Bernhard Schneidhofer

Stephen Wolthusen

MULTIGRAPH CRITICAL INFRASTRUCTURE MODEL

Keywords: Infrastructure dependency analysis, multigraph model, attack modeling

Interdependencies between critical infrastructures have been studied widely, but largely at the abstract and structural levels with an emphasis on large infrastructure networks and frequently their stochastic properties. However, an in-depth understanding of infrastructure interdependencies and the likely impact of degradation of selected elements are important for an adversary intent on maximizing attack efficiency. This chapter describes a simple multigraph model for several classes of interdependent critical infrastructure elements and an attack tree model with attribute domains extended by acyclic phase-type distributions to capture temporal dependencies. The efficacy of this modeling approach is demonstrated via a case study involving regional interdependent infrastructures that include the electric power, water and telecommunications sectors in a bounded region. The case study uses extensive simulations to demonstrate that an adversary with access only to publicly-available information and the ability to analyze a multigraph model can cause severe harm.

Introduction

Considerable research has been devoted to understand dependencies and interdependencies between critical infrastructures, including approaches that leverage graph models and graph metrics and algorithms to determine the criticality of infrastructure elements [START_REF] Cadini | Using centrality measures to rank the importance of the components of a complex network infrastructure[END_REF]. Such dependencies may extend to multiple levels and result in cascading effects [START_REF] Kotzanikolaou | Assessing n-order dependencies between critical infrastructures[END_REF] that, in turn, can form the basis of risk assessment and mitigation mechanisms [START_REF] Stergiopoulos | Risk mitigation strategies for critical infrastructures based on graph centrality analysis[END_REF].

It is frequently of interest to understand how infrastructure sectors and elements in the sectors interact in a heterogeneous infrastructure network rather than considering infrastructure elements as a single, homogeneous structure. This has been studied previously with particular emphasis on the interconnections between the electric power and information infrastructures [START_REF] Beccuti | Multilevel dependability modeling of interdependencies between the electricity and information infrastructures[END_REF][START_REF] Svendsen | Multigraph dependency models for heterogeneous infrastructures[END_REF].

However, many vulnerability effects resulting from disruptions are not immediately visible from a mere study of the connectivity between components; instead, they require the explicit consideration of dependency links [START_REF] Dong | Robustness of network of networks with interdependent and interconnected links[END_REF]. It is important to note that it is not only different infrastructure sector networks that exhibit such properties, but that the effects also arise from other aspects such as proximity [START_REF] Abdalla | Location-Based Critical Infrastructure Interdependency (LBCII)[END_REF] and clustering of embedded sub-networks [START_REF] Bashan | The extreme vulnerability of interdependent spatially embedded networks[END_REF]. At the same time, most research on susceptibility to attacks has concentrated on homogeneous networks [START_REF] Iyer | Attack robustness and centrality of computer networks[END_REF], with some work explicitly considering attacks on individual sub-networks [START_REF] Kelic | Cyber and Physical Infrastructure Interdependencies[END_REF] and their join structures [START_REF] Weldehawaryat | Modeling interdependencies over incomplete join structures of power law networks[END_REF].

A natural question that arises from this research is whether the models may be employed to identify attack vectors or, conversely, targets that require particular attention because their loss could have disproportionate effects. In an attempt to answer this question, this research enhances earlier work on multigraph models [START_REF] Svendsen | Multigraph dependency models for heterogeneous infrastructures[END_REF] by a constructive mechanism for attack vector identification. Specifically, attack trees with attribute domains proposed by Kordy et al. [START_REF] Kordy | Foundations of attack-defense trees[END_REF] are extended by acyclic phase-type distributions proposed by Arnold et al. [START_REF] Arnold | Time-dependent analysis of attacks[END_REF] to capture temporal dependencies [START_REF] Arnold | Time-dependent analysis of attacks[END_REF]. A key contribution of this chapter is the use of an extended case study that engages open-source intelligence for a bounded region comprising the electric power, water supply and telecommunications sectors to validate the proposed modeling approach. The approach provides a lower bound on an adversary's ability to identify vulnerable structures and dependencies. The results demonstrate that even with modest effort it is possible to construct attack scenarios that have significant impacts.

Modeling Framework

It is relatively straightforward to divide an infrastructure (sector) network into structural and functional aspects. For example, a water supply system can be expressed as a topology of pumping stations and interconnecting pipes as well as annotations (capacities and gradients), while the functional aspect can be represented as network flows. Both aspects can be subjected to disturbances such as stochastic failures, constraints and deliberate attacks.

Based on the work of Svendsen and Wolthusen [START_REF] Svendsen | Multigraph dependency models for heterogeneous infrastructures[END_REF][START_REF] Svendsen | Modeling approaches, in Critical Infrastructure Protection[END_REF], a heterogeneous infrastructure network is formally defined as a graph N whose vertex set V (N ) = {v 1 , . . . , v k } comprises components (nodes) capable of producing, storing or consuming services of fungible resources that flow through the network. Each pairwise dependency between nodes is represented as an arc whose head node is dependent on the tail node. Appropriate differentiation between types of services is achieved by introducing dependency types.

A dependency type is a type of interaction between two vertices. This can either be the delivery of a service or a fungible resource. The set of dependency types {d 1 , . . . , d m } is denoted by D. The i th arc carrying dependency type d j between two vertices v a and v b is uniquely defined as (v a , v b ) j i . The corresponding arc set is:

A = {(v 1 , v 2 ) 1 1 , . . . , (v k-1 , v k ) m e (k-1,k,d) } where e (k-1,k,d) is the number of arcs from v k-1,k to v k of type d m .

Individual Infrastructure Graphs

An infrastructure network can also be partitioned as proposed by Johansson and Hassel [START_REF] Johansson | Vulnerability analyses of interdependent technical infrastructures[END_REF] with an additional static hierarchical layer inserted to facilitate evaluation as illustrated in Figure 1.

To derive the functional model, the structural model is evaluated to identify the physical, cyber and logical dependencies as well as the dependency types. External strain to the model can be applied in two ways: (i) structural strain; and (ii) functional strain. Structural strain, such as the complete failure of a substation in an electric power network, corresponds to the removal of a component in the graph. Functional strain can be represented by changing the system constraints and evaluating the changes in generation, supply and demand.

Interdependent Infrastructures

To obtain an interdependence model, various structural models of the critical infrastructure sectors are merged into a single structural model via the multigraph representation with suitable join structures. This requires the evaluation of each individual infrastructure with respect to all others in order to identify and add structural dependencies between them when necessary.

Modeling Approach

A bounded region in Austria was chosen to validate the model and, especially, attack mechanism discovery. The pertinent data sets came from a geographical information system set up as part of the INSPIRE Project as required by European Council Directive 2007/2/EC [START_REF]Council of 14 March 2007 Establishing an Infrastructure for Spatial Information in the European Community (INSPIRE)[END_REF] as well as maps and cartographical

Electric Power Sector Model

Geographical information system data of the target area and additional map overlay layers for electric grids were the basis for the electric power sector model. Over the course of two weeks in March 2015, a dedicated field survey was conducted in the target area to verify and supplement the model data. Table 1 provides an overview of the acquired data. Note that denotes available, P partially available and N/A not applicable.

The structural model of the electricity sector comprises 543 nodes and 603 edges with five voltage levels ranging from 20 kV to 380 kV. The nodes represent substations, power stations and power line junctions, and the edges represent power lines (overhead and underground). The total nominal power generation capacity of all the power stations in the model is 1,012.33 MW.

The graph of the functional model comprises directed edges that represent chains of up to seven wind turbines connected in series to a single busbar. Figure 2 shows the mixed graph of the functional and structural models. The graph of the functional model is traversed in a breadth-first manner starting at substations and terminating at each reachable wind turbine to calculate simulation values (e.g., available nominal generation capacity values). Each wind turbine is a closed-loop control system that is dependent on an embedded microcomputer. The cyber dependencies are modeled as 427 additional directed dependency edges from the electric power sector model to the telecommunications and SCADA sector models.

Water Sector Model

Information pertaining to the water sector model was obtained from the regional water distribution system operator and from self-supplying municipalities. Table 2 provides an overview of the acquired information. Note that denotes available, P partially available and N/A not applicable.

The structural model of the water sector is based on cartographic data of the water system and pipe network supplied by the water distribution system operator. In total, the water network is represented in terms of 178 nodes and 194 edges. The nodes correspond to wells, purification plants, pressure booster stations, reservoirs and pipe junctions. Edges represent different kinds of water pipes. The graph representation of the functional model was derived from the logical operation and water flow directions of the system in its nominal operating mode. The supplementary functional model of the water distribution system is expressed as a capacity model that considers in-feed node capacity and load node demand. The consequences arising from system strain were estimated using breadth-first searches. Note that wells, purification plants and pressure booster stations need electricity to function. The electric power grid has 49 20 kV power junctions that supply the water nodes and create physical dependencies between the electric power and water sectors.

Telecommunications Sector Model

Data for the telecommunications sector was sourced from network backbone planning documentation in the target area and supplemented by planning documents from wind turbine operators and the electric power telecommunications network operator; this data was referenced to a geographical information system. The structural model comprises 434 vertices and 466 edges. The vertices represent network backbone nodes, wind turbine closed-loop control systems, SCADA command centers and substation network nodes; and the edges represent various types of telecommunications cables. The functional model of the telecommunications sector is not expressed in terms of dependency edges, but functionally as executable code. Each wind turbine intelligent electronic device is considered to be functional if there is a communications path between the device and its operator's SCADA center or substation. Five dedicated SCADA centers belonging to the involved wind farm operators and thirteen substation telecommunications centers were identified from the gathered information.

System Analysis

The model described above was used to conduct a vulnerability analysis. This, in turn, was used to construct attack scenarios based on the reference scenario presented in Section 5. In order to be able to triage attack scenarios, it was necessary to obtain additional information about the operating parameters because the basic model retains only relatively coarse information that does not allow the effective ranking of candidate attacks. The analysis presented below was performed using a mixed discrete event simulation approach.

Global Vulnerability Analysis

A global vulnerability analysis was conducted to obtain an overview of the vulnerabilities present in the modeled systems, the associated consequences Electric Power and Water Supply Interaction. Figure 3 shows the strain in the form of random vertex removal applied to the electric power sector and water sector models (mean values computed after 100 iterations). From a vulnerability point of view, it can be argued that the electricity system is more robust to strains than the water system. In Figure 3 (top), it can be seen that random vertex removal in the electricity model also has a significant impact on the water supply. When 20% of the vertices in the electricity model are removed, about 6% of the consumers also lose their water supply. On the other hand, Figure 3 (bottom) shows that there is no dependency of the electricity system on the water sector.

Figure 4 shifts the perspective to the global system (mean values computed after 100 iterations). Figure 4 (top) shows the total consequences -consumers who lose electricity and/or water supply when the model is exposed to strain in either sector. The total consequences are roughly equal up to the random removal of 22% of the nodes in either sector. After this threshold, random node removal in the power sector has higher overall consequences. Figure 4 (bottom) shows the results of an analysis in which nodes are randomly removed from both model components. The results show that, until 35% of the infrastructure nodes are removed, there are slightly higher consequences to the water sector than the electric power sector; beyond this threshold, the situation reverses.

Power Generation. Figure 5 shows the consequences in terms of the total nominal power output lost due to the wind turbines affected by the random removal of nodes in the electric power and telecommunications sectors. Interestingly, random removal of 10% of the nodes in the electricity model results in a lost nominal power output of about 300 MW, whereas the same 10% removal in the telecommunications model results in nearly 600 MW of lost nominal power output. In an attack scenario that is only concerned with this single consequence measure, targeting the telecommunications sector would be approximately twice as effective as targeting the electricity sector.

Critical Node Analysis

An attacker would be interested in identifying the weakest elements or largest consequence measures, including those resulting from cascading effects, in order to choose effective attack scenarios. Critical node analysis can offer valuable insights into attack selection. Note that, in this work, the search is restricted to dual simultaneous node failures instead of employing a more complex heuristic that would require 700,000 iterations.

Water and Power Supply. Table 3 lists the top five combinations for simultaneous failures in the electric power (P) and water (W) sectors. Also, it provides information about the strained nodes and consequences. The dual failure scenarios are dominated by the failure of Substation 2721, which supplies

Wind Turbine Attack Scenario

Based on the exploration in Section 4, the possibilities of interrupting power generation in the target area by attacking wind turbine telecommunications facilities and their control system networks are discussed. The attack goal for the wind turbine SCADA scenario is defined as follows:

Power Grid Frequency Impact: The attack goal is set at 75 MW of power generation capacity to become unavailable within 30 seconds. This value corresponds to the primary control mechanism in the Austrian power grid [START_REF] Steyrer | Threat of Austrian Energy Supply through Smart Metering and Smart Grid (Bedrohung der Osterreichischen Energieversorgung durch Smart Metering und Smart Grid)[END_REF]. A sudden loss of this magnitude would have a significant impact on the grid operation frequency [START_REF] Grigsby | The Electric Power Engineering Handbook[END_REF].

Targeting a Wind Turbine System

The standard security approach in modern industrial networks is physical separation (i.e., air gap security), which is not a viable concept in this scenario. The real situation involves various electricity and telecommunications connections that bridge the gap in order to provide the required information, control and management functionality [START_REF] Knapp | Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA and Other Industrial Control Systems[END_REF]. For the scenario at hand, the following three main attack paths for gaining access to the control networks are identified:

VPN and Remote-Dial-In: Several wind turbine systems operate with backup telecommunications access via vulnerable virtual private network solutions over ISDN and leased lines.

Maintenance and Control Panels: In some instances, the standard set-up for a wind turbine facility is altered with external control boards. The display cases are easily accessible at the ground level and make it simple to obtain physical access.

Webcams and Video Surveillance: Several wind turbines in the target area are equipped with network cameras on top of their towers and entrance-area video surveillance cameras. In a limited number of cases, the cameras are connected to the control network and the camera administration web interfaces are directly available on the Internet via public IP addresses.

After access to the control network of a wind turbine system has been obtained, a variety of attacks ranging from man-in-the-middle to denial-of-service are possible. Figure 6 shows a standard network setup for a wind farm. The individual implementation details differ from model to model, but the overall design is similar.

Targeting Multiple Wind Turbines

Targeting a single wind turbine is inadequate to realize the scenario goal of causing a generation loss of 75 MW in a short timeframe. The following vulnerabilities could be leveraged to target multiple wind turbines at the same time:

Wind Farm Control PLC/RTU: An attack on a wind farm control unit would enable the attacker to control a portion of the wind turbine control system. In the scenario at hand, this would result in a power loss of 18 to 30 MW for a single wind farm.

SCADA Center: If access to the control network can be gained, it is feasible to target systems at a higher level from the supervisory network portion. This would influence a much larger number of wind turbines. Safety Policies: A legal requirement has a profound impact on the operating requirements for wind turbines. Specifically, to protect against ice shedding, it is inadequate to shut down a single affected wind turbine because the adjacent turbines may also suffer from icing. As a result, forced emergency shutdown commands must be sent to all the turbines in the vicinity. Re-starting each affected turbine requires manual intervention by a technician.

Attack Modeling

Detailed attack trees for the scenario were constructed to further explore the possible attacks on the control network. In particular, two different types of attack trees were employed: (i) attack-defense trees with attribute domains [START_REF] Bagnato | Attribute decoration of attack-defense trees[END_REF][START_REF] Kordy | Foundations of attack-defense trees[END_REF]; and (ii) acyclic phase-type distributions [START_REF] Arnold | Time-dependent analysis of attacks[END_REF]. Figure 7 shows a portion of the attack-defense tree for the scenario. The attribute domains correspond to the minimal execution time and difficulty for the attacker. Assuming the sequential execution of attack steps, an attacker would need 41.5 hours for a successful attack or 21 hours assuming parallel execution. Some of the evaluated scenario variants only require intermediate technical skills.

For further evaluation, the basic attack-defense tree was translated to the acyclic phase-type distribution formalism as shown in Figure 8. The main differences are the addition of sequential logic gates that model time dependencies and the absence of defense steps. Each basic attack step execution time is fitted to an exponential distribution. After the attack tree construction is complete, it can be converted into an acyclic phase-type distribution.

As an illustration of the possible cases that can be explored, Figure 9 presents the difference in attack probabilities and the time needed for a successful attack caused by adjusting the attack model for two of the calculated scenario variants. Specifically, Figure 9 (top) shows the successful attack probabilities of the standard scenario compared with a scenario variant without control panel vulnerabilities. Figure 9 (bottom) shows the successful attack probabilities of the standard scenario compared with a scenario variant with strong network message authentication in place. This approach also facilitates the evaluation of countermeasures and defense steps.

A sensitivity analysis was conducted to determine the basic attack steps that have the greatest impact on the overall scenario. Table 5 presents the results. After an initial calculation of the attack tree, for each basic attack step, another calculation was performed with twice the estimated execution time and the results are compared against the standard scenario. It is clear that the attack steps with the greatest impact are discovering the composition of the shutdown message, sending forged authenticated messages to the control network and accessing the control network via the control panel.

Conclusions

The multigraph model presented in this chapter is specifically designed for modeling critical infrastructure interdependencies and conducting analyses of diverse attack scenarios. The approach leverages an attack tree model with attribute domains extended by acyclic phase-type distributions to capture temporal dependencies. The efficacy of the modeling approach is demonstrated via a case study involving regional interdependent infrastructures that include the electric power, water and telecommunications sectors. The case study, which incorporates global vulnerability and critical node analyses and simulations of degradation and attack candidates, enables the largely automatic triage of attack scenarios. A key contribution is the use of open-source intelligence to validate the proposed modeling approach; the results provide a lower bound on an adversary's ability to identify vulnerable structures and dependencies. All the steps in the case study, including the development and analysis of the model and attack scenarios are solely based on information available to the general public. This strongly suggests that an attacker with modest resources would be able to achieve large-scale effects.

Future work will develop effective search heuristics to permit the exploration of longer attack chains (length greater than two). This restriction is currently imposed by a bounded, but exhaustive, search as well as buffering effects. While the proposed work may not be directly applicable to the infrastructure sectors considered in this chapter, buffering and explicit flows allow the inclusion of temporal dynamics for other types of infrastructures.

Figure 1 .

 1 Figure1. Modeling a single infrastructure (adapted from[START_REF] Johansson | Vulnerability analyses of interdependent technical infrastructures[END_REF]).

Figure 2 .

 2 Figure 2. Combined structural and functional models for the electric power sector.

Figure 3 .

 3 Figure 3. Estimated consequences following random vertex removal.

Figure 4 .

 4 Figure 4. Total consequences following random vertex removal.

Figure 5 .

 5 Figure 5. Power generation consequences (electricity and telecommunications).

Figure 6 .

 6 Figure 6. Wind turbine control system network (illustration by Arne Nordmann).

Figure 9 .

 9 Figure 9. Comparisons of the probabilities of successful attacks.

Table 1 .

 1 Openly-available information about the electric power sector.

					Information Areas
	Categories	Substations	Grid Groups	Power Supply	Lines	Power Line	Specifications	Transformers	Busbars	Power	Generation	Power	Consumption	Geographical	Location
	380 kV									N/A.	P
	220 kV									N/A	P
	110 kV								P	N/A
	Power Stations N/A
	Load Nodes	N/A								N/A
	information provided by the Austrian Federal Office for Metrology and Sur-
	veying and the System Study Model provided by the European Network of
	Transmission System Operators for Electricity (ENTSO-E) [16].

Table 2 .

 2 Openly-available information about the water sector in the target area.

						Information Areas
	Facilities	Generation	Capacity	Throughput	Capacity	Storage	Capacity	Flow	Direction	Technical	Specifications	Power Grid	Connection	Water	Consumption	Geographical	Location
	Wells									P			N/A
	Purification									P			N/A
	Pressure Booster Stations									P			N/A
	Reservoirs									P			N/A
	Pipes	N/A			N/A					N/A N/A
	Load Nodes	N/A N/A N/A N/A	P	P

Table 3 .

 3 Top five subsets of critical components for simultaneous failures (P + W).

		System	Strained Nodes	Consequences	Total
	Rank	{Component}	Total (P + W)	P + W	Consequences
	1 2 3 4 5	P {2721}, P {2742} P {2721}, P {2738} P {2721}, W {3735} P {2721}, P {2744} P {2721}, P {2835}	4 (2+2) 4 (2+2) 16 (1+15) 2 (2+0) 3 (2+1)	18512 + 7269 17623 + 6293 14787 + 8964 23610 + 0 14787 + 8759	25781 23916 23751 23610 23546
	electricity to a number of nearby cities and enables a number of further scenarios
	with greater consequences. Around 75% of all computed dual failure scenarios
	have consequences in a single sector and roughly 12% of all scenarios have no
	consequences to electricity or water supply.

Table 4 .

 4 Top five subsets of critical components for simultaneous failures (T + P).

			Strained Nodes	Consequences
	Rank System {Component}	Total (T + P)	Power Generation
	1 2 3 4 5	P{2770}, P {2849} P{2770}, T {4369} P{2770}, P {2715} P{2770}, T {4333} P{2770}, P {2719}	7 (5+2) 5 (3+2) 86 (2+84) 85 (2+83) 126 (3+123)	795.35 MW 795.35 MW 694.35 MW 694.35 MW 647.70 MW
	Power Generation.

Table 4

 4

lists the top five combinations for simultaneous failures in the telecommunications (T) and electric power (P) sectors that result in severe consequences to the power generation grid group. The top five list is dominated by the top ranking single critical component, Electricity Node 2770, which supplies the SCADA center that manages the largest number of wind turbines. This readily identifies a measure for enhancing resilience.

Table 5 .

 5 Wind turbine sensitivity analysis.

	Basic Attack Step	After	After	After
		20 hours 30 hours 40 hours
	Brute force webcam	+1.08%	+0.65%	+0.23%
	Gain control panel access	+9.30%	+4.72%	+1.55%
	Crack VPN access	+3.45%	+1.97%	+0.68%
	Conduct offline reconnaissance	+0.01%	+0.01%	+0.00%
	Sniff Ethernet/IP traffic	+ 0 . 3 4 %	+ 0 . 1 6 %	+ 0 . 0 5 %
	Sweep DNP3 requests	+0.08%	+0.04%	+0.01%
	Capture EtherCAT frames	+0.34%	+0.16%	+0.05%
	Enumerate SCADA services	+5.20%	+2.48%	+0.79%
	Sniff credentials	+4.88%	+2.67%	+0.90%
	Forge authenticated messages	+7.99%	+4.11%	+1.35%
	Bribe operator	+1.42%	+0.83%	+0.29%
	Intercept similar message	+1.76%	+1.46%	+0.70%
	Construct attack from traffic and documentation	+23.39%	+13.60%	+4.81%

Figure 7. Partial attack-defense tree for the wind turbine scenario.

Figure 8. Partial attack tree for the wind turbine scenario (time-dependent).


Owen Redwood

Jason Reynolds

Mike Burmester

Integrating Simulated Physics and Device Virtualization in Control System Testbeds

Keywords: Cyber-physical systems, control systems, testbeds, virtualization CRITICAL INFRASTRUCTURE

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cyber-physical systems are computational systems that monitor and control physical systems; they encompass control systems, sensor-based systems, autonomous systems, robotic systems as well as higher-level supervisory, control and human-in-the-loop systems. These complex, specialized and diverse systems exist at the core of industrial control systems, critical infrastructure assets, operational technology networks and other utility networks. Hardware-based cyber-physical system testbeds often are expensive to design and maintain, especially in the case of critical infrastructure assets. This primarily limits removing malicious files or payloads from affected operational technology systems may not restore their overall functionality. Advances in physics simulation and microprocessor emulators and simulators can address these barriers.

This research has two main contributions. The first is a detailed simulated physics and embedded virtualization integration (SPAEVI) methodology that marries physics simulation advances with microprocessor virtualization, emulation and simulation to enhance industrial control system testbed capabilities. The second is the detailed implementation of the SPAEVI methodology that integrates a virtualized Siemens MJ-XL voltage regulator control panel within a medium-fidelity physics simulation of arbitrary electric grids with GridLAB-D.

Related Work

This work builds on previous research [START_REF] Redwood | A symbolic honeynet framework for SCADA system threat intelligence[END_REF]. Also, it leverages the testbed taxonomy presented in [START_REF] Thornton | Enhancing a virtual SCADA laboratory using Simulink[END_REF], where operational technology networks and systems are broken down into four layers:

Layer I: Sensors and actuators.

Layer II: Distributed controllers, which include programmable logic controllers (PLCs), intelligent electronic devices (IEDs) and other forms of programmable automation controllers (PACs).

Layer III: Supervisory and control systems, which encompass systems that store process data and implement control schemes that manage the lower levels.

Layer IV: Human-machine interfaces (HMIs), which enable human operators to manage physical processes.

The methodology presented in this chapter requires the virtualization of real firmware and software at Layers II, III and IV, although fully virtualized grid networks are not necessary to realize the benefits of the methodology. Physics simulation is integrated in Layer I. The remainder of this section discusses previous work related to the four layers.

Testbeds

A number of SCADA testbeds have been developed by academic, government and private entities [START_REF] Davis | SCADA cyber security testbed development[END_REF][START_REF] Dondossola | Supporting cyber risk assessment of power control systems with experimental data[END_REF][START_REF] Giani | A testbed for secure and robust SCADA systems[END_REF]. The testbeds are used to find new vulnerabilities; train engineers, incident responders and researchers; analyze attack patterns, footprints and impacts; and develop innovative defenses. Testbeds commonly fall into two categories: (i) real grid testbeds; and (ii) simulated grid testbeds that commonly engage a real-time digital simulator for physics simulations and digital-to-analog signal generators to support cyber-physical hardware integration. Generally, both groups focus on hardware-in-the-loop testing in Layers II and III, and, thus, inherit all the aforementioned limits related to vulnerability analysis, malware analysis, etc.

The most notable testbed is the National SCADA Test Bed (NSTB). This testbed, which comprises 17 test and research facilities, incorporates realisticscale control systems ranging across 61 miles of 138 kV transmission lines, seven substations and various modeling tools. It connects other testbeds such as the Critical Infrastructure Test Range at Idaho National Laboratory, Center for SCADA Security at Sandia National Laboratories, Energy Infrastructure Operations Center at Pacific Northwest National Laboratory and facilities at Oak Ridge and Argonne National Laboratories. These testbeds largely rely on real hardware for Layers I and II, and real software for Layer IV. Layer III incorporates a mix of real and virtualized systems.

Joint academic and industry testbeds include ExoGENI-WAMS-DETER at North Carolina State University [START_REF] Chakrabortty | DETER-WAMS-ExoGENI testbed for wide-area monitoring and control of power systems using distributed synchrophasors[END_REF], DETERLab at the University of Southern California and the Trustworthy Cyber Infrastructure for the Power Grid facility at the University of Illinois.

The ExoGENI-WAMS-DETER testbed has two layers. The first layer is a hardware-in-the-loop setup comprising a real-time digital simulator integrated with phasor measurement units from multiple vendors. The second is a cloudbased virtual network based on ExoGENI+DETER to enable the simulation, observation and management of arbitrary network topologies of phasor measurement units using a real-time digital simulator to generate physics inputs. The ExoGENI and DETER laboratories provide virtual networking of arbitrary topologies to simulate power grid networks at any scale.

The Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) is a large, diverse initiative that focuses on all areas of grid security research from power generation and transmission to distribution and metering. It incorporates a real-time digital simulator for hardware-in-the-loop testing. Also, it has a virtual power system testbed discussed below, which is a notable exception to the categorization above.

Thornton and Morris [START_REF] Thornton | Enhancing a virtual SCADA laboratory using Simulink[END_REF] maintain that the testbeds described above are not portable, expandable or distributable. Furthermore, only researchers with hands-on access to the testbeds are able to perform research using the resources.

Physics Simulations

Commonly-used simulation software for electric power grid security research include GridLAB-D, MATLAB Simulink and PowerWorld.

The Trustworthy Cyber Infrastructure for the Power Grid's Virtual Power System Testbed (VPST) utilizes PowerWorld software for its physics simulations, real components for hardware-in-the-loop testing and the VPST-C simulator to model computer hardware, software and communications infrastructures. The VPST approach simplifies grids by fitting all devices, software and processes to the ISO model. However, it does not appear to support embedded system virtualization at Layer II [START_REF] Bergman | The virtual power system testbed and inter-testbed integration[END_REF].

Thornton and Morris [START_REF] Thornton | Enhancing a virtual SCADA laboratory using Simulink[END_REF] present a software-based approach for virtual SCADA laboratory design utilizing Simulink. However, this work does not involve the full virtualization of Layer II systems; instead, it only provides a simulation of the ladder logic code of programmable logic controllers. Therefore, the approach may not enable the testing and analysis of real zero-days, exploits and malware designed for programmable logic controllers, such as the infamous, still-unpatched, ladder logic remote code execution (RCE) vulnerabilities [START_REF] Leverett | Vulnerability inheritance in programmable logic controllers[END_REF]. Nevertheless, Thornton and Morris provide valuable discussions of process simulation, programmable logic controller emulation and analysis that are relevant to this work.

Redwood et al. [START_REF] Redwood | A symbolic honeynet framework for SCADA system threat intelligence[END_REF] have developed a physics simulation integrated with Layer III and IV devices for real-time anomaly detection based on changes to the physics. GridLAB-D was utilized to simulate the physics and real software was used for the human-machine interface and smart IEC 68150 switch implementation. The advantage of physics-based intrusion detection is that attacks can be detected regardless of their stage, properties or vectors, and sabotagebased attacks can be identified regardless of whether they are delivered by sophisticated zero-day exploits or script kiddies who manipulate human-machine interfaces. However, GridLAB-D suffers from poor fidelity in terms of physics simulations and cannot model phasors, harmonics and other transients in real time.

Approaches that utilize real-time digital simulators for physics simulations to support hardware-in-the-loop testing are not modular, portable or distributable. However, they do offer physics simulations at the highest levels of fidelity.

Emdedded Virtualization

Embedded virtualization is a relatively small, but rapidly growing field. Its primary applications are smartphones and tablets, aerospace avionics (with the PikeOS hypervisor) and automobiles (Automotive Open System Architecture).

Operational technology systems vary significantly in hardware and software compared with information technology systems. Operating systems that are common in operational technology deployments include variants of Linux, Vx-Works, Windows Embedded, dozens of propietary operating systems and realtime operating systems, raw firmware level binaries, and so on.

Hardware options span processor families from Intel, ARM, Atmel, Texas Instruments, IBM PowerPC, Motorola Freescale, MIPS, Siemens C166, Hitachi/Renesas and numerous peripherals and analog devices. With the notable exception of SATCOM's space plug-and-play architecture (SPA) driver model, embedded cyber-physical system peripherals, sensors and actuators do not follow a plug-and-play driver model and, therefore, require individual attention. As a result, embedded system virtualization solutions for industrial control and SCADA systems are not widespread.

Adopting and/or modifying an architecture emulator or simulator may be necessary to virtualize a target device. An emulator is designed to recreate the original functionality of target hardware. Software executing on an emulator should perform exactly as if it were running on the target hardware. Simulators are designed to recreate the original functionality of the software or hardware, and are, thus, imitations. The end results are often very similar, but the im- plementations of emulators and simulators are very different. Emulators often meet the requirements for virtualizing embedded systems, but many commercial simulators are considered to be compatible if they simulate enough of the underlying hardware.

Embedded emulation is historically associated with in-circuit emulation, which involves the use of a hardware device (e.g., JTAG debugger) or in-circuit emulator to debug the software on the embedded hardware. For the purpose of this work, it is considered to be a pure software-based emulation, because it involves no hardware. Several embedded system emulation options exist; the most notable is the open-source Multi Emulator Super System (MESS), which is the basis for the Multiple Arcade Machine Emulation (MAME) Project.

While embedded system virtualization is not new, the simulated physics and embedded virtualization integration (SPAEVI) methodology presented in this chapter is novel in that it combines embedded virtualization and simulated physics. It builds on previous work [START_REF] Redwood | A symbolic honeynet framework for SCADA system threat intelligence[END_REF] and offers several benefits beyond traditional virtualization technologies.

SPAEVI Methodology

The simulated physics and embedded virtualization integration (SPAEVI) methodology is designed to produce portable, expandable and distributable software-based testbeds, primarily for embedded systems. Thus far, SPAEVI efforts have focused on single-core embedded systems; multi-core embedded systems impose additional challenges that are outside the scope of this work. Embedded virtualization is not new; however, the novel, methodical integration of a physics simulator with virtualized embedded systems is the core of the SPAEVI methodology. This section provides details about the methodology and presents a proof-of-concept implementation and experimental results.

Overview

Figure 1 presents the SPAEVI methodology workflow. The first step in the methodology is to acquire the firmware for the target device and know the processor(s) on which it executes. Vendors typically release firmware patches online; however, most vendors do not disclose any details about the processors that execute the firmware. In the event customer service or online research do not reveal processor details, the target hardware can be inspected to read the identifying numbers on the processors.

Reverse Engineering Requirements

This section outlines the SPAEVI tasks that satisfy the reverse engineering requirements for each device.

Understanding Machine-Specific Register Usage. Machine-specific registers are significant to the SPAEVI methodology because they are used to locate the lowest levels of the embedded firmware at which sensor inputs and actuator outputs occur. Processors have unique registers, dubbed machinespecific registers, outside the general purpose register set that are used for a variety of internal and external tasks, including timing, I/O, exceptions, chip selects, addressing, ports, watchdogs and more. By studying the processor user manual, it is possible to identify the machine-specific registers that facilitate I/O.

Accessing the machine-specific registers usually involves: (i) special instructions; or (ii) a fixed region of addressable memory that is reserved for the internal functionality of the processor. In the latter case, the high end (0xFFF...) region of memory is typically reserved for machine-specific registers in most systems. Furthermore, these registers are typically given unique titles for each processor. However, all the non-general-purpose registers are typically identified as machine-specific registers.

In the case of special instructions, machine-specific registers may appear in disassembled code with unique mnemonics, but are often executed only in the privileged or supervisory modes. Malware analyses of x86 systems generally do not focus on the machine-specific registers because malware typically resides outside low-level drivers, the BIOS and kernel code.

In the case of fixed memory machine-specific registers, the registers typically do not appear in a disassembler with unique mnemonics, but instead can be identified by the region of addressable memory they occupy.

Understanding how firmware uses the machine-specific registers for I/O requires the enumeration of the machine-specific registers of the processor that facilitate I/O, followed by their enumeration in the disassembled firmware. This enables the machine-specific registers that are not utilized by the device firmware to be excluded from further consideration. After enumerating the machine-specific registers that facilitate I/O, it is necessary to reverse engineer "up" the cross-reference chain from the drivers and subroutines in order to map and understand how the registers are actually used.

Understanding BIOS, Bootup and Kernel Space. Before thoroughly reverse engineering and mapping the use of I/O machine-specific registers, it is necessary to reverse engineer the BIOS code, which is usually at or near the entry point to the firmware binary. The BIOS code typically configures, initializes, pings and/or tests the system I/O using the I/O machine-specific registers. It also configures chip selects (i.e., direct memory addressing), I/O direction pins and purposes, as well as interrupts, exceptions, timeouts and the stack. These details are essential and further narrow down how the I/O machine-specific registers are utilized by the device.

Additionally, the BIOS and bootup code in most embedded firmware perform various integrity, timing and system checks during the boot process, which may impede the full boot of a virtualized embedded system. For example, a device often checks if its sensors, actuators, modules and/or peripherals are properly connected and operating; this is typically documented in the installation manual of the device and the processor user manual. It may be necessary to use breakpoints, hooks or binary patching to bypass the checks in order to force the firmware to fully boot up in the virtualized environment.

The bootstrap or bootloader may unpack and boot to a backup driver if startup checks fail; this may require an operator to insert a serial or USB cable to configure or flash the firmware. Operating systems likewise perform configuration, initialization, timing and integrity checks. Default settings and configurations are usually detailed in the device manual, although such checks may need to be bypassed as well.

Finally, a fully booted kernel usually ends up in a main loop that handles I/O. The I/O model can provide valuable guidance -these models usually fall into three main categories: (i) polling; (ii) interrupts; and (iii) direct memory access driven I/O. Note that it is not necessary to fully reverse engineer the kernel nor is it necessary to fully boot into a stable kernel to utilize the benefits of the SPAEVI methodology.

Mapping I/O Interactions and Handling. After understanding how the BIOS initializes and configures the I/O for the architecture, and enumerating the machine-specific registers in the disassembled code, it is necessary to reverse engineer each enumerated subroutine. Reverse engineering "up" the cross-references to subroutines reveals the context in which each machinespecific register in question is utilized. The chain of functions may span across drivers, kernel system calls, library function code and userland application code.

This process helps discover the purpose of the I/O machine-specific registers because it is common to find logging, protocol and even leftover ASCII debugging strings. Fortuitously, these strings were in the exact same subroutines in the proof-of-concept system developed in this research. The strings helped immediately identify the purpose of the I/O machine-specific registers and, thus, no cross-referencing was required.

Virtualization Requirements

Cyber-physical system virtualization requires accurate temporal and instruction set simulation or emulation of the processor, its I/O handling, machinespecific-registers and peripherals. Furthermore, the virtualization platform should execute the raw firmware of the target device. Additionally, it must be able to handle firmware extraction and memory region initialization.

Processor families often have multiple variants, all of them founded on a base instruction set and processor features (e.g., pipeline size, I/O model, timing module and peripheral modules). If no simulator or emulator exists for the processor of the target hardware, then a simulator or emulator for a processor in the same family may serve as a suitable starting point.

Integration Requirements

Integration requires an accurate virtualization platform and the mapping of the I/O machine-specific registers. Hooking or breakpointing the code that performs I/O enables the integration of relevant inputs and control outputs with the physics simulator. For a Layer II device, the inputs come from sensors and may be pre-processed by various FPGAs; the outputs are signals to actuators. The only thing virtualized by the SPAEVI methodology is the main processor. It is not necessary to reverse engineer or virtualize digital signal processors, FPGAs and microprocessors that handle analog I/O because they can be digitally integrated via the SPAEVI methodology.

Benefits

The SPAEVI methodology provides some novel benefits:

Dynamic Analysis of Embedded Cyber-Physical Systems: Dynamic analysis is the foundation of modern malware analysis methodologies. The ability to provide dynamic analysis capabilities for embedded cyber-physical systems is a novel contribution of the SPAEVI methodology. This aspect is discussed in detail later in this chapter.

Physics Impact Analysis: Integrating the interaction of a virtualized embedded cyber-physical system with a simulated electric grid is the core of the SPAEVI methodology and it provides novel physics impact analysis capabilities. However, the fidelity of a chosen physics simulation directly affects the benefits provided by the SPAEVI methodology. A SPAEVI implementation with a physics simulator that does not simulate down to the harmonics cannot detect or analyze an attack that maliciously triggers harmonics or similar line transients in a power grid.

Physics-Based Intrusion Detection: Physics-based intrusion detection for symbolic cyber-physical honeynets is described in [START_REF] Redwood | A symbolic honeynet framework for SCADA system threat intelligence[END_REF]. The proofof-concept implementation involved a smart IEC 68150 distribution substation switch integrated with GridLAB-D. The approach requires the accurate integration of networking in the virtualization platform, otherwise the target cannot communicate using the necessary protocols. In theory, the SPAEVI methodology can provide this benefit. However, network handling for the MJ-XL in Trace32 has to be implemented in order to realize physics-based intrusion detection for embedded cyber-physical systems.

Proof-of-Concept System

The SPAEVI proof-of-concept system comprises the Siemens MJ-XL voltage regulator control panel, selected because it controls the electric grid in a complex manner. The device technically could be categorized as a programmable logic controller; however, it predates the IEC 61131 Standard published in December 1993. It was built using the Diablo C compiler (with timestamps of 1990, 1992 and 1993). It uses the legacy RTXC real-time operating system, which is no longer supported and may be considered abandonware. Also, it uses the DNP3 protocol for remote monitoring and control.

Exploitation and access control bypass details are not presented in this chapter. Additionally, the reverse engineering details of the target outside of the I/O integration for the SPAEVI implementation are not presented. In any case, these details would be unique to each device and would not serve to clarify the methodology. Determining the processors that run the MJ-XL was a difficult task because the vendor meticulously omitted all mention from the manuals, brochures and documentation. However, this problem was solved after purchasing a used unit on eBay and inspecting the hardware. The device firmware, which was found on the vendor website, is in the Motorola S-record format.

Reverse Engineering

The SIEMENs MJ-XL control panel main board processor is a Motorola MC68332. The MC68332 is part of the 68 K (i.e., CPU32) family of processors. This processor handles several aspects of I/O, including the front key pads, configuration/update front serial port, as well as the 48 screw-in connectors on the back for interfacing with a voltage regulator. The communications module daughterboard facilitates the device's remote control via DNP3 over three network options: (i) fiber; (ii) legacy serial; and (iii) GSM. The focus in the proof-of-concept development was to discover which I/O machine-specific registers in the MC68332 read the sensor inputs and control the actuators in the voltage regulator.

The machine-specific registers in the MC68332 occupy a fixed 2 K region of memory spanning from FFFA00 to FFFFFF. They belong to three main modules (i.e., on-chip peripherals): (i) system integration module (SIM); (ii) queued serial module (QSM); and (iii) timing processor unit (TPU).

The system integration module handles key internal functionality, including chip selects, interrupts, system protection logic, watchdogs and external bus support.

The queued serial module handles the device's front data port via a serial communications interface (SCI) for configuring and flashing the firmware, and the connection to the communications module daughterboard via the queued serial peripheral interface (QSPI). The serial communications interface is configured by SCCR0 and SCRR1, which set the baud clock and bits per frame, respectively. In theory, virtualizing the serial port of the serial communications interface would enable the Siemens configuration software to be used to config-ure the virtual device, although the stability and baud clock synchronization could be problematic.

The timing processor unit provides several channels of I/O to a separate 2 KB block of RAM.

Table 1 enumerates some of the I/O machine-specific registers. Counting the number of times the machine-specific registers are used reveals the I/O functionalities used by a device. By analyzing the pin direction assignment registers, it is possible to determine the channels used for input and output.

The Motorola S-record binary format explicitly dictates the entry point into the unpacked firmware binary, which corresponds to the beginning of the BIOS. Reverse engineering the BIOS code quickly revealed the configuration of the chip selects; these are noted in Table 1 for CS1 to CS9.

Reverse engineering the cross-references to the code that uses the machinespecific registers for I/O reveals how the firmware handles sensor inputs, and more importantly, actuator control outputs to move the regulator taps. The MJ-XL patent [START_REF] Trainor | Man-Machine Interface[END_REF] and installation manual provide the valid ranges of the inputs, which served as a reference for virtualization I/O integration and testing. Ultimately, the chip selects initialized in the BIOS were vital to determining the I/O machine-specific register mapping. Table 2 presents the final results.

Virtualization

Several platforms were considered for creating the virtualization of the target. Specifically, the Trace32 sim68k, MAME, easy68k, turbo68k and other simulators were examined. However, the Trace32 sim68k simulator has the most accurate and detailed model for the MC68332 processor and on-chip peripheral modules. Furthermore, it has the most feature-laden breakpoints, enabling the CPU to be frozen and external operating system commands to be executed.

Simulated Physics Integration

GridLAB-D currently has some fidelity limitations. For example, it cannot simulate sub-second events in the mode utilized for the SPAEVI integration (real-time mode). Nevertheless, it was possible to integrate the necessary sensor inputs to the virtualized device, primarily three-phase voltage and current. GridLAB-D allows the configuration of the regulator taps for each phase, band center and width of the desired voltage, time delays for taps to move, current and voltage transducer ratios, and much more. The top controls were the primary actuators considered in the SPAEVI proof-of-concept.

The MJ-XL processor uses a global variable at 0x100050 (initially set to 0xFFFF) to craft the control signal to the tap control actuator. Depending on whether the tap actuator is raised or lowered, the signal is ANDed and ORed by a mask, and then moved to the actuator control chip select 0x82000 as follows: In order to integrate the tap actuator controls with the GridLAB-D simulation, breakpoints were placed at lines 0x00023E10 and 0x00023E62 as well as other lines of code that interact with 0x82000. The breakpoint runs a script or command outside of the Trace32 sim68k that, in turn, passes the tap control signal to an intermediate wrapper. This wrapper parses the signal and controls the tap object in GridLAB-D.

1 0 x 1 0 0 0 0 0 2 5 6 k 1 6 b i t S y s t e m R A M C H A N N E L 2 0 x 8 0 8 0 0 2 k 8 b i t D I S P L A Y S C R E E N 2 3 0 x 8 0 0 0 0 2 k 8 b i t D I S P L A Y S C R E E N 1 5 0 x 8 4 0 0 0 2 k 8 b i t T X / R X V R C S E N S O R S 7 0 x 8 1 0 0 0 2 k 1 6 b i t K E Y P R E S S C O N F I R M 8 0 x 8 1 8 0 0 2 k 1 6 b i t K E Y P R E S S I N P U T 9 0 x 8 2 0 0 0 2 k 1 6 b i t V R C C O N T R O L T X 00023DD4 pea (
Handling the semantics of how control signals are intended to control devices is the primary challenge during integration, mainly because the semantics are unique to each device. In the code above, it is apparent that bits 10 and 11 of the signal are flipped differently by the AND operation. Using these two cases as reference points, it is possible to reverse engineer and integrate other variations of how 0x82000 is controlled. Handling the sensor inputs takes more care because the analog-to-digital channels are each pinged and then read from individually, as follows: The last function call to SENSOR INPUT DRIVER uses the arguments to look up the global settings table (not shown) in order to obtain the destination to store the corresponding sensor value. The destination is calculated based on a combination of the output of PING AND READ SENSOR BY ID and the string identifying the sensor source (e.g., ADC CH0=%8d). It is beneficial, but not always necessary, to integrate the sensor inputs when implementing the SPAEVI methodology.

0002422A moveq #3,

Verification of Benefits

Several sophisticated, sabotage-based, malicious test payloads were designed and analyzed in order to verify the defensive benefits of the SPAEVI methodology. No actual exploits were designed nor were any vulnerabilities or access control bypasses sought. Specifically, the efforts focused only on return-oriented programming (ROP) payloads, which for defensive analysis, require the highest fidelity in a virtualization platform. Additionally, embedded industrial control systems usually have no defenses for such attacks [START_REF] Evans | Analysis of Defenses Against Code Reuse Attacks on Modern and New Architectures[END_REF].

Return-oriented programming is an exploit development methodology that works across all computer architecture paradigms, from von Neumann to Harvard. Typically, payloads partially use return-oriented programming and partially use traditional code injection to handle complex operations (e.g., facilitating remote command and control for attackers). However, in the case of an embedded system, if a payload is simply designed to achieve a physical effect, then it can typically re-use existing code that handles the sensors and actuators of the system being attacked.

After thoroughly mapping the I/O subroutines, a return-oriented payload compiler [START_REF] Schwartz | Q: Exploit hardening made easy[END_REF] was used to generate specific actuator actions. Each actuator device, in turn, can be tagged with a meta-description that details how the physics is changed. The return-oriented payload compiler, dubbed the Physical Effect Payload Compiler (PEPC), was used in several experiments. It is important to note once again that a return-oriented payload is distinct from an actual exploit on a target.

Results

The Physical Effect Payload Compiler was scripted to maliciously and arbitrarily move the regulator taps. The IEEE 13 Node Test Feeder model [START_REF] Redwood | A symbolic honeynet framework for SCADA system threat intelligence[END_REF] was used in the experiments and the MJ-XL was modeled as a 4.16 KV, 3.9 MW voltage regulator that feeds a distribution network. By default, the configured range of possible voltage regulation was ±10% and the per-tap change was dictated by this range divided by the number of tap positions. A tap in the maximum position [START_REF]of the Committee on Oversight and Government Reform, Cyber Security: Assessing the Immediate Threat to the United States, Serial[END_REF] indicates a 10% increase and the minimum position (-16) indicates a -10% decrease.

Several payload experiments were conducted. Figure 2 presents the results of three experiments. The payload effects in Figure 2 were directly caused by a return-oriented programming payload executed by the virtualized firmware in the SPAEVI testbed. Note that the effects were designed to be delayed by a few seconds between each change using NOP gadgets in order to visually present the data.

Note that Figure 2 shows the power fluctuations in Watts. Payload 1 flips Taps A and C to the maximum position while Tap B is moved to the minimum position, following which the inversion begins. The malicious fluctuations can force up to ±10% maximum increase or decrease in the voltage level. The malicious regulation also affects the phase angle; the experiments cause up to ±1.20 phase angle shift per phasor. Additionally, the other phasors do not change and can be forced into precise, minor phase angle imbalances. Theoret-ically, these physical fluctuations, while dependent on the device configuration, may represent a "profile" for potential malicious effects.

After further reverse engineering, it was discovered how to place any tap in an arbitrary position with a 76-byte return-oriented programming chain per tap. It was possible to indefinitely hold a tap in the maximum or minimum position with a single return-oriented programming payload of eight bytes. These statistics are useful in terms of footprint and sophistication because single-purpose payloads require minimal footprints, but sophisticated, arbitrary control of an embedded cyber-physical system requires much more. With polymorphic return-oriented programming chains, the cost per arbitrary tap chain would be much less than 76 bytes per change. Malicious regulator fluctuations can induce other transients into a grid that GridLAB-D does not have the fidelity to model.

In some instances, as in the case of the IEEE model, the phase angle and voltage fluctuations may be problematic for an electric grid. However, infrastructure redundancies, constraints and implementations may be resilient to a single device misbehaving within the described "profile" of physics changes. Breakers, fuses, protective relays and even phase angle regulators may protect against such malicious effects. However, if a grid relies on homogenous redundancies, a single exploit can be trivially leveraged against all redundant systems simultaneously, amplifying the potential for harm instead of protecting against it. Indeed, heterogeneous, diverse technologies controlling an electric grid should be declared best practices as far as cyber security is concerned. Relying on a single vendor for a specific type of device across a power grid, exposes the grid to zero-day exploits against all susceptible targets simultaneously. This would also be true for n-day exploits due to poor patching practices in industrial control systems.

This research verifies that a SPAEVI testbed can support dynamic malware analysis and forensics for Layer II to IV systems. All the effects discussed above were caused by real return-oriented programming payloads that maliciously abuse device firmware and, thus, make the results tangible. Furthermore, the SPAEVI methodology offers incident responders with portable testbed systems for malware sandboxing, incident response, physics impact analysis and other defensive research in the area of industrial control systems.

Conclusions

The novel SPAEVI testbed design methodology for integrating virtualized embedded industrial control systems and physics simulators facilitates malware and forensic analyses of embedded cyber-physical systems without risks. Unlike existing hardware-based testbeds, the SPAEVI industrial control system testbeds are portable, distributable and expandable by design. The benefits of the SPAEVI methodology span the domains of incident response, forensics, attack characterization, vulnerability analysis, sandboxing and defensive applications. The case study involving a virtualized Siemens MJ-XL voltage regulator control panel integrated with a medium-fidelity physics simulation of arbitrary

Figure 1 .

 1 Figure 1. SPAEVI methodology workflow.

Figure 2 .

 2 Figure 2. Payload experiment results.

Table 1 .

 1 Enumeration of I/O machine-specific registers.

	MSR	Address	Times Used	Summary
	PORTQS	FFFC14	0	Not used by device
	PQSPARS	FFFC16	4	Pins Select GPIO or QSPI. It is always 01111011.
				PORTQS Data Direction
	DDRQS	FFFC17	4	Register. Always
				11111110.
	SPCR0	FFFC18	24	Frequently Used
	SPCR1	FFFC1A	48	Frequently Used
	SPCR2	FFFC1C	24	Frequently Used
	SPCR3	FFFC1E	4	Rarely Used
	SPSR	FFFC1F	29	Frequently Used
	RR[0:F]	FFFD00-1F	6+	RX RAM
	TR[0:F]	FFFD20-3F	18+	TX RAM
	CR[0:F]	FFFD40-5F	17+	COMMAND RAM
	Serial Port MSR Stats (Data port on front panel)
	SCCR0	FFFC08	10
	SCCR1	FFFC0A	17+
	SCSR	FFFC0C	20	Tells if SCI has data
	SCDR	FFFC0E	19	SCI Data buffer
	MC68332 System Integration Module (SIM) MSR Stats
	CS1	FFFA50	1	Maps to 0x100000
	CS2	FFFA54	1	Maps to 0x80800
	CS3	FFFA58	1	Maps to 0x80000
	CS4	FFFA5C	0
	CS5	FFFA60	1	Maps to 0x84000
	CS6	FFFA64	0
	CS7	FFFA68	1	Maps to 0x81000
	CS8	FFFA6C	1	Maps to 0x81800
	CS9	FFFA70	1	Maps to 0x82000
	MC68332 Timing Processor Unit (TPU) MSR Stats
	TPUMCR	FFFE00	4
	TICR	FFFE08	1
	HSRR0	FFFE14	12	Used with CS 5&9
	HSRR1	FFFE16	9	Used with CS 5&9

Table 2 .

 2 MJ-XL chip select I/O map.

	Chip Select	Base Address (DMA MAPPING)	Z	C o n f i g	Reverse engineering & Mapping notes

electric grids using GridLAB-D conclusively demonstrates the benefits of the SPAEVI testbed design methodology.


domain: phys spi

text:
Venkata Praneeth

Mareedu Bhargava

Raviteja Chanduri

Vipul Vijigiri

Comparison of Iris, Finger, Voice Recognition Techniques -A Biometric Perspective

Keywords: Biometrics [1], Biometric Modalities [2], Feature Extraction, Template Matching

In the light of current lifestyle of humankind, there is a great need of high secure interfaces which apart from providing identification to the user, also enhances security. There are many biometric techniques and various new approaches that are being widely used in the fields of banking sector, security accesses, military, etc. But it is difficult to decide which of them is more feasible and secure. We tried to compare these Biometric Techniques and put forth the pros and cons of each of these methods while keeping a few major parameters as benchmarks. We believe this brief overview would help us to analyze the idea of the above approach, which would promote longevity and enable interoperability.

I. INTRODUCTION

There has been an enormous change in the use of science and security of which biometrics is one that is most widely discussed and experimented field. Biometrics has undergone drastic changes since its first inception as a Fingerprint recognizing method in China that dates back to 14th century Later on finger printing has become more standardized making it a gateway for other techniques like Finger, Iris, Voice Recognition etc. In the recent years, a number of recognition and authentication systems based on Biometric measurements have been proposed. There is no doubt in saying that Biometrics is going to be the most happening of all technologies in the field of Homeland Security.

II. SURVEY OF RELATED WORKS

There are many biometric techniques being used today and many new approaches are still in the early stages of development. Biometrics can, therefore, be grouped across a range of platforms based on their application and usage.

Here we present literature survey for some of the biometrics of the specified categories. This survey is based on the previous study and considering certain characteristics and performances of the modalities. The focus is to build a state of art for the existing biometric method that have potential to take over the global market as the efficient yet secure method to protect ones classified or personal information. Larger research centers or commercial offices use these Biometric methods to either gain or grant access to targeted audience such that it prevents internet piracy, hacking and other potential dangers that could affect the privacy.

III. PROBLEM STATEMENT AND MAIN CONTRIBUTION

Today safety and security has become a primary objective in various sectors. So, in adapting a certain biometric modality there is a need for a certain comparison scheme which enhances the usage of biometric methods and to reduce their error rate. Our research questions deals with comparison of various biometric methods, and also try to predict the future of Biometrics. We hypothesize that there have been many unanswered questions regarding the quality assessment in any one of these biometric technologies. Hence it is our aim to try and compare all those methods and provide our understanding for those who want to have a better perception based on factors like accuracy, dependency, safety, user friendly etc.

IV. PROBLEM SOLUTION

This project is an analytical review carried out on various recognition techniques and hypothesized according to previous work done. Most of the techniques are either based on verification or identification [3]. All the existing methods in biometrics are accessed by certain criteria which are limited to few parameters. This paper puts focus on the Accuracy, Cost, User friendly, Safety, Universality and dependency on the standards of the methods. Each of the methods has its own set of advantages and disadvantages characterized by the technology and innovation that it incorporates in to. As in the 20 th century, everything is based on privacy and data integrity, the technology that manages it are prone to threats that could destroy once own integrity or of the country. Companies like Sony, Samsung, apple and networking sites like Facebook, twitter and many other invest millions to maintain the protection of data. Apple came up with finger print and facial recognition recently which seems to be challenging and efficient means of protecting information. Samsung developed Iris devices to grant access to its own employees to get in and out of their work places. Biometrics can, therefore can't be justified in limited and be grouped across a range of platforms based on their application and usage. Here we present a brief analog of some of the biometrics.

BIOMETRIC MODALITIES

IRIS RECOGNITION

Iris Recognition [3] is an automated ocular based automated method of that recognizes patterns matching techniques used for retina scanning. Common iris recognition systems contain five different stages: Iris acquisition, iris localization and segmentation, normalization, encoding and pattern matching. When someone participates in an iris-recognition system; his or her eyes are scanned to create iris codes, which are in fact binary representations of the image that are stored for security reasons to counter the malfeasance. A basic scheme is as follows where 3 stages are used to evaluate the identification of the user from a prespecified database entry.

Fig3: Schematic Representation of Iris Method.

These techniques due to its uniqueness (i.e. does not change with age, time and emotional state) can secure/encrypt the data that are highly dependable marking highest levels of safety that protects these systems from counter attacks making it more accurate because of the illumination factor, providing universality to the user.

FINGERPRINT RECOGNITION

Fingerprint recognition [4] is one of the most widely used technologies today. Fingerprints are used for biometric recognition as they are quite unique and differ from person to person. Generally in every method, there are three basic steps: Capturing fingerprint by using various sensors, analyzing the data, and Template matching.

The main difference among all fingerprint recognition techniques is the analyzing of the data. The most used data technique is plotting of fingerprint ridges in a 2-d plane by converting ridges into pixels.

Fig4: Fingerprint Method Schematic Representation.

So using this method we can have high accuracies of about 99%. Fingerprint recognition technique is also quite dependent, user-friendly and cost effective. When the user speaks in front of the Voice Recognition System, it records the voice. The recorded voice is then analyzed and its key features such as tone, notes, pitch etc. are extracted. They are then compared with the template voice which is already registered within the system. The decision is taken based on the percentage of matching of those two voice features.

VOICE RECOGNITION

Voice recognition technique was dominant until early 2000's but lost its prominence due to lack of accuracy, dependency and safety.

V.RESULTS

After collecting/analyzing the data which were extracted from the papers (2007-2012) that was studied, observed six vital parameters that marks the accountability of the user to rely upon with, which provides a benchmark for these 3 biometric methods that are dominant in the field of advanced commercial applications. The realization of the parameters is as follows:

1. Accuracy: It depends on recognition rate and template matching rate. High matching rates results in better accuracy.

Dependability: It relies on FAR and FRR. FAR (False

Acceptance rate) is the probability that the system incorrectly matches the input pattern to a non-matching template in the database. It measures the percent of invalid inputs that are incorrectly accepted, for example: a potential intruder. FRR (False Rejection Rate) is this probability that the system fails to detect a match between the input pattern and a matching template in the database. It measures the percent of valid inputs that are incorrectly rejected, for example: an authorized person.

3. Safety: It secures the user data from malfeasance. It is generally related to encryption size of the biometric inputs. Higher encryption sizes are very difficult to be decoded and hence prove to be a very good safety criterion. 4. User-friendly: For a biometric method to be user friendly, it has to have easy accessibility and smooth user interface. The delay time or Extraction time (in biometric sense), is a key feature of interpreting user-friendliness. Extraction time is the time taken for an input to be analyzed and result given. Greater extraction time generally creates a sense of fear and frustration in the user. 5. Universality: Universality refers to ruggedness of the biometric system. Users require their system to be highly abrasive-resistant, good range of operational temperature and also how well can a biometric system work under various conditions.

6. Cost Effectiveness: Not all biometric users are Bill Gates or Warren buffet, so general population will look for cost effective biometric systems. Hence, cost plays a major role in a success of a biometric modality.

The above-discussed parameters are enlightened in the table as follows: According to the results obtained while taking the parameters into consideration, it can be said that Iris recognition technique dominates qualitatively over its biometric counterparts.

Fingerprint technology currently has 46% and 34% share in the biometric markets for the years 2007 and 2012 respectively. Although fingerprint has a lion's share in the usage of biometrics, Fingerprint is gradually losing its hold. According to the International Biometric Group [9], the projected market study for the 2015 reveals that Iris and face recognition is going to be the leading biometric modality with 19% of the total market share.

Fig 2 :

 2 Fig 2: Classification of Biometric Methods.

  Fig5: Voice Biometric Schematic Representation

  VI.CONCLUSIONAccordingly we have collected data in table1 and fig6 from few research centers (biometric research center, Hong Kong) and through few research papers and taking in to consideration previous work done we have come to the following conclusion.

Fig6:

  Fig6: Statistics of Various Biometrics UsagesHence due to its predominant Positive traits, Iris Technique has wide scope of usage in application such as sub substituting for

Table 1 :

 1 Comparisons of Biometrics Methods Using Parameters

  Next Generation Identification by FBI [10]: FBI took an initiative in this next generation identification. This is intended to "cut down terroristic and "culpable activities" by improving the biometric technology to the next level. According to which following modalities are considered to make it a successful project.

	passports in automated border crossing; expediting security
	screening at airports; controlling access to restricted areas.	Biometric	Iris	Fingerprint	Voice
			Methods
		V. FUTURE WORKS
	1.  Adaptability	Accuracy [6] Dependency [1],[7]	Recognition Rate>95% Matching rate>50,000Irises/sec FAR=0.01% FRR=5%	Recognition Rate (85-95%) Matching Rate<2000finger prints/sec FAR<0.0001% FRR<1%	Recognition rate-70-90% FAR=0.01% FRR=0.28%
		Capacity		Encryption	Encryption	Encryption
		Certainty	Safety [8]	Size=5000bits	Size=(2500-4000bits)	size=2000bits
		Response Time
				Extraction Time	Extraction	Extraction
		Functionality	User	(0.1-0.2sec)	Time<0.4sec	Time=0.5sec
		Interoperability	Friendly [9]
				Resistant to	Change in light	Change in
			Universality [7],[8]	abrasion	exposure effects	voice patterns
					accuracy
				High	Medium	Low
			Cost

Availability NGI is collaboration between CJIS advisory policy board (WASHINGTON D.C) and Members of compact council. Its main goals are national security, public safety, leadership in biometrics etc and to enable smooth transition in public.


Bo Yang
email: yangbo32@iie.ac.cn

Ning Li

Zhigang Lu

Jianguo Jiang

Event Detection with Convolutional Neural Networks for Forensic Investigation

Keywords: Event Detection, Convolutional Neural Networks, digital investigation

Traditional approaches rely on domain expertise to acquire complicated features. Meanwhile, existing Natural Language Processing (NLP) tools and techniques are not competent to extract information from digital artifacts collected for investigation. In this paper, we propose an improved framework based on a Convolutional neural network (CNN) to capture significant clues for event identification. The experiments show that our solution achieves excellent results.

Introduction

In digital investigations, the investigator typically has to handle substantial digital artifacts for forensics analysis. Among them, most are in the form of unstructured textual data, such as emails, chat logs, etc. The investigator searches clues from these data in order to answer questions about what happened, who caused the events, when events occurred, where, with whom they communicated, and so on. A pervasive problem is the fact that unstructured data are recorded using natural language, which is hard to understand completely by computer. This problem impedes the automation of crucial incriminating information retrieval and information extraction processes when facing a mass of textual data. Although the investigator can rely on modern digital forensics tools, such as executing keyword searches, this is often a manual process [START_REF] Pollitt | A history of digital forensics [M]//Advances in Digital Forensics VI[END_REF]. Due to the fact that the same concept is typically expressed by different terms and language styles, using keyword searches is not always effective. The quality of an analysis usually varies with the investigative experience and the expertise of each investigator [START_REF] Al-Zaidy | Mining criminal networks from unstructured text documents[END_REF].

With the advancement of data mining and availability of the computational resources to improve algorithm performance, methods of text mining using natural language processing techniques have gradually become available. By means of text mining, it makes the investigator easy to conduct content analysis and extract clues from textual data. Furthermore, automated techniques avoid threats to the privacy issues. For the reason that digital artifacts can reveal interested events, such as illegal activities at key times, communications between suspects and victims, and other clues to the investigation, obtaining valuable information from them is based on the event detection task, which involves identification of events from specific types in the artifacts. Unlike traditional event extraction task defined in Automatic Content Extraction (ACE) evaluation [3], the event detection task in forensics varies according to case type and the investigator focuses a few specific types in a specific investigation. For example, the investigator should be interested in contact events, movement events etc. other than business events in a case of murder investigation. Current research on event extraction does not apply to digital forensics.

There are two categories of features for textual analysis on event detection: lexicallevel features and sentence-level features. Convolutional neural networks that model sequential data have been proved to capture important information at sentence-level [START_REF] Kim | Convolutional neural networks for sentence classification[END_REF]. However, at the lexical-level, the same word influenced by its contexts has different meaning. Consequently, it frequently makes classifiers confused and also causes the inefficiency of keywords searches. In this paper, we present an improved one-layer convolutional neural network, which we name Classification with Similarity Vector by CNN (CSV-CNN), to capture more significant clues for event identification. Associated with each specified event is an event trigger, which most clearly expresses an event occurrence. We establish an event trigger lookup table containing most representative terms for a specific event to obtain lexical-level features. Our method computes and averages cosine similarity between each word in a sentence and word in the trigger lookup table in order to obtain a similarity vector. On the other hand, given input sentences, the network uses convolutional layers to acquire distributed vector representations of inputs to learn sentence-level features. The proposed network learns a distributed vector representation and similarity vector for each event class.

Preliminary

In this section, we first discuss related work in event extraction, and then introduce challenges posed by textual evidence.

Related work

Since 1987, a series of Message Understanding Conferences (MUC) which were initiated by DARPA showed considerable interest in event extraction and encouraged the development of new methods of in information extraction [START_REF] Grishman | Message Understanding Conference -6: A Brief History[END_REF]. MUC participants required submit evaluations to compete in textual information tasks. These tasks covered a wide range of goals, such as extracting fleet operations, identifying terrorist activities, detecting joint ventures and leadership changes in business, etc. The Automatic Content Extraction [3] program addresses the same problems as the MUC program, which defines extraction tasks according to the target objects, such as entity, relation and event. ACE focuses on annotating 8 event types and 33 subtypes.

There are several instances of the implementation of text mining techniques for event extraction can be found in literature. Best et al. [START_REF] Best | Automating event extraction for the security domain [M]//Intelligence and Security Informatics[END_REF] make use of a combination of entity extraction and a machine-learning technique for pattern-based event extraction. Li et al. [START_REF] Hong | Using cross-entity inference to improve event extraction[END_REF] proposed the crossing-entity inference to improve the traditional sentence-level event extraction task. Li et al. [START_REF] Li | Constructing Information Networks Using One Single Model[END_REF] elaborate on a unified structure for extraction of entity mentions, relations and events in ACE task. These methods achieve relatively high performance on the basis of suitable choices of features selection. However, these methods suffer from complicated feature engineering and errors from existing NLP toolkits.

Over the past few years, deep learning methods have achieved remarkable success in machine learning, especially in computer vision and speech processing tasks [START_REF] Lecun | Deep learning [J][END_REF][START_REF] Graves | Speech recognition with deep recurrent neural networks[C]//Acoustics[END_REF]. More recently, methods of handling NLP tasks using deep learning techniques started to overtake traditional sparse, linear models [START_REF] Goldberg | A Primer on Neural Network Models for Natural Language Processing[END_REF]. Word2Vec propose by Mikolov et al. [START_REF] Mikolov | Distributed representations of words and phrases and their compositionality[C]//Advances in neural information processing systems[END_REF], which could construct representation of words into a dense, low dimensional vector under a large corpus, has drawn great interests and is widely used as pre-trained word vectors. Convolutional neural networks (CNN), originally invented for computer vision, have subsequently realized significant performance in sentence classification. Nguyen et al [START_REF] Nguyen | Event detection and domain adaptation with convolutional neural networks[END_REF] used CNN for event detection that automatically learned feature form pre-trained Word2Vec embeddings, position embeddings, and entity type embeddings, with promising results.

Challenges posed by textual evidence

Because of the efficiency and the convenience, the internet and computers are being used by criminals to facilitate their offenses. Most types of collected digital textual evidences are short texts, such as emails, chat logs, blogs, and tweets. In the past, these textual data have been studied for mining digital evidences, but all of them faced common challenges posed by noisy characteristics. First, these texts are short and have limited context. For example, emails seldom contain more than 500 words, and tweets can have less than 140 characters. Thus, statistical methods such as topic modeling do not apply to discover the themes of texts for insufficient words [START_REF] Hua | Short text understanding through lexicalsemantic analysis[END_REF]. Second, most of them are more informal in style. The discourse can be regarded as written speech or spoken writing [START_REF] Kucukyilmaz | Chat mining: Predicting user and message attributes in computer-mediated communication[END_REF]. People do not always observe the grammatical rules and tend to make spelling mistakes. This means traditional NLP techniques are seldom appropriate for recorded conversations [START_REF] Agarwal | How much noise is too much: A study in automatic text classification[C]//Data Mining[END_REF]. Third, people tend to use shortened terms, characters or punctuation symbols to convey or express more meaning or inside feelings or moods [START_REF] Walther | The impacts of emoticons on message interpretation in com-puter-mediated communication[END_REF]. For example, the word "thanks" can be written as "thx", and the emoticon ":D" represents feeling happy. However, these terms or symbols are not captured by generalpurpose tokenisers and not recognized as single tokens.

Model Description

In this paper, we formalize the event detection problem as a multi-class classification problem. Given a sentence, we want to make a prediction whether it expresses some event in the pre-defined event set or not [START_REF] Li | Constructing Information Networks Using One Single Model[END_REF]? In subsection 3.1, we first introduce standard one-layer CNN for sentence classification [START_REF] Kim | Convolutional neural networks for sentence classification[END_REF]. We then propose our augmentations in subsection 3.2, which exploit two stages: lexical-level and sentencelevel feature extraction. Figure 1 describes the architecture of the proposed CSV-CNN.

Basic CNN

In this model, we first convert a tokenized sentence to a sentence matrix. Each token in a sentence is mapped into a low-dimensional vector representation, whether it is a word or not. It may be a fixed dimensional feature vector initialized at random and updated during training, or an output from pre-trained word2vec. We denote the dimensionality of the word vectors by n. In order to perform convolution on a sentence via non-linear filters, we expand the context to the maximum sentence length s by padding shorter sentences with special tokens. It is useful because it allows us to efficiently treat our data as an "image". Thus, the dimensionality of the sentence matrix is . In this matrix, let each row vector denote the corresponding token so that we can retain the inherent sequential structure of a sentence. We then denote a sentence x of length n by * +, and the sentence matrix is represented as . The main idea behind a convolution and pooling computation is to apply non-linear filters over each instantiation of a -word sliding window over a sentence. A filter converts a window of words into a fixed dimensional vector that achieves new features of the words in the window. We vary the dimensionality of the filter to acquire different filters or use multiple filters for the same to learn complementary features. In order to obtain a feature , the filter is applied on a sub-part of A :

( ) Where refers to the concatenation of tokens , is bias term, and is a non-linear activation function that is applied element-wise. We execute convolution operations for each possible sub-matrix of , which is * +, to produce a feature map: , -Where . A max-pooling function is thus applied to the feature map to obtain the most salient information. Multiple filters are implemented and the outputs are concatenated into a "top-level" feature vector. Finally, this feature vector is passed to a fully connected softmax layer for classification.

Weights can be regularized in two ways. One is Dropout, in which we set values in the weight vector with a portion at random during forward-backpropagation, the other is norm constraint, for which we set a threshold for weight vectors during training; when it exceeds the threshold, we rescale the vector accordingly.

CSV-CNN

We propose an augmentation of CNN so that the model can learn more important features at the lexical-level. And the features at the sentence-level are left to learn by basic CNN model. We first select the most important words of each event type from data set. [START_REF] Salton | Introduction to modern information retrieval[END_REF] is one of the most popular algorithms used in the fields of information retrieval and text mining. It provides a numerical statistic to reflect the extent of importance of a word in a collection. The occurrences of a word are directly proportional to the importance, but are inversely proportional to the frequency of the word in the collection. The weight of word j is computed as follows:

( ) ( ) ( ) Where
represents the times a given word occurs in a specific document, , which represents Inverse Document Frequency, is used to diminish the effect of words that appear too often in a collection, .The of is computed as follows:

( ) ( ) Where
( ) represents the quantity of documents containing . We simply calculate a score for each word and obtain the top n important words. These words can be seen as lexical-level features of each event type, which constitute the event trigger look up table.

We use pre-trained Word2Vec vectors for our word embeddings, exclude stopwords from sentences at the same time. Inspired by Word2Vec [START_REF] Mikolov | Distributed representations of words and phrases and their compositionality[C]//Advances in neural information processing systems[END_REF], which can automatically learn relationships between words like ( ) ( ) ( ) ( ) , we compute cosine similarity between the vectors of feature words from lookup table and the vectors of words from a sentence. We then average the results as a similarity vector corresponding to a specific event type. All of similarity vectors forms the penultimate layer of CSV-CNN along with the feature vector from the max-pooling layer.

The procedure of CSV-CNN is shown in the following.

Procedure CSV-CNN

Load_data() Input: data set file obtained from the dataset folder Output: x, y, vocabulary, vocabulary_inv, vocabulary_vector, similiar_vector 1. for(int i1 = 1;i1<files.length;i1++)

2.

splits the data into words 3.

set the label, obtain keywords to each class(lookup table), 4. end 5. output(sentences, labels, keywords_labels) 6. for(int i2 = 0;i2<number of sentences;i2++)

7.

Pads all sentences to the same length 8. end 9. Output(sentences_padded) 10. for(int i3 = 0;i3<number of words;i3++)

11.

Builds a vocabulary mapping from word to index 12.

Builds a vocabulary vector matrix mapping from word to vector

Experiments

Datasets

Although CNN has been demonstrated to have high performance in previous work on event detection [START_REF] Nguyen | Event detection and domain adaptation with convolutional neural networks[END_REF], the dataset utilized for evaluation is based on newswire articles and does not apply to forensic investigation scenarios. Due to privacy constraints, actual cases and their related data are always not available for academic research. Therefore, we conducted a performance evaluation on a similar data. We utilized the Enron email dataset [START_REF] Cohen | Enron email dataset[END_REF], which was made public during the legal investigation. This dataset contains messages belonging to 158 employees in Enron Corporation before its bankruptcy. We select sentences from these messages to tag events of interest. To this end, we establish four categories: movement, transaction, meet and correspondence. Each category contains 100 sentences. These four events usually occur in crime cases. Several example sentences are shown in Table 1. We performed experiments on one dataset containing 400 sentences with 1,271 unique terms.

Table 1. Example sentence of dataset

Event Type

Example sentence

Meet

We met with Gov Davis on Thursday evening in LA.

Movement I was at PIRA today and got a preview of their presentation on Oct 11-12. Correspondence I sent you an earlier email about the blue files.

Transaction

I transferred $10,000 out of the checking account on Monday 2/28/00.

Conclusions

In this paper, we present an improving framework based on CNN. We use prede-fined event typed sentences from enron dataset to evaluate the performance. The experiment shows that our solution achieves excellent results. In future work, we tend to refine our method in extracting specific information in wider scale. We plan on testing our method over a more appropriate large corpus to evaluate.

Fig. 1 .

 1 Fig. 1. Illustration of CSV-CNN

Fig. 2 .

 2 Fig. 2. Architecture of CSV-CNN4.3 The performance and analysisFirst, it demonstrates similar vector of our example sentences from our dataset as shown in Table.2. Although the similar vectors do not classify all of the example sentences independently, the first and the third ones can be classified by them. The result from Table 2 has proved the similar vector helps to find clues at the lexical-level indirectly.The performance of CSV-CNN and standard CNN are shown in Figure3 and Figure4respectively. Training metrics from the figures are not smooth because we use small batch sizes. It suggests that to achieve better results require a large corpus in the future work. As we can see from the figures, our model shows better at the accuracy and loss aspects.

2 .

 2 Although the similar vectors do not classify all of the example sentences independently, the first and the third ones can be classified by them. The result from Table2has proved the similar vector helps to find clues at the lexical-level indirectly.The performance of CSV-CNN and standard CNN are shown in Figure3 and Figure4respectively. Training metrics from the figures are not smooth because we use small batch sizes. It suggests that to achieve better results require a large corpus in the future work. As we can see from the figures, our model shows better at the accuracy and loss aspects.

  Fig. 3. Accuracy and loss plots of CSV-CNN(blue is training data, red is 10% dev data).

  Figure 4. accuracy and loss plots of CNN (blue is training data, red is 10% dev data).

  Illustration of CSV-CNN

	word embedding	convolutional	Max-pooling	Classifier output
	I
	sent
	you
	an
	earlier
	email
	about
	the
	blue
	files
		Lookup table	Similarity vector

Table 2 .

 2 Similar vector of example sentence

	Meet	Movement Correspondence Transaction	Example sentence
					We met with Gov Davis
	0.08648066	0.07980033	0.04879327	0.02744178	on Thursday evening in
					LA.
					I was at PIRA today and
	0.0313917	0.0246127	0.04972452	0.0223587	got a preview of their presentation on Oct 11-
					12.
					I sent you an earlier
	0.03896217	0..10931941	0.28144109	0.08396807	email about the blue
					files.
					I transferred $10,000
	0.0236352	0.05342571	0.07086471	0.04953432	out of the checking account on Monday
					2/28/00.