Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

Video anomaly detection in real-time on a Power-Aware Heterogeneous Platform

FPGAs and GPUs are often used when real-time performance in video processing is required. An accelerated processor is chosen based on task-specific priorities (power consumption, processing time and detection accuracy), and this decision is normally made once at design time. All three characteristics are important, particularly in battery-powered systems. Here we propose a method for moving selection of processing platform from a single design-time choice to a continuous run time one.We implement Histogram of Oriented Gradients (HOG) detectors for cars and people and Mixture of Gaussians (MoG) motion detectors running across FPGA, GPU and CPU in a heterogeneous system. We use this to detect illegally parked vehicles in urban scenes. Power, time and accuracy information for each detector is characterised. An anomaly measure is assigned to each detected object based on its trajectory and location, when compared to learned contextual movement patterns. This drives processor and implementation selection, so that scenes with high behavioural anomalies are processed with faster but more power hungry implementations, but routine or static time periods are processed with power-optimised, less accurate, slower versions. Real-time performance is evaluated on video datasets including i-LIDS. Compared to power-optimised static selection, automatic dynamic implementation mapping is 10% more accurate but draws 12W extra power in our testbed desktop system.

Minimal residual disease monitoring in multiple myeloma: a comparison between allelic-specific oligonucleotide real-time quantitative polymerase chain reaction and flow cytometry.

BACKGROUND AND OBJECTIVES: Minimal residual disease (MRD) studies are useful in multiple myeloma (MM). However, the definition of the best technique and clinical utility are still unresolved issues. The aim of this study was to analyze and compare the clinical utility of MRD studies in MM with two different techniques: allelic-specific oligonucleotide real-time quantitative PCR (ASO-RQ-PCR), and flow cytometry (FCM). DESIGN AND METHODS: Bone marrow samples from 32 MM patients who had achieved complete response after transplantation were evaluated by ASO-RQ-PCR, using TaqMan technology, and multiparametric FCM. RESULTS: ASO-RQ-PCR was only applicable in 75% of patients for a variety of technical reasons, while FCM was applicable in up to 90%. Therefore, simultaneous PCR/FCM analysis was possible in only 24 patients. The number of residual tumor cells identified by both techniques was very similar (mean=0.29%, range=0.001-1.61%, correlation coefficient=0.861). However, RQ-PCR was able to detect residual myelomatous cells in 17 patients while FCM only did so in 11; thus, 6 cases were FCM negative but PCR positive, all of them displaying a very low number of clonal cells (median=0.014%, range=0.001-0.11). Using an MRD threshold of 0.01% (10(-4)) two risk groups with significantly different progression-free survival could be identified by either PCR (34 vs. 15m, p=0.04) or FCM (27 vs. 10m, p=0.05). INTERPRETATION AND CONCLUSIONS: Although MRD evaluation by ASO-RQ-PCR is slightly more sensitive and specific than FCM, it is applicable in a lower proportion of MM patients and is more time-consuming, while both techniques provide similar prognostic information.