Abstract
Cyber-physical systems (CPSs) are ubiquitous in critical areas as diverse as public infrastructure (e.g., water treatment, water distribution, and power grid), autonomous vehicles, and aerospace. The serious consequences of such systems malfunctioning or being maliciously attacked have led to numerous defense mechanisms. These typically rely on models (e.g., a formal model or a series of invariants) for reasoning about the behavior of CPSs, and can be derived manually or generated using some machine learning techniques. As computational and physical processes are deeply intertwined in CPSs, it can be very difficult to construct accurate enough models manually, motivating automated solutions. However, existing solutions for CPSs tend to be limited to unsupervised learning scenarios that solely recognize the inherent structure of the data set, often requiring the existence of large amounts of data and additional restrictions to work as anomaly detectors. Furthermore, the evaluation of these techniques requires a set of attacks, while manually constructing these is time-consuming. In this thesis, we propose and evaluate three new techniques to bring us closer to automating the defense and analysis of CPSs. First, we propose an approach for attestation, i.e. for checking that the control code of a system has not been changed. This is achieved through a supervised machine learning approach, in which faults are automatically seeded into PLC code to provide the abnormal data. Second, we propose an approach for assessment, in which predictive machine learning models and metaheuristic search are used together to construct benchmarks of attacks for evaluating defense mechanisms. Finally, we propose active fuzzing, an approach for constructing packet-level attack benchmarks, using active learning to avoid the need for lengthy (and unrealistic) pre-training. We evaluated our techniques on real-world water purification and distribution plants, finding that the attestation approach can detect 47 of 55 network and code modification attacks, and the assessment approaches can find multiple attacks at different levels of the network that drive the plants into 27 different unsafe states.