Whitelisting Cyber Attack Detection according to Estimated Operational States for CPS These days, cyber attacks against cyberphysical systems (CPS) such as power plants are constantly growing, and therefore the countermeasures are essential. Whitelisting cyber attack detection, that detects anomalous activity as deviation from normal network communication, is especially attracting attention as one of the countermeasures because the traffic patterns are predictable in CPS. However, attackers can execute illegal operations within the normal network communication defined as the whitelisting detection rules because such operations tend to cause unstable control depending on operational states. In this work, we propose a new whitelisting cyber attack detection method that estimates the operational state of CPS and monitors the CPS network with the whitelisting detection rules according to the estimated state. The proposed method can define the more limited normal network communication to generate the whitelisting detection rules in each operational state. We experimented and evaluated the method on a plant simulator, and confirmed the effectiveness of the method: state estimation with support vector machine and attack detection with divided whitelisting detection rules.

Stealthy Rootkits in Smart Grid Controllers This paper presents a stealthy and persistent attack on a CyberPhysical System (CPS), namely the smart grid and a multilayer approach to detect such an attack. The attack on the CPS controller uses a rootkitbased malware. When activated, the rootkit overwrites operator commands to the smart grid relays while evading detection by the operator control station. The rootkit sends valid replies to the operator while corrupting the controller operation through a dynamically loaded library, which is hidden by the rootkit. The attack persists even when the controller stops and restarts since the rootkit automatically restarts the process with the malicious library by using a background daemon, which the rootkit hides from userspace tools. Using a highfidelity simulation of the smart grid CPS, we show that the attack drastically impacts the CPS, especially when the adversary strategically chooses the target relays to attack. We design an ensemble of detectors to detect the attack and uncover its persistence and insertion mechanisms. The detector uses measures such as hardware performance counters (HPCs), change detection in binary signatures, change detection in system calls, and detection of hidden processes and file system entries.