Alexandre Barreto ITA/GMU. Paulo C.G. Costa GMU. Edgar Yano ITA

Transcription

1 Alexandre Barreto ITA/GMU Paulo C.G. Costa GMU Edgar Yano ITA 1

2 failure in electric power system

3 The New World Increasing automa on of processes and systems that are part of cri cal infrastructures. Society is increasingly dependent on technology [1]. Cyber domain as the new dimension of war, together with air, land and sea. Need to understand how ac ons performed in the cyber domain (space and me) affect the opera ons taking place in other domains [2], [3].

4 Agenda Research s Ques on Cyber- Argus Framework Study Case Campos Basin Final Remarks

5 Agenda Research s Ques on Cyber- Argus Framework Study Case Campos Basin Final Remarks

6 Research Question To understand how ac ons performed in the cyber domain (space and me) affect the opera ons (in other domains), its necessary to correlate cyber and physical behaviors in an integrated view that allows tasks to be evaluated in real me.

7 Agenda Research s Ques on Cyber- Argus Framework Study Case Campos Basin Final Remarks

8 Cyber- Argus Framework Model Mission Model Infrastructure Knowledge Base The Cyber-ARGUS Framework Links Mission Information to Network Information to Assess Cyber Impacts. Develop Cyber Impact Evalua on Collect Cyber and Mission SA

9 Model Mission (1/2) Mission: The task, together with the purpose, that clearly indicates the ac on to be taken and the reason therefore. In common usage, especially when applied to lower military units, a duty assigned to an individual or unit (DoD, 2010).

10 Model Mission (2/2)

11 Why BPMN/OWL to describe Mission? Describe the task; Describe the pre and post condi ons; Describe the resources envolved (services); Describe restric on (temporal and func onal using gateways); Describe events (temporal, func onal, etc.); and Describe who performes the task.

12 Mapping BPMN <- > Mission Concept Model Concept Source Mission Model BPMN Organiza on Pool System Lane Ac vity Task Service Performer Condi on Gateway or Event BPMN and OWL

13 What can t be easily described in BPMN/OWL? Service Level Agreement; Goals; Measures; Other restric ons; and Restric on in run me.

14 Model Infrastructure Uses basic informa on provided by the Mission Model (name of service, cyber asset, etc) to enable Cyber- ARGUS to build the network architecture (rou ng and neighbor table - SNMP).

15 Model Infrastructure

16 Building Knowledge Base Performer Concept Model the mission (resources, tasks and some condi ons) Model Infrastructure (nodes, services, ports) Knowledge Base Convert Ontology to graph representa on Ontology Representa on Graph Representa on

17 Collect Cyber and Mission SA Tasks Iden fy what is relevant to SA; Classify incoming data and and Infer new informa on; and Update KB.

18 Develop Impact Evaluation History Degrada on Analysis Cost analysis Temporal analysis Dependence paths analysis

19 Develop Impact Evaluation Temporal analysis v What s task do I need to monitor? (relevant tasks) v How much me do I need to finish the task and accomplish the goal? A B C E G D F slot- me me

20 Develop Impact Evaluation Dependence paths analysis v In this state, can I reach the goal? v If task C fails, do I have alternate path to reach the goal? A B C E G D F slot- me me

21 Develop Impact Evaluation Cost analysis v Can I do the task within the planed cost? v If task C is compromised, does the alterna ve route have an acceptable cost? A B C E G D F slot- me me

22 Develop Impact Evaluation History Degrada on Analysis Cost analysis v How fast my network is degrading? A B C E G D F t0=10 un t1=15un t2=25 un t3=45 un slot- me Δd=23.45 un/t me

23 C2 Collaborative Research Testbed The C2 Collabora ve Research Testbed is a set of Commercial Off- the- Shelf (COTS) tools that provides a realis c and complex simula on environment to conduct C2 research experiments.

24 Agenda Research s Ques on Cyber- Argus Framework Study Case Campos Basin Final Remarks

25 Campos Basin Scenario The scenario models Air Traffic Control opera ons in the Campos Basin. The Campos Basin is a petroleum rich area located in the Rio de Janeiro state, and is responsible for 80% of Brazil's petroleum produc on (1 million 265 thousand barrels). Oil development opera ons include heavy helicopter traffic between the con nent and oceanic fields during day me, with an average of 50 minutes per flight. Legend Airfield Oil Field

26 Campos Basin Scenario Use of ADS- B Technology Legend Radar Coverage ADS- B Coverage

27 Cyber- Argus Campos Basin Study Case The goal is to simulate the effect of multiple cyberattacks on the Campos Basin operation, and to understand the impact these attacks might have on the security and safety of air transportation operations.

28 Retrieve information from BPMN File (1/2) Time restric ons Performers Resource restric ons

29 Retrieve information from BPMN File (2/2)

30 [node 1, node 2,..., node x ] What are the Services: FTP, SMTP, MYSQL performers? neighbors: node 2,node 3, node 4 Knowledge Base Cyber- Argus Mission Manager node 1 [...] Give me your neighbors and services! Give me your neighbors and services! Mission and Infrastructure Model node 2 node 3 node 4

31 Using Rules to update Mission Model Goal01 - > Aircra (?x) ^ flighttime(?x,?y) ^ swrlb:lessthanorequal(?y,30) Sla03 - > Asset(?x) ^ hasmemory (?x,?y) ^ memoryfree(?y,?k) ^ swrlb:less(?k,100)

32 Knowledge Base Update Ontology Representa on Classify, Inference & Search Graph Representa on Relevant Informa on Cyber- Argus Event Manager Network Monitoring Tools SNMP Tools Other Log Systems Security Tools Applica ons Logs

33 Visualization 33 Tac cal Visualiza on 3D Visualiza on ATC Visualiza on Network Visualiza on

34 Agenda Research s Ques on Cyber- Argus Framework Study Case Campos Basin Final Remarks

35 Final Remarks This paper presented an approach for connec ng the cyber and physical domains, with the objec ve of assessing the impact that ac ons in the former have in the la er. This is research in progress in an area where clear answers are usually not a ainable, mostly due to the complexity as well as to the level of subjec vity involved in real me impact assessment. It is a firm step, since a er a emp ng various approaches we remain convinced that the solu on to this problem relies in a combina on of techniques where seman c technologies and simula on play a major role.

36 Questions? IV Integrated Center of Air Defense and Air Traffic Control (CINDACTA IV) Manaus AM Brazil 36

37 Alexandre Barreto ITA/GMU Paulo C.G. Costa GMU Edgar Yano ITA 37

38

39 Cyber- Argus Reference Implementation Argus Editor Applica ons Logs Mission Map IT Map Event Manager Mission Manager Impact Assessment Network Monitoring Tools Security Tools Graph Lib Owl Lib Support Tools: OWL API Pellet JGraphT & Jgraph SNMP4Ant SNMP Tools