Modelling the impact of cyber attacks on the traffic control centre of an urban automobile transport system by means of enhanced cybersecurity

Transcription

1 Modelling the impact of cyber attack on the traffic control centre of an urban automobile tranport ytem by mean of enhanced cyberecurity Yoana Ivanova 1,* 1 Bulgarian Academy of Science, Intitute of ICT, Information Technologie for Security Department, 1 Sofia, Bulgaria Abtract. Thi paper aim to how the major role mean of protection play for trengthening the cyberecurity of critical tranport infratructure by uing the advanced method of imulation modelling. The imulation model of a Traffic Control Centre (TTC) of an urban Automobile Tranport Sytem (ATS) i created by the author in the iverbed Modeler Academic Edition 17.5 computer network imulation ytem and i expoed to the impact of a Denial-of-Service attack. In addition, logical concluion have been made on the bai of the experimental reult obtained and evaluated by comparative analyi with reult from analogou previou tudie. 1 Introduction The focu of the preent reearch i on the meaure of trengthening and maintaining a ecure, operational and utainable critical tranport infratructure and in particular an urban Automobile Tranport Sytem (ATS) by building a reliable cyber protection of it Traffic Control Centre (TCC). For thi purpoe, the author ha tudied and analyzed variou advanced imulation environment baed on agent-baed modelling uch a NetLogo [1], Aimun 8., Cico Packet Tracer and iverbed Modeler. The capabilitie of iverbed Modeler Academic Edition 17.5 for modelling of computer network by uing a rich palette of realitic network device and component, which could be preciely configured, make it the preferable oftware for aeing the impact of a Denialof-Service attack on the TCC. It i logical that the choice of an impenetrable protection i preceded by a detection of the vulnerabilitie in a ytem. An example of an adaptive conceptual architecture for critical infratructure cyberecurity i hown in Fig. 1. A it can be een, the Topological Vulnerability Analyi (TVA) and the trategie for reducing the vulnerability are carried out at the prevention tage of the overall management, monitoring and analyi proce, while the reinforcement of ecurity by technical mean i recommended to be done at the lat tage. The advantage of complex ytem modelling by uing profeional imulation oftware are defined on the bai of a comparion with the other publicly known method of penetration tet for aeing the vulnerability of the critical infratructure againt cyber attack. Fig. 1. Adaptive conceptual architecture for critical infratructure cyberecurity. 2 Advantage of imulation modelling for aeing the vulnerability of critical infratructure to cyber attack Simulation modelling i the main tool of TVA that i expreed in monitoring the tate of network aet and maintaining model of network vulnerabilitie and reidual rik. It combine thee to produce model that how the impact of individual and combined vulnerabilitie on overall ecurity poture [2]. In iverbed Modeler Academic Edition 17.5 there i a poibility for pecifying the etting of the DoS-attack profile and the vulnerability called probability of * Correponding author: y.ivanova@ba.bg The Author, publihed by EDP Science. Thi i an open acce article ditributed under the term of the Creative Common Attribution Licene 4. (

2 infection in percentage, a it can be een from the creenhot hown in Fig. 2. The tudy could begin with abence of vulnerability (None) and continue to et the maximum vulnerability of 1 %. the method of imulation modelling the phae become fewer a there i no direct and continuou communication with the client who ha commiioned the penetration teting. Thi can be conidered a another advantage of imulation modelling, becaue the client i not contantly involved in the proce of performing a penetration tet, but get a finihed end product. Additionally, penetration teting i uually conducted on ite at the intitution or organization that ha commiioned it and thi caue a diruption of it normal functioning during thi proce. 3 Mean of protection againt cyber attack baed on the potential vulnerabilitie Fig. 2. Sytem vulnerability etting related to a DoS-attack. Penetration tet are ued to verify ecurity and, in particular to detect vulnerabilitie in ecurity ytem by attacking them in the ame way a a potential hacker would. One of the main difference between the two method i that penetration tet mut be implemented in "virtual machine" with vulnerable application in order to afely tet different technique that target a ytem breakthrough, uing publicly available tool [3]. Thi can be conidered a an advantage of imulation modelling a compared to penetration tet, becaue the direct intallation of imulation oftware on a peronal computer doe not poe a threat of infection. Indeed, both method in their eence are intended to detect vulnerabilitie in the ytem but differ in the purpoe of taking thi action. In imulation modelling vulnerability aement precede imulation execution, while in penetration tet the attacker wate time looking for weak point in the ytem. Practically, every complex ytem of great importance uch a a TCC i protected in ome way and it take the attacker a relatively long time to overcome thee mean of protection. In thi cae, the advantage of imulation modelling i the poibility for the impact of a cyber attack to be een intantly by relevant etting for ignoring the protection. Actually, the full proce of penetration teting i executed in even ucceive phae a follow: Preengagement, Information gathering, Threat modelling, Vulnerability analyi, Exploitation, Pot exploitation, eporting [3]. An analogou equence of five phae in modelling a DoS-attack on a TCC in iverbed Modeler Academic Edition 17.5 can be preented a a comparion: Gathering information about the DoS-attack, Attack modelling, Vulnerability aement, Simulation execution, Summary evaluation of the reult. By uing The firt tep in defining an optimal protection trategy i to determine preciely the vulnerability of the pecific management ytem which could be related to lape in: network configuration not uing flow management method; unencrypted paword; bad device configuration in term of ecurity. network hardware unafe phyical port and unreliable phyical protection. mean of protection miconfigured firewall, undefined network ecurity perimeter. oftware buffer overflow, DoS-attack, lack of Intruion Detection Sytem (IDS), failure to maintain Log and monitor them in real time. hardware inufficient teting, unreliable phyical protection, unauthorized acce, inecure remote acce, Electromagnetic Interference (EMI). communication ytem unuitable Log of firewall and router, lack of monitoring, authentication and verification of data integrity. ecurity policie and procedure [4]. On the bai of the claified main vulnerabilitie the author recommend the following mean for overall improvement of cyberecurity: antiviru oftware contant update of the oftware i required to prevent penetration into the ytem. router thi autonomou device working with IP addree can be defined a a mart device compared to the witch, becaue except for ditributing the traffic it i alo able to reduce the vulnerability of the ytem to cyber threat from Internet. Virtual Private Network (VPN) they enure remote acce, preerving the high quality and integrity of the output information. For example, IP VPN i a ervice deigned to meet the need of corporate buine, where high quality, ecurity and rich capabilitie for integrated data, voice, video and multimedia tranmiion hould be guaranteed. Firewall thi i an advanced approach to cyberecurity that i implemented a a trong authentication intead of tatic paword through oftware and hardware complexe, router, and other ecurity meaure. The interpretation of rule i implemented conitently by filter that allow for or prohibit the tranmiion of data (packet) to the next filter or protocol level. Honeypot and Honeynet honeypot repreent fake computer ytem, etup a a "decoy", that are ued to 2

3 collect data on intruder. Thi "decoy" appear to contain operating ytem vulnerabilitie that make it an attractive target for hacker. While it appear vulnerable to attack, it actually prevent acce to valuable data, adminitrative control and other computer. Adminitrator can collect data on the identity, acce, and compromie method ued by the intruder. Honeynet are network, where all inbound and outbound data i analyzed and collected [5]. Unified Threat Management (UTM) complex olution for cyber threat protection including all neceary module. 4 Modelling the impact of a DoS-attack on the Traffic Control Centre of an urban Automobile Tranport Sytem through a firewall inertion Being a profeional imulation oftware iverbed Modeler i widely ued in ecurity and defene for modelling all network type and technologie (VoIP, TCP, OSPFv3, MPLS, IPv6) and analying network. It i uitable for teting and demontrating technology deign before production; increaing network &D productivity; developing proprietary wirele protocol and technologie; and evaluating enhancement to tandardbaed protocol [6]. For a comparion NetLogo i an open ource multiagent programmable modelling environment with a wide range of application in different area that make it very ueful for tudent. But it i not pecialized in computer network modelling and analyi like iverbed Modeler and Cico Packet Tracer. The imilarity between iverbed Modeler and Cico Packet Tracer i the poibility to imulate the complete network by connecting real type network device and component. The main advantage of iverbed Modeler compared to Cico Packet Tracer i the poibility for directly imulating the impact of cyberattack on different computer network. For thi reaon the author ha preferred iverbed Modeler Academic Edition 17.5 to make the part of thi reearch related to modelling the TCC and a cyberattack on it. The reearch can be continued uing the profeional traffic modelling oftware Aimun 8. after a logical aumption that the erver or ervice top reponding to client requet a a reult of the imulated DoS-attack and thi affect the Traffic Signal Control Sytem. In thi paper the focu i on trengthening the protection through a firewall inertion in order to reduce the probability of infection and repectively traffic change under the impact of a DoS-atack to be prevented. Diturbance in normal ignalling of traffic light are oberved after the erver ha topped working due to the communication between the erver and the ignal controller of the traffic light [7]. Uing reliable protection in TCC hould help to upport the normal traffic flow without increaing time delay and mean queue oberved under the impact of ucceful cyberattack. The reearch of Prof. J. Alex Halderman from the Univerity of Michigan in the field of computer ecurity can be ued in upport of the claim about the coure and conequence of cyberattack on an urban ATS. In thi tudy, the team led by Prof. Halderman conclude that the vulnerabilitie they dicovered in the infratructure are not a fault of any one device or deign choice, but rather how a ytemic lack of ecurity concioune, which i expreed in: unencrypted radio ignal; ue uername and paword by default; a debug port that i eay to be attacked; uing an older verion of the intalled oftware [8]. The author reference model (M ef ) of TCC ha a typical network configuration including 3 worktation, 3 erver and a witch connected in a linear bu network. It ha been developed in iverbed Modeler Academic Edition 17.5 uing built-in protection imulated by pecific etting. The model i ubjected to the impact of a DoS-attack that caue uch an intenive traffic (flooding) that the proceing of the requet i impeded [9]. The author ha choen to work with a firewall type ethernet2_lip8_firewall_adv, which i a pecially programmed router. A creenhot of the model i hown in Fig. 3. Fig. 3. The model of TCC with a firewall inertion under the impact of a DoS-attack. The duration of thi imulation i 3 and i divided into ix equal interval of 5. Table 1 contain imulation reult from 1 cenario. In the current reearch, the method ued for verification of the model i baed on the reaction time that repreent а time interval between the beginning of an action and beginning of the correponding repone. The reearch i made for 1 conecutive cenario. Thi method ha been preferred by the author, becaue it demontrate one of the great advantage of imulation modelling. It provide an opportunity the reearch to be done entirely in a virtual environment in order to ave financial reource for realization in a phyical environment uing a hardware prototype. Therefore, the imulation reult can be accepted a ufficiently reliable and at thi tage it i not required to be compared with reult of other analogou tudie. The comparative diagram in Figure 4, 5 and 6 how in which econd of running the imulation are regitered peak level of T S and T, repectively with built-in protection and a firewall. The dark blue chart how T without a firewall, while the red one how T with a firewall. The green chart how T S without a firewall, while the light blue one how T S with a firewall. 3

4 , T Table 1. Peak level of traffic ent (TS, max) and traffic received (T, max), depending on the inter arrival time (T) for the model under the impact of a DoS-attack repectively without and with a firewall ,7 6,7 3, ,7 6,7 3,4,5 1 13,5 13,5 3,4,25 16,5 13,5 13,5 6,7,2 16,8 13,5 2 1, ,5 16,4 6,4,1 33, , , ,5 34,5, Fig. 4. ТS = f (T) and T = f (T) at Т = 2., Fig. 5. ТS = f (T) and T = f (T) at Т =,2., , Fig. 6. ТS = f (T) and T = f (T) at Т =,2.,, Table 2, 3 and 4 contain the ummary reult of all three chart and how in which time interval in econd are regitered peak level of T S and T a function of the elected three value of the inter arrival time T, repectively without and with a firewall. Table 2. Peak level of traffic ent (TS, max) and traffic received (T, max) at T = 2. [1; 5] 3,3 3,4 [5; 1] 3,3 3,3 6,7 [1; 15] 3,3 6,7 3,4 [15; 2] 6,7 3,3 6,7 3,4 [2; 25] 1 6,7 3,4 [25; 3] 6,7 3,3 Table 3. Peak level of traffic ent (TS, max) and traffic received (T, max) at T =,2. [1; 5] 3 3 3,4 [5; 1] 13,5 6,7 13,4 3,4 [1; 15] 13, [15; 2] 13,5 13,5 13,4 6,7 [2; 25] 13,5 6,7 2 3,4 [25; 3] 16,7 1 13,4 3,4 Table 4. Peak level of traffic ent (TS, max) and traffic received (T, max) at T =,2. [1; 5] [5; 1] [1; 15] [15; 2] [2; 25] [25; 3] Summary evaluation On the bai of the tabular and graphical reult the author ha come to the following concluion. When a firewall i ued the number of ent packet T S, max i generally lower than the number of packet ent when built-in protection by vulnerability etting are ued. Before the time interval [25; 3], when the number of ent packet i le than 8, a better filtration of the packet ent i oberved due to the firewall inertion a compared with the cae of uing only built-in device protection. In the lat time interval, when the number of ent packet exceed 8, there i a aturation which may be due to a limitation of the ued type of a firewall. 4

5 It i alo neceary to etablih whether the packet themelve repreent a threat or not. In cae that certain packet threaten the ytem i neceary to improve the elected firewall model by replacing it with another model, or by integrating it with other mean of protection. In addition, when a firewall i ued the cae of flooding are reduced to only one in the lat time interval from all ten cenario, while without the inerted mean of enhanced protection the flooding tart in the time interval [2; 25] and it deepen in the lat time interval [25; 3]. Thi mean that a ytem denial can be oberved in at leat two of all 1 cenario. If thi hould be preented with the probability of an advere event, then when a firewall i ued, thi probability i equal to 1 %, but it i at leat twice a much if there i not a firewall inertion. ecommendation to enhance the protection ued One of the reliable olution for analyzing the received packet are Intruion Detection Sytem (IDS), which evaluate each packet and ae whether it i a hazard or not. If a packet i defined a a ource of a cyber threat, the ytem decide whether to ignore it completely, log it to be analyzed by the adminitrator or immediately alert that uch a packet ha infiltrated the network. The IDS can be placed in different location in the network, a well a in the firewall itelf. The advantage of placing it in the firewall i that many of the upiciou packet will be blocked at the entrance and potential cyber threat will be prevented. Beide, IDS control the firewall. An IP addre of the network controller that monitor the traffic hould not be et when configuring IDS to prevent a potential attacker from detecting the device. The aim i for the IDS enor to be protected from network can and attack that it i trying to find. In thi cae the diadvantage i that the removal of the IP addre caue problem for adminitrator to manage the proce. The olution i to ue two network interface, one of which i configured without IP and work a a enor, and the other one i connected to a eparate local area network that collect information and manage IDS device [1]. meaurement in a phyical environment. In the preent cae, uch tudy i not intended becaue the aim i to emphaize the advantage of imulation modelling itelf. eference 1. Y. Ivanova, Military Journal, Sofia, 4, (215). 2. S. Jajodia, S. Noel, B. O Berry, Managing Cyber Threat: Iue, Approache and Challenge, Kluwer Academic Publiher, (25). 3. G. Weidman, No Starch Pre Inc., San Francico, 2-6 (214). 4. E. Stoilov, Department of Informatic at NBU, Sofia, (21). 5. SANS Intitute. Honey Pot and Honey Net - Security through Deception, 1-5 (23). 6. iverbed Technology, iverbed Modeler: A Suite of Protocol and Technologie with a Sophiticated Development Environment, San Francico (217). 7. Y. Ivanova, IJITS, iue 3, vol. 9, (217). 8. Y. Ivanova, IJITS, iue 2, vol. 9, (217). 9. B. Ghena, W. Beyer, A. Hillaker, J. Pevarnek. & A. J. Halderman, Green Light Forever: Analyzing the Security of Traffic Infratructure, Proceeding of the 8th USENIX Workhop on Offenive Technologie (WOOT 14) (214). 1. E. Stoilov, Department of Informatic at NBU, Sofia, (211). 5 Concluion Thi reearch i an example of applying imulation modelling for olving problem related to cyberecurity of critical tranport infratructure. There are poibilitie for the tudy to be extended in order to improve the method and mean of protection uing the imulation reult. It ha been demontrated that the negative impact of a cyber attack on the TCC can be reduced by uing appropriate protection, but the wide variety of exiting cyber threat require that the mean of protection are contantly teted, updated and improved. The demontrated method prove that the ue of a imulation environment i a very effective way to achieve that aim. One of the direction in which the reearch can be expanded i an additional verification baed on the margin of error by comparing the imulation reult with 5