SUGISAKAMASANORI

Journal of Advances in Artificial Life Robotics
Vol. 4(2); September (2023), pp. 106–109
ON LINE ISSN 2435-8061; ISSN-L 2435-8061
https://alife-robotics.org/jallr.html

Research Article

Cyber-Physical Security Testbed for Dam Control System
Meng-Wei Chang, Jung-Shian Li, I-Hsien Liu

Department of Electrical Engineering / Institute of Computer and Communication Engineering, National Cheng Kung University, No.1 Daxue Rd., East Dist.,
Tainan City, 701401, Taiwan

ARTICLE INFO
Article History
Received 08 October 2022
Accepted 30 October 2023
Keywords
Critical infrastructure
CPS
ML-AskTestbedMachine learning
Dataset

ABSTRACTAs critical infrastructure has seen substantial growth in recent years, the security of its CyberPhysical Systems (CPS) has gained greater significance. The rapid evolution of machine learningtechnology is being harnessed to detect and prevent these threats. Accordingly, this study
establishes a Testbed for gathering pertinent datasets to aid machine learning needs, including
model training and attack analysis.

© 2022 The Author. Published by Sugisaka Masanori at ALife Robotics Corporation Ltd.
This is an open access article distributed under the CC BY-NC 4.0 license(http://creativecommons.org/licenses/by-nc/4.0/)

Fortunately, the progress in machine learning andneural networks has paved the way for a multitude ofnovel detection models to counter these threats. For
example, J. Goh and their team [5] have leveraged thecapabilities of Recurrent Neural Networks (RNN) to
develop models for the identification of cyberattacks,utilizing datasets in the training process. Similarly, J.
Inoue and their colleagues [6] have dedicated their efforts
to pioneering anomaly detection methodologies in thedomain of water treatment, adding another layer ofsecurity to critical infrastructure.
While the two methods mentioned above center onwater treatment, the importance of addressing thesecurity of dam Cyber-Physical Systems (CPS) can nolonger be understated in light of global incidents.
Consequently, this study places a strong emphasis on thedevelopment of a testbed that encompasses both physicaland network data components within a dam environment,
marking a primary objective of this research

1. Introduction
Over the years of development, critical infrastructures
have significantly enhanced our quality of life. Theintroduction of the industry 4.0 concept [1] in 2011
marked a pivotal moment, prompting various industries
to prioritize the establishment of secure Cyber-PhysicalSystems (CPS) [2]. CPS, which integrate computation,
networking, and physical processes, empower us tomonitor the system's physical processes and network
traffic, enhancing overall system performance andresource allocation.
However,vulnerabilities
persistintheinfrastructure's CPS, potentially endangering lives. Dam
facilities, in particular, experience annual failures andsecurity breaches. Some failures result from abnormal
inflows triggered by extreme weather conditions, such as
the Loas Dam collapse due to heavy rainfall in 2018 [3].
On a different note, the cyberattack on the Bowman
Avenue Dam in 2013 [4] exposed the system'svulnerability to potential hacker-induced crises.

Corresponding author’s E-mail: ihliu@cans.ee.ncku.edu.tw, mwchang@cans.ee.ncku.edu.tw, jsli@cans.ee.ncku.edu.tw URL: www.ncku.edu.tw106

2. Research Background3.1. Dam Environment

Our research delves into the principles of Industrial
Control Systems (ICS) [7] and the SWaT testbeddeveloped in Singapore [14]. Constructing our system inalignment with existing industry standards lends
credibility to our data. As such, we will provide a concise
overview of these frameworks before diving into thespecifics of our testbed.

The testbed's structure is visually represented in Fig.1,
featuring the simulation of seven spillways within thedam, each managed by PLCs.

2.1. Industrial Control System
An Industrial Control System (ICS) is a comprehensive
network designed to automate industrial processes,
comprising various elements such as Human MachineInterfaces (HMI) [8] and Supervisory Control and Data
Acquisition (SCADA) [9] systems. These components
work together with Master/Remote Terminal Units(MTU/RTU) to transmit commands, Programmable
Logic Controllers (PLC) [10] to execute these commands,
and a Data Historian for logging historical operational
data. While ICS variations cater to specific applications,
their primary role is to manage and integrate both
Information Technology (IT) and Operational
Technology (OT) aspects within the system.

Fig. 1. The dam scenario within the testbed, featuring sevenspillways, which are controlled by three PLCs

The water level within the dam is subject tofluctuation due to factors including the inflow fromupstream, rainfall, and the discharge of water
downstream. There are seven gates in total, the first two
representing the regular discharge which is controlled by
two PLCs; and the others will be the backup spillways
that only rise up by a same PLC simultaneously whenneeded.
The primary objective of the spillways is to regulate
the water level within the dam to accommodate a rangeof purposes, including agricultural and domestic watersupply. Conversely, any gate control behaviors that resultin either excessively high or low water levels areclassified as non-normal operations. Such deviations
from normal operations have the potential to lead toserious dam failures or an inability to meet water supply
demands.

2.2. SWaTThe iTrust SWaT (Secure Water Treatment) testbed
replicates a water treatment plant, serving as a researchfacility for cybersecurity in industrial control systems(ICS). It allows controlled experiments and vulnerability
assessments, aiding the development of security
solutions to protect critical infrastructure from cyberthreats and enhance ICS security.
Similar to SWaT, we need to record information likewater flow and gate status. However, our architectural
focus lies in simulating and recording dam gate controls,hence emphasizing the status and command messages ofthe gate.
3.

3.2. CPS framework
As depicted in Fig.2, the Human Machine Interface(HMI) maintains a constant query to the connected PLCs
for gateway status updates and possesses the capability
to transmit commands to the PLCs via Modbus TCP [11]packets. Furthermore, it communicates with the linked
SQL server to log the operational data.
The Arduino boards are used to serves as theprimary interface for on-site dam management. In actual
dam operations, workers commonly engage with thefacility's controls by physically pressing buttons on thecontrol panels, a practice necessitated by security
considerations. This design choice is motivated by theTestbed Architecture

The objective of our testbed is to is to mimic a real dam's
CPS in the data we collect, achieved by replicating aretired dam in Taiwan. We will delve into thearchitectural specifics in the following section, outlining
how this goal is accomplished.

107dam control system
experimentation.

potential occurrence of Man-in-the-Middle (MITM)
attacks [12] between the PLCs and HMI, posing a risk ofdelivering counterfeit data to the SQL server.
Additionally, we will separately capture and store thetransmitted packets within both the OT and IT networks
using Wireshark [13] hosts.
Inflow data for the dam is sourced from historical
records of a retired dam system. Gate control behavior
includes typical operations for positive samples andirregular events, such as incorrect gate control, creating
non-standard gate statuses as negative samples. Ourfuture plans involve adding more attack scenarios toenhance dataset diversity.

forfurtheranalysis

and5. Conclusions and Future Works
In our research, we have developed a comprehensive
CPS testbed that encompasses both OT and IT elements
within a dam environment. This testbed is closely alignedwith real dam infrastructures, utilizing components froma retired dam system.
Looking ahead, our plans include the collection of
the dataset for different types of operation, or evencomplete publication of the dataset. We are also
exploring the potential integration of additional physicalattack and cyberattack scenarios into the testbed.
Our primary focus is on elevating the testbed toenhance the security of critical infrastructure systems.

4. Testbed Implementation
To put the testbed architecture depicted in Fig.2 into
practice, we've assembled an array of components from aretired dam system. These include the Schneider
TWDLCAE40DRF PLCs [15], the HMI, and a Windows
10 PC serving as the database.

Acknowledgements
This work was supported by the National Science andTechnology Council (NSTC) in Taiwan, under contract
numbers 111-2218-E-006-010-MBK and 112-2634-F006-001-MBK, and the Water Resources Agency (WRA)
under the Ministry of Economic Affairs (MOEA) inTaiwan.
References
1. Lasi, H., Fettke, P., Kemper, HG. et al. “ Industry 4.0, ”
Business and Information Systems Engineering, Vol. 6, pp.
239-242, 2014.
2. E. A. Lee, “ CPS foundations,” Proceedings of the 47th
design automation conference, Anaheim, CA, USA, 13-18
Jun., 2010.
3. BBC NEWS, “Loas dam collapse: Many feared dead as
floods hit villages,” 2018. [Online]. Available:
https://www.bbc.com/news/world-asia-44935495.
[Accessed 7 Aug 2022]
4. GARY COHEN, “Throwback Attack: How the modest
Bowman Avenue Dam became the target of Iranian hackers,”
2021.
[Online].
Available:
https://www.industrialcybersecuritypulse.com/facilities/thr
owback-attack-how-the-modest-bowman-avenue-dambecame-the-target-of-iranian-hackers/. [Accessed 7 Aug
2022]
5. J. Goh, S. Adupu, M. Tan and Z. S. Lee, “ Anomaly
Detection in Cyber Physical Systems Using Recurrent
Neural Networks,” 2017 IEEE 18th International Symposium
on High Assurance Systems Engineering (HASE), Singapore,
12-14 Jan., 2017.
6. J. Inoue, Y. Yamagata, Y. Chen, C. M. Poskitt and J. Sun“Anomaly Detecion for a Water treatment System Using
Unsupervised Machine Learning”, 2017 IEEE International

Fig. 2. The testbed's CPS framework comprises both the IT andOT elements within the system

In addition, we've incorporated two extra Windows
10 PCs dedicated to the task of recording packets using
Wireshark. Furthermore, the network infrastructurefeatures the Cisco IE 4000 [16] for Switch 1 and the HP
1810-8G [17] for Switch 2.
To mimic the behavior of the dam gates, we've
integrated Arduino MEGA 2560 boards [18] to emulate
the DI/DO values associated with the gates, these values
will also be recorded. The Operate behaviors can be
executed by two paths: serial communication or PLC
digital outputs. Where serial communication emulates
on-site gate control, while the PLC digital output serves
as the remote control from the HMI.
This comprehensive setup enables us to accurately
replicate and record the interactions and operations of the108

Conference on Data Mining Workshops (ICDMW), New
Orlearns, LA, USA, 18-21 Nov., 2017.
7. K. Stouffer, S. Lightman, V. Pillitteri, M. Abrams and A.
Hahn, Guide to Industrial Control Systems (ICS) Security,
NIST Special Publication 800-82, R2, USA, 2014.
8. P. Papcun, E. Kajati and J. Koziorek “ Human MachineInterface in Concept of Industry 4.0, ” 2018 World
Symposium on Digital Intelligence for Systems andMachines (DISA), Slovakia, 23-25 Aug., 2018.
9. A. Daneels and W. Salter, “ WHAT IS SCADA? ” , 7thInternational Conference on Accelerator and Large
Experimental Physics Control System, Trieste, Italy, 4-8
Oct., 1999.
10. E. R. Alphonsus, M. O. Abdullah “ A review on theapplications of programmable logic controllers (PLCs), ”
Renewable and Sustainable Rnergy Reviews, Vol. 60, pp.
1185-1205, 2016.
11. Andy Swales, Open Modbus/TCP Specification, R1,Schneider Electric, France, 1999.
12. Avijit Mallik, “Man-in-the-middle-attack: Understanding in
simple words”, Cyberspace: Jurnal Pendidikan Teknologi
Informasi, Vol. 2, pp.109-134, 2018.
13. Gerald Combs, “Wireshark”, 1998. [Online]. Available:
https://www.wireshark.org. [Accessed 7 Aug 2022]
14. iTrust, “Secure Water Treatment (SWaT) Dataset” [Online].
Availabe: https://itrust.sutd.edu.sg/itrust-labs-home/itrustlabs_swat/. [Accessed 7 Aug 2022]
15. Schneider Electic, “TWDLCAE40DRF,” 2022. [Online].
Available:
https://www.se.com/ww/en/product/TWDLCAE40DRF/compact-plc-base-twido-100-240-v-ac-supply-24-i-24-v-dc16-o/. [Accessed 7 Aug 2022]
16. Cisco, “Industrial Ethernet 4000 Series Switches,” 2022.
[Online].
Available:
https://www.cisco.com/c/en/us/products/collateral/switches/industrial-ethernet-4000-series-switches/datasheet-c78733058.html. [Accessed 7 Aug 2022]
17. HPE, “HPE OfficeConnect 1810 Switch Series,” 2022.
[Online].
Available:
https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-c02500478
18. Arduino, “Arduino MEGA 2560 Rev3,” 2022. [Online].
Available: https://store.arduino.cc/products/arduino-mega2560-rev3. [Accessed 7 Aug 2022]

Authors Introduction
Mr. Meng-Wei Chang

He is a postgraduate of Cloud andNetwork Security (CANS) Lab,
Institute of Computer andCommunication
Engineering,
National Cheng Kung University
in Taiwan. He received his B.S.
degree from the Department ofPhysics, National Taiwan Normal
University, Taiwan in 2021. Hisinterests are Cyber-Security andICS Security.

Prof. Jung-Shain Li

He is a full Professor in theDepartmentofElectricalEngineering, National Cheng Kung
University, Taiwan. He graduatedfrom the National Taiwan University,Taiwan, with B.S. in 1990 and M.S.
degrees in 1992 in ElectricalEngineering. He obtained his PhD in1999 in Computer Science from theTechnical University of Berlin, Germany. He teaches
communication courses and his research interests include
wired and wireless network protocol design, network
security, and network management. He is the director ofTaiwan Information Security Center @ National ChengKung University.
Prof. I-Hsien Liu

He is an assistant professor inDepartmentofElectricalEngineering, National Cheng Kung
University, Taiwan. He obtained hisPh.D. in 2015 in Computer andCommunication Engineering from theNational Cheng Kung University. Hisinterests are Cyber-Security, Wireless
Network, Group Communication, and Reliable
Transmission. He is the deputy director of Taiwan
Information Security Center @ National Cheng Kung
University(TWISC@NCKU).

109