Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

Rapid single-nucleotide polymorphism-based identification of clonal Pseudomonas aeruginosa isolates from patients with cystic fibrosis by the use of real-time PCR and high-resolution melting curve analysis

Pseudomonas aeruginosa genotyping relies mainly upon DNA fingerprinting methods, which can be subjective, expensive and time-consuming. The detection of at least three different clonal P. aeruginosa strains in patients attending two cystic fibrosis (CF) centres in a single Australian city prompted the design of a non-gel-based PCR method to enable clinical microbiology laboratories to readily identify these clonal strains. We designed a detection method utilizing heat-denatured P. aeruginosa isolates and a ten-single-nucleotide polymorphism (SNP) profile. Strain differences were detected by SYBR Green-based real-time PCR and high-resolution melting curve analysis (HRM10SNP assay). Overall, 106 P. aeruginosa sputum isolates collected from 74 patients with CF, as well as five reference strains, were analysed with the HRM10SNP assay, and the results were compared with those obtained by pulsed-field gel electrophoresis (PFGE). The HRM10SNP assay accurately identified all 45 isolates as members of one of the three major clonal strains characterized by PFGE in two Brisbane CF centres (Australian epidemic strain-1, Australian epidemic strain-2 and P42) from 61 other P. aeruginosa strains from Australian CF patients and two representative overseas epidemic strain isolates. The HRM10SNP method is simple, is relatively inexpensive and can be completed in <3 h. In our setting, it could be made easily available for clinical microbiology laboratories to screen for local P. aeruginosa strains and to guide infection control policies. Further studies are needed to determine whether the HRM10SNP assay can also be modified to detect additional clonal strains that are prevalent in other CF centres.

A prospective clinical trial of a real-time polymerase chain reaction assay for the diagnosis of candidemia in nonneutropenic, critically ill adults

Background. Invasive Candida infection among nonneutropenic, critically ill adults is a clinical problem that has received increasing attention in recent years. Poor performance of extant diagnostic modalities has promoted risk-based, preemptive prescribing in view of the poor outcomes associated with inadequate or delayed antifungal therapy; this risks unnecessary overtreatment. A rapid, reliable diagnostic test could have a substantial impact on therapeutic practice in this patient population.

Methods. Three TaqMan-based real-time polymerase chain reaction assays were developed that are capable of detecting the main medically important Candida species, categorized according to the likelihood of fluconazole susceptibility. Assay 1 detected Candida albicans, Candida parapsilosis, Candida tropicalis, and Candida dubliniensis. Assays 2 and 3 detected Candida glabrata and Candida krusei, respectively. The clinical performance of these assays, applied to serum, was evaluated in a prospective trial of nonneutropenic adults in a single intensive care unit.

Results. In all, 527 specimens were obtained from 157 participants. All 3 assays were run in parallel for each specimen; they could be completed within 1 working day. Of these, 23 specimens were obtained from 23 participants categorized as having proven Candida infection at the time of sampling. If a single episode of Candida famata candidemia was excluded, the estimated clinical sensitivity, specificity, and positive and negative predictive values of the assays in this trial were 90.9%, 100%, 100% and 99.8%, respectively.

Conclusions. These data suggest that the described assays perform well in this population for enhancing the diagnosis of candidemia. The extent to which they may affect clinical outcomes, prescribing practice, and cost-effectiveness of care remains to be ascertained.

Rapid differentiation between fluconazole-sensitive and -resistant species of Candida directly from positive blood-culture bottles by real-time PCR

In view of both the delay in obtaining identification by conventional methods following blood-culture positivity in patients with candidaemia and the close relationship between species and fluconazole (FLC) susceptibility, early speciation of positive blood cultures has the potential to influence therapeutic decisions. The aim was to develop a rapid test to differentiate FLC-resistant from FLC-sensitive Candida species. Three TaqMan-based real-time PCR assays were developed to identify up to six Candida species directly from BacT/Alert blood-culture bottles that showed yeast cells on Gram staining at the time of initial positivity. Target sequences in the rRNA gene complex were amplified, using a consensus two-step PCR protocol, to identify Candida albicans, Candida parapsilosis, Candida tropicalis, Candida dubliniensis, Candida glabrata and Candida krusei; these are the most commonly encountered Candida species in blood cultures. The first four of these (the characteristically FLC-sensitive group) were identified in a single reaction tube using one fluorescent TaqMan probe targeting 1 8S rRNA sequences conserved in the four species. The FLC-resistant species C. krusei and C. glabrata were detected in two further reactions, each with species-specific probes. This method was validated with clinical specimens (blood cultures) positive for yeast (n=33 sets) and the results were 100% concordant with those of phenotypic identification carried out concomitantly. The reported assay significantly reduces the time required to identify the presence of C. glabrata and C. krusei in comparison with a conventional phenotypic method, from ~72 to

Design Methodology for Real-Time FPGA-Based Sound Synthesis

Explicit finite difference (FD) schemes can realise highly realistic physical models of musical instruments but are computationally complex. A design methodology is presented for the creation of FPGA-based micro-architectures for FD schemes which can be applied to a range of applications with varying computational requirements, excitation and output patterns and boundary conditions. It has been applied to membrane and plate-based sound producing models, resulting in faster than real-time performance on a Xilinx XC2VP50 device which is 10 to 35 times faster than general purpose and DSP processors. The models have developed in such a way to allow a wide range of interaction (by a musician) thereby leading to the possibility of creating a highly realistic digital musical instrument.

Host-based P2P flow identification and use in real-time

Data identification is a key task for any Internet Service Provider (ISP) or network administrator. As port fluctuation and encryption become more common in P2P traffic wishing to avoid identification, new strategies must be developed to detect and classify such flows. This paper introduces a new method of separating P2P and standard web traffic that can be applied as part of a data mining process, based on the activity of the hosts on the network. Unlike other research, our method is aimed at classifying individual flows rather than just identifying P2P hosts or ports. Heuristics are analysed and a classification system proposed. The accuracy of the system is then tested using real network traffic from a core internet router showing over 99% accuracy in some cases. We expand on this proposed strategy to investigate its application to real-time, early classification problems. New proposals are made and the results of real-time experiments compared to those obtained in the data mining research. To the best of our knowledge this is the first research to use host based flow identification to determine a flows application within the early stages of the connection.

Development and comparison of a Primer-Probe Energy Transfer based assay and a 5 ' conjugated Minor Groove Binder assay for sensitive real-time PCR detection of infectious laryngotracheitis virus

In this study the design and development of two real-time PCR assays for the rapid, sensitive and specific detection of infectious laryngotracheitis virus (ILTV) DNA is described. A Primer-Probe Energy Transfer (PriProET) assay and 5' conjugated Minor Groove Binder (MGB) method are compared and contrasted. Both have been designed to target the thymidine kinase gene of the ILTV genome. Both PriProET and MGB assays are capable of detecting 20 copies of a DNA standard per reaction and are linear from 2 x 10(8) to 2 x 10(2) copies/mu l. Neither PriProET, nor MGB reacted with heterologous herpesviruses, indicating a high specificity of the two methods as novel tools for virus detection and identification. This study demonstrates the suitability of PriProET and 5' conjugated MGB probes as real-time PCR chemistries for the diagnosis of respiratory diseases caused by ILTV. (C) 2011 Elsevier B.V. All rights reserved.

Real-time GPU color-based segmentation of football players

In this paper, we propose a multi-camera application capable of processing high resolution images and extracting features based on colors patterns over graphic processing units (GPU). The goal is to work in real time under the uncontrolled environment of a sport event like a football match. Since football players are composed for diverse and complex color patterns, a Gaussian Mixture Models (GMM) is applied as segmentation paradigm, in order to analyze sport live images and video. Optimization techniques have also been applied over the C++ implementation using profiling tools focused on high performance. Time consuming tasks were implemented over NVIDIA's CUDA platform, and later restructured and enhanced, speeding up the whole process significantly. Our resulting code is around 4-11 times faster on a low cost GPU than a highly optimized C++ version on a central processing unit (CPU) over the same data. Real time has been obtained processing until 64 frames per second. An important conclusion derived from our study is the scalability of the application to the number of cores on the GPU. © 2011 Springer-Verlag.

Surface plasmon resonance-based inhibition assay for real-time detection of Cryptosporidium parvum oocyst

A surface plasmon resonance (SPR)-based inhibition assay method using a polyclonal anti-mouse IgM arrayed Cryptosporidium sensor chip was developed for the real-time detection of Cryptosporidium parvum oocysts. The Cryptosporidium sensor chip was fabricated by subsequent immobilization of streptavidin and polyclonal anti-mouse IgM (secondary antibody) onto heterogeneous self-assembled monolayers (SAMs). The assay consisted of the immunoreaction step between monoclonal anti-C. parvum oocyst (primary antibody) and oocysts, followed by the binding step of the unbound primary antibody onto the secondary antibody surface. It enhanced not only the immunoreaction yield of the oocysts by batch reaction but also the accessibility of analytes to the chip surface by antibody–antibody interaction. Furthermore, the use of optimum concentration of the primary antibody maximized its binding response on the chip. An inversely linear calibration curve for the oocyst concentration versus SPR signal was obtained in the range of 1×106–1×102 oocysts ml-1. The oocyst detection was also successfully achieved in natural water systems. These results indicate that the SPR-based inhibition assay using the Cryptosporidium sensor chip has high application potential for the real-time analysis of C. parvum oocyst in laboratory and field water monitoring.

An integrated approach for real-time model-based state-of-charge estimation of lithium-ion batteries

Lithium-ion batteries have been widely adopted in electric vehicles (EVs), and accurate state of charge (SOC) estimation is of paramount importance for the EV battery management system. Though a number of methods have been proposed, the SOC estimation for Lithium-ion batteries, such as LiFePo4 battery, however, faces two key challenges: the flat open circuit voltage (OCV) vs SOC relationship for some SOC ranges and the hysteresis effect. To address these problems, an integrated approach for real-time model-based SOC estimation of Lithium-ion batteries is proposed in this paper. Firstly, an auto-regression model is adopted to reproduce the battery terminal behaviour, combined with a non-linear complementary model to capture the hysteresis effect. The model parameters, including linear parameters and non-linear parameters, are optimized off-line using a hybrid optimization method that combines a meta-heuristic method (i.e., the teaching learning based optimization method) and the least square method. Secondly, using the trained model, two real-time model-based SOC estimation methods are presented, one based on the real-time battery OCV regression model achieved through weighted recursive least square method, and the other based on the state estimation using the extended Kalman filter method (EKF). To tackle the problem caused by the flat OCV-vs-SOC segments when the OCV-based SOC estimation method is adopted, a method combining the coulombic counting and the OCV-based method is proposed. Finally, modelling results and SOC estimation results are presented and analysed using the data collected from LiFePo4 battery cell. The results confirmed the effectiveness of the proposed approach, in particular the joint-EKF method.

Real-time estimation of battery internal temperature based on a simplified thermoelectric model

Li-ion batteries have been widely used in the EVs, and the battery thermal management is a key but challenging part of the battery management system. For EV batteries, only the battery surface temperature can be measured in real-time. However, it is the battery internal temperature that directly affects the battery performance, and large temperature difference may exist between surface and internal temperatures, especially in high power demand applications. In this paper, an online battery internal temperature estimation method is proposed based on a novel simplified thermoelectric model. The battery thermal behaviour is first described by a simplified thermal model, and battery electrical behaviour by an electric model. Then, these two models are interrelated to capture the interactions between battery thermal and electrical behaviours, thus offer a comprehensive description of the battery behaviour that is useful for battery management. Finally, based on the developed model, the battery internal temperature is estimated using an extended Kalman filter. The experimental results confirm the efficacy of the proposed method, and it can be used for online internal temperature estimation which is a key indicator for better real-time battery thermal management.

Dielectrics in a time-dependent electric field: a real-time approach based on density-polarization functional theory

In the presence of a (time-dependent) macroscopic electric field the electron dynamics of dielectrics cannot be described by the time-dependent density only. We present a real-time formalism that has the density and the macroscopic polarization P as key quantities. We show that a simple local function of P already captures long-range correlation in linear and nonlinear optical response functions. Specifically, after detailing the numerical implementation, we examine the optical absorption, the second- and third-harmonic generation of bulk Si, GaAs, AlAs and CdTe at different level of approximation. We highlight links with ultranonlocal exchange-correlation functional approximations proposed within linear response time-dependent density functional theory framework.