Search

Fundamental components of the distribution systems of electric energy are primary and secondary substation networks. Considering the incorporation of legacy communication infrastructure in these systems, they often have in- herent cybersecurity vulnerabilities. Moreover, traditional intrusion defence strategies for IT systems are often not applicable. With the aim to improve cybersecurity in substation networks, in this paper we present two methods for monitoring SCADA system: the first one exploiting neural networks, while the second one is based on formal methods. To evaluate the effective- ness of the proposed methods, we conducted experiments on a real test bed representing the substation domain as close to real-world as possible. From this test bed we collect data during normal operation and during situations where the system is under attack. To this end several different types of attack are conducted. The data collected is used to test two versions of the mon- itoring system: one based on machine learning with a neural network and one using a model-checking approach. Moreover, the two proposed models are tested with new data to evaluate their performance. The experiments demonstrate that both methods obtain an accuracy greater than 90%. In particular, the methodology based on formal methods achieves better per- formance if compared to the one based on neural networks.

Important components of the electric energy distribution systems are primary and secondary substations. Due to the incorporation of legacy communication infrastructure in these systems, they often have inherent cyber-security vulnerabilities. Further, traditional intrusion defence strategies for IT systems are often not applicable. In order to improve cyber-security in substation networks, this paper presents a neural net-based monitoring system. Further, to evaluate the applicability of the system, all experiments were conducted on a real test bed, which represents the substation domain as close as possible to reality. The proposed monitoring system covers several tasks. First, relevant network packets are acquired from network traffic and analysed. Based on these packets statistical features are extracted. Then, classes are defined, and a normal behaviour model of the network is trained by the neural net. New network traffic is compared to the model, in order to determine the nature of the traffic and identify potential anomalies. Finally, the monitoring system is evaluated by conducting several supervised and unsupervised network attacks against the test bed.

In this paper we present a method to detect Man-in-the-Middle attacks on industrial control systems. The approach uses anomaly detection by developing a model of normal behaviour of the industrial control system network. To come as close as possible to reality a simple industrial system, a conveyor belt with sensors and actuators, was set up with controllers widely used in industry. A machine learning approach based on the k-Nearest Neighbors algorithm with Bregman divergence was used to define a model of normal (valid) behaviour. Afterwards Man-in-the-Middle attacks were launched against the system and its behaviour during the attack was compared to the valid behaviour model. The results show that the approach taken was able to detect such attacks with satisfactory accuracy.

In this paper we describe a novel approach to model smart meter networks aimed at analyzing security related aspects of such networks. The model is realized as a multi-agent based simulation. This allows for detailed analysis of network behaviour on different layers. The layers realized in the simulation are a protocol layer for syntactic analysis of the protocol, a data layer for semantic analysis of the commands transmitted, and an information layer where metering data is interpreted. The ultimate goal of the project is the design and proof-of-concept implementation of an innovative Intrusion Detection System specifically apt for smart meter networks. The simulation described in this paper together with data from real world field tests will be used to deduce formal rules describing regular behaviour of the network which then will be the input for the IDS.

In this paper we propose the use of formal methods to model malicious code behavior. The paradigm shift in malware detection from conventional, signature-based static methods to evaluating dynamic system behavior is motivated by the rising number and ever-increasing sophistication of malware currently in the wild. Because of advanced polymorphic and metamorphic techniques, a purely signature-based approach is no longer sufficient for accurate malware recognition. Automating the process of behavior analysis necessitates the use of formal methods. The modeling process is built upon two cornerstones: special system call execution traces generated through dynamic analysis of suspicious code and a self-defined taxonomy of (malicious) system activities. The formal model consists of two parts: A definition of malicious behavior in the form of combinations of tasks necessary to achieve a certain malign goal and of rules for translating each task into possible patterns of system calls. Both models are realized through formal grammars. The behavior model uses the tasks as the alphabet and the grammar rules define which patterns of activities can be used to accomplish certain high-level malicious goals. The translation model on the other hand contains an attributed context-free grammar for each task. The alphabet of each grammar consists of Windows system (API) calls, the grammar rules map each task to patterns of these calls. The attributes are used to convey information contained in the parameters of the individual calls.

This paper details a schema developed for defining malicious behavior in software. The presented approach enables malware analysts to identify and categorize malicious software through its high-level goals as well as down to the individual functions executed on operating system level. We demonstrate the practical application of the schema by mapping dynamically extracted system call patterns to a comprehensive hierarchy of malicious behavior.

The following work proposes the use of a special description-language for producing input data of finite element programs. The programs now used require a detailed description of the structure to be analysed, and they require it in a form which is unfavourable to the user and which promotes errors. Therefore, a language was designed which allows a short and compact description of the structure. This description is then automatically transformed into the input data. In this paper, the design process and the characteristics of the language are presented. Some comments on its implementation, that is on the development of a special preprocessor, are made. As target system, the finite element program SAP IV has been chosen. Finally, we want to present an example of the improvements achieved by the use of this language and the SAP IV preprocessor, respectively.

After explaining some reasons for the prototype-approach to software development and after giving a short classification of such approaches this paper tries to clarify the concept of prototyping. We suggest a clear distinction between a model and a prototype. Based on this distinction a new methodology of software development making use of models and a prototype is presented. The application of this methodology needs an interactive and highly flexible programming environment and a set of special software tools.

Durch zunehmendes Leistungsvermogen und rasanten Preisverfall gekennzeichnet, dringt die automatische Informationsverarbeitung heute in immer mehr Anwendungsbereiche ein. Durch die Fortschritte der grafischen Datenverarbeitung und des CAD wird eine Anwendung im Architekturburo wirtschaftlich und arbeitstechnisch sinnvoll. Die Art des Einsatzes dieses neuen Werkzeugs hat allerdings bedeutende Auswirkungen auf das bearbeitete “Produkt”. Hier wird eine CAD-Einsatzweise im Architekturburo vorgeschlagen, die sich den bisherigen Rationalisierungsversuchen im Bauwesen mit ihrer Tendenz zur Monotonie insofern entgegenstellt, als eine grostmogliche Individualisierung zusammen mit rationellem Bauen angestrebt wird.