Identifying and Analyzing Implicit ... - ciri.illinois.educiri.illinois.edu/sites/default/files/2018.01.25_Jaskolka Slides... · InP.Höfner,P.Jipsen,W.Kahl,andM.E.Müller,editors,Proceedings

IntroductionAnalysis FrameworkConcluding Remarks

Identifying and Analyzing Implicit Interactions inCritical Infrastructure Systems

Jason JaskolkaCollaborator: John Villasenor (UCLA)

Department of Systems and Computer EngineeringCarleton University, Ottawa, ON, Canada

[email protected]

January 25, 2018

Jason Jaskolka CIRI Webinar Series 1 / 35


Acknowledgement & Disclaimer

AcknowledgementThis material is based upon work supported by the U.S. Department ofHomeland Security under Grant Award Number, 2015-ST-061-CIRC01.

DisclaimerThe views and conclusions contained in this document are those of theauthors and should not be interpreted as necessarily representing theofficial policies, either expressed or implied, of the U.S. Department ofHomeland Security.



Critical InfrastructureCybersecurity Challenges in Critical InfrastructureImplicit Component InteractionsResearch Problem

Critical Infrastructure




Cybersecurity Challenges in Critical Infrastructure

Ubiquitous and pervasive

Large, complex, and rapidly growing

Mix of legacy systems and new technologies

Numerous components or agents and even more interactions, someof which may be:

Unfamiliar, unplanned, or unexpectedNot visible or not immediately comprehensible

}Implicit

Interactions

Software/Hardware from third-party suppliers

Cyber-attackers are far more sophisticated and have access to farmore powerful tools than in the past




Implicit Interactions

Definition (Implicit Interaction)An interaction among system components that may be unfamiliar,unplanned, or unexpected, and either not visible or not immediatelycomprehensible by the system designers.

Can indicate unforeseen design flaws allowing for these interactions

Constitute linkages of which designers are generally unaware=⇒ security vulnerability

Can be exploited to mount cyber-attacks at a later timePotential for unexpected system behaviorsExample: Gain unauthorized access to information




Research Problem

Assuring safety, security, and reliability of critical infrastructuresystems is becoming a top priority

Shortcomings in development of formal methods and tools fordetermining whether such systems are protected fromcyber-threats [Bennett 2015]

Ability to detect undesirable interactions among system componentsis needed [Jackson and Ferris 2012]

Research ChallengeDevelop a rigorous (formal methods-based) approach to better

understand, identify, analyze, and mitigate implicit interactions incritical infrastructure systems.




Why Formal Methods?

According to the DHS Cybersecurity Research Roadmap [DHS 2009]

“Formal verification and other analytic tools that can scale willbe critical to building systems with significantly higher assur-ance than today’s systems.”

“In particular, theories are needed to support analytic toolsthat can facilitate the prediction of trustworthiness, inclusionmodeling, simulation, and formal methods.”

“The potential utility of formal methods has increased sig-nificantly in the past four decades and needs to be consideredwhenever it can be demonstrably effective.”



Modeling using C2KAFormulating and Identifying Implicit InteractionsAnalyzing Implicit InteractionsMitigating Implicit Interactions

Proposed Approach for Solving the Problem

Research GoalDevelop an analysis framework to enhance our understanding ofhow and why implicit interactions can exist and to identify systemdeficiencies in critical components to enable a better assessmentof risks being taken by using such components to build criticalinfrastructure systems.

1 Model critical infrastructure systems using a mathematicalframework

2 Formulate and identify the existence of implicit interactions

3 Analyze existing implicit interactions

4 Mitigate the existence of and/or minimize the threat posed byimplicit interactions




Illustrative Example: Manufacturing Cell









StorageAgent Handling

AgentProcessingAgent

Control/CoordinationAgent





Control Agent(C)

Handling Agent(H)

Processing Agent(P)

Storage Agent(S)

(2) load

(3) loaded(7) unloaded

(4) prepare(5) status

(6) unload

(8) setup(12) done

(9) state

(9) status

(10) ready(11) process

(9) material

(11) process

(12) processed

(1) start (13) end




Approach for Solving the Problem


Communicating Concurrent Kleene Algebra (C2KA)


Potential for Communication


Classifying and Measuring Severity and Exploitability


Preemptive and Reactive Solutions




An Algebraic Modeling FrameworkCommunicating Concurrent Kleene Algebra (C2KA)

Formalism for modeling distributed multi-agent systems

Captures communication and concurrency of agents at an abstractalgebraic level

Expresses influence of stimuli on agent behavior in open systems aswell as communication through shared environments

Three levels of specification1 Stimulus-Response Specification

2 Abstract Behavior Specification

3 Concrete Behavior Specification





Definition (C2KA)A Communicating Concurrent Kleene Algebra (C2KA) is a system

(S,K), where

S =(

S,⊕,�, d, n)is a stimulus structure

K =(

K ,+, ∗, ; , *©,;©, 0, 1

)is a CKA(

SK ,+)is a unitary and zero-preserving left S-semimodule with next behavior mapping

◦ : S × K → K(SK,⊕

)is a unitary and zero-preserving right K-semimodule with next stimulus mapping

λ : S × K → Sand where the following axioms are satisfied for all a, b, c ∈ K and s, t ∈ S:

1 s ◦ (a ; b) = (s ◦ a) ;(λ(s, a) ◦ b

)2 a ≤K c ∨ b = 1 ∨ (s ◦ a) ;

(λ(s, c) ◦ b

)= 0

3 λ(s � t, a) = λ(

s, (t ◦ a))� λ(t, a)

4 s = d ∨ s ◦ 1 = 15 a = 0 ∨ λ(n, a) = n




Agent SpecificationsIllustrative Example: Manufacturing Cell

Table: Stimulus-response specification of the Control Agent C

◦ start load loaded prepare done unload unloaded setup ready process processed endidle idle idle prep idle idle idle idle idle idle idle idle idleprep prep prep prep prep prep prep init prep prep prep prep prepinit init init init init init init init init init proc init initproc proc proc proc proc proc proc proc proc proc proc idle proc

λ start load loaded prepare done unload unloaded setup ready process processed endidle load n prepare n n n n n n n n nprep n n n n n n setup n n n n ninit n n n n n n n n n done n nproc n n n n n n n n n n end n

Control Agent C 7→⟨idle + prep + init + proc

⟩Storage Agent S 7→

⟨empty + full

⟩Handling Agent H 7→

⟨wait + move

⟩Processing Agent P 7→

⟨stby + set + work

⟩Figure: Abstract behavior specification of the manufacturing cell agents




Agent SpecificationsIllustrative Example: Manufacturing Cell

C 7→

idle def= state := 0prep def= state := 1init def= state := 2

proc def= state := 3

S 7→

{empty def= status := 0

full def= status := 1

H 7→

wait def= skipmove def= if (status = 1) −→

material := 1dc ¬(status = 1) −→

material := 0fi

P 7→

stby def= skipset def= if (material = 1 ∧ state = 2

∧ status = 0) −→ready := 1

dc ¬(material = 1 ∧ state = 2∧ status = 0) −→

ready := 0fi

work def= if (ready = 1) −→part := PROCESS()

dc ¬(ready = 1) −→part := null

fi

Figure: Concrete behavior specification of the manufacturing cell agents








Potential for Communication








Intended System Interactions

Control Agent(C)

Handling Agent(H)

Processing Agent(P)

Storage Agent(S)

(2) load

(3) loaded(7) unloaded

(4) prepare(5) status

(6) unload

(8) setup(12) done

(9) state

(9) status

(10) ready(11) process

(9) material

(11) process

(12) processed

(1) start (13) end

Pintended denotes the set of intended system interactionsJason Jaskolka CIRI Webinar Series 17 / 35



Illustrative Example: Manufacturing CellIntended System Interactions

C S C H S C P H

P

C P

C

Pintended ={

C→S S→S C→S H→S S→S C→S P→S H→S P→S C,C→S S→S C→S H→S S→S C→S P→S H→S C→S P,C→S S→E H→E P→S H→S C→S P,C→S S→E H→E P→S H→S P→S C,. . .

C→S S→S C→S H→S S→E P→S H→S C→S P,C→S S→S C→S H→S S→E P→S H→S P→S C,C→S S→S C→S H→S S→S C→E P→S H→S C→S P,C→S S→S C→S H→S S→S C→E P→S H→S P→S C

}Jason Jaskolka CIRI Webinar Series 18 / 35



Formulating Existence of Implicit Interactions

Potential for Communication via Stimuli (A→+S B)

A has the potential for communication via stimuli with B if and only if∃(n | n ≥ 1 : A→n

S B)

whereA→n

S B ⇐⇒ ∃(C | C ∈ A ∧ C 6= A ∧ C 6= B : A→(n−1)

S C ∧ C→S B)

A→S B ⇐⇒ ∃(

s, t | s, t ∈ Sb ∧ t ≤S λ(s, a) : t ◦ b 6= b)

Definition (Existence of Implicit Interactions)An implicit interaction exists in a system formed by a set A of agents, if andonly if for any two agents A,B ∈ A with A 6= B:

∃(p | p =⇒ (A + B) : ∀(q | q ∈ Pintended : ¬SubPath(p, q) )

)where SubPath(p, q) is a predicate indicating that p is a subpath of q.




Identifying Implicit Interactions

1 Determine the potential communication paths that exist from thesystem specification

Example: Consider the manufacturing cell:

$ pfc system agentP agentSP ~> S: True

P ->S H ->S C ->S SP ->S C ->S SP ->S C ->S H ->S SP ->S H ->S S

$ pfc system agentH agentCH ~> C: True

H ->S CH ->S S ->E P ->S CH ->E P ->S CH ->S P ->S CH ->S S ->S C

Control Agent(C)

Handling Agent(H)

Processing Agent(P)

Storage Agent(S)




Identifying Implicit Interactions

2 Determine if a potential communication path is an implicitinteraction

Example: Consider the following potential communication paths:H→S S→S C and P→S C→S S

C S C H S C P H

P

C P

C




Identifying Implicit InteractionsControl Agent

(C)

Handling Agent(H)

Processing Agent(P)

Storage Agent(S)

C S C H S C P H

P

C P

C







2 Formulate and identify the existence of implicit interactionsPotential for Communication








Analyzing Implicit Interactions

Provide a means for determining the interactions that have thepotential to most negatively impact the system

Severity: a measure of the relative non-overlap between a possibleinteraction with the intended interactions of a system

less overlap =⇒ higher severity =⇒ more unexpected

Exploitability: a measure of the fraction of ways that a sourceagent can influence the behavior of its adjacent agents to eventuallyinfluence the behavior of the sink agent

higher exploitability =⇒ more ways to influence behaviors




Sample Tool OutputIdentification & Severity

------------------------ALL PATHS: S ~> C------------------------SEVERITY = 0.00 S ->E P ->S H ->S CSEVERITY = 0.50 S ->E H ->S CSEVERITY = 0.50 S ->E P ->S CSEVERITY = 0.33 S ->E H ->E P ->S CSEVERITY = 0.33 S ->E H ->S P ->S CSEVERITY = 0.00 S ->S C

------------------------IMPLICIT PATHS: S ~> C------------------------S ->E H ->S CS ->E P ->S CS ->E H ->E P ->S CS ->E H ->S P ->S C

------------------------ALL PATHS: P ~> S------------------------SEVERITY = 0.33 P ->S H ->S C ->S SSEVERITY = 0.50 P ->S C ->S SSEVERITY = 0.33 P ->S C ->S H ->S SSEVERITY = 0.50 P ->S H ->S S

------------------------IMPLICIT PATHS: P ~> S------------------------P ->S H ->S C ->S SP ->S C ->S SP ->S C ->S H ->S SP ->S H ->S S

Attack Scenarios & ExploitabilityIMPLICIT PATH = S ->E H ->S CATTACK SCENARIOS = {status}EXPLOITABILITY = 1.00

IMPLICIT PATH = S ->E P ->S CATTACK SCENARIOS = {material, state, status}EXPLOITABILITY = 0.75

IMPLICIT PATH = S ->E H ->E P ->S CATTACK SCENARIOS = {status}EXPLOITABILITY = 0.75

IMPLICIT PATH = S ->E H ->S P ->S CATTACK SCENARIOS = {status}EXPLOITABILITY = 0.25

.

.

.

IMPLICIT PATH = P ->S C ->S SATTACK SCENARIOS = {start}EXPLOITABILITY = 0.20

IMPLICIT PATH = H ->E P ->S C ->S SATTACK SCENARIOS = {}EXPLOITABILITY = 0.00




Experimental Results

For the manufacturing cell system:29 of the 65 total interactions are identified as implicit interactions

Result of the potential for out-of-sequence messages or reads/writesfrom system agents

Due to cyber-attack or failure

Demonstrates hidden complexity and coupling among agentsPotential for unexpected system behaviors

Although the example is presented in the context of manufacturing,the analogous communication and dependencies are found in nearlyall complex distributed systems







2 Formulate and identify the existence of implicit interactionsPotential for Communication

3 Analyze existing implicit interactionsClassifying and Measuring Severity and Exploitability






A Comment on Mitigating Implicit Interactions

1 Preemptive ApproachesEliminate potential for communication while maintaining overallsystem functionality

Introduce intermediate agents or modify agent behaviors

2 Reactive ApproachesMonitor communication and behavior to find suspicious activity



Impact & Future Research DirectionsConcluding RemarksRelated Publications and ReferencesQuestions

Impact of this Research

Enhances the understanding of the hidden complexity and couplingin critical infrastructure systems

Formal foundation upon which mitigation approaches can bedeveloped

Basis for developing guidelines for designing and implementingcritical infrastructure systems that are resilient to cyber-threats

There is still more to be done!




Where Do We Go From Here?

Refinements to classification and measurement of severity andexploitability

Study impact of implicit interactions through simulation

Further articulate mitigation approaches

Validate and evaluate our approaches in real-world applicationsWorking with USTRANSCOM on analyzing a case study systemObtain useful direction and feedback for transitioning ourfoundational research into practical outcomes from the project

Develop software tools to automate the specification, identification,and analysis of critical infrastructure systems based on ourmathematical foundations




Concluding Remarks

Implicit interactions can pose a serious cyber-threat to criticalinfrastructure systems

Aids in addressing potential security vulnerabilities at early stages ofsystem development

Provides vital information that can drive decisions on where and howto spend valuable resources in mitigation efforts

Community engagement can enable contributions to emergingchallenges in critical infrastructure cybersecurity




Related Publications and References

J. Jaskolka and J. Villasenor.An Algebraic Approach for Simulating and Analyzing Distributed Systems.ACM Transactions on Modeling and Computer Simulation, (Under Review).

J. Jaskolka and J. Villasenor.Evaluating the Exploitability of Implicit Interactions in Distributed Cyber-Physical Systems.ACM Transactions on Cyber-Physical Systems, (Under Review).

J. Jaskolka and J. Villasenor.An Approach for Identifying and Analyzing Implicit Interactions in Distributed Systems.IEEE Transactions on Reliability, 66(2):529-546, June 2017.

J. Jaskolka and J. Villasenor.Identifying Implicit Component Interactions in Distributed Cyber-Physical Systems.Proceedings of HICSS-50, 5988–5997, January 2017.

J. Jaskolka.On the Modelling, Analysis, and Mitigation of Distributed Covert Channels.Ph.D. Thesis, McMaster University, March 2015.




Related Publications and ReferencesJ. Jaskolka and R. Khedri.A Formulation of the Potential for Communication Condition using C2KA.In A. Peron and C. Piazza, editors, Proceedings of GandALF 2014, volume 161 of ElectronicProceedings in Theoretical Computer Science, 161–174. September 2014.

J. Jaskolka, R. Khedri, and Q. Zhang.Endowing Concurrent Kleene Algebra with Communication Actions.In P. Höfner, P. Jipsen, W. Kahl, and M. E. Müller, editors, Proceedings of RAMiCS 2014,volume 8428 of Lecture Notes in Computer Science, 19–36. April 2014.

C. Bennett.Feds Lack Method to Grade Critical Infrastructure Cybersecurity.The Hill (Online), November 2015.

S. Jackson and T. L. J. Ferris.Infrastructure Resilience: Past, Present, and Future.The CIP Report, 11(6):6–13, December 2012.

U.S.A. Department of Homeland Security.A Roadmap for Cybersecurity Research.Department of Homeland Security Science and Technology Directorate, November 2009.




Questions?




Thank You


Documents

Identifying and Analyzing Implicit ... - ciri.illinois.educiri.illinois.edu/sites/default/files/2018.01.25_Jaskolka Slides... · InP.Höfner,P.Jipsen,W.Kahl,andM.E.Müller,editors,Proceedings