a) completeness : for any x S, $\Pr[B_2(B_1(S),x) = 1] = 1$

b) soundness: for any $x \in S$, $\Pr[B_2(B_1(S),x)=1] \le e$

False positive : Given a representation M of S, if $x \notin S$ and $B_2(M,x) = 1$, x is false positive; e is the error rate of B

A single fixed input x and the probability is taken over the randomness of B. We want to give a stronger soundness requirement that considers a sequence of inputs $x_1, x_2, \dots, x_t$ that is not fixed but chosen by an adversary, where the adversary gets the responses of previous queries and can adaptively choose the next query accordingly. If the adversary's probability of finding a false positive $x^*$ that was not queried before is bounded by e, then B is an (n, t, e)-resilient Bloom filter setup phase of the Bloom filter and the adversary get the security parameter $\lambda$.

Adversarial-resilient Bloom filter with a steady representation: Let $B = (B1, B2)$ be an $(n, \varepsilon)$-Bloom filter with a steady representation. B is an $(n, t, \varepsilon)$-adversarial resilient Bloom filter (with a steady representation) if for all sufficiently large $\lambda \in \mathbb{N}$ and for any probabilistic polynomial-time adversary A we have that the advantage of A in the following challenge is at most $\varepsilon$:

1. Adversarial Resilient: $\Pr[\text{Challenge}_{A,t}(\lambda) = 1] \le e$, where the probabilities are taken over the internal randomness of $B1$ and A and where the random variable $\text{Challenge}_{A,t}(\lambda)$ is the outcome of the following game:

$\text{Challenge}_{A,t}(\lambda)$:

1. $M \leftarrow B_1(S, 1^{\lambda})$.

2. $x^* \leftarrow A^{B_2(M, \cdot)}(1^{\lambda}, S)$ where A performs at most t queries $x_1, \dots, x_t$ to the query oracle $B_2(M, \cdot)$.

3. If $x^* \notin S \cup \{x_1, \dots, x_t\}$ and $B_2(M, x^*) = 1$ output 1, otherwise output 0.

### Test Case : Optimal Margin Classifier for Secure Adaptive Filter

The expert panel are trying to explore whether an efficient privacy preserving optimal margin classifier (e.g. support vector machine) can be applicable for packet classification in communication network and webmail spam filtering. It is an interesting issue whether secure adaptive filter is a private classification problem where SVM can improve the accuracy of classification without false positive or false negative as compared to the use of traditional Bloom or Cuckoo felter. Another issue is cost of computation and cost of communication. Here, the most important issue is the performance of SVM in terms of classification accuracy and privacy of data. Classification comprises of two subtasks: learning a classifier from training data with class labels and predicting the class labels for unlabeled data using the learned classifier. Data can be stored as feature vectors. In the classification problem of detecting email spam, the training data comprises of emails with labels spam / nospam.

Support Vector Machine (SVM) is the most well-known kernelized maximum margin classifier. The learning methodology is the approach of using examples to synthesize programs for computing the desired output from a set of inputs; it generates target decision function in hypothesis space. The learning algorithm selects training data as input and selects a hypothesis from the hypothesis space. There are various methods of learning such as supervised learning from taining examples,
unsupervised learning, batch learning and online learning. The next issue is generalization - how to assess the quality of an online learning algorithm? Consistent hypothesis performs correct classification of the training data. The ability of a learning machine to correctly classify data not existing in the training set is known as generalization. How to improve generalization : Ockham's Razor suggests that unnecessary complications are not helpful; it may results overfit.

Support Vector Machine (SVM) is a learning system that uses a hypothesis space of linear functions in a high dimensional feature space, trained with a learning algorithm from optimization theory that implements a learning bias derived from statistical learning theory. In case of pattern classification problem, the objective of SVM is to devise a computationally efficient way of learning for finding out an optimal capacity of the pattern classifier to minimize the expected generalization error on a given amount of training data by maximizing the margin between training patterns and class boundary. The basic properties of SVM are that the learning system is suitable for both linear and nonlinear problems, computationally efficient algorithm through modular and dual representation in Kernel induced high dimensional feature space and optimized generalization bounds. Let us discuss about learning in kernel induced feature space.

Target Function – $f(m_1,m_2,r) = C*m_1*m_2/r^2$

$g(x,y,z) = \ln f(m_1,m_2,r) = \ln C + \ln m_1 + \ln m_2 - 2 \ln r = c + x + y - 2z$

A linear machine can learn g but not f. A kernel is a function K such that for all x,z $\epsilon X$; $K(x,z) = \langle\varphi(x), \varphi(z)\rangle$ where $\varphi$ is a mapping from input space X to inner product feature space F.

$$ \langle x,z \rangle^2 = (\sum_{i=1}^{n} x_i z_i)^2 = (\sum_{i=1}^{n} x_i z_i) (\sum_{j=1}^{n} x_j z_j) = \sum_{i=1}^{n} \sum_{j=1}^{n} x_i z_i x_j z_j = \sum_{i,j=(1,1)}^{n,n} (x_i x_j) (z_j z_i) = \varphi(x) \cdot \varphi(z) $$

Let us consider linear classification problem : given a linearly separable training sample $S = ((x_1, y_1), \dots, (x_l, y_l))$, the hyperplane (w,b) realizes the maximal margin hyperplane with geometric margin $\gamma = 1/||w||_2$ by solving the optimization problem Minimize $\langle w, w \rangle$ Subject to $y_i \langle w, x_i \rangle + b \ge 1$ where $i = 1, \dots, l$

In case of SVM, the strategy is to find the maximal margin hyperplane in kernel induced feature space.

In case of linear classification problem, the equation of hyperplane –

$f(x) = \langle w, x \rangle + b = 0$ or, $f(x) = \sum_{i=1}^{l} w_i x_i + b = 0$; An input $x = (x_1, \dots, x_n)$ belongs to positive class if $f(x) \ge 0$; An input $x = (x_1, \dots, x_n)$ belongs to negative class if $f(x) < 0$

Decision function: $h(x) = \text{sgn}(f(x)) = \text{sgn}(\langle w, x \rangle + b)$

In case of linear classification problem, functional margin of an example $(x_i, y_i)$ is $\gamma_i = y_i \langle w, x_i \rangle + b$

Geometric margin measures the Euclidean distance between an example and the hyperplane, it is expressed as normalized linear function $(w/||w||_2, b/||w||_2)$.

Updation rule of SVM algorithm in Primal Form: if $\gamma_i$ or $y_i \langle w, x_i \rangle + b \le 0$ then $w_{k+1} \leftarrow w_k + \eta y_i x_i$, $k \leftarrow k+1$ $\gamma_i > 0$ indicates correct classification of the training example.

Duality is one of the basic features of Support Vector Machines; SVMs can be modelled as Linear Learning Machines in a dual fashion. In this case, updation rule of the perceptron algorithm is expressed in dual form. The solution i.e. final
hypothesis of weight vector is a linear combination of training points. Each pattern $x_i$ is associated with an embedding strength $\alpha_i$, which is proportional to the no. of times misclassification of $x_i$ causes updation of the weight.

$$w = \sum_{i=1}^{l} \alpha_i y_i x_i$$

$$f(x) = \langle w, x \rangle + b = 0$$

$$= (\sum_{i=1}^{l} \alpha_i y_i x_i, x) + b)$$

$$= (\sum_{i=1}^{l} \alpha_i y_i <x_i, x>) + b)$$

In the dual form, the updation rule and decision function can be expressed in the form of inner product space $<x_i, x>$.

Let us focus on kernel based algorithms; two separate learning functions; learning algorithm in an embedded space; Kernel function performs the embedding; Embed data to a different space; Possibly higher dimension; Linearly separable in the new space. Kernels themselves can be constructed in a modular way. Modularity is one of the important properties of SVM.

Another critical issue is learning in kernel induced feature space : Kernel methods exploit information about the inner products between data items. Kernel function can simplify the computation of separating hyperplane without explicitly carrying out the map in the feature space. The number of operations to compute the inner product space is not proportional to the number of features. Hence, high dimension of feature space does not affect the computation.

### Learning In Kernel Induced Feature Space :

Since $F$ is high dimensional, the RHS of this equation is computationally very expensive.

$$f(x) = \langle w, x \rangle + b = (\sum_{i=1}^{l} \alpha_i y_i <x_i, x> + b) \quad \text{Eq. of hyperplane in Input Space}$$

$$f(x) = \langle w, \phi(x) \rangle + b = (\sum_{i=1}^{l} \alpha_i y_i <\phi(x_i), \phi(x)> + b) \quad \text{Eq. of hyperplane in Feature Space where } \phi \text{ is a mapping from input space to inner product feature space.}$$

$$f(x) = \sum_{i=1}^{l} \alpha_i y_i K(x_i, x) + b \quad \text{where } K = \text{Kernel function}$$

### Computation of geometric margin : Geometric margin is the functional margin of a normalized weight vector. In case of linear classifier, the hyperplane function ($w,b$) does not change if we rescale the hyperplane ($mw,mb$) where $m \in R^+$ due to inherent degree of freedom. So, to optimize the geometric margin, we can consider functional margin of 1 for two points $x^+$ and $x^-$.

$$\langle w, x^+ \rangle + b = +1; \langle w, x^- \rangle + b = -1$$

$$\text{Geometric margin } \gamma = \frac{1}{2}(\|w\|_2) [(\langle w, x^+ \rangle + b) - (\langle w, x^- \rangle + b)] = \frac{1}{\|w\|_2}$$

### SVM Problem Formulation : Given a linearly separable training sample $S = ((x_1, y_1), \dots, (x_l, y_l))$, the hyperplane ($w,b$) realizes the maximal margin hyperplane with geometric margin $\gamma = 1/\|w\|_2$ by solving the optimization problem

$$\text{Minimize } \langle w, w \rangle$$

$$\text{Subject to } y_i (\langle w, x_i \rangle + b) \geq 1 \text{ where } i = 1, \dots, l$$

This is a convex optimization problem minimizing a quadratic function under linear inequality constraints.

$$\text{Primal Form } \text{---- } L(w, b, \alpha) = \frac{1}{2}\langle w, w \rangle - \sum_{i=1}^{l} \alpha_i [y_i (\langle w, x_i \rangle + b) - 1]$$

### SVM Problem Formulation

$$\partial L(w, b, \alpha)/\partial w = w - \sum_{i=1}^{l} \alpha_i y_i x_i = 0$$

$$\partial L(w, b, \alpha)/\partial b = \sum_{i=1}^{l} \alpha_i y_i = 0$$
$$w = \sum_{i=1}^{l} \alpha_i y_i x_i$$

**Dual Form -----**

$$L(w, b, \alpha) = \frac{1}{2} \langle w, w \rangle - \sum_{i=1}^{l} \alpha_i [y_i (\langle w, x_i \rangle + b) - 1] \\ = \sum_{i=1}^{l} \alpha_i - \frac{1}{2} \sum_{i=1}^{l} \alpha_i \alpha_j y_i y_j \langle x_i, x_j \rangle$$

**[Quadratic form]**

SVM problem formulation is as follows : Given a linearly separable training sample S = ((x₁, y₁), ..., (xᵢ, yᵢ)), the hyperplane (w,b) realizes the maximal margin hyperplane with geometric margin γ = 1/ ||w||₂ by solving the optimization problem in Dual Form

$$\text{Maximize} \quad \sum_{i=1}^{l} \alpha_i - \frac{1}{2} \sum_{i=1}^{l} \alpha_i \alpha_j y_i y_j \langle x_i, x_j \rangle \\ \text{Subject to} \quad \sum_{i=1}^{l} \alpha_i y_i = 0$$

$$\alpha_i \ge 0$$

$$w^* = \sum_{i=1}^{l} \alpha_i^* y_i x_i = \text{Desired solution}$$

$$b^* = \frac{1}{2} [ \max_{y_i=-1} \langle w^*, x_i \rangle + \min_{y_i=1} \langle w^*, x_i \rangle ]$$

**Optimal Hyperplane ---**

$$f(x, \alpha^*, b^*) = \sum_{i=1}^{l} \alpha_i^* y_i \langle x_i, x \rangle + b^*$$

The advantages of SVM is no local minima due to convexity of the quadratic optimization problem, it is an advantage over neural networks. The open issue is speeding up the training method, choice of appropriate Kernel functions and use of Kernel methods in other algorithms.

## 3. STRUCTURE

### *Structure Analytics*

Dr. Aziz is analyzing the structure of the systems associated with emerging digital technologies. There are various types of deployment models in cloud computing such as private cloud, public cloud and hybrid cloud. Private cloud is operated solely for a single organization managed internally or by a third party and hosted internally or externally. Public cloud offers a set of services over a network that is open for public use. Hybrid cloud offers the benefits of public and private cloud. In cloud architecture, multiple cloud components communicate with each other over a loose coupling mechanism (e.g. messaging queue). Cloud computing service models are arranged as layers in a stack : Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), Database-as-a-Service (DaaS), Datastorage-as-a-Service (dSaaS), Mobile-backend-as-a-Service (MBaaS), serverless computing and Function-as-a-Service (FaaS) [1-20].

IaaS provides online services of network infrastructure such as physical computing resources, location, data partitioning, scaling, security and backup from data centers. PaaS offers a development environment to application developers through programming languages, libraries, services and various tools. The service consumer does not manage or control the underlying cloud infrastructure (e.g. network, servers, operating systems or data storage) but has control over deployed applications and possibly configuration settings for the application hosting environment. SaaS permits a service consumer to use the software applications of
the service provider running on a cloud infrastructure. The applications are accessible from various client devices through web browser or a program interface. The consumer does not manage or control the underlying cloud infrastructure but can access to application software and databases. Cloud providers manage the infrastructure and platforms that run the applications. MBaaS permits web app and mobile app developers linking their applications to cloud storage and cloud computing services through application programming interfaces (APIs). Serverless computing permits cloud provider fully managing starting and stopping virtual machines. FaaS is a service hosted remote procedure call that leverages serverless computing to enable the deployment of individual functions in the cloud that run in response to events.

**IIoT:** IoT is the network of physical objects embedded with sensors, software and network connectivity that enables the objects to monitor, collect, exchange and analyze data. Industrial Internet of Things (IIoT) is a set of hardware and software components (e.g. smart sensors and actuators) enabled by IoT to support manufacturing and industrial processes. IIoT leverages the power of smart machines and real-time analytics across several industries such as manufacturing (Industry 4.0), logistics, oil, gas, transportation, energy, utilities, mining, metals and aviation. The benefits of IIoT may include better connectivity, scalability, cost savings, improved productivity and better analytics for predictive maintenance.

**Pervasive & wearable computing** : One of the most promising emerging digital technology is health monitoring smart wearable systems (SWS) through advances of micro-electro-mechanical systems, electrical simulation, mechatronics, sensors, actuators, biomedical instrumentation and nanotechnology. SWS is an interesting cost-effective solution which can monitor a patient's health status in real-time and support complex healthcare applications for disease prevention, symptom detection and medical diagnosis. Let us consider the structure of smart wearable system (SWS). The system may have various types of digital and mechatronics components such as sensors, actuators, power supplies, wireless communication units, processing units, algorithms, software, user interfaces and smart fabrics to capture and process data and make intelligent decisions based on the measurement of various parameters of human body such as temperature, blood pressure, heart rate, respiration rate, blood oxygen saturation and ECG. The measured data are sent to a central node (e.g. PDA, medical centre) through wireless communication system. SWS is expected to monitor the state of the health of human agents (e.g. patients, athletes, issue alerts and send feedback to the medical staff in real-time. The healthcare experts and consultants can take rational decisions on patient care accordingly. There are various issues and challenges in telecare, telehealth and telemedicine through new models, prototypes, test beds and industrial products to enhance the performance of healthcare system and minimize the risk of illness, injury, inconvenience and rehabilitation. But, there are various constraints such as high cost, size, weight, energy consumption, complexity of sensor implementation and connectivity, ethics, laws, information security and privacy, freedom, autonomy, reliability, consistency, safety and service issues.
Edge computing needs the support of a distributed and open IT architecture having decentralized processing power, mobile computing and IoT technologies. Data is processed by the device itself or by a local computer or server, rather than being transmitted to a data center. Edge structure consists of servers, applications, content distribution network and small clouds at the edge. An edge gateway is a virtual router in either a compact or a full configuration. Edge devices are used by enterprises and service providers through cloud computing and IoT technologies for more intelligence, computing power and advanced services at the network edge. Edge structure uses cloud infrastructure but keeps assets at the edge of the network. A version of the client's apps may run locally to allow ready use without latency, with another versions residing in the regional and central data centers for data warehousing and mining.

<table><caption>Figure 10.3: Information System Structure for Solar Computing</caption><thead><tr><th>Application schema</th><th>ERP: MM, HR, FICO, CRM, SCM</th><th>Demand response</th><th>Predictive analytics</th><th>Business analytics</th></tr></thead><tbody><tr><th>Data schema</th><td>Demand Supply</td><td>Tariff price</td><td>Grid status</td><td>Environmental analysis</td></tr><tr><th>Security schema</th><td>Stability analysis</td><td>Reliability consistency</td><td>Access control</td><td>Attacks DoS</td></tr><tr><th>Networking schema</th><td>Internet</td><td>Mobile communication</td><td>LAN</td><td>Satellite GPS</td></tr><tr><th>Computing schema</th><td>AI: Expert system</td><td>Soft computing</td><td>Billing & payment fn.</td><td>Service oriented computing</td></tr><tr><th>System protection</th><td>Relay</td><td>Circuit breaker</td><td>Switchgear fuse isolators</td><td>Measurement instrumentation</td></tr><tr><th>System control</th><td>Smart meters</td><td>Voltage control</td><td>Frequency & PF control</td><td>Sensors & monitoring</td></tr><tr><th>Power system</th><td>Power generation</td><td>Power transmission</td><td>Power distribution</td><td>Load Smart homes</td></tr></tbody></table>

Dr. Aziz is analyzing a smart grid in terms of various system components such as power generation, transmission and distribution system, generators, transformers, transmission lines, loads, switchyards, microgrids comprising of AC/DC sources and loads, renewable energy sources and energy storage system. Figure 10.3 shows the layered structure of a smart power grid having two core layers: (a) physical and (b) information. The physical layer consists of bottom three layers. The first layer connects various components of a power system such as power generation, transmission, distribution and loads. The next layer is system control which consists of smart meters, voltage, frequency and power factor controllers, sensors and
monitoring instruments. Smart meters are able to support exchange of real-time information on demand and supply of electrical power from a smart grid. The meter reading may be communicated to the consumers through SMS and e-mail. The third layer protects the smart grid through various types of relays, circuit breakers, switchgears, fuses and isolators.

The next layer of the smart grid structure is information layer which is associated with computing, networking, security, data and application schema. This layer aggregates information from the physical layer and analyzes data intelligently. The computing schema uses knowledge based expert system and various soft computing tools for automated system control of the smart grid. It is also necessary to compute bills or invoices for the consumers based on consumption of energy; The basic building blocks of networking schema are internet and mobile communication systems. The data schema manages data on demand and supply, tariff and pricing plans. The application schema has various components such as ERP, SCM, CRM, DSS and business analytics; the ERP system may have materials management, finance and cost control, HR and maintenance modules.

<figure><img src="image_94.png" /><figcaption>Figure 10.4 Expert System for a Smart Grid</figcaption></figure>

The solar computing system should be able to interact with the consumers on various issues such as demand response schemes, current energy sources, information on availability of power, peak load, energy consumption, payments, discounts, variable pricing mechanisms and charging of electrical and hybrid vehicles. The objective of demand response schemes is to accommodate variable supply of renewable energy sources and high frequency monitoring of demand and supply for smart homes, buildings and micro-grids. Solar computing considers the scope of various types of emerging applications such as internet of energy, smart homes and autonomous micro-grids to manage and monitor the use, storage and production of electrical energy through a network of automated modules.

Expert systems are computer based information systems that use expert knowledge to attain high level decisions performance in a specific problem domain [Figure 10.4]. The basic principles of ES include how to determine who experts are, the definition of expertise, how expertise can be transferred from an agent to a
computer, how the system works. An expert is an agent who has special knowledge, judgement, experience and methods to give advice and solve problems. The knowledge is basically a set of facts and rules. An ES is expected to recognize and formulate a problem, solve a problem quickly and correctly, explain a solution, learn from experience, restructure knowledge, breaking rules if necessary, determining relevance and degrading gracefully. Expertise is extensive task specific knowledge that use expert process. The level of expertise determines the performance of a decision. Expertise is obtained in various ways ; implicit knowledge is gained from experience; explicit knowledge is gained through supervised learning. Expertise is associated with high degree of intelligence, learning from past success and mistakes, well stored, organized and quickly retrievable knowledge from an expert who has excellent recall of patterns from previous experience. The knowledge is related to a specific problem domain, rules and procedures, heuristics about what to do in a given problem situation, global strategies for solving a problem, meta knowledge (knowledge about knowledge) and facts about problem areas.

Dr. Aziz is presenting the complexity analysis on the structure of IIoT enabled ICS and SCADA technology in terms of various components such as PLC, RTU, field devices, intelligent electrical and electronic devices, workstations, human machine interface, communication gateways, data historians, controllers and software applications; their functions, topology, connectivity and communication protocols. The configuration and scope of an ICS may be simple, medium or highly complex; may be fully or semi-automated. There are various types of ICS like SCADA, process control system (PCS), distributed control system (DCS), safety (SIS), building automation system (BAS), energy management system (EMS) and embedded system (ES).

A Process Control System (PCS) controls an automation process in an industrial plant (e.g. steel, chemical, life-science). SIS monitors an automation process and prevents an unsafe plant operation through a set of sensors and controllers. DCS controls multiple automation processes at a plant (e.g. oil refineries, water treatment plant). BAS monitors and controls a building's infrastructure services such as heating, ventilation, air conditioning, cooling, lighting, elevators, fire protection, energy management etc. through intelligent Internet Protocol (IP). EMS monitors and controls a smart power grid.

SCADA is a type of ICS which collects data and monitors an automated power plant. SCADA control center monitors and manages RTUs and IEDs; the human operators or supervisors use HMI or a supervisory control software to control the power plant by changing set points. A SCADA system may supervise one or more DCSs or PCSs at distant locations, through intelligent communication protocols wherein bandwidth, reliability, latency and jitter are critical success factors. A SCADA system is a process automation system; it is used to gather data from the sensors and the instruments distributed at remote sites and to transmit the data into a central system for controlling or monitoring the basic mechanism. The system controller can view the data collected from the sensors on SCADA host computers located at master site. Automated or operator driven supervisory commands are
transmitted to the control system based on the data received from the remote sensors.

Generally, a SCADA system is composed of five basic components [1]: (i) a sensor network that senses process variables at remote site, (ii) a set of operating instruments connected to the sensors, (iii) a set of local processors that collect data and communicate with programmable logic controllers (PLC), RTU, intelligent electronic devices (IED), transducers, relays and process controllers; (iv) SCADA servers / host computers / master terminal units (MTU) as central point of process control, performance monitoring, data warehousing and data mining and (v) wired / wireless communication channels between local processors and host computers.

Let us do the technical analysis on various components of an industrial control system &/ SCADA. A PLC is a microprocessor controlled electronic device that reads input data from sensors, executes programmed instructions based on input and supervisory control, generate output signals for change of switch settings or actuators. A PLC has CPU, communication interface, input and output modules and power supply and executes various types of programming languages such as ladder diagram, block diagram, structured text, instruction list and sequential function chart. A RTU is a microprocessor controlled electronic device and of two types such as station and field RTUs. Intelligent Electronic Devices (IED) may have one or more processors and can interact with various external entities like digital relays and meters.

A workstation is typically a computer or server running a standard operating system; hosts the programming software for making changes in the logic of the controllers and other applications. HMI is a software application which provides alarms, process status and data trends of an automated processes to a plant supervisor. An HMI can operate on various platforms such as desktop computers, tablets, smart phones or SCADA panel screens. Data Historian is a software application for time series analysis of real-time data. Communication Gateway enables two devices to communicate with each other. A Front End Processor is a dedicated communications processor. There may be various types of field devices like sensors, transducers and actuators which directly interface with a controller through digital or analog I/O module or industrial protocol (e.g. Modbus). The typical architecture of SCADA supports TCP, IP, UDP and wireless communication protocols as well as Modbus TCP, private radio, cellular or satellite networks [6]. The selection of appropriate communication schema depends on various factors such as data rate, polling frequency, distance, area, budget and future needs. A SCADA system can monitor and control thousands of input / output (I/O) points. This is a complex integrated system: a SCADA network may be integrated with other different types of information and communication systems such as web enabled enterprise applications and business intelligence solutions [3,4]. This architecture provides a real-time, fault-tolerant and intelligent distributed computing platform.

Let us do system audit analysis on digital transformation of ICS / SCADA [ Figure 10.5]. In many plants, ICS and SCADA were installed a long time back. It is possible to improve the system performance and productivity of various old plants through system audit grid analysis : divest the dead, old and obsolete technologies (e.g.
electromagnetic relays, PLCs) and invest on emerging technologies (e.g. digital relay protection, sensor networks, Internet communication protocols, self healing system, AI based plant) for digital transformation.

What are the benefits of deploying wireless communication schema in ICS and SCADA? It is a costly strategic option; it requires high capital allocation and technological skill for the replacement of wired networking schema with wireless schema and extensive upgrading efforts. This initiative of digital transformation also requires the replacement of critical electrical and electronic equipments such as digital relays, digital smart meters and sensors which should be fit for operation in wireless environment. It is also important to look into security and privacy of critical data in wireless environment against malicious cyber and physical attacks. It is really challenging to select appropriate wireless technologies for multi-tiered ICS & SCADA architecture. A typical wired ICS infrastructure may be damaged due to natural disaster or act of terrorism. However, there are several benefits of wireless schema in terms of network bandwidth, high speed, reliability, adaptability, availability, safety, scalability, reduced cost of cabling and installation, flexible installation, adhoc ondemand deployment, providing redundancy and efficient integration among different components of plant.

<figure><img src="image_95.png" /><figcaption>Figure 10.5: System Audit Grid for IIoT enabled SCADA / ICS</figcaption></figure>

Let us explore the structure of quantum computing model in terms of quantum bits, quantum gates, quantum algorithms and quantum circuit. What are the basic elements of secure multi-party quantum computing model: computing schema, data schema, networking schema and application schema?

**Quantum bits:** A bit is the fundamental building block of classical computation and information. Secure Multi-party Quantum Computation (SMQC) is built upon an analogous concept quantum bit or qubit. Qubit is a mathematical object with specific properties. Qubits are abstract mathematical objects to construct a general theory of SMQC. A bit has two possible states – 0 and 1. Like classical bit, qubit has two possible states $|0\rangle$ and $|1\rangle$ where $|\rangle$ is Dirac notation. The difference between bits and qubits is that a qubit can be in a state other than $|0\rangle$ and $|1\rangle$. It is also possible to form linear combination of states known as superposition. $|\Psi\rangle = \alpha|0\rangle + \beta|1\rangle$; where $\alpha$ and $\beta$ are complex numbers. The state of Qubit is a vector in 2-dimensional complex vector space. The special states $|0\rangle$ and $|1\rangle$ are known as computational basis states and form an orthogonal basis for vector space. In classical
computation, a bit is examined whether it is in a state 0 or 1. We can not examine a
qubit to determine its quantum state i.e. the values of α and β. We can only acquire
much more restricted information about the quantum state. When we measure
Qubit, we get either the result 0 with probability α² or result 1 with probability β².
In general, a qubit's state is a unit vector in 2D complex vector space. Another
important issue is multiple qubits: if there are two bits, there will be four possible
states – 00,01,10 and 11. If there are 2 qubits, there will be 4 computational basis
states |00>, |01>, |10> and |11>. The state vector describing 2 qubits is |Ψ> = α₀₀.|00> + α₀₁.|01>α₁₀.|10>α₁₁.|11>.

**Quantum computation** : A classical computer is built from an electrical circuit containing wires and logic gates. A quantum computer is built from a quantum circuit and elementary quantum gates to execute secure multi-party quantum computation. Let a system has two states |0> and |1>. Then quantum NOT gate :

$|\Psi'\rangle = \alpha. |1\rangle + \beta. |0\rangle$.

Quantum NOT gate, X = [0, 1; 1, 0]; Quantum state α.|0> + β.|1> = [α, β]; X. [α β] = [β, α]

Z = [1 0;0 -1], H = 1 / root 2 [1, 1; 1, -1]

<figure><img src="image_96.png" /><figcaption>Figure 10.6 : Qubit logic gates (a)NOT gate, (b) Z gate; (c) H gate</figcaption></figure>

There are various types of quantum gates such as AND, NAND, OR, NOR, XOR, Z gate and H gate; H gate represents Hadamard operation, a rotation of a space about y axis by 90° followed by a rotation of X axis by 180°.

Quantum circuit : It is made of quantum gates and wire. Let a circuit swaps the states of two qubits.

|a,b> → |a, a ⊕ b>; |a ⊕ (a ⊕ b), a ⊕ b> = |b, a ⊕ b>; |b ⊕ (a ⊕ b) ⊕ b> = |b,a>

<figure><img src="image_97.png" /><figcaption>Figure 10.7 : Qubit circuit swapping 2 qubits</figcaption></figure>
<figure><img src="image_98.png" /><figcaption>Figure 10.8 : Controlled U gate and NOT gate</figcaption></figure>

**Quantum algorithms** : What class of computation can be performed using quantum circuit? How to compute SMQC with computation using classical logic circuits ?

**Toffoli gate** : It has 3 input bits and 3 output bits. It is a reversible gate. Two bits are controlled bits that are unaffected by the action of Toffoli gate. The third bit is a target bit that is flipped if both control bits are set to 1 and otherwise left alone.

$(a, b, c) \rightarrow (a, b, c \oplus a \circ b) \rightarrow (a, b, c)$

**Truth table of Toffoli gate** :

Input - $[0,0,0;0,0,1;0,1,0;0,1,1;1,0,0;1,0,1;1,1,0;1,1,1]$;

Output – $[0,0,0;0,0,1;0,1,0;0,1,1;1,0,0;1,0,1;1,1,1;1,1,0]$;

**Quantum parallelism** : It is a fundamental feature of many quantum algorithms. It allows quantum computers to evaluate a function $f(x)$ for any different values of $x$ simultaneously.

<figure><img src="image_99.png" /><figcaption>Figure 10.9: Tofoli gate</figcaption></figure>

**Structure Analytics**

* ✿ Bloom filter

* ▲ Adaptive Bloom Filter /

* ✿ Cuckoo filter

* ▲ Adaptive Cuckoo Filter /

* ■ Cuckoo hash table

* ✿ Parallel pipeline

Data structure is the basic building block of efficient algorithms. It is used to organize a large amount of data which can be queried efficiently. Randomized data structure assumes that inputs and queries are independent of its internal randomness. For any sequence of inputs, an efficient data structure yields a correct answer with high probability over its internal randomness. There are various types of structure of secure adaptive filter such as Bloom filter, Cuckoo filter, Adaptive Cuckoo filter and parallel d-pipeline.

**Bloom filter** : It is a simple space-efficient randomized data structure to represent a set to support membership queries. It allows false positives but the space savings often outweigh this drawback when the probability of an error is controlled. The fundamental principle of the filter is that wherever a list or set is used, and space is at a premium, it is rational to select Bloom filter if the effect of false positives can be mitigated. It exists in an adversarial model if one way function exists. It is used for
query processing in database and also networking applications. Let, a set $S = \{x_1, x_2, ..., x_n\}$ of n elements is described by an array of m bits, initially all set to 0. A Bloom filter uses k independent hash functions $h_1, ..., h_k$ with range $\{1, ..., m\}$. These hash functions map each item in the universe to a random number uniform over the range $\{1, ..., m\}$. For each element $x \in S$, the bits $h_i(x)$ are set to 1 for $1 \le i \le k$. A location can be set to 1 multiple times, but only the first change has an effect.

<figure><img src="image_100.png" /><figcaption>Figure 10.10 : Bloom Filter</figcaption></figure>

Let us check if an item y is in S, we check whether all $h_i(y)$ are set to 1. If not, then clearly y is not a member of S. If all $h_i(y)$ are set to 1, we assume that y is in S, although we are wrong with some probability. Hence, a Bloom filter may yield a false positive, where it suggests that an element x is in S even though it is not. For many applications, false positives may be acceptable as long as their probability is sufficiently small. In figure10.10, a Bloom filter begins as an array of all 0s. Each item in the set $x_i$ is hashed k times, with each hash yielding a bit location; these bits are set to 1. To check if an element y is in the set, hash it k times and check the corresponding bits. The element $y_1$ cannot be in the set, since a 0 is found at one of the bits. The element $y_2$ is either in the set or the filter has yielded a false positive.

**Cuckoo filter** : It is an approximate membership check data structure based on cuckoo hash tables. Instead of storing set elements, it stores fingerprints of the elements using an additional *hash function*. It uses less space but ensures a low false positive probability. Cuckoo hash tables provide an efficient dictionary data structure; it is implemented as a collection of d subtables composed of b buckets each with each bucket having c cells. The hash table uses d hash functions ($h_1; h_2;...h_d$), where the domain is the universe of possible input elements and the range is $[0; b]$. The structure supports: look up, insertion and deletion operations as stated in aforesaid secure adaptive filter algorithm.

**Adaptive Cuckoo Filter** : ACF is a data structure for approximate set membership that extends the concept of cuckoo fillters by reacting to false positives and removing them for future queries. In packet processing application, queries may correspond to flow identifiers; a search for an element is likely to be followed by repeated searches for that element. Removing false positives can significantly lower the false positive rate. ACF uses a *cuckoo hash table* to store fingerprints. ACF is able to significantly reduce the false positive rate; ACF is an approximate membership check structure that can remove false positives selectively without
introducing false negatives. In contrast with the cuckoo filter, where movements in the cuckoo table can be based solely on the finnger-prints, ACF has original elements available in a slower, larger memory. When inserting a new element, existing elements can be moved. The removal of false positives is almost as simple as a search operation and does not substantially impact the performance of the filter. The structure of ACF is defined in terms of a set of parameters : number of tables used in the Cuckoo hash (d), number of cells per bucket (c), total number of cells over all tables (m), number of buckets per table [ b = m/ (d.c)], occupancy or load (l) and number of bits used for fingerprints (a).

# 4. SECURITY

## Security Analytics

Prof. Kamal Kumar, Prof. Simon Watson and Dr. Henry Plank are analyzing the security intelligence of emerging digital technologies. An information system (IS) may face various types of threats from both external and internal environments but it should be vigilant and protected through a set of security policies. Emerging digital technologies demand the support of adaptive security architecture so that the associated information systems can continuously assess and mitigate risks intelligently. Adaptive security is a critical feature of an emerging digital technology that monitors IS in real-time to detect any anomalies, vulnerabilities or malicious traffic congestion. If a threat is detected, IS should be able to mitigate the risks through a set of preventive, detective, retrospective and predictive capabilities and measures. Adaptive security analyzes the behaviors and events of an information system to protect against and adapt to specific threats before the occurrence of known or unknown types of malicious attacks.

The basic objective of emerging adaptive security architecture and dynamic data protection mechanism is to assess and mitigate the risks of enterprise information system rationally and intelligently. What constitutes an effective strategy of IS security schema? It is debatable whether the proactive approach to IS security is superior to reactive approach. It is possible to recommend an interesting strategy: reactive security may be competitive with proactive security as long as the reactive approach learns from past attacks instead of overreacting to the last attack on the information system. It is not a trivial problem and needs the support of an efficient security protocol from intelligent threat analytics and adaptive security architecture. The following section presents the construction of an adaptive security algorithm to ensure the security of an information system based on proactive and reactive approaches. The basic building blocks of the algorithm are intelligent threat analytics, cryptographic solutions and dynamic data protection. It is basically an attempt of the cross fertilization of algorithmic game theory and cryptography. It is essential to verify the security intelligence of a smart grid at various levels : L₁, L₂, L₃, L₄ and L₅. At level L₁, the system performance of the grid is verified in terms of reliability, consistency, stability, robustness, safety, liveness and resiliency. Resiliency measures how fast a system can return to the normal operation following a disruption. The other critical factors are deadlock-freeness and synchronization.
The next level is L₂ wherein it is required to audit the access control policy of the grid in terms of authentication, authorization, correct identification, privacy, confidentiality, commitment and trust of the users and the system administrator. At level L₃, the security schema is verified in terms of fairness and correctness (e.g. accuracy of measurement of data in meter reading). At level L₅, it is crucial to assess the risks of various types of malicious attacks on a smart grid such as denial of service (DoS), Sybil and false data injection attack.

At level L₄, it is essential to verify the efficiency of digital relay protection of the transmission lines, generators and motors connected to the power grid such as overcurrent, earth fault, short circuit, voltage and reactive power control and distance protection. Digital relays protect the power system from the adverse effects of a fault which occurs as a random event. The fault current is always greater than the normal load current. If the faulty power system component is not isolated from the grid in time, it may lead to instability. A protection system may consist of CT / PT, CVT, battery, circuit breaker, transducers and protection relays. Overcurrent relays can be used to protect transmission lines, transformers, generators and motors. Reliability and consistency are expected in power system protection. A relay must be dependable and secure; it should operate for specific operating conditions; it should not operate for any other power system disturbance. The responsibility and accountability is defined by a zone of protection. A protection system is responsible for all types of faults occurring within the zone of protection.

Let us present the SWOT analysis on digital power system protection. Smart power grid protection is going through a diffusion of technology from electromagnetic and static relays towards computer enabled digital relays; digital computers have been replacing traditional tools used for short circuit, load flow and stability analysis. Power system protection relays are the next promising scope of computerization based on improved computer hardware, efficient algorithms and programming codes. Digital relays offer the best economic and technical solutions for real-time monitoring and control of power systems today.

Digital relay protection provides several benefits in terms of cost, self-checking reliability, consistency, system integration, adaptive relaying and functional flexibility. The cost of a relay is the main consideration in its acceptability. The cost of digital relays has been declining steadily; the cost of conventional electromagnetic and static relays has been increasing due to change in design, inflation and declining sales and production. A digital relay can be programmed to monitor its hardware and software schema continuously and can detect any malfunctions. It fails in a safe mode and sends a service request alarm to the system center. Digital computers and digital technology have become the basis of measurements, communication, and control of a smart grid. Digital relays can accept digital signals from transducers and fiber optic channels and can be integrated with the control and monitoring system efficiently. Digital computer can be programmed to perform several functions such as measuring and monitoring flows and voltages in transformers and transmission lines, controlling the opening and closing of circuit breakers and switches and providing necessary backup. The relaying function calls for intensive computational activity at no extra cost when a fault occurs on the system. It is an interesting innovation agenda how AI algorithms, heuristics and computing
techniques can be applied in various roles of digital power system protection: (Level A) relaying, switch yard protection, measurements, control, diagnostics, communication with levels B and C; (Level B) man machine interface, data acquisition and storage, sequence of events analyses, coordination, back-up protection, communication with level A and B and (Level C) system control, event analyses, communication with levels A & B, adaptive relaying and system performance analysis.

<figure><img src="image_101.png" /><figcaption>Figure 10.11: Threat Analytics of a Smart Grid</figcaption></figure>

**Adaptive security and dynamic data protection** : Let us consider the technology associated with adaptive security and dynamic data protection of a smart grid operated through solar computing. New threats are getting originated as an outcome of technology innovation and may cause new forms of disruptions with severe impact. Today, it is essential to deploy adaptive security architecture for solar computing. A smart grid demands continuous monitoring and remediation; traditional ‘prevent and detect’ and incident response mindsets may be not sufficient to prevent a set of malicious attacks. Adaptive security is an essential part of solar computing. It is required to assess as-is system administration strategies, investment and competencies; identify the gaps and deficiencies and adopt a continuous, contextual and coordinated approach.

For example, prevention and detection are traditional approaches to the security of a smart grid. In today's digital world of expanding threats and risks, real-time system monitoring is essential to predict new threats and automate routine responses and practices. Advanced analytics is the basic building block of next generation security protection which should be to manage an enormous volume, velocity and variety of data through AI and machine learning techniques. User Entity Behavior Analytics detect anomalous patterns by comparing with the normal profile and the activities of the users and trigger alarms by sensing single or
multiple attacks on solar computing system. The security must overcome the interorganizational barriers among security, application development and operations teams and be integrated deeply into solar computing architecture.

Dynamic data protection is an effective way to move towards adaptive security architecture. DDP surfaces anomalies and adjusts individualized data security controls proactively in near real-time to protect the critical data of an enterprise. Adaptive Security with dynamic data protection is expected to offer many benefits over traditional security platforms depending on the size of organization and networking schema – real time monitoring of events, users and network traffic; autonomous and dynamic resolutions; prioritization and filtering of security breaches; reduction of attack surface and impact or damage of a threat and reduction of resolution time. This technology is expected to adapt to the needs of solar computing system irrespective of the size of network, nature of operation or exposure of threats. It can assess the requirements of information security with greater accuracy through a set of intelligent policies and procedures and can ensure better understanding of strength, weakness, opportunities and threats of the security architecture.

A system may face various types of threats from both external and internal environments but it should be vigilant and protected through a set of security policies. An emerging technology demands the support of an adaptive security architecture so that the associated system can continuously assess and mitigate risks intelligently. Adaptive security is a critical feature of a technology that monitors the network or grid associated with a system in real time to detect any anomalies, vulnerabilities or malicious traffic congestion. If a threat is detected, the technology should be able to mitigate the risks through a set of preventive, detective, retrospective and predictive capabilities and measures. Adaptive security analyzes the behaviors and events of a system to protect against and adapt to specific threats before the occurrence of known or unknown types of malicious attacks. Adaptive security monitors a solar computing system in real time to detect anomalies, malicious traffic and vulnerabilities. If a threat is detected, it is essential to counter the threat in various ways. Preventive capabilities allow the system to create products, processes, and policies that counter-attack malicious attack (e.g. web security) on the solar computing system. The detective capabilities should identify those attacks in time at minimum impact and not detected by preventative capabilities. Retrospective capabilities should perform in-depth analysis of threats not detected by the detective layer to avoid such types of attacks in future. Predictive capabilities provide alerts about external events and anticipates new types of threats.

Abnormal operating conditions and faults may cost a smart grid significantly but may be prevented through intelligent prediction and control mechanism of *knowledge based expert system*. An expert system is expected to monitor, detect and diagnose abnormal conditions of solar power system and provides safeguards against unexpected process conditions. It is possible to model faults and instability in a complex smart grid through expert system which is basically a knowledge based real-time fault diagnostics. The expert system uses the valuable knowledge from the experts, operators and real-time data from various sensors, measuring
instruments and various electrical and electronic devices connected to a smart grid. Soft computing algorithms (e.g. fuzzy logic and ANN) may be used for mining acquired real time data and knowledge discovery from data.

There are two methods of fault diagnosis: model based approach and knowledge based approach. Model based approach adopts quantitative models to estimate states and parameters of system. But, it is almost impossible to obtain a model that exactly matches the process behavior of a smart grid in practice. The mismatch between the behavior of the model and the plant or smart grid may lead to large error signals. Abnormal operation may cause false alarms unless appropriate thresholds are used. It may be impossible to model non-linear systems by analytical equations. These negative aspects demand the support of alternative knowledge based methods in fault diagnosis such as ANN, fuzzy logic and CBR. Knowledge based fault diagnosis is done based on the evaluation of real-time monitored data according to a set of rules which human experts (e.g. operators, engineers, support staff) have learnt from past experience. The knowledge may be input and output process variables, patterns of abnormal process conditions, fault symptoms, operational constraints and performance criteria. Knowledge based approach automates human intelligence for smart grid supervision. Knowledge based approach is suitable for large and complex, nonlinear smart grid. Linear approximation of nonlinear system may result significant errors. The combined approach of knowledge based fault diagnosis with real-time process variables improves the reliability, consistency and efficiency of the system. Knowledge based fault diagnosis has three basic steps: (a) acquire real time process data from sensors and intelligent electrical and electronic devices; the sensed process variables indicate problem of safety and stability of smart solar grid. (b) make inferences or diagnosis based on acquired process data and (c) take actions based on inferences such as raising alarms, informing operators and automated on/off operation of connected equipments for resiliency of the smart grid. Please refer to section 9 which has analyzed the case of a self-healing smart grid through verification of security intelligence at levels L1,L2,L3,L4 and L5.

The next element of the deep analytics is security. The basic building block of security of IIoT enabled ICS and SCADA technology is an intelligent threat analytics. The threats to a plant may be method, target, protocol and identity specific. Insider attacks are more malicious than outsider attacks as the adversaries may have more knowledge about the internal architecture of SCADA & ICS. Method specific threats define how active or passive threats are executed. The method specific threats can be either passive or active. In passive attack, the adversary monitors and analyzes the data captured from SCADA & ICS. In active method, the adversary may send false data to the components of SCADA system. Target specific threats attack specific component of SCADA network such as PLC, relays and smart meters. The adversaries may try to exploit the vulnerabilities associated with the networking protocols (e.g. DNP3, Modbus).

Please refer to section 9 which outlines security intelligence verification mechanism (SIVM) and also shows its application in three different cases: (a) SCADA for a smart power grid, (b) adaptive industrial control system and (c) defense for border
security surveillance. SIVM is the backbone of the security of IIoT enabled SCADA and ICS technology. Table 4.1 summarizes the major findings of an intelligent threat analytics for the protection of SCADA & ICS in terms of target, risks assessment and mitigation strategies and verification mechanisms. A verification mechanism is expected to provide one or more services by detecting, preventing or recovering from one or more security attacks. We have found that no single verification algorithm can provide adequate security to ICS & SCADA.

<table><caption>Table 10.1: Threat Analytics</caption><thead><tr><td>Target</td><td>Security Threats on SCADA / ICS</td><td>Verification mechanisms</td><td>Risk mitigation strategies</td></tr></thead><tbody><tr><td>Networking schema</td><td>Intrusion: sybil, cloning or node replication, wormhole, DoS, node capture</td><td>Intrusion Verification Mechanism (IVM)</td><td>Bio-inspired AI: self / non-self classification for negative selection, danger signal detection; identity control</td></tr><tr><td>Networking schema</td><td>Secure communication : Device attestation, false data injection attack, coremelt attack, multicast attack: rushing, blackhole, neighbor, jellyfish</td><td>Private communication verification mechanism (PCVM)</td><td>Challenge response protocol, bad data measurement, SCADA network traffic congestion analysis; Key management protocol to preserve group, forward and backward privacy.</td></tr><tr><td>Cyber application schema</td><td>Web service security</td><td>Web security verification mechanism (WSVM)</td><td>Trusted service oriented computing</td></tr><tr><td>Computing and application schema</td><td>Biometric access control</td><td>Access Control Verification Mechanism (ACVM)</td><td>Biometric enrollment and recognition; credential based access control</td></tr><tr><td>Data schema</td><td>Privacy : inference control</td><td>Privacy Verification Mechanism (PVM)</td><td>Statistical disclosure control preserving confidentiality and privacy: randomization, suppression, generalization, sampling, summarization, aggregation.</td></tr></tbody></table>

An intelligent threat analytics should perform various type of vulnerabilities analysis as follows:

**Vulnerability analysis 1:** Domain (configuration, design specification, implementation) vs. weakness (account mgmt, poor coding practice, poor authentication, interface programming, malfunctioning devices, poor logging, inefficient monitoring);

**Vulnerability analysis 2:** Risk elements ( purpose of attacks [ information capture, sabotage], lateral movement [ automatic], location command and control server [Insider and outsider attack], initial attack vector [Automatic]) vs. types of attacks (e.g. capture information from target through industrial espionage, identity theft, IP theft, spearphishing, drive-by-download attack);

**Vulnerability analysis 3:** Classification of vulnerabilities (buffer outflow, forced browsing, code injection, access control, input validation, resource exhaustion, authentication attack, path traversal, resource allocation, weak password, DLL
hijacking, SQL injection, cryptographic failure, CSRF, weak encryption) vs. history of occurrence;

*Vulnerability analysis 4 : metrics (physical, information, cognitive, social) vs. risk mitigation practice (plan, absorb, recover, adapt);*

It is essential to define an optimal set of security metrics in terms of risk and resilience. The metrics are the measurable properties of ICS that quantify the degree to which objectives have been achieved and provide vital information of system performance. Security metrics are associated with critical business functions such as incident, vulnerability, patch, configuration, security and change management. The metrics should be linked to a strategy, can be quantified, comprehensive, and measurable and indicates the right behavior of a system. Relevant Metrics are directly linked to decision making goals, objectives and relevant attributes of a system.

*Adaptive security and dynamic data protection*

The expert panel are interaction on the technology associated with adaptive security and dynamic data protection of ISI analytics. New threats are getting originated as an outcome of technology innovation and may cause new forms of disruptions with severe impact. Today, it is essential to deploy adaptive security architecture for SCADA & ICS which demands continuous monitoring and remediation; traditional ‘prevent and detect’ and incident response mindsets may be not sufficient to prevent a set of malicious attacks. *Adaptive security* is an essential part of ISI analytics. It is required to assess as-is system administration strategies, investment and competencies; identify the gaps and deficiencies and adopt a continuous, contextual and coordinated approach.

For example, prevention and detection are traditional approaches to the security of SCADA & ICS. In today's digital world of expanding threats and risks, real-time system monitoring is essential to predict new threats and automate routine responses and practices. Advanced analytics is the basic building block of next generation security protection which should be to manage an enormous volume, velocity and variety of data through AI and machine learning techniques. User Entity Behavior Analytics detect anomalous patterns by comparing with the normal profile and the activities of the users and trigger alarms by sensing single or multiple attacks on SCADA & ICS. The security must overcome the inter-organizational barriers among security, application development and operations teams and be integrated deeply into ISI analytics architecture.

*Dynamic data protection* is an effective way to move towards adaptive security architecture. DDP surfaces anomalies and adjusts individualized data security controls proactively in near real-time to protect the critical data of an enterprise. Adaptive Security with dynamic data protection is expected to offer many benefits over traditional security platforms depending on the size of organization and networking schema: real time monitoring of events, users and network traffic, autonomous and dynamic resolutions, prioritization and filtering of security breaches, reduction of attack surface and impact or damage of a threat and reduction of resolution time. This technology is expected to adapt to the needs of ISI
analytics irrespective of the size of network, nature of operation or exposure of threats. It can assess the requirements of information security with greater accuracy through a set of intelligent policies and procedures and can ensure better understanding of strength, weakness, opportunities and threats of security architecture.

A system may face various types of threats from both external and internal environments but it should be vigilant and protected through a set of security policies. An emerging technology demands the support of an adaptive security architecture so that the associated system can continuously assess and mitigate risks intelligently. Adaptive security is a critical feature of a technology that monitors the network or grid associated with a system in real-time to detect any anomalies, vulnerabilities or malicious traffic congestion. If a threat is detected, the technology should be able to mitigate the risks through a set of preventive, detective, retrospective and predictive capabilities and measures. Adaptive security analyzes the behaviors and events of a system to protect against and adapt to specific threats before the occurrence of known or unknown types of malicious attacks. Adaptive security feature of ISI analytics monitors SCADA & ICS in real-time to detect anomalies, malicious traffic and vulnerabilities. If a threat is detected, it is essential to counter the threat in various ways. Preventative capabilities allow enterprises to create products, processes, and policies that counter-attack malicious attack (e.g. web security) on SCADA & ICS. The detective capabilities should identify those attacks in time at minimum impact and not detected by preventative capabilities. Retrospective capabilities should perform in-depth analysis of threats not detected by the detective layer to avoid such types of attacks in future. Predictive capabilities provide alerts about external events and anticipates new types of threats.

## Adaptive Security Algorithm [ASA]

**Agents:** Defender (e.g. system administrator), Attacker (e.g. malicious agent or adversary);

**System:** Enterprise information system;

**Objectives:** optimize enterprise IS security investment;

**Constraints:** budget, resources, time;

**Input:** Enterprise information system performance parameters and architecture;

**Strategic moves:**

* Adaptive security

* Dynamic data protection

* Self-healing mechanism

* Crash proof code

* Real-time fault diagnostics

* Adoption of hybrid strategy i.e. an optimal mix of proactive and reactive approaches.

**Revelation principle:** The agents preserve privacy of strategic data;

* **Defender:** The defender does not disclose the proactive and reactive approach of information security to the adversaries.

* **Attacker:** The adversaries preserve the privacy of the plan of malicious attack, information of targets and weak links.
<figure><img src="image_102.png" /></figure>

* **Threat modeling**

* Call threat analytics function ($f_a$);

* Estimate probability ($p$) of occurrence along two dimensions: Low [L] and High [H];

* Estimate impact of risk i.e. sunk cost (c) along two dimensions: [L,H];

* Map threats into a set of risk profiles or classes: LL, LH, HL and HH;

* Estimate security requirements in terms of demand plan ($P_d$);

* Develop risk mitigation plan ($P_m$): accept / transfer / remove / mitigate risks.

* Identify targets: computing, data, networking and application schema;

* Verify security intelligence of information system in real-time.

* **Data schema:**

* Dynamic data protection:

* check data integrity;

* assess the risks of false data injection and shilling attacks by the intruders;

* verify access control efficiency in terms of authentication, authorization, correct identification, privacy, audit, confidentiality and nonrepudiation;

* **Computing schema:** verify fairness, correctness, accountability, transparency, rationality, trust and commitment in multi-party computation;

* **Networking schema:**

* Verify system performance in terms of reliability, consistency, stability, liveness, deadlock-freeness, reachability, safety, resiliency;

* assess the risks of intrusion, denial of service (DoS), coremelt, Sybil, node replication and wormhole attacks;

* **Application schema**

* do penetration testing;

* audit user acceptance, system performance and quality of application integration.

<figure><img src="image_103.png" /></figure>

* adopt sense-and-respond strategy.

* assess risks of single or multiple attacks on the information system; analyze performance, sensitivity, trends, exception and alerts.

* what is corrupted or compromised?

* time series analysis: what occurred? what is occurring? what will occur?
* insights : how and why did it occur? do cause-effect analysis.

* recommend : what is the next best action?

* predict: what is the best or worst that can happen?

* Adjust P<sub>d</sub> and P<sub>m</sub>.

Payment function:

* Estimate aspiration point, reservation point, strong, weak, indifference and veto thresholds in the security requirements.

* Trade-off proactive vs. reactive security: assign weights to each risk profile.

* Do portfolio rationalization of the security schema.

* Select dominant strategy of IS investment from the options of process re-engineering, transformational, renewal, experiment and reinforcement on the weakest link.

Output: Optimal security investment plan

Real-time Fault Diagnostics

An intelligent adaptively secure system for monitoring, supervisory control, and diagnosis of complex operations of a smart plant may adopt data driven or analytical or knowledge based approach and is expected to have following capabilities [45-51] : (a) coordinate various tasks of process control such as monitoring, diagnosis and supervisory control; (b) integrate the solution approaches of data driven, analytical and knowledge based intelligent systems; (c) the ability to coordinate different schemes of knowledge representations such as rules, frames, models and cases; (d) maintain a global database and global management of process knowledge; (e) maintain a hierarchical structure of data models on controllers, actuators, sensors, logical constraints, process models, faults and processes at various abstraction levels and (f) the ability to adapt to a changing environment of plant operation.

Abnormal operating conditions and faults may cost a plant significantly but may be prevented through intelligent prediction and control mechanism of knowledge based expert system. An expert system is expected to monitor, detect and diagnose abnormal conditions of a plant and provides safeguards against unexpected process conditions. It is possible to model faults and instability in a complex plant through expert system which is basically a knowledge based real-time fault diagnostics. The expert system uses the valuable knowledge from the experts, operators and real-time data from various sensors, measuring instruments and various electrical and electronic devices connected to a plant. Soft computing algorithms (e.g. fuzzy logic and ANN) may be used for mining acquired real time data, inferencing and knowledge discovery from data.

There are two methods of fault diagnosis : *model based approach* and *knowledge based approach*. Model based approach adopts quantitative models to estimate to estimate states and parameters of system. But, it is almost impossible to obtain a model that exactly matches the process behavior of a plant in practice. The mismatch between the behavior of the model and the plant may lead to large error
signals. Abnormal operation may cause false alarms unless appropriate thresholds are used. It may be impossible to model nonlinear systems by analytical equations. These negative aspects demand the support of alternative knowledge based methods in fault diagnosis such as ANN, fuzzy logic and CBR. Knowledge based fault diagnosis is done based on the monitoring and evaluation of real-time data according to a set of rules which human experts (e.g. operators, engineers, support staff) have learnt from past experience. The knowledge may be input and output process variables, patterns of abnormal process conditions, fault symptoms, operational constraints and performance criteria. Knowledge based approach automates human intelligence for plant supervision; it is suitable for large and complex nonlinear plant. Linear approximation of nonlinear system may result in significant errors. The combined approach of knowledge based fault diagnosis with real-time process variables improves the reliability, consistency and efficiency of the system. Knowledge based fault diagnosis has three basic steps [Appendix]: (a) acquire real-time process data from sensors and intelligent devices; the sensed process variables indicate problem of safety and stability of the plant; (b) make inferences or diagnosis based on acquired process data; (c) take actions based on inferences such as raising alarms, informing operators and automated on/off operation of connected equipments for resiliency of the plant. Please refer to the case study of Industrial Control System in section 9.2 wherein the concept of RTFD is appropriately applicable.

## Analysis of Adaptive Security Algorithm (ASA)

Recently, there is a trend of cross fertilization between two disciplines: game theory and cryptography. Cryptography focuses on secure multi-party computation preserving privacy, fairness and correctness against the threats of malicious agents. Game theory tries to understand the behavior of rational agents with well defined goals in a given situation and designs the rules of interaction. There are differences between the two disciplines based on specific issues such as players, solution drives, incentives, privacy, trust, early stopping, deviation and collusion. Cryptography assumes honest or malicious players; game theory assumes rational players; the solution drives are secure protocol and equilibrium respectively. Both disciplines study collaborative interactions among the agents with conflicting interests. It is possible to solve traditional game theoretic problems and design of efficient mechanisms using the concept of cryptographic solutions and secure multi-party computation. It is also an interesting research agenda to explore new cryptographic concerns using game theoretic concepts such as secure and fair computation and rational secret sharing. Traditionally, cryptographic solutions are focused on the privacy, fairness and correctness to ensure information security. The domain needs a broad outlook for improved efficiency in new applications.

ASA is associated with the problem of information security investment decisions based on the concept of computer science, economics, management science and related disciplines. It is a complex decision making problem. The existing woks attempt to derive and compare optimal investment strategy exploring the delicate balance between proactive and reactive approaches. The current work is an attempt
to extend the existing research. It presents the construction of a deep learning based algorithmic mechanism to ensure the security of an information system based on proactive and reactive approaches. The basic building blocks of the mechanism are threat analytics, cryptographic solutions and adaptive secure multiparty computation.

ASA is associated with a security game. Game theory is concerned with a complex decision making process in which two or more players interact. Each of these players tries to optimize its own objective function. A game can be classified as cooperative game or a non-cooperative game. In a cooperative game, the players make agreements in order to minimize their common cost or to maximize their common payments. This is not possible in a non-cooperative game. A cooperative game is a game where a group of players enforce a cooperative behavior. The game is defined by $(N,u)$ where $N$ denotes a group of agents and $u$ is a real valued characteristic function. The ASA is defined by various types of elements: a group of agents or players, model, actions, a finite set of inputs of each agent, a finite set of outcomes as defined by output function, a set of objective functions and constraints, payments, a strategy profile, a dominant strategy which maximizes the utility of an agent for all possible strategies of other agents involved in the mechanism, security intelligence and revelation principle. There are two agents in the security game: a defender (D) and the attacker (A). Each agent adopts and executes a or a set of strategies. A pure strategy is a deterministic policy for a single move game. For many games, an agent can do better with a mixed strategy. The best strategy may depend on the knowledge of the defender about prospective attacks and the sunk costs incurred when upgrading information security schema reactively. The payment function of the mechanism estimates an optimal investment plan for the security of information system. One of the most critical issues of ASA is revelation principle and verification of security intelligence of the information system schema. The agents preserve the privacy of strategic data. The defender does not disclose the proactive and reactive approach of information security to the adversaries. The adversaries preserve the privacy of the plan of malicious attack. The basic building block of ASA is adaptive security and DDP.

Let us explain the objectives of adaptive security architecture in depth. New threats are getting originated as an outcome of digital technology innovation and may cause new forms of disruptions with severe impact. Today, it is essential to deploy adaptive security architecture for the emerging technologies. The systems demand continuous monitoring and remediation; traditional ‘prevent and detect’ and incident response mindsets may be not sufficient to prevent a set of malicious attacks. It is required to assess as-is system administration strategies, investment and competencies; identify the gaps and deficiencies and adopt a continuous, contextual and coordinated approach.

For example, prevention and detection are traditional approaches to the security of an information system. In today's world of expanding threats and risks, real-time system monitoring is essential to predict new threats and automate routine responses and practices. The system should not only rely on traditional prevent-and-detect perimeter defense strategies and rule based security but should adopt cloud based solutions and open application programming interfaces also. Advanced
analytics is the basic building block of next generation security protection which should be to manage an enormous volume, velocity and variety of data through AI and machine learning techniques. Intelligent analytics are expected to detect anomalous patterns by comparing with the normal profile and the activities of the users, peer groups and other entities such as devices, applications and smart networks and trigger alarms by sensing single or multiple attacks on the system. The security element must overcome the barriers among security, application development and operations teams and be integrated deeply into system architecture.

Next, it is essential to develop effective ways to move towards adaptive security architecture. The mechanism should surface anomalies and adjusts individualized security controls proactively in near real-time to protect the critical data of a system. Adaptive security with dynamic data protection is expected to offer many benefits over traditional security platforms depending on the size of the system and complexity of networking schema: real time monitoring of events, users and network traffic; autonomous and dynamic resolutions; prioritization and filtering of security breaches; reduction of attack surface and impact or damage of a threat and reduction of resolution time. The emerging digital technology is expected to adapt to the needs of a system irrespective of the size of network, nature of operation or exposure of threats. It can assess the requirements of security with greater accuracy through a set of intelligent policies and procedures and can ensure better understanding of strength, weakness, opportunities and threats of the security architecture.

Adaptability is about responding to change effectively and decisively through reactive approach: the ability to identify the change in search space for the adversaries, understanding the probable impacts of the hit by the adversaries, rapid quantification what is under its control to compensate, identification what modifications to the environment are necessary and adoption of risk mitigation measures in time without any hesitation. The defender tries to define the requirements of the security schema of an information system in terms of aspiration point, reservation point and adjustment of various preferential thresholds (e.g. indifference, strong preference, weak preference, veto) and preferred solutions. The value of the objective function which is desirable or satisfactory to the decision maker or defender is defined as aspiration point. The value of the objective function that the defender wants to avoid is reservation point. The defender can use various preference thresholds in order to compare alternatives and to define outranking relations. There is an interval of preference wherein it is not possible for the defender to distinguish between different alternatives and this is defined as indifference threshold. Strict preference threshold is defined as minimal increase or decrease of any objective that makes the new alternative strictly preferred with respect to this objective. There exists an intermediate region between indifference and strict preference threshold where the defender may hesitate to compare alternatives. It is defined as weak preference threshold. Veto threshold indicates what is the minimal increase or decrease of any objective that makes the new alternative unacceptable regardless of the value of other objectives.
The adaptive security algorithm evaluates the security intelligence of an information system based on proactive and reactive approaches. Real-time security management involves high cost of computation and communication. The vulnerability of the system to a disruptive event should be viewed as a combination of likelihood of a disruption and its potential severity. The defender must do two critical tasks: assess risks and mitigate the assessed risks. To assess risks, the system administrator should explore basic security intelligence: what can go wrong in the operation of the system? what is the probability of the disruption? how severe it will be? what are the consequences if the disruption occurs? A vulnerability map can be modeled through a set of expected risk metrics, probability of disruptive event and the magnitude of consequences. For example, the map has four quadrants in a two dimensional space; the vertical axis represents the probability of disruptive event and the horizontal axis represents the magnitude of the consequences. The system may face a set of challenges to solve the problem of resiliency: what are the critical issues to be focused on? what can be done to reduce the probability of a disruption? what can be done to reduce the impact of a disruption? How to improve the resiliency of the system? The critical steps of risk assessment are to identify a set of feasible risk metrics; assess the probability of each risk metric; assess severity of each risk metric and plot each risk metric in the vulnerability map. The critical steps of risk mitigation are to prioritize risks; do causal analysis for each risk metric; develop specific strategies for each cell of vulnerability map and be adaptive and do real-time system monitoring.

*The computational cost of adaptive security algorithm depends on the complexity of threat analytics function ($f_a$) and payment function ($f_p$) in terms of investment allocation heuristics.*

The cost of computation is a function of the complexity of threat analytics. The threat analytics analyze system performance, sensitivity, trends, exception and alerts along two dimensions: time and insights. The analysis on time dimension may be as follows: what is corrupted or compromised in the system: agents, communication schema, data schema, application schema, computing schema and protocol? what occurred? what is occuring? what will occur? assess probability of occurrence (p) and impact or sunk cost (c). The analysis on insights may be as follows: how and why did the threat occur? What is the output of cause-effect analysis? The analytics also recommends what is the next best action? It predicts what is the best or worst that can happen? The threat analytics also evaluates the vulnerability of the information system to a disruptive event in terms of likelihood of a disruption and its potential severity. The computational burden is also associated with the identification of a set of feasible risk metrics for each type of threat on the information system, assessment of the probability of each risk metric, computation of severity or sunk cost of each risk metric and plotting each risk metric in the vulnerability map.

Another major computational burden of ASA is the complexity of verification or model checking algorithms. The verification system requires both automated and semi-automated verification options. The verification system calls threat analytics
and a set of model checking algorithms for various phases: exploratory phase for locating errors, fault finding phase through cause effect analysis, diagnostics tool for program model checking and real-time system verification. Model checking is basically the process of automated verification of the properties of the system under consideration. Given a formal model of a system and property specification in some form of computational logic, the task is to validate whether or not the specification is satisfied in the model. If not, the model checker returns a counter example for the system's flawed behavior to support the debugging of the system. Another important aspect is to check whether or not a knowledge based system is consistent or contains anomalies through a set of diagnostics tools.

The cost of computation also depends on the complexity of payment function. The payment function estimates aspiration point, reservation point, strong, weak, indifference and veto thresholds in the security requirements; makes trade-off proactive vs. reactive security: assign weights to each threat; exercises portfolio rationalization of the security schema and allocates fund based on the selection of invest options. There are various objectives of investment of information security schema such as process re-engineering, transformational, renewal, experiment and reinforcement on the weakest link. The payment function selects appropriate heuristics of fund allocation such as selective based on ranks, linear and proportional allocation. When the budget of the defender is more than the total projected demand, the agent would like to satisfy all the portfolios of IS security schema using the resource allocation function. However, when the budget is less than total demand, the agent should find the investment plan based on various types of allocation heuristics, objectives and constraints.

Linear allocation is an equal sharing of the pain or shortage of capacity among various components of IS security schema. The threat $T_i$ is allocated fund $q_i = d_i - (1/n) \max (0, \sum_{i=1}^n d_i^* - C)$ where n is the number of threats and C is the budget capacity of the defender. In case of proportional allocation, the threat $T_i$ is allocated fund $q_i = \min \{d_i^*, C \cdot \frac{d_i^*}{\sum_{i=1}^n d_i^*}\}$. Reactive approach may consider reinforcement learning strategy and allocates more budget to easier-to-defend edges of the attack graph. When new edges are revealed, the budget is reallocated uniformly from the already revealed edges to the newly revealed edges. Myopic bug chasing is most likely an ineffective reactive approach. But, the strategy of gradually reinforcing attacked edges by shifting budget from unattacked edges of the attack graph may be cost effective. Another fund allocation strategy is selective allocation based on the computation of the rank of the threats which is computed based on probability of occurrence (p) and impact or sunk cost (c).

The security intelligence of ASA is associated with the computing, data, application and networking schema of an information system and is verified through the properties of adaptive secure multi-party computation.
ASA evaluates the security of an enterprise information system in breadth and depth from the perspective of collective intelligence. The targets of the defender are computing, data, networking and application schema of an information system. It is basically a holistic approach which is focused on both proactive and reactive security. *Let us first consider proactive approach.* The verification algorithms check fairness, correctness, accountability, transparency, rationality, trust and commitment of the computing schema. It is essential to verify authentication, authorization, correct identification, privacy and audit of data schema. The health of networking schema is verified in terms of safety, reliability, consistency, liveness, deadlock-freeness, reachability and resiliency. The security of application schema is evaluated through penetration testing in terms of user acceptance, system performance and quality of application integration. In case of machine learning with adversarial setting, the ASA also audits the security of data schema and monitors the risk of false data injection attack, noise, missing data and incomplete features and assesses the risk of Sybil attack. The security of application schema is verified in terms of flaws in training and testing strategy (no. of training and testing samples, learning rate), the efficiency of data mining algorithms and knowledge extraction procedure through penetration testing. Penetration testing searches for potential vulnerabilities and it can be modeled to reduce uncertainty in a security game. It is an information gathering option prior to investing into protection against a threat.

Next let us consider *reactive approach* which adopts sense-and-respond strategy. The basic objective of adaptive secure multi-party computation is to identify the hit of adversaries on computing schema that may choose the corrupted parties during the course of computation. The verification algorithms check the scope of information leakage or violation of privacy in various steps of secure multi-party computation algorithm : adding random noise to data, splitting a message into multiple parts randomly and sending each part to a decision making agent through a number of parties hiding the identity of the source, controlling the sequence of passing selected messages from an agent to others through serial or parallel mode of communication, dynamically modifying the sequence of events and agents through random selection and permuting the sequence of messages randomly. *Adaptability* is basically responding to change(s) effectively and decisively: the ability to identify the occurrence of uncommon threats which are not considered in proactive approach; change in system performance, understanding the probable cost of malicious attacks, rapid quantification what is under its control to compensate, identification what modifications to the environment are necessary and adoption of risk mitigation measures in time. The defender adjusts the requirements of the security schema of an information system adaptively in terms of aspiration and reservation point and various preferential thresholds. Adaptive secure multi-party computation identifies what is corrupted or compromised; what has occurred or what is occurring; performs cause-effect analysis for more transparency and insights; decides what the next best action is and also predicts what is the best or worst that can happen.
ASA shows the importance of an efficient algorithmic mechanism for proper evaluation of the security schema of an information system. It is basically a hybrid approach which recognizes the role of both proactive and reactive approaches in making decisions on investment of IS security schema rationally. The reactive approach may outperform proactive one against the threats that never occur actually. Sometimes, reactive approach may be cost effective as compared to proactive approach. The basic building blocks of the ASA are threat analytics, cryptographic solutions and adaptive security architecture. The threat analytics monitor the system performance based on time series data, detects and analyzes different types of vulnerabilities on enterprise information system. This work finds a set of interesting research agenda for future work: (a) explore new cryptographic concerns using game theoretic concepts and intelligent reasoning; (b) how to design an intelligent threat analytics; (c) how to design automated verification algorithms; (d) how to rationalize adaptive secure multi-party computation protocols and (e) how to quantify and code miscellaneous security intelligence parameters?

*Case Analysis*: This section has analyzed three test cases to develop Security Intelligence Verification Mechanism [SIVM] for IIoT enabled SCADA and ICS technology: (a) SCADA for a smart power grid, (b) industrial control system and (c) defense - border security surveillance. The basic building blocks of SIVM are a set of security protocols: intrusion verification, private communication, web security verification, biometric access control verification and privacy verification. SIVM is useful to analyze the security element of the deep analytics.

## Test Case 1: SCADA for a Smart Power Grid

### Security Intelligence Verification Mechanism [SIVM<sub>PG</sub>]*

System: Intelligent System [ Knowledge based system (KBS), DSS/ GDSS, BI]

Input: Sensors data;

Move: Call deep analytics → assess threats on 7-'S' elements;

* Scope: SCADA for smart power grid,

* System: Information system having computing, networking, data, application and security schema;

* Structure: Sensors, central server, connecting link or communication channel;

* Strategy:

* Governance:

* proactive approach

* reactive approach

* Automated system verification and model checking

* Goal setting: call deep threat analytics

* Shared vision

* Intelligent Communication protocol for collaborative and collective intelligence

* Security at multiple levels (L1, L2, L3, L4 and L5)
* Staff: System administration, technical and maintenance staff, operation team, management consultants;

* Skill: technical, management;

* Style: Adaptive, resilient leadership style, system coordination, intelligent coordination;

* Support: Preventive and breakdown maintenance;

Revelation principle: Audit privacy and confidentiality of critical data based on information disclosure policy.

Payment function: Audit business intelligence of contracts with the service providers.

Verification algorithms [refer section 9.4]:

1. Call threat analytics.

2. Do *automated verification* of the security intelligence of data, computing, application, networking and security schema at levels 1,2,3,4 and 5.

3. Adaptive security for dynamic data protection through preventive, detective, retrospective and predictive capabilities.

Level 1 (*data schema*):

* Flaws in access control: Authentication, Authorization, Correct identification, Privacy, Audit, Confidentiality, Integrity, Non-repudiation, locking of passwords, false data injection attack;

* Intrusion detection;

* Data warehousing, data mining, data visualization and performance measurement strategy;

Level 2 (*computing schema*):

* Correctness of computation, system configuration and mechanism

* KBS:

* knowledge base, inference engine, user interface, knowledge acquisition and refining subsystem, justifier, workplace;

* case based reasoning through case base maintenance, case retrieval, case adaptation and learning;

* DSS/GDSS :

* Intelligence in search of right conditions;

* Design of possible alternatives;

* Choice of appropriate action or solution;

* Implementation in problem solving or exploiting opportunities;

* Structured / semi-structured / unstructured decision making for operational control / managerial control / strategic planning;

* BIS

* Detection of incomplete, imprecise, noisy or missing data

* Inefficient data mining algorithms with flaws in training and testing strategy

* Flaws in knowledge discovery from data (KDD)
* Fairness in resource allocation;

* Transparency of process, procedure and mechanism;

* Accountability of role in system administration, operation and maintenance;

**Level 3 (application schema):**

* Poor system performance : Denial of Service (DoS) attack, reliability, consistency, resiliency, stability, robustness, liveness, deadlock freeness, lack of synchronization, human error in keying of mobile devices or remote operation;

* flaws in web application design : logic attack, cross site scripting, injection flaws, malicious file injection, insecure direct object reference, cross site request forgery, information leakage and improper error handling, broken authentication, session hijack, insecure cryptographic storage, insecure web communication, failure to restrict URL access, flaws in application integration;

**Level 4 (networking schema):** Identify types of malicious attack : internal and external; Cyber attacks, Rubber hose attack, Sybil attack, Node replication attack, Wormhole attack, Coremelt attack, Forward, Blackhole, Neighbor, Jellyfish, Crypto jacking on mobile devices;

**Level 5 (security schema):**

* Assess the risk of multi-party corruption (e.g. sender, receiver, data, communication channel, mechanism and protocol);

* Business intelligence of payment function

**Risk mitigation:**

* **Proactive approach**

* Call predictive analytics; analyze probability of occurrence vs. impact;

* Call challenge response protocol;

* Preventive maintenance, Technology upgradation, System isolation

* **Reactive approach**

* **Sense-and-response against bad luck**

* Natural disaster : Heavy rainfall, snowfall, storm, cyclone, flood, earthquake;

* Industrial / HR unrest / Political strike

* Accidents

* Terrorism

3. Adjust device settings automatically.

**Output:** SCADA performance scorecard; security intelligence.
## Test Case 2: Industrial Control System

<figure><img src="image_104.png" /></figure>

**Security Intelligence Verification Mechanism [SIVM<sub>ICS</sub>]**

**System:** Industrial Control System;

**Input:** Sensors data;

**Move:** Call deep analytics --> assess threats on 7-'S' elements;

* **Scope:** Supervisory, adaptive, fuzzy control of industrial plant

* Linear model

* Nonlinear model

* **System:** Computing, Networking / Communication, Data, Application and security schema;

* **Structure:** Sensors, central server, connecting link, system, fuzzy controller;

* **Strategy:**

* Governance: proactive and reactive approach, intelligent secure communication protocol, shared vision, goal setting

* Automated system verification and model checking

* **Security-sensitivity at multiple levels**

* **Staff:** System administration, technical and maintenance staff, operation team, management consultants;

* **Skill:** technical, management,

* **Style:** Adaptive, resilient leadership style, system coordination, intelligent coordination;

* **Support:** Preventive maintenance, breakdown maintenance.

**Revelation principle:** Audit privacy and confidentiality of critical data based on information disclosure policy.

**Payment function:** Audit business intelligence of contracts with the service providers.

**Verification algorithms** [refer section 9.4]:

1. Call threat analytics.

2. Do *automated verification* of the security intelligence of data, computing, application,

networking and security schema at levels 1,2,3,4 and 5.
3. Adaptive security for dynamic data protection through preventive, detective, retrospective and predictive capabilities.

Level 1 (data schema): Authentication, Authorization, Correct identification, Privacy, Audit, Confidentiality, Integrity, Non-repudiation, locking of passwords, false data injection attack, intrusion detection through access control;

Level 2 (computing schema):

* Correctness of computation [Reference: Figure 10.2]

o Input scaling i.e. normalization /* For a MISO, x₁, x₂,...,xₙ : controller inputs in IF part of fuzzy rules; u₁,u₂,...,uₘ : controller outputs in the THEN part of fuzzy rules ; Input scaling Eₙ = Nₑ,e; E = (e₁,e₂,...,eₙ)ᵀ; Eᵢ = xᵢ-x₉ ; Nₑ = normalization of factors */

o Fuzzification of controller input variables /* During fuzzification, a crisp controller input x* is assigned a degree of membership to the fuzzy region from IF part of a fuzzy rule*/

E* = e₁*, e₂*,...,eₙ*; e* : a normalized crisp controller input. LEJ =
LEJ₁₁,...,LEJₙ)ᵀ

LE<sup>j</sup><sub>n</sub>: Fuzzy values taken by the controller inputs

o Inference i.e. rule firing /* For a MISO FC, i<sup>th</sup> fuzzy rule - R<sup>j</sup><sub>c</sub>: IF e = LE<sup>j</sup> THEN u = LU<sup>j</sup>*/

o Defuzzification of controller output variables /* Obtain a scalar value u from membership function CU(u) where U : defuzzified controller output */

o Output scaling i.e. denormalization : U<sub>N</sub> = N<sub>u,u</sub> ; /* The defuzzified normalized controller output U<sub>N</sub> is denormalized with the help of an off-line predetermined scalar denormalization factor N<sub>u</sub><sup>-1</sup> */

* Fairness in system performance,

- Transparency of process / procedure / mechanism,

* Accountability in system administration, operation and maintenance;

Level 3 (application schema):

- Stability in system performance, robustness, accuracy and speed

* Reliability, Consistency, Resiliency, Liveness, Denial of Service (DoS) attack, Deadlock freeness, Lack of synchronization,

- Human error in keying of mobile devices or remote operation;

* Flaws in application integration;

Level 4 (networking schema): Identify types of attack : internal and external; Cyber attacks, Rubber hose attack, Sybil attack, Node replication attack, Wormhole attack, Coremelt attack, Forward, Blackhole, Neighbor, Jellyfish, Crypto jacking on mobile devices;

Level 5 (security schema) : multi-party corruption [e.g. sender, receiver, data, communication channel, business intelligence in terms of payment function, mechanism, protocol, process, procedure];.

Risk mitigation :

* Proactive approach

- Call predictive analytics; analyze probability of occurrence vs. impact ;

- Call challenge response protocol;

- Preventive maintenance, technology upgradation, system isolation;
* Reactive approach

* Sense-and-respond against bad luck such as natural disaster, accidents and terrorism

4. Adjust device settings automatically.

Output: SCADA performance scorecard; security intelligence.

## Test Case 3 : Defense - Border Security Surveillance

This is a great challenge to the SCADA system administrator, power system planners, analysts, researchers and operators to sustain security and safety of a smart, intelligent energy grid. The proposed verification mechanisms and resilient SCADA are also applicable in sensor networks for defense application, automated continuous production plants, refineries, oil and gas pipelines. For instance, the defense security system of a country I tries to monitor the activities and the movement of the security force, tanks, war ships and weapons manufacturing plant of a neighboring country C by deploying a SCADA network [Figure 7.5]. A base station is built at a strategic location to control the SCADA network; the sensors relay critical data to the base station. The adversary i.e. the defense security system of country C may be able to launch different types of attacks such as sybil attack, physical destruction of sensor nodes, resource consumption attack to deplete the limited energy of the sensors and the attack on routing and data link protocols associated with the defense information and communication system of country I.

<figure><img src="image_105.png" /><figcaption>Figure 10.13 : Border Security Surveillance</figcaption></figure>

The defense system of country I may face the threat of foreign computer hackers who can dismantle the power grid, transportation system, financial networks and e-governance system. The adversaries may try to gain control of critical switches; may
derail passenger trains, contaminate the water supply in major cities or shut down the power grid. Actually, country I requires new standards for critical public and private infrastructure facilities like power plants, water treatment plants and gas pipelines where a breach of security could cause significant economic damage. The recent wave of cyber attacks on various financial institutions and oil companies globally should be recalled in this context. A smart, resilient SCADA system can protect the critical infrastructure of a country through a set of efficient verification mechanisms. There is scope of future works on miscellaneous web security issues.

## Security Intelligence Verification Mechanism [SIVM<sub>D</sub>]*

System: Defense SCADA;

Input: Sensor data;

Move: Call deep analytics → assess threats on 7-'S' elements;

* Scope: Private defense communication;

* System: Information system associated with SCADA such as computing, networking, data, application and security schema;

* Structure: Sensors (e.g. mobile sensors - drones, Unmanned Aerial Vehicle [UAV], static sensors – CCTV camera), base station server, communication channel;

* Strategy:

* Governance:

* proactive approach

* reactive approach

* Automated system verification and model checking

* Shared vision on privacy and revelation principle

* Intelligent communication protocol for collaborative and collective intelligence

* Security: audit security intelligence at multiple levels L<sub>1-5</sub>;

* Staff: System administration, technical and maintenance staff, operation team;

* Skill: technical (e.g. electronics, communication, computer, electrical, mechanical), management information system, system maintenance, military operation;

* Style: Dynamic leadership style for efficient system coordination;

* Support: preventive and breakdown maintenance.

**Revelation principle:** Audit privacy and confidentiality of critical data based on information disclosure policy.

**Payment function:** Audit business intelligence of contracts with the vendors and service providers.

**Verification algorithms** [refer section 9.4]:

1. Call threat analytics → assess threats on private defense communication channel;

2. Adopt risk mitigation strategies to ensure private defense communication:

* Proactive approach
* Call predictive analytics → analyze probability of occurrence vs. impact;

* Call challenge-response protocol;

* Reactive approach : interleaved hop-by-hop authentication; Adaptive security for dynamic data protection through preventive, detective, retrospective and predictive capabilities.

* Sense-and-respond against bad luck such as natural disaster, military revolution, political strike, accidents and terrorism.

3. Verify security intelligence of data, computing, application, networking and security schema of defense SCADA at levels 1,2,3,4 and 5.

Level 1 (data schema):

* Detect flaws in access control : confidentiality, data integrity, non-repudiation; authentication, authorization, correct identification, privacy and audit; false data injection attack;

* Intrusion detection;

* Compromising data warehousing, data mining, data visualization and performance measurement strategy;

Level 2 (computing schema):

* Correctness of computation

* Fairness in resource allocation

* Transparency of process, procedure and mechanism

* Accountability of role in system administration, operation and maintenance

Level 3 (application schema):

* Poor system performance : Denial of Service (DoS) attack, reliability, consistency, resiliency, liveness, deadlock, human error in remote operation of drones;

* Flaws in web application schema (e.g. session hijack, application integration);

Level 4 (networking schema): Assess the risk of coremelt attack causing traffic congestion, delay in communication due to forward, blackhole, neighbor and jellyfish attack, cyber, rubber hose, sybil, node replication and wormhole attack;

Level 5 (security schema):

* Assess the risk of multi-party corruption of one or more entities involved in private defense communication (e.g. sender, receiver, data, communication channel, mechanism and protocol) by adversaries;

* Assess the risks of insider attack

* Ensure privacy of the route and time of travel of the military convoy without any leakage of information.

* Different time of travel of military and civilian convoy without any mix of the two traffics.

* A pilot convoy should audit and check the clearance of route through drones.

* Decomposition of a large convoy into smaller units

* Intrusion detection through detectives and countermeasures
* Be alert on false data injection attack.

* Execute DoS attack on communication services to restrict false data injection attack (if necessary)./*caution: violation of human rights in healthcare and emergency services*/

**Output:** security intelligence of defense communication network.

## Security Protocols

*Intrusion Verification Mechanism*

**System:** SCADA states (local, global, initial, goal), state transition relation;

**Input:** A self-set $S \subseteq U$, a monitoring set $M \subseteq U$ for a given system parameters;

**Output:** for each element $m \in M$, either self or non-self, danger or normal;

$D \leftarrow$ set of detectors that do not match any $s \in S$;

for each $m \in M$ do

{

call threat analytics (A) → sense danger signal;

secure function evaluation → verify innate and adaptive system immunity (i)

= f(a,b,c,d,e);

check e-passport, computing, storage and resource capacity in real-time;

}

sense-challenge-respond to system immunity resiliently;

if $m$ matches any detector $d \in D$ then identify $m$ as non-self;

else identify $m$ as self;

check if non-self suspicious node is benign or malign danger node;

if it is malign then suppress it else give alert.

**AI Moves:**

a. *Multidimensional view of intelligent reasoning* (logical, analytical, case based, forward and backward chaining, sequential, parallel, uncertainty, probabilistic, approximation, predictive, imaginative, perception);

b. *Define system immunity* (i) = f(a,b,c,d,e); a: collective intelligence, b: machine intelligence, c: security intelligence, d: collaborative intelligence, e: business intelligence; f: secure verification function.

c. *Private search for evidence*;

An intrusion is considered as an activity that violates the security policy of a system. Intrusion detection systems are based on the assumption that the behavior of an intruder is different from that of an authorized user and the unauthorized activities can be detected by analyzing user's profile and activities, host based IDs, network based IDs and application based IDs. Auditing is required at different levels of granularity for the detection of misuse and anomaly. An intruder tries to gain access to an unauthorized system to which it has no legitimate access. It occurs by exploiting system vulnerabilities or by simply cracking the user ids and passwords of legitimate users. If a malicious agent is able to access the system, it is considered as an authorized user and is granted the access rights of the user. The basic objective is to effectively detect and prevent insider misuse. Intrusion may occur in various forms on a distributed network such as sybil, cloning or node replication,
wormhole denial of service, key interception and node capture. The following
section presents intrusion verification mechanism (IVM).

Private Communication

*Defense SCADA System architecture*: MTU: Defense base station i.e. master terminal unit; u: Communication nodes of defense network; v: sensor nodes; L: Leader of a cluster of sensor nodes; n: Number of hops between MTU and L; uᵢ: Upper association node; uⱼ: lower association node; k_u: Signcryption key of node u shared with MTU; k uv: Pairwise signcryption key shared between nodes u and v; k v: Time-stamped authentication key of node v; M (k,m) : Authenticated message m signcrypted with a key k.

call challenge response protocol for *device attestation* verification → check whether a
sensor node is tampered by a malicious agent;

check the *configuration* and correct setting of each sensor node → detect whether
malicious software is loaded into sensor nodes; verify the integrity of the code;
perform secure code updates and ensure untampered execution of code;

check state variables and measure bad data against *false data injection* attacks;
verify authentication in private communication between sensor nodes and base
station or MTU;

do network traffic congestion analysis → assess the risk of *coremelt* attack;

do *multicast* traffic analysis → detect rushing, blackhole, neighbor and jellyfish attacks; check group, forward and backward privacy in secure group communication.

Let us consider test case 3 of private defense communication. It is very important to verify the privacy and security in SCADA communication. A malicious agent can exploit the configuration of a defense network to launch false data injection attack against state estimation and introduce arbitrary errors into certain state variables while bypassing existing techniques for bad measurements detection. Reliable SCADA operation requires system monitoring based on precise measurements of bus voltage, real and reactive power. These measurements are transmitted from the measuring instruments to SCADA. State estimation is used in system monitoring to estimate the best state by analyzing measured data and various system models. The output of the state estimation is used in contingency analysis. A malicious agent can compromise the measuring instruments to inject errors. Here, the real challenge is to detect bad measurements. If the malicious agent knows SCADA configuration, it can systematically generate bad measurements which can bypass the common assumption that the square of difference between observed and estimated data becomes significant during bad measurements. The attacker may try to inject arbitrary errors in certain state variables or aims to find an attack vector as long as it can result a wrong estimation of state variables. Real-time system monitoring is essential to ensure reliable operations of SCADA against false data injection attack. The adoption of communication equipments manufactured by foreign vendors may be a risky option in secure communication; it is an open debatable issue.
Device attestation verification is a critical requirement of a smart SCADA. It securely ensures whether a sensor node or remote terminal unit or any other device associated with SCADA network is tampered by a malicious attack. Each device should be attested with a valid digital test certificate. This certificate indicates the identity of the manufacturers, model number, serial number and tampering status of each device. SCADA must verify the identity and tampering status of each associated device. The basic objective of device attestation is that a malicious agent should not be able to configure or change correct setting of each device. The digital test certificate defines the basic security requirements of service provider and device manufacturer in terms of mutually acceptable security policies, certificate formats, naming convention and operational issues [18]. It should aid the deployment of system, operation, system audit, signing and revocation of certificate. Each device should be able to authenticate and authorize other devices without the support of backend security server. A malicious agent may be able to compromise a set of remote terminal units; it may be able to access the compromised RTUs and may launch a coordinated attack by modifying the software of the RTUs. It is also possible for the attacker to hide the attack by reporting correct data to the master terminal unit.

CSVM assumes that SCADA control center knows the exact hardware configuration of the sensor node or RTU like CPU model, CPU clock speed and the memory configuration. The hardware of the RTU is not corrupted. There is a secure authenticated communication channel between RTU and external verifier. The adversary can control the software and the operating system of RTU; it can access RTUs directly over the Internet or by compromising different devices of SCADA control center. There is at least one trusted external verifier at the SCADA control center which cannot be compromised by the malicious attacker.

A challenge response protocol is employed between a trusted external verifier and RTU. The external verifier sends a random challenge to the RTU. A self checking verification function on RTU computes a checksum over its own instructions and returns the result to the external verifier. If an adversary tampers with the verification function, either the computed checksum will be incorrect or there will be a significant increase in computation time. If the external verifier receives the correct checksum within the expected time, it is concluded that the verification function code on RTU is unaltered. The verification function includes a cryptographic hashing function which computes a hash of RTU's memory. The external verifier compares the computed hash with the expected hash to ensure that the device has not been modified. Alternatively, a hash may be computed over a known executable to ensure that it has not been modified.

**False data injection attack:** The verification mechanism starts with authentication certificate allocation. SCADA administrator assigns each sensor and communication node an authentication certificate which is a unique ID endorsed with a bootstrapping time. Next step is neighborhood search. After the deployment in SCADA network, each new node handshakes with each of its neighbors by establishing a one-hop pair wise signcryption key. Each sensor node handshakes with the leader (L) and each communication node handshakes with the leader / other communication node / MTU. A node validates the IDs and time-stamps of its
associated nodes with the help of MTU periodically. Then q number of sensor nodes sense the process variables collaboratively when they detect the occurrence of an event of interest. The leader collects the signcrypted data from all participating sensor nodes; unsigncrypts the signcrypted data; wraps them into a message (m) and forwards m to MTU through a set of communication nodes. Next step is relay; each forwarding communication node verifies the message code computed by its lower association node and then unsigncrypts the received message. If the verification fails; it drops the message and informs the instance to MTU. Otherwise, it computes a new message code based on its pairwise signcryption key shared with its upper association node. Finally, it forwards the message to the next node towards MTU. Finally, MTU verifies the message received from the communication node. If MTU detects that q nodes have endorsed the message (m) correctly, it accepts m otherwise discards m.

The basic objective of CSVM is to authenticate each communication node in the SCADA and also to know other valid communication nodes (neighbors) present in the system. A time stamp is involved in the authentication mechanism. The base station system administrator (SA) of SCADA network allocates a certificate to each node and it includes both ID and bootstrapping time to authenticate the identity of a new node. In the certificate, the ID and timestamp are signed by the private key of SA. When a new node is deployed in the SCADA, it shows its certificate to its neighbors. The neighbors can verify the certificate of the new node with the public key of SA. A new node can be accepted into the SCADA if it has a correct identity and a valid time-stamp.

Next, let us consider *Coremelt attack* where the malicious attackers send traffic between each other and not towards a victim host. It is a powerful attack since there are O(N²) connections among N attackers which can cause significant congestion in core SCADA network. SCADA networks often use web service to enable coordination among physical systems. The malicious attackers are able to flood the end hosts with unwanted traffic to interrupt the normal communication. This is a specific type of Denial-of-Service (DoS) attack where the network link to SCADA server is congested with illegitimate traffic such that legitimate traffic experiences high loss and poor communication performance. Such a poor connectivity between SCADAs can damage critical infrastructure with cascading effect. To address such attacks, it is important to identify the source of excessive traffic and prioritize legitimate traffic. The attackers often rely on distributed denial of service attacks where many subverted machines i.e. botnets are used to generate illegitimate traffic. There are three steps to launch a Coremelt attack [25]. First, the attackers select a link in the SCADA network as the target link. Then, they identify what pairs of subverted machines can generate traffic that traverses the target link. Finally, they send traffic between the identified pairs to overload the target link. Thus, the attacker uses a collection of subverted machines sending data to each other to flood and disable a network link. An efficient SCADA should allow end hosts to identify long-running legitimate traffic. During heavy load, the router forward packets with proper priority and capabilities while dropping packets without capabilities. SCADA requires an efficient tracing and network traffic monitoring system to avoid this attack.
Next let us discuss *multicast attack*. The communication schema of SCADA should support message *broadcasting* and *multicasting*. SCADA may have thousands of sensor nodes or remote terminal units. Therefore, multicasting is a critical requirement of secure SCADA communication. The number and size of keys to be stored in a remote terminal unit should be limited due to memory constraint. The computational and communication cost is O(n) where n is the number of sensor nodes or remote terminal units. In SCADA network, actual addition or deletion of a sensor node occurs rarely since the system is commissioned based on a long term plan. But, the remote nodes may be easily compromised by the malicious agents. It needs an efficient *key management mechanism* to preserve group key, forward and backward privacy [15,16]. *Group key privacy* is computationally infeasible for an adversary or malicious agent to discover any group key of SCADA. *Forward privacy* prevents a user which has already left from the SCADA group from accessing future communication within the group all the keys along the path from the leaving point to the root node of the key tree should be changed. It ensures forward privacy. *Backward privacy* prevents a user from accessing past communications of SCADA group, all the keys along the path from the joining point to the root node of the key tree should be changed. The protocols for key management of secure group communication such as join, leave and sub-group change can be found in [37,38,39].

## Web Security Verification

**Application**: Web enabled SCADA; **Agents**: User of the web application, system administrator;

verify the *design flaws* in service oriented computing schema.

**logic attack**: check the main flow, sub flows and exception flows as per business rules of the application;

**cross site scripting**: check whether all parameters of the web application are validated properly; check the risk of phishing attack;

**injection flaws**: check whether user data modify the meaning of command and queries sent to any interpreters invoked by web application;

**malicious file injection**: check the use of dangerous application programming interfaces by testing and code review;

**insecure direct object reference**: check through code review whether the web application allows direct object references;

**cross site request forgery**: check whether web application generates authorization token that is not automatically submitted by the web browser;

**information leakage and improper error handling**: check whether web application leaks any data through error messages; check whether the application builds a trusted computing environment;

**broken authentication and session management**: check through code review whether the web application properly authenticates users and protects their identities and credentials;

**insecure cryptographic storage**: check whether web application properly encrypts sensitive data; check configuration of the web server;
**insecure web communication**: check whether the web application ensures private communication between the sending and receiving agents; assess the risk of snooping;

**failure to restrict URL access**: check whether proper access control is enforced at the presentation layer and business logic for all URLs in the web application;

The web security verification mechanism (WSVM) verifies service oriented computing schema to mitigate the risk of common vulnerabilities. WSVM addresses a set of dangerous attacks against web enabled distributed computing system. The basic objective of WSVM is to protect SCADA from phishing attacks, privacy violations, identity theft, system compromise, data alteration, data destruction, financial and reputation loss. Cross site scripting (XSS) flaw allows an attacker to execute malicious code in the web browser of the user that can hijack user session, deface websites, possibly introduce worms or insert hostile content or conduct phishing attack and take over the browser of the victim through malware. The best protection of XSS is a combination of validation of all incoming data and appropriate encoding of all output data. Validation allows the detection of XSS attacks and encoding prevents injection of malicious script into the browser. Cross site request forgery (CSRF) forces the web browser of the logged on user to send a request to a vulnerable web application which forces the victim's browser to perform a hostile action. Web applications rely solely on automatically submitted credentials such as session cookies, basic authentication credentials, source IP address, SSL certificates or windows domain credentials. CSRF is applicable to any web application that has no authorization checks against vulnerable actions.

Injection flaws allow the attacker to create, read, update or delete any arbitrary data available to the application. Even, it may compromise the web application completely bypassing firewalled protection. SQL injection occurs when the data input of the user is sent to an interpreter as part of a command and query. The hostile data of the attack forces the interpreter to change the data or execute unintended command. The common protection measures are to use strong and safe interpreters, do input validation, use strongly typed parameterized query APIs, enforce least privileges, avoid detailed error messages, use stored procedures, do not use dynamic query interfaces and do not use simple escaping functions.

Web application developers often trust input files improperly and the data is checked insufficiently. Arbitrary, remote and hostile content may be processed or invoked by the web server. It allows an attacker to perform execution of malicious code, installation of tool kit and system compromises remotely. Flawless design is required during the construction of system architecture, design and software testing. The application developers should use indirect object reference map, check errors, validate user's input and implement firewall rules appropriately. Another critical problem is insecure direct object reference; a direct object reference occurs when a reference is exposed to a file, directory, database records or key as a URL or form parameter. A malicious agent can manipulate these references to access other objects without authorization. The web application should avoid exposing direct object reference to the users by using an index, indirect reference map or other indirect validated method that is easy to validate.
An web application can unintentionally leak information about their configuration, internal state or violate privacy through error messages and it can launch dangerous attacks. The application should get support from a standard exception handling mechanism to prevent the leakage of unwanted information; detailed error handling should be limited; errors should be properly checked and should not be exploited by the intruders. Broken authentication and session management is caused due to the failure of protection of credentials and session tokens. It can hijack user's or administration's accounts, undermine authorization and accountability controls and cause privacy violations. The common protective measures are the adoption of efficient authentication mechanisms, secure communication and credential storage, use of efficient session management mechanisms; invalid session identifiers should be rejected.

Insecure cryptographic storage is caused due to the failure in encrypting sensitive data; it leads to disclosure of sensitive data and compliance violation. It is required to avoid inefficient weak cryptographic algorithms and check whether sensitive data are encrypted properly. An web application may fail to encrypt network traffic to protect sensitive communications. The adversary can sniff traffic from the communication network and access sensitive data, credentials, authentication or session token. The application should properly encrypt critical data. The only protection for a URL is that links to a page are not presented to unauthorized users. The adversary may get access to these pages and view private data. All URLs and business functions should be protected by an effective access control mechanism. Web security is a very broad topic; some common critical issues have been discussed above very briefly. There are several open issues in the design of service oriented computing schema. It is an interesting option to interview Internet experts, web developers and programmers and analyze the complexities and challenges in web programming issues.

## Access Control

Biometrics are used for automated recognition of SCADA users and system administrators based on their biological and behavioral traits such as finger prints, face image, iris and voice. Traditional authentication methods like passwords and identity documents may fail to meet reliable security and performance of identification systems. Some physical and behavioral attributes of human beings are uniquely associated with an individual. Biometrics captures these traits with sensors; represent them in digital format; compare the recorded data with the data acquired from the same user previously and performs recognition [33]. Biometrics are applicable to VISA verification for regulating international border crossing, welfare distribution, access control at airport and power plant's control room, access control to shared resources and information, remote financial electronics transactions and distribution of social welfare benefits.

SCADA may be attacked at any point such as host or MTU, RTU, communication node or sensor node. It should be protected by a robust access control mechanism. Access control is the process of receiving the requests of the users for specific resources and data and determining whether the request should be granted or denied. The access control system is a combination of access control policy, model
and mechanism. Access control may be based on user's identity or role or the
regulatory constraints as defined by the system administrator. Credential based
access control grant or deny access to the resources by exploiting digital certificates
and make access decisions on the basis of a set of properties that the client should
have fulfilled. This trust negotiation process may suffer from privacy problem since
the SCADA server discloses its access control policy entirely and the client exposes
its credentials certificates to gain access to a resource. An efficient negotiation
strategy should restrict the disclosure of information. The service accessibility rules
specify the necessary and sufficient conditions for accessing a resource while
credential disclosure rules define the conditions that govern the release of
credentials and declarations. The SCADA server should discloses the minimal set of
policies for granting access while the client releases the minimal set of certificates to
access the resource. Prerequisites are the conditions that must be satisfied for a
service request. Requisites are conditions that allow the service request to be
successfully granted. The SCADA server should not disclose a requisite rule until
the client satisfies a prerequisite rule. Biometrics can be also used for credential
based access control of distributed computing systems.

Agents: Client (C), SCADA server (S);

check the correctness of enrollment and recognition mechanisms for biometric access control;

C requests S for the access to a resource r such as data or application;

S requests C for prerequisites;

C informs prerequisites to S;

S requests for requisites to C;

C informs requisites to S;

S verifies the credentials provided by C;

if the verification is true, then S grants C the access to r;

else S asks C the required credentials;

C selects the requested credentials (if possible) and informs S;

S verifies the credentials of C;

if the verification is true, then S grants C the access to r;

else S rejects the request of C;

intrinsic failure: check false match, non-match and failure to enroll or acquire biometric data;

adversary attacks: check collusion, coercion, negligence, enrollment fraud, exception abuse;

infrastructure attacks: check sabotage overloading, attacks on user interface, system modules, databases and interconnections, modification of data and information leakage, spoofing, impersonation, man in the middle attack, replay and hill climbing.

Credential based access control strategy grants or denies access to the resources based on biometric prerequisites and requisites as specified by the client during trust negotiation process.
BACVM mechanism verifies the security intelligence of a biometric access control system associated with SCADA. It basically explores the risks of various threats on biometric access control. A User presents his or her biometric identity to a biometric system for the purpose of being recognized. Biometric systems can be used efficiently for authentication, nonrepudiation and identity recognition claim. Biometric recognition is the science of establishing the identity of the user based on his or her physical and or behavioral characteristics either in fully automated or a semi-automated way. A biometric system measures one or more physical or behavioral traits such as finger print, palm print, face, iris, retina, ear, voice, signature, gait, hand vein, odor or DNA information of an individual to determine or verify his identity. These characteristics are known as traits, indicators, identifiers or modalities. The biometric mechanism has two phases – enrollment and recognition. During enrollment, biometric data is acquired from the individuals and stored in a database along with the person's identity. During recognition, biometric data is acquired from the individual and compared with the stored data to determine the identity of the user.

The failure to a biometric system is basically a security threat - denial of service (DoS), intrusion, repudiation and function creep. The legitimate users may be prevented from obtaining access to the information assets. An unauthorized user may gain illegitimate access to the system and this intrusion affects the basic integrity of the system. A legitimate user denies the usage of system or data after having access to it. Corrupted users may deny their actions. An adversary may exploit the biometric system for different function. The biometric system may fail due to flaws in enrollment and recognition mechanisms. It may also fail due to manipulation by adversaries which could either be insider or external entities. External entities may be imposters and attackers. Insiders may be system administrators or legitimate corrupter users. Insider attacks may be collusion, coercion, negligence, enrollment fraud and exception abuse. Infrastructure attacks may be due to sabotage overloading; it may be attacks on user interface, system modules, interconnections and template databases. Attacks on user interface result impersonation spoofing alternation. Attacks on system modules cause modification and exploit faults. Attacks on interconnections cause man-in-the-middle, replay or hill climbing. Attacks on template database result modification and leakage of critical sensitive data.

An adversary may attack human element or system infrastructure associated with a biometric system. The system administrators may do mistakes in enrollment, disenrollment of users or in adjustment of security parameters controlling the performance of a biometric system such as threshold on match scores and minimum limits on the quality of acquired biometric sample. The administrator may do mistakes and breach the security of biometric system. In case of collusion, an authorized user willingly turns malicious and attacks the system either individually or in collaboration with external adversaries. A coerced user does not carry out any attack willingly. An authorized user is forced to turn malicious through physical threat or blackmail. External attackers can also exploit the negligence of authorized users such as log out of the system after completing transactions. In case of enrollment fraud, an adversary may be able to enroll into the biometric system
illegally with a false identity and credentials. The system administrator should detect a duplicate identity by matching the biometric traits of a new user against the traits of all enrolled users. Another critical issue is exception abuse where exceptional situations may cause denial of service to legitimate users. It may be the failure of hardware and software components of a biometric system or poor quality of data (e.g. noise, missing data) during enrollment phase.

An adversary may attack the functional modules of a biometric system infrastructure such as sensor, extractor, template database, matches or attacks at the interface of the modules and decision modules. The common types of attacks are overloading and sabotage. A malicious agent may cause physical damage to one or more components of the biometric infrastructure such as putting off power supply, damaging of sensor interfaces or introducing excessive noise that affects the normal operation of biometric system. An imposter may attempt to intrude the biometric system by posing himself as an authorized user either casually or targeted way. The imposter does not modify his biometric traits in the first case. In the second case, the imposter may target an identity whose biometric characteristics are known to be similar to its traits. The imposter may execute mimicry attack by modifying his biometric characteristics. It may adopt the strategy of obfuscation by changing biometric characteristics to avoid detection. It is mainly applicable in negative recognition applications. Obfuscation can be done by presenting a poor quality image or noisy biometric sample. The solution is to improve the robustness of biometric algorithm.

Spoofing is the most common attack at user interface level and it involves the presentation of spoof biometric trait. A spoof is any counterfeit biometric that is not obtained from a live person. It includes the presentation of fake or artificial traits such as gummy finger, thin film on the top of a finger, recorded voice or mask of a face. If the sensor is unable to distinguish between spoofed and genuine biometric traits, an adversary can easily intrude the system under a false identity. Spoof detection is done through liveness detection by checking the signs of human vitality or liveness through blood pulse. Spoofing can be done by directly colluding with or coercing an authorized user, covert acquisition, hill climbing attacks or stealing the biometric template from the database. For spoof detection, common psychological properties used include pulse rate, blood pressure, perspiration, spectral or optical properties of human skin, electrical conductivity of human tissues and skin deformation. A malicious agent can subvert biometric processing by directly undermining the core functional modules of a biometric system such as signal processing or pattern making algorithms or by manipulating the communication between these modules. Template database can be hacked or modified by an adversary to gain unauthorized access or to deny access to legitimate users. There may be leakage of stored biometric template information due to lack of strict database access control.

The biometric system is a costly option in information security management; it requires complex data schema in terms of data warehousing and data structure. It ensures non-repudiation authentication and integrity, only legitimate or authorized users are able to access physical or logical resources protected by it. The imposters cannot access the protected resources or information. Another important issue is
availability where authorized users must have timely and reliable access to the
protected data. It also ensures confidentiality; it must be used for the intended
functionality i.e. credential based access control. A user can be recognized by what
he knows (e.g. passwords, PIN or cryptographic key), what he possesses (e.g.
passport, driving license, mobile phone, ID card) and who he is intrinsically (e.g.
inherent physical and behavioral characteristics). The proliferation of web based
services and deployment of distributed computing systems have led to the risks of
identity theft significantly. Facial recognition software, voice recognition system and
digital fingerprint or palms scanning are emerging trends of biometrics. The traits
such as fingerprints, retina, vein patterns and facial dimensions are generally
considered unique user profile but these features may be associated with a fake user
ID intentionally or by mistake during registration process. Biometric data
management should take care of user privacy and institutional convenience
simultaneously.

Privacy Verification

Agents: Client (C), SCADA / ICS administrator;

Input: Query for sensitive sensor data (q);

Output : Private sensor data (d<sup>p</sup><sub>s</sub>);

C→SCADA: q;

SCADA: Retrieve sensor data (d_s); Call move (M_i) for privacy preserving data mining;

M₁: Suppress d_s partially;

• M₂: Randomize d�s;

* M₃: Achieve k-anonymity through generalization, suppression, de-identification;

• M₄: Summarize or aggregate d�s;

• M₅: Replace dₛ with a small sample;

• SCADA → C: d<sup>p</sup><sub>s</sub> ;

Verify the performance and efficiency of algorithms: encryption, decryption, digital signature, digital certificate, signcryption;

Verify the degree of information leakage in inference control.

PVM preserves the privacy of SCADA data through efficient secure multi-party
computation and privacy preserving data mining.

A client interacts with SCADA through enterprise applications or web; submits
simple or complex queries and searches for intelligent information. A malicious
agent may be able to attack SCADA server during this communication between
sending and receiving agents. PVM tries to protect sensitive data from unsolicited
or unsanctioned disclosure of SCADA data by calling different statistical disclosure
control and privacy preserving data mining techniques. The privacy of sensitive
SCADA data may be preserved by suppressing the data intelligently before any
disclosure or computation. Specific attributes of particular records may be
suppressed completely. In case of partial suppression, an exact attribute value is
replaced with a less informative value by rounding or using intervals. K-anonymity
is achieved through generalization, suppression and de-identification [8]. The
attribute values are generalized to a range to reduce the granularity of representation. Quasi-identifier attributes are completely or partially suppressed. De-identification is achieved by suppressing the identity linked to a specific record or altering the dataset to limit identity linkage. Summarization releases the data in the form of a summary that allows approximate evaluation of certain classes of aggregate queries while hiding individual records. The sensitive data set may be replaced with a small sample. Aggregation presents data in the form of sum, average or count. Randomization perturbs the data randomly before sending them to the server and introduces some noise. The noise can be introduced by adding or multiplying random values to numerical attributes. SCADA administrator generally preserves the privacy of sensitive data through encryption, decryption, digital signature and certificates and signcryption. PVM checks whether different statistical disclosure control techniques are really able to preserve the privacy of sensitive SCADA data from the adversaries during communication with the client through web or different enterprise applications.

The next issue is the security of quantum computing model in depth. At level L1, is it possible to verify the efficiency of access control in terms of authentication, authorization, correct identification, privacy, audit, confidentiality, non-repudiation and data integrity? For any secure service, the system should ask the identity and authentication of one or more agents involved in secure multi-party computation. The agents of the same trust zone may skip authentication but it is essential for all sensitive communication across different trust boundaries.

<figure><img src="image_106.png" /><figcaption>Figure 10.14: Secure Multi-party Quantum Computing</figcaption></figure>
After the identification and authentication, quantum computing model should address the issue of authorization. The system should be configured in such a way that an unauthorized agent cannot perform any task out of scope. The system should ask the credentials of the requester; validate the credentials and authorize the agents to perform a specific task as per agreed protocol. Each agent should be assigned an explicit set of access rights according to role. Privacy is another important issue; an agent can view only the information according to authorized access rights. A protocol preserves privacy if no agent learns anything more than its output; the only information that should be disclosed about other agent's inputs is what can be derived from the output itself. The agents must commit the confidentiality of data exchange associated with private communication.

Privacy is a critical concern of the revelation principle of quantum computation; is it possible to address the issue of secure private communication through cryptography, digital signature and signcryption? The fundamental objectives of cryptography are to provide confidentiality, data integrity, authentication and non-repudiation. Cryptography ensures privacy and secrecy of information through encryption methods. Data integrity ensures that data is protected from unauthorized modifications or false data injection attack. The system should provide public verifiability so that anyone can verify the integrity of the data. Redundancy of data is a critical issue which is resulted through replication across the writers.

Traditionally, cryptographic solutions are focused to ensure information security and privacy. Is it possible to explore other different security concerns of quantum computing model? At level L2, is it possible to verify the efficiency of secure multiparty quantum computing in terms of fairness, robustness, correctness, transparency, accountability, trust and commitment? A protocol ensures correctness if the sending agent broadcasts correct data and each recipient receives the same correct data in time without any change and modification done by any malicious agent. Fairness is associated with the commitment, honesty and rational reasoning on payment function, trust and quality of service. Fairness ensures that something will or will not occur infinitely often under certain conditions. The recipients expect fairness in private communication according to their demand plan, objectives and constraints. The sending agent expects fairness from the recipients in terms of true feedback and commitment on confidentiality of data. As per traditional definition of fairness of secure multi-party computation, either all parties learn the output or none. The system must ensure the accountability and responsibility of the agents in access control, data integrity and non-repudiation. In fact, accountability is also associated with collective intelligence. Transparency is associated with communication protocols, revelation principle and automated system verification procedures. For example, a mechanism should clearly state its goal to define a policy. There exists an inherent tension between transparency and privacy. A fully transparent system allows anyone to view any data without any provision of privacy. On the other side, a fully private system provides no transparency. Privacy can be achieved using cryptographic techniques at increased cost of computation and communication. Is it possible to trade-off privacy vs. transparency? Is it possible to provide public verifiability of its overall state without
disclosing information about the state of each entity? Public Verifiability allows anyone to verify the correctness of the state of the system.

Next, is it is possible to verify the system performance of quantum computing model at level L3 in terms of stability, robustness, reliability, consistency, resiliency, liveness, deadlock freeness, reachability, synchronization and safety? The performance of a system and quality of service is expected to be consistent and reliable. Reachability ensures that some particular state or situation can be reached. Safety indicates that under certain conditions, an event never occurs. Safety is a critical requirement of any system whether it may be mechanical, electrical, electronics, information technology, civil, chemical, metallurgical or instrumentation engineering. Liveness ensures that under certain conditions an event will ultimately occur. Deadlock freeness indicates that a system can never be in a state in which no progress is possible; this indicates the correctness of a real-time dynamic system. Another important issue is robustness of a system. The delivery of the output should be guaranteed and the adversary should not be able to threaten a denial of service attack against a protocol.

At level L4, is it possible to assess the risks of various types of malicious attacks by adversaries on quantum computing model such as Denial of Service (DoS), false data injection attack, sybil attack, shilling attack, coremelt attack (or network traffic congestion), blackhole, neighbor, node deletion, rushing and jellyfish attacks? A quantum computing model may face various types of threats from both external and internal environments but it should be vigilant and protected through a set of security policies. Quantum computing model demands the support of an adaptive security architecture so that the associated system can continuously assess and mitigate risks intelligently. Adaptive security is a critical feature of quantum computing that monitors it in real time to detect any anomalies, vulnerabilities or malicious traffic congestion. If a threat is detected, the technology should be able to mitigate the risks through a set of preventive, detective, retrospective and predictive capabilities and measures. Adaptive security analyzes the behaviors and events to protect against and adapt to specific threats before the occurrence of known or unknown types of malicious attacks. At level L5, it is required to assess the risks of various types of corruptions of the agents associated with quantum computing model.

Let us explain the objectives of adaptive security of quantum computing model in depth. New threats are getting originated as an outcome of technology innovation and may cause new forms of disruptions with severe impact. Today, it is essential to deploy adaptive security architecture for the emerging technologies. The systems demand continuous monitoring and remediation; traditional ‘prevent and detect’ and incident response mindsets may be not sufficient to prevent a set of malicious attacks. It is required to assess as-is system administration strategies, investment and competencies; identify the gaps and deficiencies and adopt a continuous, contextual and coordinated approach. For example, prevention and detection are traditional approaches to the security of a system. In today’s world of expanding threats and risks, real-time system monitoring is essential to predict new threats and automate routine responses and practices. The system should not only rely on traditional prevent-and-detect perimeter defense strategies and rule based security
but should adopt cloud based solutions and open application programming interfaces also. Advanced analytics is the basic building block of next generation security protection which should be to manage an enormous volume, velocity and variety of data through AI and machine learning techniques. Intelligent analytics are expected to detect anomalous patterns by comparing with the normal profile and the activities of the users, peer groups and other entities such as devices, applications and smart networks and trigger alarms by sensing single or multiple attacks on the system. The security element must overcome the barriers among security, application development and operations teams and be integrated deeply into system architecture.

Next, it is essential to develop effective ways to move towards adaptive security architecture. The mechanism should surface anomalies and adjust individualized security controls proactively in near real-time to protect the critical data of a system. Adaptive Security with dynamic data protection is expected to offer many benefits over traditional security platforms depending on the size of the system and complexity of networking schema – real time monitoring of events, users and network traffic; autonomous and dynamic resolutions; prioritization and filtering of security breaches; reduction of attack surface and impact or damage of a threat and reduction of resolution time. The emerging technology is expected to adapt to the needs of a system irrespective of the size of network, nature of operation or exposure of threats. It can assess the requirements of security with greater accuracy through a set of intelligent policies and procedures and can ensure better understanding of strength, weakness, opportunities and threats of the security architecture.

### Security Analytics:

*Agents:* System analysts;

*Algorithm:*

<figure><img src="image_107.png" /></figure>

call intelligent threat analytics, verify security intelligence at multiple levels.

* Level 1: audit computational intelligence in terms of correctness of computation and rationality of filter configuration,

* Level 2: verify system performance of the adaptive filter in terms of reliability, consistency, resiliency and liveness;

* Level 3: malicious attacks – verify the risks of Denial of Service (DoS), false data injection, intrusion and Sybil attack on adaptive filter;

* Level 4: multi-party corruption - assess the risks of corruption of system administrator and filtering mechanism of adaptive filter;

* Level 5: verify the efficiency of access control of adaptive filter in terms of authentication, authorization, correct identification, privacy, audit, nonrepudiation, confidentiality and data integrity.

* **Revelation principle**: Preserve privacy of output of adaptive filter.

* identify what is corrupted or compromised?

* time: what occurred? what is occurring? what will occur? assess probability of occurrence and impact.

* insights: how and why did it occur? do cause-effect analysis.
* recommend : what is the next best action?

* predict : what is the best or worst that can happen?

What do you mean by security in adaptive filter; how to verify security intelligence in adaptive filter? It is essential to verify security intelligence of secure adaptive filter collectively through rational threat analytics at five levels : L1, L2, L3, L4 and L5. The basic building blocks of the security of adaptive filter are an adversary model and an intelligent threat analytics. An adversary is a malicious agent who attacks a system or a protocol; the basic objectives are to cause disruption and malfunctioning of a secure system. The security intelligence of adaptive filter should be analyzed in terms of assumptions, goals and capabilities of the adversary. It is also crucial to analyze the adversary model in terms of environment, location, network, resources, access privileges, equipments, devices, actions, results, risks, reasons and motivations of attacks and probable targets (i.e. why the adversary attacks and to obtain what data).

**Theorem : Correctness and privacy of computation of adaptive filter is ensured through a rational threat analytics.**

It is essential to verify correctness and privacy of computation by the adaptive filter. The correctness of the filter is deeply associated with right configuration of the data schema (S). The privacy of computation can be ensured through a robust revelation principle of the filter. The data schema (S) may be misconfigured due to various types of threats such as Sybil attack, false data injection attack, shilling attack by corrupted recommender system and multi-party corruption. In case of false data injection attack, incomplete, corrupted, noisy and incorrect data may be fed to the data schema (S). It is essential to verify the fairness, trust and correctness of input data in time.

It is really complex to trace the corrupted agents. The entities associated with the data schema (S) may be partitioned into two subsets: correct and faulty. Each correct entity presents one legitimate identity to other entities. Each faulty entity presents one legitimate identity and one or more counterfeit identities to S. Each identity is an informational abstract representation of an entity that persists across multiple communication events. The entities communicate through messages. A malicious agent may control multiple pseudonymous identities and can manipulate, disrupt or corrupt the data schema (S) that relies on redundancy by injecting false data or suppressing critical data. It is sybil attack. Sybil attack may be detected through intelligent tracing mechanism such as trusted explicit and implicit certification, robust authentication, resource testing and incentive based game.

It is essential to verify the security intelligence of adaptive filter at multiple levels to ensure the correctness and privacy of computation. At level L1, is it possible to verify the efficiency of access control in terms of authentication, authorization, correct identification, privacy, audit, confidentiality, non-repudiation and data integrity. For any service from the filter, the system should ask the identity and authentication of one or more agents involved in secure multi-party computation. The agents of the same trust zone may skip authentication but it is essential for all sensitive
communication across different trust boundaries. After the identification and authentication, an adaptive filter should address the issue of authorization. The system should be configured in such a way that an unauthorized agent cannot perform any task out of scope. The system should ask the credentials of the requester; validate the credentials and authorize the agents to perform a specific task as per agreed protocol. Each agent should be assigned an explicit set of access rights according to role. Privacy is another important issue; an agent can view only the information according to authorized access rights. A protocol preserves privacy if no agent learns anything more than its output; the only information that should be disclosed about other agent's inputs is what can be derived from the output itself. The agents must commit the confidentiality of data exchange associated with private communication.

Privacy is a critical concern of the revelation principle of secure adaptive filter; is it possible to address the issue of secure private communication through cryptography, digital signature and signcryption? The fundamental objectives of cryptography are to provide confidentiality, data integrity, authentication and non-repudiation. Cryptography ensures privacy and secrecy of information through encryption methods. Data integrity ensures that data is protected from unauthorized modifications or false data injection attack. The system should provide public verifiability so that anyone can verify the integrity of the data. Redundancy of data is a critical issue which is resulted through replication across the writers.

Traditionally, cryptographic solutions are focused to ensure information security and privacy. Is it possible to explore other different security concerns of adaptive filter? At level L2, is it possible to verify the efficiency of adaptive filter in terms of fairness, robustness, correctness, transparency, accountability, trust and commitment? A protocol ensures correctness if the sending agent broadcasts correct data and each recipient receives the same correct data in time without any change and modification done by any malicious agent. Fairness is associated with the commitment, honesty and rational reasoning of the associated agents on payment function, trust and quality of service. Fairness ensures that something will or will not occur infinitely often under certain conditions. The recipients expect fairness in private communication according to their demand plan, objectives and constraints. The sending agent expects fairness from the recipients in terms of true feedback and commitment on confidentiality of data. As per traditional definition of fairness of secure multi-party computation, either all parties learn the output or none. The system must ensure the accountability and responsibility of the agents in access control, data integrity and non-repudiation. In fact, accountability is also associated with collective intelligence. Transparency is associated with communication protocols, revelation principle and automated system verification procedures. For example, a mechanism should clearly state its goal to define a policy. There exists an inherent tension between transparency and privacy. A fully transparent system allows anyone to view any data without any provision of privacy. On the other side, a fully private system provides no transparency. Privacy can be achieved using cryptographic techniques at increased cost of computation and communication. Is it possible to trade-off privacy vs. transparency?
Next, is it possible to verify the system performance of adaptive filter at level L3
in terms of stability, robustness, reliability, consistency, resiliency, liveness,
deadlock freeness, reachability, synchronization and safety? The performance of a
system and quality of service is expected to be consistent and reliable. Reachability
ensures that some particular state or situation can be reached. Safety indicates that
under certain conditions, an event never occurs. Liveness ensures that under certain
conditions an event will ultimately occur. Deadlock freeness indicates that a system
can never be in a state in which no progress is possible; this indicates the correctness
of a real-time dynamic system. Another important issue is robustness of a system.
The delivery of the output should be guaranteed and the adversary should not be
able to threaten denial of service attack against a protocol.

At level L4, is it possible to assess the risks of various types of malicious attacks by adversaries on adaptive filter such as Denial of Service (DoS), false data injection attack, sybil attack, shilling attack, coremelt attack (or network traffic congestion), blackhole, neighbor, node deletion, rushing and jellyfish attacks? An adaptive filter may face various types of threats from both external and internal environments but it should be vigilant and protected through a set of security policies. An adaptive filter demands the support of an intelligent architecture so that the associated system can continuously assess and mitigate risks intelligently. Adaptive security is a critical feature of the filter that monitors it in real time to detect any anomalies, vulnerabilities or malicious traffic congestion. If a threat is detected, the technology should be able to mitigate the risks through a set of preventive, detective, retrospective and predictive capabilities and measures. Adaptive security analyzes the behaviors and events to protect against and adapt to specific threats before the occurrence of known or unknown types of malicious attacks. At level L5, it is required to assess the risks of various types of corruptions of the agents associated with an adaptive filter.

Let us explain the objectives of security of adaptive filter in depth. New threats are
getting originated as an outcome of technology innovation and may cause new forms
of disruptions with severe impact. Today, it is essential to deploy adaptive security
architecture for the emerging technologies. The system demands continuous
monitoring and remediation; traditional ‘prevent and detect’ and incident response
mindsets may be not sufficient to prevent a set of malicious attacks. It is required to
assess as-is system administration strategies, investment and competencies; identify
the gaps and deficiencies and adopt a continuous, contextual and coordinated
approach. For example, prevention and detection are traditional approaches to the
security of a system. In today’s world of expanding threats and risks, real-time
system monitoring is essential to predict new threats and automate routine
responses and practices. The system should not only rely on traditional prevent-
and-detect perimeter defense strategies and rule based security but should adopt
cloud based solutions and open application programming interfaces also. Advanced
analytics is the basic building block of next generation security protection which
should be to manage an enormous volume, velocity and variety of data through AI
and machine learning techniques. Intelligent analytics are expected to detect
anomalous patterns by comparing with the normal profile and the activities of the
users, peer groups and other entities such as devices, applications and smart
networks and trigger alarms by sensing single or multiple attacks on the system. The security element must overcome the barriers among security, application development and operations teams and be integrated deeply into system architecture. Next, it is essential to develop effective ways to move towards adaptive security architecture. The mechanism should surface anomalies and adjusts individualized security controls proactively in near real-time to protect the critical data of a system. Adaptive Security with dynamic data protection is expected to offer many benefits over traditional security platforms depending on the size of the system and complexity of networking schema – real time monitoring of events, users and network traffic; autonomous and dynamic resolutions; prioritization and filtering of security breaches; reduction of attack surface and impact or damage of a threat and reduction of resolution time. The emerging technology is expected to adapt to the needs of a system irrespective of the size of network, nature of operation or exposure of threats. It can assess the requirements of security with greater accuracy through a set of intelligent policies and procedures and can ensure better understanding of strength, weakness, opportunities and threats of the security architecture.

Let us also discuss the issue of private classification by secure adaptive filter using kernel method such as support vector machine. Private SVM returns outputs (e.g. kernel value, classification labels) in encrypted form so that the same can be decrypted only through a common agreement by authorized agents. SVM algorithm may reveal sensitive data in various ways. SVM may leak some side information that is not specified by functions of the algorithm. The specified output result itself can reveal sensitive data. Private SVM should define an intelligent revelation principle : which data can be revealed. It should not reveal more information than required. The basic building block of private SVM may be secure multi-party computation which can preserve the privacy of sensitive data through various methods : adding random noise to data [The basic objective of data perturbation is to alter the data so that real individual data values cannot be recovered. For an input x, (x+r) preserves the privacy of x if r is a secret random number]; splitting a message into multiple parts randomly and sending each part to a DMA through a number of parties hiding the identity of the source; controlling the sequence of passing selected messages from an agent to others through serial or parallel mode of communication; dynamically modifying the sequence of events and agents through random selection; permuting the sequence of messages randomly and masking of data;

Let us consider the second issue - the output results generated by SVM may reveal sensitive information. There should be a trade-off between revealing sensitive information and useful knowledge. SVM can reveal internal value, classifier and classification results. Any of the revealed internal values can breach the privacy of training and testing data and the output results can also leak the privacy of classified data. Thus, it is important to define what additional information should the analysts come to know after running a private SVM; only an authorized agent should know class labels of classified data. If the classification results are too sensitive then the authorized agent should obtain only an aggregated output data. Private SVM assumes a semi-honest model the agents follow the protocol correctly
but use the obtained information to gain new knowledge. It should neither leak
information training data nor the classifiers; the sensitive data should be encrypted.
There should be a tradeoff between privacy and the efficiency of private SVM in
tems of cost of computation and communication.

5. STRATEGY

Strategy Analytics

Prof. Simon Watson is exploring a set of intelligent strategic moves for the innovation of emerging digital technologies such as scope analysis, requirements engineering, system design, talent management, team management and coordination, resources planning, concept development, concept evaluation, system architecture design, system development plan, roll out, process design, prototyping and testing The technological innovation on digital technology is associated with. Efficient change management ensures that an organization and its workforce are ready, willing and able to embrace the new processes and information systems. The change management is a complex process. The change should occur at various levels such as system, process, people and organization. Communication is the oil that ensures that everything works properly. It is essential to communicate the scope of digital technology to the policy makers, state and central governments, corporate executives, academic and research community.

Strategy can be analyzed from different dimensions such as R&D policy, learning
curve, SWOT analysis, technology life-cycle analysis and knowledge management
strategy. Technology trajectory is the path that the technology takes through its
time and life-cycle from the perspectives of rate of performance improvement, rate
of diffusion or rate of adoption in the market. The emerging digital technologies are
now passing through the growth phase of S-curve. Initially, it may be difficult and
costly to improve the performance of the technology. The performance is expected
to improve with better understanding of the fundamental principles and system
architecture. The dominant design should consider an optimal set of most advanced
technological features which can meet the demand of the customer, supply and
design chain in the best possible way. It is really interesting to analyze the impact of
various factors on the trajectory of digital technology

<figure><img src="image_108.png" /><figcaption>Figure 10.15: Technology life-cycle analysis</figcaption></figure>
**SWOT Analysis on Cloud Computing** : Let us exercise SWOT analysis on cloud computing. The strength of cloud computing is associated with several issues such as IT cost reduction, improved system performance and productivity, easier maintenance, agility, device and location independent access, scalability and elasticity via dynamic provisioning of resources in near real-time, security, multitenancy, availability, business continuity, disaster recovery, on demand self service (e.g. computing capabilities, server time, network storage capacity), broad network access by various client platforms (e.g., mobile phones, tablets, laptops, and workstations), resource pooling, rapid elasticity and measured services. Multitenancy enables sharing of resources and costs across a large pool of service consumers; the computing resources of the service provider can be pooled to serve multiple consumers using a multi-tenant model with different physical and virtual resources dynamically assigned and reassigned as per the demand of the service consumers. System capabilities can be elastically provisioned and released maintaining scalability automatically. Resource usage (e.g. storage, processing, bandwidth, active user accounts) can be monitored, controlled, optimized and reported with transparency. It is possible to ensure agility of an enterprise with re-provisioning, adding or expanding technological infrastructure resources. Cost reduction is possible by converting capital expenditure to operational expenditure. This strategy may lower barriers to entry as IT infrastructure is provided by a third party and need not be purchased for one time or infrequent intensive computing tasks.

But, there are several limitations of cloud computing such as privacy of critical strategic data, loss of control over critical strategic data, access control problems, confidentiality, data integrity, reliability, consistency, resiliency, network traffic congestion, delay in data communication, threats of various types of malicious attacks (e.g. sybil attack, false data injection attack, denial of service attack) and multi-party corruption. The top three threats in the cloud are insecure interfaces and APIs, data loss, data leakage and hardware failure. Cloud computing poses privacy concerns as the service provider can access the data of service consumer in the cloud at any time. It could accidentally or deliberately alter or delete critical data. The service providers may share or sell strategic data of the consumers to third parties. The consumers can encrypt data to prevent unauthorized access. But, this move may result high cost of computation and communication.

<figure><img src="image_109.png" /><figcaption>Figure10.16: Technology life-cycle analysis of solar computing</figcaption></figure>
The technological innovation on a smart grid is associated with a set of intelligent strategic moves such as scope analysis, requirements engineering, quality control, system design, concurrent engineering, talent management, team management and coordination, resources planning, concept development, concept evaluation, system architecture design, system development plan, roll out, process design, prototyping and testing. Efficient change management ensures that an organization and its workforce are ready, willing and able to embrace the new processes and systems associated with a smart grid. The change management is a complex process. The change should occur at various levels such as system, process, people and organization. Communication is the oil that ensures everything works properly. It is essential to communicate the scope of solar grid and related solar computing to the public policy makers, state and central governments, corporate executives, academic and research community.

The fifth element of the deep analytics is strategy. This element can be analyzed from different dimensions such as R&D policy, learning curve, SWOT analysis, technology life-cycle analysis and knowledge management strategy. Technology trajectory is the path that the technology takes through its time and life-cycle from the perspectives of rate of performance improvement, rate of diffusion or rate of adoption in the market. The technology of solar computing is now passing through the emergence phase of S-curve. Initially, it may be difficult and costly to improve the performance of the technology. The performance is expected to improve with better understanding of the fundamental principles and system architecture. The dominant design should consider an optimal set of most advanced technological features which can meet the demand of the consumers in the best possible way. It is really interesting to analyze the impact of various factors on the trajectory of smart solar grid technology.

<figure><img src="image_110.png" /><figcaption>Figure 10.17 : Technology life-cycle analysis of SCADA & ICS</figcaption></figure>

The fifth element of deep analytics is strategy. This element can be analyzed from different dimensions such as R&D policy, learning curve, SWOT analysis, technology life-cycle analysis and knowledge management strategy. Technology trajectory is the path that IIoT enabled ICS and SCADA technology takes through its time and life-cycle from the perspectives of rate of performance improvement, rate of diffusion or rate of adoption in the market. This technology is now passing
through the growth phase of S-curve. Initially, it is difficult and costly to improve
the performance of the technology. The performance is expected to improve with
better understanding of the fundamental principles and system architecture. The
dominant design should consider an optimal set of most advanced technological
features which can meet the demand of the customer, supply and design chain in the
best possible way. It is really interesting to analyze the impact of various factors on
the trajectory IIOT enabled SCADA and ICS technology.

*Strategy 1 : SIVM verifies innate and adaptive system immunity in terms of collective, machine, security, collaborative and business intelligence through multi-dimensional view on intelligent reasoning.*

SIVM is defined by a set of elements : system, a group of agents, a finite set of inputs, a finite set of outcomes as defined by output function, a set of objective functions and constraints, payment function, an optimal set of moves, revelation principle and model checking or system verification protocol. The proposed mechanism evaluates the innate and adaptive immunity of a system which is defined by a set of states (e.g. initial, goal, local and global) and state transition relations. The mechanism follows a set of strategic moves. The basic building block of the mechanism is an analytics having multidimensional view of intelligent reasoning. Reasoning has multiple dimensions like common sense, automated theorem proving, planning, understanding, hypothetical, simulation dynamics and envisioning i.e. imagination or anticipation of alternatives. The inference engine selects appropriate reasoning techniques from a list of options such as logical, analytical, case based, forward and backward chaining, sequential, parallel, uncertainty, probabilistic, approximation, predictive, imaginative and perception based reasoning depending on the demand of an application. Another important move is the collection of evidence through private search which may require a balance between breadth and depth optimally.

The critical challenge is how to detect the danger signal from a system? The mechanism evaluates system immunity (i) combinatorially in terms of collective, machine intelligence, security, collaborative and business intelligence. The *collective intelligence* (a) is defined in terms of scope, input, output, process, agents and system dynamics. For a complex application, it verifies coordination and integration among system, strategy, structure, staff, style, skill and shared vision. What is being done by the various components of a system? Who is doing? Why? How? Where? When? The *machine intelligence* (b) checks the system in terms of safety, liveness, concurrency, reachability, deadlock freeness, scalability and accuracy. For example, it should check preconditions, post conditions, triggering events, main flow, sub flow, alternate flow, exception flow, computational intelligence, communication cost, traffic congestion, time and space complexity, resources, capacity utilization, load, initial and goal states, local and global states and state transition plans of the information system associated with ICS/SCADA.

The *security intelligence* (c) verifies the system in terms of authentication, authorization, correct identification, non-repudiation, integrity, audit and privacy; rationality, fairness, correctness, resiliency, adaptation, transparency,
accountability, trust, commitment, reliability and consistency. The *collaborative intelligence* (d) evaluates the feasibility and effectiveness of human-computer interaction to achieve single or multiple set of goals, information sharing principle and negotiation protocol. The *business intelligence* (e) is associated with business rules such as HR policy, payment function, cost sharing, bonus, contractual clauses, quality, performance, productivity, incentive policy and competitive intelligence. The mechanism verifies system immunity through a set of verification algorithms. It is possible to follow various strategies like model checking, simulation, testing and deductive reasoning for automated verification. Simulation is done on the model while testing is performed on the actual product. It checks the correctness of output for a given input. Deductive reasoning tries to check the correctness of a system using axioms and proof rules. There is risk of state space explosion problem in case of a complex system with many components interacting with one another; it may be hard to evaluate the efficiency of coordination and integration appropriately. Some applications also demand semi-automated and natural verification protocol. The mechanism calls threat analytics and assesses risks of single or multiple attacks on the system under consideration: analyze performance, sensitivity, trends, exception and alerts; checks what is corrupted or compromised: agents, protocol, communication, data, application and computing schema? Performs time series analysis: what occurred? what is occuring? what will occur? assess probability of occurrence and impact; explores insights : how and why did it occur? do cause-effect analysis; recommends : what is the next best action? predicts: what is the best or worst that can happen?

*Strategy 2 : SIVM verifies security intelligence collectively through rational threat analytics.*

Model checking is an automated technique for verifying a finite state concurrent system such as a hardware or software system. Model checking has three steps: represent a system by automata, represent the property of a system by logic and design model checking algorithm. The security intelligence of SCADA is a multi-dimensional parameter which is defined at five different levels L1,L2,L3,L4 and L5. At level L1, it is essential to verify the security of data schema in terms of authentication, authorization, correct identification, privacy and audit of access control mechanism offered by the system. In this case, the system should ask the identity and authentication of one or more agents involved in SCADA operation and system administration. The agents of the same trust zone may skip authentication but it is essential for all sensitive communication across different trust boundaries. After correct identification and authentication, SIVM should address the issue of authorization. The system should be configured in such a way that an unauthorized agent cannot perform any task out of scope. The system should ask the credentials of the requester; validate the credentials and authorize the agents to perform a specific task as per agreed protocol. Each agent should be assigned an explicit set of access rights according to role. Privacy is another important issue; an agent can view only the information according to authorized access rights. A protocol preserves privacy if no agent learns anything more than its output; the only
information that should be disclosed about other agent's inputs is what can be
derived from the output itself. The privacy of data may be preserved in different
ways such as adding random noise to data, splitting a message into multiple parts
randomly and sending each part to an agent through a number of parties hiding the
identity of the source, controlling the sequence of passing selected messages from an
agent to others through serial or parallel mode of communication, dynamically
modifying the sequence of events and agents through random selection and
permuting the sequence of messages randomly. The agents must commit the
confidentiality of data exchange associated with private communication.

At level L2, it is essential to verify the computing schema in terms of fairness, correctness, transparency, accountability and trust. A protocol ensures correctness if the sending agent broadcasts correct data free from any false data injection attack and each recipient receives the same correct data in time without any change and modification done by any malicious agent. Fairness is associated with proper resource allocation, trust, commitment, honesty and rational reasoning of the agents involved in SCADA system administration. Fairness ensures that something will or will not occur infinitely often under certain conditions. The mechanism must ensure the accountability and responsibility of the agents in access control, data integrity and non-repudiation. The transparency of SCADA system administration is associated with communication protocols and revelation principle.

At level L3, it is essential to verify the application schema in terms of system
performance. The performance of the system and quality of service is expected to be
consistent and reliable. Reachability ensures that some particular state or situation
can be reached. Safety indicates that under certain conditions, an event never
occurs. Liveness ensures that under certain conditions an event will ultimately
occur. Deadlock freeness indicates that a system can never be in a state in which no
progress is possible; this indicates the correctness of a real-time dynamic system.
SCADA is expected to be a resilient system. The resiliency measures the ability to
and the speed at which the system can return to normal performance level following
a disruption.

At level L4, SIVM verifies networking schema and assesses the threats of internal and external malicious attacks on SCADA & ICS such as cyber attack, rubber hose, sybil, node replication, wormhole, coremelt, forward, blackhole, neighbor, jellyfish and crypto jacking attack. At level L5, SIVM verifies security schema and assesses the risk of multi-party corruption (e.g. sender, receiver, data, communication channel, mechanism and protocol) and business intelligence of payment function.

Strategy 3 : The security intelligence of an industrial control system is verified comprehensively in terms of correctness of computing schema, stability and robustness in system performance of the plant, data, networking, security and application schema.
Please refer to second test case in the appendix where SIVM is applied for a plant having supervisory adaptive fuzzy control. Let us first explain various types of circuits for intelligent process control of the plant. Next, it is essential to call threat analytics and verify the security intelligence of data, computing, application, networking and security schema at levels 1,2,3,4 and 5. At level L1, it is crucial to verify the data schema in terms of authentication, authorization, correct
identification, privacy, audit, confidentiality, integrity, non-repudiation, locking of
passwords, false data injection attack and intrusion for proper access control of the
plant. Any flaws in access control may affect the stable performance of the plant
negatively. A malicious agent can take over the control of the plant completely or
partially by hacking system control passwords or compromising system
administration.

Next, let us consider level L2 to verify the computing schema. Fuzzy logic is a multi-
valued logic used for approximate reasoning. Fuzzy logic based algorithms are used
for the control of complex plants through fuzzy controllers. The fuzzy controllers
(FC) operate based on IF-THEN fuzzy rules. Industrial process control systems use
various types of controllers such as P/PI/PID through adaptive gain scheduling,
supervisory control architectures and algorithms. The fuzzy controllers use IF-
THEN rules, can learn universal approximation property and can deal with fuzzy
values. If there are flaws in design of these basic features of fuzzy controllers, a
plant may face various types of problems in terms of system performance, stability
and robustness.

A plant's behavior can be defined by a set of IF-THEN fuzzy rules based on
knowledge acquisition from knowledge based expert system, ANN and GA based
algorithms. ANN and GA are used to learn fuzzy rules through structural
identification which requires structural apriori knowledge such as linear or
nonlinear control of a system. Another approach is parameter identification, scaling
and normalization of physical signals. Another important feature is universal
approximation: a fuzzy system with IF-THEN rules firing, defuzzification and
membership function can approximate any real continuous function with certain
approximation error due to the overlap of membership function from IF parts of a
set of fuzzy rules. The inputs to the fuzzy controller are fuzzy values; they are
quantitative numbers being obtained from different sources. For example, the
intensity of a signal with respect to time interval is expressed by a membership
function. FCs are able to deal with fuzzy value through heuristics or model based
approaches.

The objective of fuzzy control is to design a feedback control law in the form of a set of fuzzy rules such that the closed loop system exhibits the desired behavior of a given model of the system and its desired behavior. The quality of nonlinear control is measured in terms of system performance, stability, robustness, accuracy and response speed In case of stabilization, the state vector of a closed loop system should be stabilized around a set point of the state space. Here, the challenge is to define a set of fuzzy rules based control law. In case of tracking, a FC is to be designed so that the output of closed loop system follows a time varying trajectory. The basic objective is to find a control law in terms of a set of fuzzy rules such that the tracking error [x(t) – x<sup>d</sup>(t)] tends to zero. In fact, stabilization is a special type of tracking where the desired trajectory is constant.

Next, let us consider system performance of a plant in terms of computing and
application schema at level L3. In case of linear control, the behavior of a closed
loop system can be specified in exact quantitative terms such as rise time, setting
time, overshoot and undershoot. The desired behavior of a non-linear closed system
can be specified in qualitative terms such as stability, accuracy, response speed and
robustness. In case of linear control, stability implies the ability to withstand bounded disturbances in linear range of operation of the system. In case of nonlinear control, the behavior of the system is analyzed in terms of effects of positive disturbances and robustness. Robustness is the sensitivity of the closed loop system to various types of effects such as measurement noise, disturbances and unmodelled dynamics. The closed loop system must be insensitive to these effects. Accuracy and response speed must be considered for desired trajectories in the region of operation. Moreover, it is important to verify the plant's performance in terms of reliability, consistency, resiliency, liveness, denial of service (DoS) attack, deadlock freeness, synchronization and application integration. It is expected to minimize human error in plant's operation from the perspectives of correct decision making and adjustment of the setting of plant's parameters.

The verification of correctness of computing schema of a fuzzy controller is a critical issue. A fuzzy logic controller defines a control law in terms of a transfer element due to non-linear nature of computation. The fuzzy control law is expressed by a set of 'IF THEN' fuzzy rules. 'IF' part of a fuzzy rule describes a fuzzy region in the state space. 'THEN' part specifies a control law applicable within fuzzy region from IF part of the same rule. FC yields a smooth non-linear control law through the operation of aggregation and defuzzification. The correctness of computing schema is associated with a set of computational steps such as input scaling or normalization, fuzzification of controller input variables, inference rule firing, defuzzification of controller output variables and output scaling or denormalization.

In case of supervisory control, one or more controllers are supervised by a control law on a higher level. The low level controllers perform a specific task under certain conditions keeping a predefined error between desired state and current state, performing a specific control task and being at a specific location of the state space. Supervision is required only if some of the predefined conditions fail: change the set of control parameters or switches from one control strategy to another. Supervisory algorithms are formulated in terms of IF-THEN rules. Fuzzy IF-THEN rules support soft supervision and avoid hard switching between set of parameters or between control structures.

In case of adaptive control, a dynamic system may have a known structure, but uncertain or slowly varying non-linear parameters. Direct adaptive approaches start with sufficient knowledge about the system structure and its parameters. Direct change of controller parameters optimize the system's behavior with respect to a given criterion. Indirect adaptive control methods estimate the uncertain parameters of the system under control on-line and use the estimated parameters in the computation of the control law. Adaptive control audits system performance in terms of stability, robustness, tracking convergence, tuning and optimization of various parameters like scaling factors for input and output signals, input and output membership functions and fuzzy IF-THEN rules.

It is also essential to audit security intelligence of the networking schema of the plant at level L₄: detect threats of internal and external attacks such as cyber, rubber hose attack, sybil, node replication, wormhole, coremelt, forward, blackhole, neighbor, jellyfish and Crypto jacking attack. A real-time monitoring system must
audit multi-party corruption at level L<sub>5</sub> [e.g. sender, receiver, data, communication channel, mechanism, protocol, process, procedure]. The system administrator should mitigate the risks of various threats through proactive, reactive approaches and sense-and-response against bad luck like the occurrence of natural disaster.

*Strategy 4: SCADA / ICS requires both automated and semi-automated verification mechanisms for intrusion detection.*

SCADA / ICS calls threat analytics and a set of model checking algorithms for various phases : exploratory phase for locating errors, fault finding phase through cause effect analysis, diagnostics tool for program model checking and real-time system verification. Model checking is basically the process of automated verification of the properties of the system under consideration. Given a formal model of a system and property specification in some form of computational logic, the task is to validate whether or not the specification is satisfied in the model. If not, the model checker returns a counter example for the system’s flawed behavior to support the debugging of the system. Another important aspect is to check whether or not a knowledge based system is consistent or contains anomalies through a set of diagnostics tools.

There are two different phases : explanatory phase to locate errors and fault finding phase to look for short error trails. Model checking is an efficient verification technique for communication protocol validation, embedded system, software programmers', workflow analysis and schedule check. The basic objective of the model checking algorithm is to locate errors in a system efficiently. If an error is found, the model checker produces a counter example how the errors occur for debugging of the system. A counter example may be the execution of the system i.e. a path or tree. A model checker is expected to find out error states efficiently and produce a simple counterexample. There are two primary approaches of model checking: symbolic and explicit state. Symbolic model checking applies a symbolic representation of the state set for property validation. Explicit state approach searches the global state of a system by a transition function. The efficiency of model checking algorithms is measured in terms of automation and error reporting capabilities. The computational intelligence is also associated with the complexity of threat analytics equipped with the features of data visualization and performance measurement.

The threat analytics analyze system performance, sensitivity, trends, exception and alerts along two dimensions: time and insights. The analysis on time dimension may be as follows: what is corrupted or compromised in the system: agents, communication schema, data schema, application schema, computing schema and protocol? what occurred? what is occuring? what will occur? Assess probability of occurrence and impact. The analysis on insights may be as follows : how and why did the threat occur? What is the output of cause-effect analysis? The analytics also recommends what is the next best action? It predicts what is the best or worst that can happen?

*How can you assess the immunity of ICS against intrusion in the form of sybil, cloning, wormhole or node capture attacks?* Traditional intrusion detection