Search

Network-based attacks on control systems may alter sensor data delivered to the controller, effectively causing degradation in control performance. As a result, having access to accurate state estimates, even in the presence of attacks on sensor measurements, is of critical importance. In this work, we analyze performance of resilient state estimators (RSEs) when any subset of sensors may be compromised by a stealthy attacker. Specifically, we consider systems with the well-known l 0 -based RSE and two commonly used sound intrusion detectors (IDs). For linear time-invariant plants with bounded noise, we define the notion of perfect attackability (PA) when attacks may result in unbounded estimation errors while remaining undetected by the employed ID (i.e., stealthy). We derive necessary and sufficient PA conditions, showing that a system can be perfectly attackable even if the plant is stable. While PA can be prevented with the use the standard cryptographic mechanisms (e.g., message authentication) that ensure data integrity under network-based attacks, their continuous use imposes significant communication and computational overhead. Consequently, we also study the impact that even intermittent use of data authentication has on RSE performance guarantees in the presence of stealthy attacks. We show that if messages from some of the sensors are even intermittently authenticated, stealthy attacks could not result in unbounded state estimation errors. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) technologies enable development of reconfigurable manufacturing systems—a new generation of modularized industrial equipment suitable for highly customized manufacturing. Sequential control in these systems is largely based on discrete events, whereas their formal execution semantics is specified as control interpreted Petri nets (CIPN). Despite industry-wide use of programming languages based on the CIPN formalism, formal verification of such control applications in the presence of adversarial activity is not supported. Consequently, in this article, we introduce security-aware modeling and verification techniques for CIPN-based sequential control applications. Specifically, we show how CIPN models of networked industrial IoT controllers can be transformed into time Petri net (TPN)-based models and composed with plant and security-aware channel models in order to enable system-level verification of safety properties in the presence of network-based attacks. Additionally, we introduce realistic channel-specific attack models that capture adversarial behavior using nondeterminism. Moreover, we show how verification results can be utilized to introduce security patches and facilitate design of attack detectors that improve system resiliency and enable satisfaction of critical safety properties. Finally, we evaluate our framework on an industrial case study. Note to Practitioners—Our main goal is to provide formal security guarantees for distributed sequential controllers. Specifically, we target smart automation controllers geared toward Industrial IoT applications that are typically programed in C/C++ and are running applications originally designed in, for example, GRAFCET (IEC 60848)/SFC (IEC 61131-3) automation programming languages. Since existing tools for the design of distributed automation do not support system-level verification of relevant safety properties, we show how security-aware transceiver and communication models can be developed and composed with distributed controller models. Then, we show how existing tools for verification of time Petri nets can be used to verify relevant properties including safety and liveness of the distributed automation system in the presence of network-based attacks. To provide an end-to-end analysis as well as security patching, results of our analysis can be used to deploy suitable firmware updates during the stage when executable code for target controllers (e.g., in C/C++) is generated based on GRAFCET/SFC control models. We also show that security guarantees can be improved as the relevant safety/liveness properties can be verified after corresponding security patches are deployed. Finally, we show applicability of our framework on a realistic distributed pneumatic manipulator. [ABSTRACT FROM AUTHOR]

Continuous deep brain stimulation (cDBS) of the subthalamic nucleus (STN) or globus pallidus is an effective treatment for the motor symptoms of Parkinson's disease. The relative benefit of one region over the other is of great interest but cannot usually be compared in the same patient. Simultaneous DBS of both regions may synergistically increase the therapeutic benefit. Continuous DBS is limited by a lack of responsiveness to dynamic, fluctuating symptoms intrinsic to the disease. Adaptive DBS (aDBS) adjusts stimulation in response to biomarkers to improve efficacy, side effects, and efficiency. We combined bilateral DBS of both STN and globus pallidus (dual target DBS) in a prospective within-participant, clinical trial in six patients with Parkinson's disease (n = 6, 55–65 years, n = 2 females). Dual target cDBS was tested for Parkinson's disease symptom control annually over 2 years, measured by motor rating scales, on time without dyskinesia, and medication reduction. Random amplitude experiments probed system dynamics to estimate parameters for aDBS. We then implemented proportional-plus-integral aDBS using a novel distributed (off-implant) architecture. In the home setting, we collected tremor and dyskinesia scores as well as individualized β and DBS amplitudes. Dual target cDBS reduced motor symptoms as measured by Unified Parkinson's Disease Rating Scale (UPDRS) to a greater degree than either region alone (P < 0.05, linear mixed model) in the cohort. The amplitude of β-oscillations in the STN correlated to the speed of hand grasp movements for five of six participants (P < 0.05, Pearson correlation). Random amplitude experiments provided insight into temporal windowing to avoid stimulation artefacts and demonstrated a correlation between STN β amplitude and DBS amplitude. Proportional plus integral control of aDBS reduced average power, while preserving UPDRS III scores in the clinic (P = 0.28, Wilcoxon signed rank), and tremor and dyskinesia scores during blinded testing at home (n = 3 , P > 0.05, Wilcoxon ranked sum). In the home setting, DBS power reductions were slight but significant. Dual target cDBS may offer an improvement in treatment of motor symptoms of Parkinson's disease over DBS of either the STN or globus pallidus alone. When combined with proportional plus integral aDBS, stimulation power may be reduced, while preserving the increased benefit of dual target DBS. [ABSTRACT FROM AUTHOR]

A digital microfluidic biochip (DMFB) enables the miniaturization of immunoassays, point-of-care clinical diagnostics, and DNA sequencing. A recent generation of DMFBs uses a microelectrode-dot-array (MEDA) architecture, which provides fine-grained control of droplets and real-time droplet sensing using CMOS technology. However, microelectrodes in a MEDA biochip can degrade due to charge trapping when they are repeatedly charged and discharged during bioassay execution; such degradation leads to the failure of microelectrodes and erroneous bioassay outcomes. To address this problem, we first introduce a new microelectrode-cell design such that we can obtain the health status of all the microelectrodes in a MEDA biochip by employing the inherent sensing mechanism. Next, we present a stochastic game-based model for droplet manipulation, and a formal synthesis method for droplet routing that can dynamically change droplet transportation routes. This adaptation is based on the real-time health information obtained from microelectrodes. Comprehensive simulation results for four real-life bioassays show that our method increases the likelihood of successful bioassay completion with negligible impact on time-to-results. [ABSTRACT FROM AUTHOR]