����Ӱ��

Applications in the cyber-physical systems (CPS) domain are increasingly interconnected for efficiency, better monitoring, and improved functionality. Traditionally, such systems were immune to software security attacks, but the increased interconnectivity is opening up new attack surfaces. Recent events, such as the Stuxnet attack, have shown the serious damage that can result. Attacks can be particularly destructive for systems that have safety-critical constraints with real-time properties. In this talk, I will present methods that we have developed at UIUC to detect intrusions in such systems and ensuring that the physical system remains safe. Essentially, the inherent properties of real-time systems (the timing constraints, the predictable-by-design nature, etc.) can be repurposed to detect security violations/intrusions. We (a) analyze the behavior of real-time control tasks and (b) implement an intrusion detection scheme based on this behavior. By combining results from both of those efforts with an architectural design (which we call “SecureCore”), we are able not just to detect intrusions as soon as they occur, but also to keep the underlying physical system safe. I will present the analysis of various behavioral profiles such as timing, operating system behavior, memory traffic and control flow and show how these properties can be combined with the SecureCore architecture to detect intrusions in real-time systems.