Formal modelling and analysis of DNP3 secure authentication

Supervisory Control and Data Acquisition (SCADA) systems are one of the key foundations of smart grids. The Distributed Network Protocol version 3 (DNP3) is a standard SCADA protocol designed to facilitate communications in substations and smart grid nodes. The protocol is embedded with a security mechanism called Secure Authentication (DNP3-SA). This mechanism ensures that end-to-end communication security is provided in substations. This paper presents a formal model for the behavioural analysis of DNP3-SA using Coloured Petri Nets (CPN). Our DNP3-SA CPN model is capable of testing and verifying various attack scenarios: modification, replay and spoofing, combined complex attack and mitigation strategies. Using the model has revealed a previously unidentified flaw in the DNP3-SA protocol that can be exploited by an attacker that has access to the network interconnecting DNP3 devices. An attacker can launch a successful attack on an outstation without possessing the pre-shared keys by replaying a previously authenticated command with arbitrary parameters. We propose an update to the DNP3-SA protocol that removes the flaw and prevents such attacks. The update is validated and verified using our CPN model proving the effectiveness of the model and importance of the formal protocol analysis.

Formal security analysis of the DNP3-secure authentication protocol

This thesis evaluates the security of Supervisory Control and Data Acquisition (SCADA) systems, which are one of the key foundations of many critical infrastructures. Specifically, it examines one of the standardised SCADA protocols called the Distributed Network Protocol Version 3, which attempts to provide a security mechanism to ensure that messages transmitted between devices, are adequately secured from rogue applications. To achieve this, the thesis applies formal methods from theoretical computer science to formally analyse the correctness of the protocol.

An efficient hybrid evolutionary optimization algorithm based on PSO and SA for clustering

The K-means algorithm is one of the most popular techniques in clustering. Nevertheless, the performance of the K-means algorithm depends highly on initial cluster centers and converges to local minima. This paper proposes a hybrid evolutionary programming based clustering algorithm, called PSO-SA, by combining particle swarm optimization (PSO) and simulated annealing (SA). The basic idea is to search around the global solution by SA and to increase the information exchange among particles using a mutation operator to escape local optima. Three datasets, Iris, Wisconsin Breast Cancer, and Ripley’s Glass, have been considered to show the effectiveness of the proposed clustering algorithm in providing optimal clusters. The simulation results show that the PSO-SA clustering algorithm not only has a better response but also converges more quickly than the K-means, PSO, and SA algorithms.

A novel hybrid evolutionary algorithm based on ACO and SA for distribution feeder reconfiguration with regard to DGs

This paper presents an efficient hybrid evolutionary optimization algorithm based on combining Ant Colony Optimization (ACO) and Simulated Annealing (SA), called ACO-SA, for distribution feeder reconfiguration (DFR) considering Distributed Generators (DGs). Due to private ownership of DGs, a cost based compensation method is used to encourage DGs in active and reactive power generation. The objective function is summation of electrical energy generated by DGs and substation bus (main bus) in the next day. The approach is tested on a real distribution feeder. The simulation results show that the proposed evolutionary optimization algorithm is robust and suitable for solving DFR problem.

A hybrid evolutionary algorithm based on ACO and SA for distribution feeder reconfiguration

This paper deals with an efficient hybrid evolutionary optimization algorithm in accordance with combining the ant colony optimization (ACO) and the simulated annealing (SA), so called ACO-SA. The distribution feeder reconfiguration (DFR) is known as one of the most important control schemes in the distribution networks, which can be affected by distributed generations (DGs) for the multi-objective DFR. In such a case, DGs is used to minimize the real power loss, the deviation of nodes voltage and the number of switching operations. The approach is carried out on a real distribution feeder, where the simulation results show that the proposed evolutionary optimization algorithm is robust and suitable for solving the DFR problem.

Distribution harmonic state estimation based on a hybrid PSO and SA algorithm considering parameters uncertainty

This paper presents a new algorithm based on a Hybrid Particle Swarm Optimization (PSO) and Simulated Annealing (SA) called PSO-SA to estimate harmonic state variables in distribution networks. The proposed algorithm performs estimation for both amplitude and phase of each harmonic currents injection by minimizing the error between the measured values from Phasor Measurement Units (PMUs) and the values computed from the estimated parameters during the estimation process. The proposed algorithm can take into account the uncertainty of the harmonic pseudo measurement and the tolerance in the line impedances of the network as well as uncertainty of the Distributed Generators (DGs) such as Wind Turbines (WT). The main feature of proposed PSO-SA algorithm is to reach quickly around the global optimum by PSO with enabling a mutation function and then to find that optimum by SA searching algorithm. Simulation results on IEEE 34 bus radial and a realistic 70-bus radial test networks are presented to demonstrate the speed and accuracy of proposed Distribution Harmonic State Estimation (DHSE) algorithm is extremely effective and efficient in comparison with the conventional algorithms such as Weight Least Square (WLS), Genetic Algorithm (GA), original PSO and Honey Bees Mating Optimization (HBMO) algorithm.

Security analysis of the non-aggressive challenge response of the DNP3 Protocol using a CPN Model

Distributed Network Protocol Version 3 (DNP3) is the de-facto communication protocol for power grids. Standard-based interoperability among devices has made the protocol useful to other infrastructures such as water, sewage, oil and gas. DNP3 is designed to facilitate interaction between master stations and outstations. In this paper, we apply a formal modelling methodology called Coloured Petri Nets (CPN) to create an executable model representation of DNP3 protocol. The model facilitates the analysis of the protocol to ensure that the protocol will behave as expected. Also, we illustrate how to verify and validate the behaviour of the protocol, using the CPN model and the corresponding state space tool to determine if there are insecure states. With this approach, we were able to identify a Denial of Service (DoS) attack against the DNP3 protocol.

Can social resilience inform SA/SIA for adaptive planning for climate change in vulnerable regions?

Social resilience concepts are gaining momentum in environmental planning through an emerging understanding of the socio-ecological nature of biophysical systems. There is a disconnect, however, between these concepts and the sociological and psychological literature related to social resilience. Further still, both schools of thought are not well connected to the concepts of social assessment (SA) and social impact assessment (SIA) that are the more standard tools supporting planning and decision-making. This raises questions as to how emerging social resilience concepts can translate into improved SA/SIA practices to inform regional-scale adaptation. Through a review of the literature, this paper suggests that more cross-disciplinary integration is needed if social resilience concepts are to have a genuine impact in helping vulnerable regions tackle climate change.

Real-time and interactive attacks on DNP3 critical infrastructure using Scapy

The Distributed Network Protocol v3.0 (DNP3) is one of the most widely used protocols, to control national infrastructure. Widely used interactive packet manipulation tools, such as Scapy, have not yet been augmented to parse and create DNP3 frames (Biondi 2014). In this paper we extend Scapy to include DNP3, thus allowing us to perform attacks on DNP3 in real-time. Our contribution builds on East et al. (2009), who proposed a range of possible attacks on DNP3. We implement several of these attacks to validate our DNP3 extension to Scapy, then executed the attacks on real world equipment. We present our results, showing that many of these theoretical attacks would be unsuccessful in an Ethernet-based network.

Can social resilience inform SA/SIA for adaptive planning for climate change in vulnerable regions?

This book represents a landmark effort to probe and analyze the theory and empirics of designing water disaster management policies. It consists of seven chapters that examine, in-depth and comprehensively, issues that are central to crafting effective policies for water disaster management. The authors use historical surveys, institutional analysis, econometric investigations, empirical case studies, and conceptual-theoretical discussions to clarify and illuminate the complex policy process. The specific topics studied in this book include a review and analysis of key policy areas and research priority areas associated with water disaster management, community participation in disaster risk reduction, the economics and politics of ‘green’ flood control, probabilistic flood forecasting for flood risk management, polycentric governance and flood risk management, drought management with the aid of dynamic inter-generational preferences, and how social resilience can inform SA/SIA for adaptive planning for climate change in vulnerable areas. A unique feature of this book is its analysis of the causes and consequences of water disasters and efforts to address them successfully through policy-rich, cross-disciplinary and transnational papers. This book is designed to help enrich the sparse discourse on water disaster management policies and galvanize water professionals to craft creative solutions to tackle water disasters efficiently, equitably, and sustainably. This book should also be of considerable use to disaster management professionals, in general, and natural resource policy analysts.

Multifunctional SA-PProDOT binder for lithium ion batteries

An environmentally benign, highly conductive, and mechanically strong binder system can overcome the dilemma of low conductivity and insufficient mechanical stability of the electrodes to achieve high performance lithium ion batteries (LIBs) at a low cost and in a sustainable way. In this work, the naturally occurring binder sodium alginate (SA) is functionalized with 3,4-propylenedioxythiophene-2,5-dicarboxylic acid (ProDOT) via a one-step esterification reaction in a cyclohexane/dodecyl benzenesulfonic acid (DBSA)/water microemulsion system, resulting in a multifunctional polymer binder, that is, SA-PProDOT. With the synergetic effects of the functional groups (e.g., carboxyl, hydroxyl, and ester groups), the resultant SA-PProDOT polymer not only maintains the outstanding binding capabilities of sodium alginate but also enhances the mechanical integrity and lithium ion diffusion coefficient in the LiFePO4 (LFP) electrode during the operation of the batteries. Because of the conjugated network of the PProDOT and the lithium doping under the battery environment, the SA-PProDOT becomes conductive and matches the conductivity needed for LiFePO4 LIBs. Without the need of conductive additives such as carbon black, the resultant batteries have achieved the theoretical specific capacity of LiFePO4 cathode (ca. 170 mAh/g) at C/10 and ca. 120 mAh/g at 1C for more than 400 cycles.

Jacob Judey-Barosin and his father Hermann Judey hiking with friends; Sächsische Schweiz Portraits Men

l-r: Martin Lipschitz, Sam Kohn, Hermann Judey, Willy Lipschitz, Georg Eliasberg and Jacob Judey-Barosin

DNP3 network scanning and reconnaissance for critical infrastructure

The Distributed Network Protocol v3.0 (DNP3) is one of the most widely used protocols to control national infrastructure. The move from point-to-point serial connections to Ethernet-based network architectures, allowing for large and complex critical infrastructure networks. However, networks and con- figurations change, thus auditing tools are needed to aid in critical infrastructure network discovery. In this paper we present a series of intrusive techniques used for reconnaissance on DNP3 critical infrastructure. Our algorithms will discover DNP3 outstation slaves along with their DNP3 addresses, their corresponding master, and class object configurations. To validate our presented DNP3 reconnaissance algorithms and demonstrate it’s practicality, we present an implementation of a software tool using a DNP3 plug-in for Scapy. Our implementation validates the utility of our DNP3 reconnaissance technique. Our presented techniques will be useful for penetration testing, vulnerability assessments and DNP3 network discovery.

Isolation of a High Affinity Neutralizing Monoclonal Antibody against 2009 Pandemic H1N1 Virus That Binds at the `Sa' Antigenic Site

Influenza virus evades host immunity through antigenic drift and shift, and continues to circulate in the human population causing periodic outbreaks including the recent 2009 pandemic. A large segment of the population was potentially susceptible to this novel strain of virus. Historically, monoclonal antibodies (MAbs) have been fundamental tools for diagnosis and epitope mapping of influenza viruses and their importance as an alternate treatment option is also being realized. The current study describes isolation of a high affinity (K-D = 2.1 +/- 0.4 pM) murine MAb, MA2077 that binds specifically to the hemagglutinin (HA) surface glycoprotein of the pandemic virus. The antibody neutralized the 2009 pandemic H1N1 virus in an in vitro microneutralization assay (IC50 = 0.08 mu g/ml). MA2077 also showed hemagglutination inhibition activity (HI titre of 0.50 mu g/ml) against the pandemic virus. In a competition ELISA, MA2077 competed with the binding site of the human MAb, 2D1 (isolated from a survivor of the 1918 Spanish flu pandemic) on pandemic H1N1 HA. Epitope mapping studies using yeast cell-surface display of a stable HA1 fragment, wherein `Sa' and `Sb' sites were independently mutated, localized the binding site of MA2077 within the `Sa' antigenic site. These studies will facilitate our understanding of antigen antibody interaction in the context of neutralization of the pandemic influenza virus.