{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,14]],"date-time":"2024-07-14T01:40:05Z","timestamp":1720921205542},"reference-count":45,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2021,6,9]],"date-time":"2021-06-09T00:00:00Z","timestamp":1623196800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["740610"],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"Water CIs are exposed to a wide number of IT challenges that go from the cooperation and alignment between physical and cyber security teams to the proliferation of new vulnerabilities and complex cyber-attacks with potential disastrous consequences. Although novel and powerful solutions are proposed in the literature, most of them lack appropriate mechanisms to detect cyber and physical attacks in real time. We propose a Cross-Layer Analytic Platform (denoted as CLAP) developed for the correlation of Cyber and Physical security events affecting water CIs. CLAP aims to improve the detection of complex attack scenarios in real time based on the correlation of cyber and physical security events. The platform assigns appropriate severity values to each correlated alarm that will guide security analysts in the decision-making process of prioritizing mitigation actions. A series of passive and active attack scenarios against the target infrastructure are presented at the end of the paper to show the mechanisms used for the detection and correlation of cyber\u2013physical security events. Results show promising benefits in the improvement of response accuracy, false rates reduction and real-time detection of complex attacks based on cross-correlation rules.<\/jats:p>","DOI":"10.3390\/jcp1020020","type":"journal-article","created":{"date-parts":[[2021,6,9]],"date-time":"2021-06-09T08:22:22Z","timestamp":1623226942000},"page":"365-386","source":"Crossref","is-referenced-by-count":1,"title":["CLAP: A Cross-Layer Analytic Platform for the Correlation of Cyber and Physical Security Events Affecting Water Critical Infrastructures"],"prefix":"10.3390","volume":"1","author":[{"given":"Gustavo","family":"Gonzalez-Granadillo","sequence":"first","affiliation":[{"name":"Atos Research & Innovation, Cybersecurity Unit, 28037 Madrid, Spain"}]},{"given":"Rodrigo","family":"Diaz","sequence":"additional","affiliation":[{"name":"Atos Research & Innovation, Cybersecurity Unit, 28037 Madrid, Spain"}]},{"ORCID":"http:\/\/orcid.org\/0000-0002-8650-4642","authenticated-orcid":false,"given":"Juan","family":"Caubet","sequence":"additional","affiliation":[{"name":"Eurecat, Centre Tecnol\u00f2gic de Catalunya, IT & OT Security Unit, 08005 Barcelona, Spain"}]},{"given":"Ignasi","family":"Garcia-Mil\u00e0","sequence":"additional","affiliation":[{"name":"Worldsensing, Barcelona, 08014 Barcelona, Spain"}]}],"member":"1968","published-online":{"date-parts":[[2021,6,9]]},"reference":[{"key":"ref_1","unstructured":"Harp, D.R., and Gregory-Brown, B. (2021, February 03). IT\/OT Convergence, Bridging the Divide. Nextdefense White Paper. Available online: https:\/\/ics.sans.org\/media\/IT-OT-Convergence-NexDefense-Whitepaper.pdf."},{"key":"ref_2","unstructured":"Willis, T. (2021, June 05). Closing the Gap Between Physical and Cyber Security. Technical Report. Available online: https:\/\/technative.io\/closing-the-gap-between-physical-and-cyber-security\/."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"103201","DOI":"10.1016\/j.micpro.2020.103201","article-title":"Cyber-physical systems security: Limitations, issues and future trends","volume":"77","author":"Yaacoub","year":"2020","journal-title":"Microprocess. Microsyst."},{"key":"ref_4","first-page":"1","article-title":"The Security Analysis and Research of DNP3.0 of SCADA System","volume":"6","author":"Xin","year":"2014","journal-title":"Ind. Technol. Innov."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1176","DOI":"10.3390\/sym7031176","article-title":"Real Time MODBUS Transmissions and Cryptography Security Designs and Enhancements of Protocol Sensitive Information","volume":"7","author":"Shahzad","year":"2015","journal-title":"Symmetry J."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Wanying, Q., Weimin, W., Surong, Z., and Yan, Z. (2015, January 18\u201320). The Study of Security Issues for the Industrial Control Systems Communication Protocols. Proceedings of the Joint International Mechanical, Electronic and Information Technology Conference (JIMET), Chongqing, China.","DOI":"10.2991\/jimet-15.2015.129"},{"key":"ref_7","unstructured":"Hackers Arise (2020, December 05). Metasploit SCADA Hacking, Post. Available online: https:\/\/www.hackers-arise.com\/post\/2018\/10\/22\/metasploit-basics-part-16-metasploit-scada-hacking."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"052058","DOI":"10.1088\/1742-6596\/1213\/5\/052058","article-title":"Research and Implementation of Modbus TCP Security Enhancement Protocol","volume":"121","author":"Xuan","year":"2019","journal-title":"J. Phys. Conf. Ser."},{"key":"ref_9","unstructured":"Allied Telesis (2020, November 03). Modbus TCP Feature Overview and Configuration Guide. Technical Guide. Available online: https:\/\/www.alliedtelesis.com\/sites\/default\/files\/documents\/feature-guides\/modbus_feature_overview_guide.pdf."},{"key":"ref_10","unstructured":"OFWAT (2021, January 03). Towards Water 2020\u2014Meeting the Challenges for Water and Wastewater Services in England and Wales, Available online: https:\/\/www.ofwat.gov.uk\/wp-content\/uploads\/2015\/10\/pap_tec201507challenges.pdf."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"50","DOI":"10.5942\/jawwa.2017.109.0021","article-title":"Protecting Drinking Water Utilities from Cyber Threats","volume":"109","author":"Clark","year":"2017","journal-title":"J. Am. Water Work. Assoc."},{"key":"ref_12","unstructured":"American Water Works Association (2021, January 03). State of the Water Industry Report. Available online: https:\/\/www.awwa.org\/Portals\/0\/AWWA\/ETS\/Resources\/2019_STATE%20OF%20THE\\%20WATER%20INDUSTRY_post.pdf."},{"key":"ref_13","unstructured":"Janke, R., Tryby, M., and Clark, R.M. (2021, June 05). Protecting Water Supply Critical Infrastructure: An Overview. Securing Water and Wastewater Systems Global Experiences. Available online: https:\/\/www.researchgate.net\/publication\/263443851_Protecting_Water_Supply_Critical_Infrastructure_An_Overview."},{"key":"ref_14","unstructured":"The Software Alliance (2021, January 03). (2015) EU Cybersecurity Dashboard. A Path to a Secure European Cyberspace. Available online: http:\/\/cybersecurity.bsa.org\/assets\/PDFs\/study_eucybersecurity_en.pdf."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"25","DOI":"10.5038\/1944-0472.8.3S.1471","article-title":"Critical Infrastructure Protection: Maintenance is National Security","volume":"8","author":"Hemme","year":"2015","journal-title":"J. Strateg. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"103614","DOI":"10.1016\/j.micpro.2020.103614","article-title":"On the design of secure primitives for real world applications","volume":"80","author":"Sklavos","year":"2021","journal-title":"J. Microprocess. Microsyst."},{"key":"ref_17","unstructured":"Nizam, F., Chaki, S., Al Mamun, S., and Kaiser, M.S. (2016, January 7\u20139). Attack Detection and Prevention in the CyberPhysical System. Proceedings of the International Conference on Computer Communication and Informatics, Coimbatore, India."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Sadi, M.A., Ali, M.H., Dasgupta, D., Abercrombie, R.K., and Kher, S. (2015, January 7\u201310). Co-Simulation Platform for Characterizing Cyber Attacks in Cyber Physical Systems. Proceedings of the IEEE Symposium Series on Computational Intelligence, Cape Town, South Africa.","DOI":"10.1109\/SSCI.2015.178"},{"key":"ref_19","unstructured":"Rubio-Hernan, J., Cicco, L.D., and Garcia-Alfaro, J. (September, January 31). Revisiting a Watermark-based Detection Scheme to Handle Cyber-Physical Attacks. Proceedings of the 11th International Conference on Availability, Reliability and Security (ARES), Salzburg, Austria."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Rubio-Hernan, J., De Cicco, L., and Garcia-Alfaro, J. (2016, January 2\u20134). Event-Triggered Watermarking Control to Handle Cyber-Physical Integrity Attacks. Proceedings of the Nordic Conference on Secure IT Systems, (NordSec), Oulu, Finland.","DOI":"10.1007\/978-3-319-47560-8_1"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Rubio-Hernan, J., De Cicco, L., and Garcia-Alfaro, J. (2017). On the use of watermark-based schemes to detect cyber-physical attacks. EURASIP J. Inf. Secur., Available online: https:\/\/doi.org\/10.1186\/s13635-017-0060-9.","DOI":"10.1186\/s13635-017-0060-9"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Nikolopoulos, D., Makropoulos, C., and Kalogeras, D. (2018, January 10\u201313). Developing a stress-testing platform for cyber-physical water infrastructure. Proceedings of the 4th International Workshop on Cyber-Physical Systems for Smart Water Networks, Porto, Portugal.","DOI":"10.1109\/CySWater.2018.00009"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Nikolopoulos, D., Moraitis, G., Bouziotas, D., Lykou, A., Karavokiros, G., and Makropoulos, C. (2020). Cyber-Physical Stress-Testing Platform for Water Distribution Networks. J. Environ. Eng., 146.","DOI":"10.1061\/(ASCE)EE.1943-7870.0001722"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1016\/j.jpdc.2016.12.012","article-title":"Distributed host-based collaborative detection for false data injection attacks in smart grid cyber-physical system","volume":"103","author":"Li","year":"2017","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Housh, M., and Ohar, Z. (2017, January 21\u201325). Model-based approach for cyber-physical attack detection in water distribution systems. Proceedings of the World Environmental and Water Resources Congress, Sacramento, CA, USA.","DOI":"10.1061\/9780784480625.067"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Abokifa, A.A., Haddad, K., Lo, C.S., and Biswas, P. (2017, January 21\u201325). Detection of cyber physical attacks on water distribution systems via principal component analysis and artificial neural networks. Proceedings of the World Environmental and Water Resources Congress, Sacramento, CA, USA.","DOI":"10.1061\/9780784480625.063"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Pasha, M.F.K., Kc, B., and Somasundaram, S.L. (2017, January 21\u201325). An approach to detect the cyber-physical attack on water distribution system. Proceedings of the World Environmental and Water Resources Congress, Sacramento, CA, USA.","DOI":"10.1061\/9780784480625.065"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Aghashahi, M., Sundararajan, R., Pourahmadi, M., and Banks, M.K. (2017, January 21\u201325). Water distribution systems analysis symposium-battle of the attack detection algorithms (batadal). Proceedings of the World Environmental and Water Resources Congress, Sacramento, CA, USA.","DOI":"10.1061\/9780784480595.010"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1186\/s13673-019-0175-8","article-title":"Attack detection in water distribution systems using machine learning","volume":"9","author":"Ramotsoela","year":"2019","journal-title":"Hum. Centric Comput. Inf. Sci."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Wu, M. (2019). Intrusion Detection for Cyber-Physical Attacks in Cyber Manufacturing System. [Ph.D. Thesis, Syracuse University].","DOI":"10.1115\/IMECE2019-10135"},{"key":"ref_31","unstructured":"Sun, C., Puig, V., and Cembrano, G. (2018, January 10\u201313). Real-Time Control of Urban Water Cycle under Cyber- Physical Systems Framework. Proceedings of the International Workshop on Cyber-physical Systems for Smart Water Networks, Porto, Portugal."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Suciu, G., Sachian, M.A., Petre, I., Petrache, D., Petrescu, G., Mantzana, V., Gkotsis, I., Bertone, F., Viarengo, L., and Andronello, S. (2020). Cyber-physical Threat Detection Platform Designed for Healthcare Systems. Ann. Disaster Risk Sci., 3.","DOI":"10.51381\/adrs.v3i1.38"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Stellios, I., Kotzanikolaou, P., Psarakis, M., and Alcaraz, C. (2021). Risk Assessment for IoT-Enabled Cyber-Physical Systems. Learning and Analytics in Intelligent Systems, Springer.","DOI":"10.1007\/978-3-030-41196-1_8"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"102316","DOI":"10.1016\/j.cose.2021.102316","article-title":"Assessing IoT enabled cyber-physical attack paths against critical systems","volume":"107","author":"Stellios","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"171","DOI":"10.1016\/j.future.2020.09.002","article-title":"Autonomous mitigation of cyber risks in the Cyber\u2013Physical Systems","volume":"115","author":"Kholidy","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Gonzalez-Granadillo, G., Gonzalez-Zarzosa, S., and Faiella, M. (2018, January 26\u201328). Towards an Enhanced Security Data Analytic Platform. Proceedings of the 15th Conference on Security and Cryptography, Porto, Portugal.","DOI":"10.5220\/0006831106190624"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1109\/MSP.2018.2885359","article-title":"Protecting Water Infrastructure from Cyber and Physical Threats: Using Multimodal Data Fusion and Adaptive Deep Learning to Monitor Critical Systems","volume":"36","author":"Bakalos","year":"2019","journal-title":"IEEE Signal Process. Mag."},{"key":"ref_38","unstructured":"Soldatos, J., Isabel Pra\u00e7a, I., and Jovanovic, A. (2021). Applying Machine Learning and Deep Learning Algorithms for the Detection of Physical Anomalies in Critical Water Infrastructures. Chapter 9 in Cyber-Physical Threat Intelligence for Critical Infrastructures Security, Now Publishers."},{"key":"ref_39","unstructured":"Soldatos, J., Isabel Pra\u00e7a, I., and Jovanovic, A. (2021). Cyber-Physical Solutions for Real-time Detection, Analysis and Visualization at Operational Level in Water CIs. Chapter 8 in Cyber-Physical Threat Intelligence for Critical Infrastructures Security, Now Publishers."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Gonzalez-Granadillo, G., Diaz, R., Medeiros, I., Gonzalez-Zarzosa, S., and Machnicki, D. (2019, January 26\u201328). LADS: A Live Anomaly Detection System based on Machine Learning Methods. Proceedings of the 16th SECRYPT Conference, Prague, Czech Republic.","DOI":"10.5220\/0007948904640469"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Gonzalez-Granadillo, G., Bedoya, A., and Diaz, R. (2021, January 6\u20138). An Improved Live Anomaly Detection System (I-LADS) based on Deep Learning Algorithm. Proceedings of the 18th SECRYPT Conference, Online, Streaming.","DOI":"10.5220\/0010573705680575"},{"key":"ref_42","unstructured":"(2020, April 05). B+B SmartWorx.: The Answer to the 14 Most Frequently Asked Modbus Questions. White Paper. Available online: http:\/\/www.bb-elec.com\/Learning-Center\/All-White-Papers\/Modbus\/The-Answer-to-the-14-Most-Frequently-Asked-Modbus.aspx."},{"key":"ref_43","unstructured":"(2021, June 05). STOP-IT Consortium.: Risk Management plan. Project Deliverable D7.4. Available online: https:\/\/nemesis-edu.eu\/wp-content\/uploads\/2019\/07\/D7.4-Quality-Assurance-Risk-Management_v4.pdf."},{"key":"ref_44","unstructured":"Git Code (2020, December 03). Protocol SCADA Rules. Available online: https:\/\/github.com\/codecat007\/snort-rules\/blob\/master\/snortrules-snapshot-29150\/rules\/protocol-scada.rules."},{"key":"ref_45","unstructured":"(2021, June 05). STOP-IT Consortium.: Lessons Learned and Societal Impact. Project Deliverable D7.5. Available online: https:\/\/ec.europa.eu\/research\/participants\/documents\/downloadPublic?documentIds=080166e5b200a26b&appId=PPGMS."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/1\/2\/20\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,14]],"date-time":"2024-07-14T01:22:42Z","timestamp":1720920162000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/1\/2\/20"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,9]]},"references-count":45,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2021,6]]}},"alternative-id":["jcp1020020"],"URL":"https:\/\/doi.org\/10.3390\/jcp1020020","relation":{},"ISSN":["2624-800X"],"issn-type":[{"value":"2624-800X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,9]]}}}