The application of autonomic computing for the protection of industrial control systems

Critical infrastructures are defined as the basic facilities, services and utilities needed to support the functioning of society. For over three-thousand years, civil engineers have built these infrastructures to ensure that needed services and products are available to make mankind more comfortable, secure and productive. Modern infrastructure control systems are vulnerable to disruption from natural disaster, accident, negligent operation and intentional cyber assaults from malicious agents. Many critical processes within our infrastructures are continuous (e.g., electric power, etc.) and cannot be interrupted without consequence to industry and the public. Failure to protect the critical infrastructure from cyber assaults will result in physical, economic and social impacts, extending from the local to the national level. Cyber weapons have shown that harm to infrastructures can occur before system operators have time to determine the source. We present the thesis that infrastructure control systems can employ autonomic computing technology to detect anomalies and mitigate process disruption. Specifically we focus on: 1) autonomic computing algorithms that can be integrated into control systems and networks to detect and respond to anomalies; 2) autonomic technology capable of detecting and blocking infrastructure controller commands, that if executed, would result in process disruption; 3) design and construction of a prototype Autonomic Critical Infrastructure Protection appliance (ACIP) for integration and testing of autonomic algorithms; and 4) the design and construction of a test bed capable of modeling critical infrastructures and related control systems and processes for the purpose of testing and demonstrating new autonomic technologies. We report on the development of a new, multi-dimension ontology that organizes cyber assault methodologies correlated with perpetrator motivation and goals. Using this ontology, we create a theoretical framework to identify the integration points for protective technology within infrastructure control systems. We have created a unique modeling and simulation test bed for critical infrastructure systems and processes, and a prototype autonomic computing appliance. Through this work, we have developed an expanded understanding of autonomic computing theory and its application to controls systems. We also, through experimentation, prove the thesis and establish a roadmap for future research.