover, two selection schemes are presented to confirm the former and the latter ST, and the goal is to optimize the secondary transmission performance and the primary security performance, respectively. For the non-security model and the proposed protocol, we derive the closed-form expressions of the intercept probability and the outage probability for the PU. We also obtain the closed-form expression of outage probability for the secondary user. The numerical results show that the security performance of the PU is significantly enhanced in our protocol compared to the non-security model. In addition, the outage performance of the secondary users is also improved in high secondary transmit SNR region.

Microgrid is an electrical power supply system in some areas centering on a decentralized power supply independent from the existing wide area power supply system, and it is critical to secure its security because it is a core domain of Smartgrid 2.0 as well as a closely related part with general customers. As ICTs are integrated to the existing electric grid, various security threats happening in the existing IT network can happen in Smartgrid including Microgrid. In order to respond to these security threats, a security architecture considering ICT needs to designed. However, in the existing security standards for Smartgrid, there is no discussion on Microgrid or, if any, it is only at a insignificant level, so it is anticipated that coping with various security threats with these standards is not easy. Therefore, in this paper, we analyze the vulnerabilities of Microgrid system and application and propose an advanced security architecture to respond to them.

With the integration of advanced computing and communication technologies, the Smart Grid is expected to greatly enhance efficiency and reliability of future power systems with renewable energy resources, as well as distributed intelligence and demand response. Along with the salient features of the Smart Grid, cyber security emerges to be a critical issue because millions of electronic devices are inter-connected via communication networks throughout critical power facilities, which has an immediate impact on reliability of such a widespread infrastructure. In this paper, we discuss the packet based attacks and study the Optimal Inspection Points (OIP) problem, which asks us to find a subset of nodes in a given network to perform the Deep Packet Inspection so as to maximize the number of scanned packets while satisfying the delay constraints. This problem finds many applications for malicious attack detection, especially for those cases where each single packet or the network traffic is required to be inspected. Accordingly, we prove OIP is NP-complete and provide an FPTAS in the case of single path routing. For the multiple path routings, we design an FPTAS when the routing graph takes a form of series-parallel graphs, which is commonly used to model electric networks. We also discuss the multi-scan scenario and design PIVOT algorithm to tackle the problem and evaluate the algorithms through experiments.

The malicious codes and attacks against ICS today are becoming more advanced and intelligent. The security risk for ICS is increasing, and it’s becoming more important to secure the cyber safety of ICS from these security threats. Recent ICS not only uses serial communication protocol, but also an Ethernet-based control communication protocol. Malicious codes attacking ICS attempts to imitate the corresponding control protocol to insert malware into the payload for communication, or imitates normal control packets for malicious control or disabling of control devices. Also, multiple presentations exist on the possible scenarios of various cyber attack targeting. However, current IDS/IPS for ICS functions with technology to detect attacks based on a blacklist, and thus cannot detect attacks exhibiting new techniques. In order to solve these problems, there have been recent studies on white list based attack detection technology for practical application on ICS. However, current studies on white list based detection technology utilizes a white list based on IP address, service port number information, etc., and thus cannot be utilized to detect attacks exhibiting a replay pattern or in which only data value is changed inside a normal command. This study suggests a technology that can detect attacks exhibiting a replay pattern against ICS, using white list based detection and machine learning to educate control traffic and apply the results to actual detection.

The Internet of Things (IoT) utilizes algorithms to facilitate intelligent applications across cities in the form of smart-urban projects. As the majority of devices in IoT are battery operated, their applications should be facilitated with a low-power communication setup. Such facility is possible through the Low-Power Wide-Area Network (LPWAN), but at a constrained bit rate. For long-range communication over LPWAN, several approaches and protocols are adopted. One such protocol is the Long-Range Wide Area Network (LoRaWAN), which is a media access layer protocol for long-range communication between the devices and the application servers via LPWAN gateways. However, LoRaWAN comes with fewer security features as a much-secured protocol consumes more battery because of the exorbitant computational overheads. The standard protocol fails to support end-to-end security and perfect forward secrecy while being vulnerable to the replay attack that makes LoRaWAN limited in supporting applications where security (especially end-to-end security) is important. Motivated by this, an enhanced LoRaWAN security protocol is proposed, which not only provides the basic functions of connectivity between the application server and the end device, but additionally averts these listed security issues. The proposed protocol is developed with two options, the Default Option (DO) and the Security-Enhanced Option (SEO). The protocol is validated through Burrows&ndash, Abadi&ndash, Needham (BAN) logic and the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The proposed protocol is also analyzed for overheads through system-based and low-power device-based evaluations. Further, a case study on a smart factory-enabled parking system is considered for its practical application. The results, in terms of network latency with reliability fitting and signaling overheads, show paramount improvements and better performance for the proposed protocol compared with the two handshake options, Pre-Shared Key (PSK) and Elliptic Curve Cryptography (ECC), of Datagram Transport Layer Security (DTLS).

Fog-cloud storage is an emerging concept to challenge one significant limitation of the central cloud storage of the future; high latency. In order to promote the broad adoption of fog-cloud storage concept, it is crucial to have a practical compensation scheme for the storage service providers. However, to the best of our knowledge, no such mechanism has been introduced in the literature so far. This paper introduces a transparent and efficient compensation mechanism for the fogcloud storage service providers of the for-cloud storage system proposed by Kim et. al. The proposed system has three main advantages. First, its compensation mechanism for the network data storage service is transparent to users in a sense that any end-user device, which can access a cloud storage, can use the payment scheme without any modification on the enduser device, and does not need to know the existence of any fog storage provider. Second, only two different types of lightweighted cryptographic computations, hash computation and symmetric encryption, are used in the proposed system. Last, only small amount of messages need to be exchanged to implement our system. This paper also provides a rigorous analysis of the correctness of the proposed system.

The secure USB flash drive was developed to improve the security of the conventional USB flash drive, which is vulnerable to leakages of internally stored data caused by extortion, loss, etc. However, it has been continuously reported that the secure USB flash drive, which protects data through the adoption of a wide range of security technologies in wide-ranging ways, cannot assure data security because of implementation and environmental vulnerabilities, eavesdropping, unlock commands, and reverse engineering. As such, there is growing demand for a more powerful secure USB flash drive to solve these fundamental problems. Therefore, this paper presents a secure USB mechanism that prevents leakages of authentication data and does not compare authentication data for smart human care services, which have been a fundamental problem of existing flash drives. The proposed mechanism provides better security than the existing secure USB flash drive by satisfying the need for confidentiality, integrity, authentication, and access control and safely protecting data from impersonation, man-in-the-middle, replay, and eavesdropping attacks by malicious attackers. An assessment of its security using the formalized verification tool AVISPA has proved that it is safe. Therefore, it is considered that a safer, more secure USB flash drive can be manufactured using the mechanism proposed in this paper.

It appears that interest in the Internet of things (IoT) has recently reached its peak, with a great deal of focus from both the private and public sectors. IoT, a technology that enables the exchange of data through linkage among all objects surrounding the user, can create new services. Data communication among objects is not limited to personal information, but can also deliver different data types, such as sensing information collected from the surrounding environment. When such data is collected and used maliciously by an attacker, it is more vulnerable to threats than in conventional network environments. Security of all data transmitted in the IoT environment is therefore essential for preventing attacks. In IoT network composed of many sensors, group communication is required. However, it is difficult to apply the conventional cipher algorithm to IoT devices. In this paper, we propose a method to forward each group key to a group member in a decentralized way using proxy re-encryption. The proposed scheme is best suited for large-scale dynamic IoT networks without a central network controller.

The high demand of electricity makes power networks more vulnerable under cascading failures. Because of the operational dependencies between nodes, the failure of a small set of nodes can cause a large cascade of failures which results in the breakdown of the network. Thus, it is crucial to study the vulnerability of the power network under the cascading failures.In this paper, we study the cascading critical node (CasCN) problem which asks to find a set of nodes whose failure maximizes the number of failed nodes under the effect of cascading failures. We first show that the problem is NP-hard to approximate within the factor of O ( n 1 - ? ) . We then design a new metric to evaluate the importance of nodes in the network and use it as the base to design the Fully Adaptive Cascading Potential algorithm. In the case where the network is robust, we propose an alternative algorithm, the Cooperating Attack algorithm, which includes several novel properties to solve the problem. Simulation results demonstrate the efficiency of proposed algorithms and provide more insight into the vulnerability of the power network.

SInce 2000, Instrumentation and Control(I&C) systems of Nuclear Power Plant(NPP) based on analog technology began to be applied to the digital technology. NPPs under construction in the country with domestic APR1400 I&C system, most devices were digitalized. Cyber security of NPP I&C systems has emerged as an important issue because digital devices compared to the existing analog equipment are vulnerable to cyber attacks. In this paper, We proposed the risk rating process of cyber security threats in NPP I&C system and applied the proposed process to the Reactor Protection System(RPS) developed through Korea Nuclear Instrumentation & Control System(KINCS) project for evaluating the risk of cyber security threats.

The authenticated key agreement (AKA) protocol is an important cryptographic mechanism, which allows two users to establish a session key for future communication. Recently, the certificateless public key cryptography received wide attention since it could solve the certificate management problem in the traditional public key cryptography and solve the key escrow problem in the identity-based public key cryptography. In this paper, we present a strongly secure certificateless authenticated key agreement (CLAKA) protocol without pairing suitable for smart media and mobile environments, which is provably secure in the extended Canetti---Krawczyk (eCK) model and is secure as long as each party has at least one uncompromised secret. Compared with previous CLAKA protocols, our protocol has advantages over them in security or efficiency.

As the key element, sensor networks are widely investigated by the Internet of Things (IoT) community. When massive numbers of devices are well connected, malicious attackers may deliberately propagate fake position information to confuse the ordinary users and lower the network survivability in belt-type situation. However, most existing positioning solutions only focus on the algorithm accuracy and do not consider any security aspects. In this paper, we propose a comprehensive scheme for node localization protection, which aims to improve the energy-efficient, reliability and accuracy. To handle the unbalanced resource consumption, a node deployment mechanism is presented to satisfy the energy balancing strategy in resource-constrained scenarios. According to cooperation localization theory and network connection property, the parameter estimation model is established. To achieve reliable estimations and eliminate large errors, an improved localization algorithm is created based on modified average hop distances. In order to further improve the algorithms, the node positioning accuracy is enhanced by using the steepest descent method. The experimental simulations illustrate the performance of new scheme can meet the previous targets. The results also demonstrate that it improves the belt-type sensor networks’ survivability, in terms of anti-interference, network energy saving, etc.

Recently an online electric vehicle (OLEV) concept has been introduced, where vehicles are propelled by the wirelessly transmitted electrical power from the infrastructure installed under the road while moving. The absence of secure-and-fair billing is one of the main hurdles to widely adopt this promising technology. This paper introduces a new secure and privacy-aware fair billing framework for OLEV on the move through the charging plates installed under the road. We first propose two extreme lightweight mutual authentication mechanisms, a direct authentication and a hash chain-based authentication between vehicles and the charging plates that can be used for different vehicular speeds on the road. Second, we propose a secure and privacy-aware wireless power transfer on move for the vehicles with bidirectional auditability guarantee by leveraging game theoretic approach. Each charging plate transfers a fixed amount of energy to the vehicle and bills the vehicle in a privacy-aware way accordingly. Our protocol guarantees secure, privacy-aware, and fair billing mechanism for the OLEVs while receiving electric power from the infrastructure installed under the road. Moreover, our proposed framework can play a vital role in eliminating the security and privacy challenges in the deployment of power transfer technology to the OLEVs.

Nuclear Power Plant Instrumentation and Control System(NPP I&C) which is used to operate safely is changing from analog technology to digital technology. Ever since NPP Centrifuge of Iran Bushehr was shut down by Stuxnet attack in 2010, the possibility of cyber attacks against the NPP has been increasin g. However, the domestic and international regulatory guideline s that was published to strengthen the cyber security of the NPP I&C describes security requirements and method s to establish policies and procedures. These guidelines are not appropriate for the development of real applicable cyber security technology . Therefore, specialized cyber security technologies for the NPP I&C need to be developed to enhance the security of nuclear power plants. This paper proposes a cyber security technology d evelopment system which is exclusively for the development of nuclear technology. Furthermore, this method has been applied t o the ESF-CCS developed by The KINCS R&D project.Keywords: CyberSecurity, Digital Instrumentation & Control System, Logic al, Logical Architecture, Threat접수일(2013년 11월 19일), 수정일(2014년 4월 3일), 게재확정일(2014년 4월 16일)* 본 연구는 2013년도 산업통상자원부의 재원으로 한국에너지기술평가원(KETEP)의 지원을 받아 수행한 연구과제입니다. (No. 20121510100030)

Recently, a tremendous advancement has been made in the field of network and communication. A usage of pervasive applications for machine-to-machine communication is increasing day by day. Digital forensic examiners are facing different type of problems. The most prominent problems among the research community are data overload, data modeling, data characterization and data presentation. This paper addresses these issues by analyzing a dataset of instant messages (IMs) over the period of 2 years and 4-months. Various patterns of interaction between target user and his/her buddies are analyzed through Social Network Analysis (SNA). The strength of relationship e.g. close, fair, temporary, etc. between each pair of users is determined by analyzing their social interaction ratio with respect to the chat frequency of overall network. The characterization of IMs is to identify the interaction between various actors from Social Network of Instant Messages (SNIM) and the prominence of certain actor within social network. Graphs and matrices are used to model and characterize the SNIM and suitable techniques are identified for computational analysis of SNIM. Centrality measures such as degree centrality, betweenness centrality and closeness centrality are taken to determine the connection of each actor with its neighbors and its influence within SNIM. ‘Vizster’ and ‘Prefuse’ are used for graphical representations and to analyze SNIM forensically. The effectiveness of ‘snowball method’ for forensic analysis of dataset graphically is also discussed. In the end the maximum number of immediate ties at step 1 of each vertex are considered to determine the most influential and significant vertices from the SNIM. Various relationship levels are defined on the basis of examiner-defined threshold to conclude the required results.

As a number of attacks such as Stuxnet and BlackEnergy targeting the control system of critical infrastructure have happened, the importance of security enhancement for the facilities such as industrial CPS (Cyber Physical System) has emerged. In this paper, by reflecting the characteristics of industrial CPS, we propose a packet diversity-based anomaly detection model which we can learn and conduct detection with more effectively than the existing anomaly detection systems. In the proposed detection system, in order to enhance the sensitivity of the detection model, we construct a detection models on each after grouping the data of an industrial CPS into packet structure based on features of packet header. The proposed detection system aims single packet anomaly detection to cope with the threats such as injection attacks, malformed packet used in fuzzing and others. For the architecture of anomaly detection system, we suppose a structure applying whitelist and learning-based detection model doubly. Measuring packet diversity using payload variation of packet and entropy-based uncertainty is also proposed to select which learning-based detection model is appropriate to dataset. As learning-based detection models, anomaly detection system uses a model constructed with a well-known learning method OCSVM (One Class SVM) and a newly proposed representative detection model made for solving the limitation of OCSVM.

The application of IT in all industrial facilities has led to the use of special-purpose systems in diverse areas. As such, special-purpose systems have increasingly become the target or path of hacking attacks. From a digital forensics viewpoint, these systems can be used to gather evidence from all the relevant digital devices such as whole systems or storage units at the scene of a crime. Notably, In case of special-purpose embedded system, unlike a conventional computing system, is almost always ‘powered on’ like server, the accumulated data can remain in the volatile memory. This paper focuses on analyzing ways of gathering physical memory data for application in an embedded system and of developing a test system to analyze the physical memory for verification.

In this paper, we present a new reset tree-based scheme to protect cryptographic hardware against optical fault injection attacks. As one of the most powerful invasive attacks on cryptographic hardware, optical fault attacks cause semiconductors to misbehave by injecting high-energy light into a decapped integrated circuit. The contaminated result from the affected chip is then used to reveal secret information, such as a key, from the cryptographic hardware. Since the advent of such attacks, various countermeasures have been proposed. Although most of these countermeasures are strong, there is still the possibility of attack. In this paper, we present a novel optical fault detection scheme that utilizes the buffers on a circuit’s reset signal tree as a fault detection sensor. To evaluate our proposal, we model radiation-induced currents into circuit components and perform a SPICE simulation. The proposed scheme is expected to be used as a supplemental security tool.