Modeling and Analysis of Attacks and Counter Defense Mechanisms for Cyber Physical Systems

Abstract—In this paper, we develop an analytical model based on stochastic Petri nets to capture the dynamics between ad-versary behavior and defense for cyber physical systems. We consider several types of failures including attrition failure, pervasion failure, and exfiltration failure which can happen to a cyber physical system. Using a modernized electrical grid as an example, we illustrate the parameterization process. Our results reveal optimal design conditions, including the intrusion detection interval, and the redundancy level, under which the modernized electrical grid’s mean time to failure is maximized. Further, there exists a design tradeoff between exfiltration failure, attrition failure, and pervasion failure when using redundancy to improve the overall system reliability. Index Terms- Cyber physical systems, intrusion detection, redundancy engineering, mean time to failure, modeling and analysis. ACRONYMS AND ABBREVIATIONS CPS Cyber physical system IDS Intrusion detection system MTTF Mean time to failure SPN Stochastic Petri net NOTATION S,C,A sensors, control nodes, actuators INITx Initial node type x count MINx Minimum node type x count PBADx Compromised node type x count PGOODx Uncompromised node type x count Tsensing Sensing interval TTX Exfiltration rate Pfnx Node type x false negative probability Pfpx Node type x false positive probability TIDSx Node type x audit interval αx Node type x redundancy factor λx Node type x compromise rate λTCPx Node type x aggregate compromise rate λTFPx Node type x aggregate false positive rate λTIDx Node type x aggregate detection rate λTLEAKx Node type x aggregate exfiltration rate I