On Ladder Logic Bombs in Industrial Control Systems

In industrial control systems, devices such as Programmable Logic Controllers (PLCs) are commonly used to directly interact with sensors and actuators, and perform local automatic control. PLCs run software on two different layers: a) firmware (i.e. the OS) and b) control logic (processing sensor readings to determine control actions). In this work, we discuss ladder logic bombs, i.e. malware written in ladder logic (or one of the other IEC 61131-3-compatible languages). Such malware would be inserted by an attacker into existing control logic on a PLC, and either persistently change the behavior, or wait for specific trigger signals to activate malicious behaviour. For example, the LLB could replace legitimate sensor readings with manipulated values. We see the concept of LLBs as a generalization of attacks such as the Stuxnet attack. We introduce LLBs on an abstract level, and then demonstrate several designs based on real PLC devices in our lab. In particular, we also focus on stealthy LLBs, i.e. LLBs that are hard to detect by human operators manually validating the program running in PLCs. In addition to introducing vulnerabilities on the logic layer, we also discuss countermeasures and we propose two detection techniques.Comment: 11 pages, 14 figures, 2 tables, 1 algorith

Needed: a National Strategy to Preserve Public Research Universities

http://deepblue.lib.umich.edu/bitstream/2027.42/89045/1/2010_Chronicle_Commentary.pd

Firing the Unproductive Employee: Will Civil Service Reform Make a Difference?

Civil service reform included a set of changes intended to facilitate the firing of consistently un productive employees. This article describes the background and logic of these changes, reviews the status of their implementation, and offers preliminary evidence on their consequences for per sonnel management in the federal government.Peer Reviewedhttp://deepblue.lib.umich.edu/bitstream/2027.42/68633/2/10.1177_0734371X8200200208.pd

Exact Computation of Influence Spread by Binary Decision Diagrams

Evaluating influence spread in social networks is a fundamental procedure to estimate the word-of-mouth effect in viral marketing. There are enormous studies about this topic; however, under the standard stochastic cascade models, the exact computation of influence spread is known to be #P-hard. Thus, the existing studies have used Monte-Carlo simulation-based approximations to avoid exact computation. We propose the first algorithm to compute influence spread exactly under the independent cascade model. The algorithm first constructs binary decision diagrams (BDDs) for all possible realizations of influence spread, then computes influence spread by dynamic programming on the constructed BDDs. To construct the BDDs efficiently, we designed a new frontier-based search-type procedure. The constructed BDDs can also be used to solve other influence-spread related problems, such as random sampling without rejection, conditional influence spread evaluation, dynamic probability update, and gradient computation for probability optimization problems. We conducted computational experiments to evaluate the proposed algorithm. The algorithm successfully computed influence spread on real-world networks with a hundred edges in a reasonable time, which is quite impossible by the naive algorithm. We also conducted an experiment to evaluate the accuracy of the Monte-Carlo simulation-based approximation by comparing exact influence spread obtained by the proposed algorithm.Comment: WWW'1

Stealthy Deception Attacks Against SCADA Systems

SCADA protocols for Industrial Control Systems (ICS) are vulnerable to network attacks such as session hijacking. Hence, research focuses on network anomaly detection based on meta--data (message sizes, timing, command sequence), or on the state values of the physical process. In this work we present a class of semantic network-based attacks against SCADA systems that are undetectable by the above mentioned anomaly detection. After hijacking the communication channels between the Human Machine Interface (HMI) and Programmable Logic Controllers (PLCs), our attacks cause the HMI to present a fake view of the industrial process, deceiving the human operator into taking manual actions. Our most advanced attack also manipulates the messages generated by the operator's actions, reversing their semantic meaning while causing the HMI to present a view that is consistent with the attempted human actions. The attacks are totaly stealthy because the message sizes and timing, the command sequences, and the data values of the ICS's state all remain legitimate. We implemented and tested several attack scenarios in the test lab of our local electric company, against a real HMI and real PLCs, separated by a commercial-grade firewall. We developed a real-time security assessment tool, that can simultaneously manipulate the communication to multiple PLCs and cause the HMI to display a coherent system--wide fake view. Our tool is configured with message-manipulating rules written in an ICS Attack Markup Language (IAML) we designed, which may be of independent interest. Our semantic attacks all successfully fooled the operator and brought the system to states of blackout and possible equipment damage

A Pre-Proposal - Summer Faculty Careers Institute for Ph.D. students, Postdoctoral Fellows, and Junior Faculty

http://deepblue.lib.umich.edu/bitstream/2027.42/88564/1/2003_FIPSE_PFF_7.2.pd

Optical characteristics of nanocrystalline AlxGa1-xN thin films deposited by hollow cathode plasma-assisted atomic layer deposition

Cataloged from PDF version of article.Gallium nitride (GaN), aluminum nitride (AlN), and AlxGa(1-x)N films have been deposited by hollow cathode plasma-assisted atomic layer deposition at 200 degrees C on c-plane sapphire and Si substrates. The dependence of film structure, absorption edge, and refractive index on postdeposition annealing were examined by x-ray diffraction, spectrophotometry, and spectroscopic ellipsometry measurements, respectively. Well-adhered, uniform, and polycrystalline wurtzite (hexagonal) GaN, AlN, and AlxGa1-xN films were prepared at low deposition temperature. As revealed by the x-ray diffraction analyses, crystallite sizes of the films were between 11.7 and 25.2 nm. The crystallite size of as-deposited GaN film increased from 11.7 to 12.1 and 14.4 nm when the annealing duration increased from 30 min to 2 h (800 degrees C). For all films, the average optical transmission was similar to 85% in the visible (VIS) and near infrared spectrum. The refractive indices of AlN and AlxGa1-xN were lower compared to GaN thin films. The refractive index of as-deposited films decreased from 2.33 to 2.02 (lambda = 550 nm) with the increased Al content x (0 400 nm). Postdeposition annealing at 900 degrees C for 2 h considerably lowered the refractive index value of GaN films (2.33-1.92), indicating a significant phase change. The optical bandgap of as-deposited GaN film was found to be 3.95 eV, and it decreased to 3.90 eV for films annealed at 800 degrees C for 30 min and 2 h. On the other hand, this value increased to 4.1 eV for GaN films annealed at 900 degrees C for 2 h. This might be caused by Ga2O3 formation and following phase change. The optical bandgap value of as-deposited AlxGa1-xN films decreased from 5.75 to 5.25 eV when the x values decreased from 1 to 0.68. Furthermore, postdeposition annealing did not affect the bandgap of Al-rich films. (C) 2014 American Vacuum Society

Hollow cathode plasma-assisted atomic layer deposition of crystalline AIN, GaN and AI Ga1- N thin films at low temperatures

Cataloged from PDF version of article.The authors report on the use of hollow cathode plasma for low-temperature plasma-assisted atomic layer deposition (PA-ALD) of crystalline AlN, GaN and AlxGa1 xN thin films with low impurity concentrations. Depositions were carried out at 200 C using trimethylmetal precursors and NH3 or N2/H2 plasma. X-ray photoelectron spectroscopy showed the presence of 2.5–3 at.% O in AlN and 1.5–1.7 at.% O in GaN films deposited using NH3 and N2/H2 plasma, respectively. No C impurities were detected within the films. Secondary ion mass spectroscopy analyses performed on the films deposited using NH3 plasma revealed the presence of O, C (both <1 at.%), and H impurities. GIXRD patterns indicated polycrystalline thin films with wurtzite crystal structure. Hollow cathode PA-ALD parameters were optimized for AlN and GaN thin films using N2/H2 plasma. Trimethylmetal and N2/H2 saturation curves evidenced the selflimiting growth of AlN and GaN at 200 C. AlN exhibited linear growth with a growth per cycle (GPC) of 1.0 A. For GaN, the GPC decreased with the increasing number of deposition cycles, indicating ˚ substrate-enhanced growth. The GPC calculated from a 900-cycle GaN deposition was 0.22 A. ˚ Ellipsometric spectra of the samples were modeled using the Cauchy dispersion function, from which the refractive indices of 59.2 nm thick AlN and 20.1 nm thick GaN thin films were determined to be 1.94 and 2.17 at 632 nm, respectively. Spectral transmission measurements of AlN, GaN and AlxGa1 xN thin films grown on double side polished sapphire substrates revealed near-ideal visible transparency with minimal absorption. Optical band edge values of the AlxGa1 xN films shifted to lower wavelengths with the increasing Al content, indicating the tunability of band edge values with the alloy composition

Teaching Key Competencies in Liberal Arts Education

The study of the liberal arts provides an exemplary arena for students to become active learners. The complexity of modern society requires a broader understanding of societal problems rather than a specialized one. Real problems are multifaceted and demand multifaceted solutions. Engaging students in the study of the liberal arts can provide a basis for lifelong learning and civic involvement.Peer Reviewedhttp://deepblue.lib.umich.edu/bitstream/2027.42/34808/1/2_ftp.pd

Stress response inside perturbed particle assemblies

The effect of structural disorder on the stress response inside three dimensional particle assemblies is studied using computer simulations of frictionless sphere packings. Upon applying a localised, perturbative force within the packings, the resulting {\it Green's} function response is mapped inside the different assemblies, thus providing an explicit view as to how the imposed perturbation is transmitted through the packing. In weakly disordered arrays, the resulting transmission of forces is of the double-peak variety, but with peak widths scaling linearly with distance from the source of the perturbation. This behaviour is consistent with an anisotropic elasticity response profile. Increasing the disorder distorts the response function until a single-peak response is obtained for fully disordered packings consistent with an isotropic description.Comment: 8 pages, 7 figure captions To appear in Granular Matte