Identifying Security-Critical Cyber-Physical Components in Industrial Control Systems

In recent years, Industrial Control Systems (ICS) have become an appealing target for cyber attacks, having massive destructive consequences. Security metrics are therefore essential to assess their security posture. In this paper, we present a novel ICS security metric based on AND/OR graphs that represent cyber-physical dependencies among network components. Our metric is able to efficiently identify sets of critical cyber-physical components, with minimal cost for an attacker, such that if compromised, the system would enter into a non-operational state. We address this problem by efficiently transforming the input AND/OR graph-based model into a weighted logical formula that is then used to build and solve a Weighted Partial MAX-SAT problem. Our tool, META4ICS, leverages state-of-the-art techniques from the field of logical satisfiability optimisation in order to achieve efficient computation times. Our experimental results indicate that the proposed security metric can efficiently scale to networks with thousands of nodes and be computed in seconds. In addition, we present a case study where we have used our system to analyse the security posture of a realistic water transport network. We discuss our findings on the plant as well as further security applications of our metric.Comment: Keywords: Security metrics, industrial control systems, cyber-physical systems, AND-OR graphs, MAX-SAT resolutio

Extensions of Barrier Sets to Nonzero Roots of the Matching Polynomials

In matching theory, barrier sets (also known as Tutte sets) have been studied extensively due to its connection to maximum matchings in a graph. In this paper, we first define $\theta$-barrier sets. Our definition of a $\theta$-barrier set is slightly different from that of a barrier set. However we show that $\theta$-barrier sets and barrier sets have similar properties. In particular, we prove a generalized Berge's Formula and give a characterization for the set of all $\theta$-special vertices in a graph

On Representation of the Reeb Graph as a Sub-Complex of Manifold

The Reeb graph $\mathcal{R}(f)$ is one of the fundamental invariants of a smooth function $f\colon M\to \mathbb{R}$ with isolated critical points. It is defined as the quotient space $M/_{\!\sim}$ of the closed manifold $M$ by a relation that depends on $f$. Here we construct a $1$-dimensional complex $\Gamma(f)$ embedded into $M$ which is homotopy equivalent to $\mathcal{R}(f)$. As a consequence we show that for every function $f$ on a manifold with finite fundamental group, the Reeb graph of $f$ is a tree. If $\pi_1(M)$ is an abelian group, or more general, a discrete amenable group, then $\mathcal{R}(f)$ contains at most one loop. Finally we prove that the number of loops in the Reeb graph of every function on a surface $M_g$ is estimated from above by $g$, the genus of $M_g$.Comment: 18 page

Foliations of Isonergy Surfaces and Singularities of Curves

It is well known that changes in the Liouville foliations of the isoenergy surfaces of an integrable system imply that the bifurcation set has singularities at the corresponding energy level. We formulate certain genericity assumptions for two degrees of freedom integrable systems and we prove the opposite statement: the essential critical points of the bifurcation set appear only if the Liouville foliations of the isoenergy surfaces change at the corresponding energy levels. Along the proof, we give full classification of the structure of the isoenergy surfaces near the critical set under our genericity assumptions and we give their complete list using Fomenko graphs. This may be viewed as a step towards completing the Smale program for relating the energy surfaces foliation structure to singularities of the momentum mappings for non-degenerate integrable two degrees of freedom systems.Comment: 30 pages, 19 figure

Surface bundles with genus two Heegaard splittings

It is known that there are surface bundles of arbitrarily high genus which have genus two Heegaard splittings. The simplest examples are Seifert fibered spaces with the sphere as a base space, three exceptional fibers and which allow horizontal surfaces. We characterize the monodromy maps of all surface bundles with genus two Heegaard splittings and show that each is the result of integral Dehn surgery in one of these Seifert fibered spaces along loops where the Heegaard surface intersects a horizontal surface. (This type of surgery preserves both the bundle structure and the Heegaard splitting.)Comment: 30 pages, 8 figure