Antonio Di

Stefano Panzieri

Andrea Gasparri

Distributed data fusion for situational awareness in critical infrastructures with link failures

Keywords: Distributed data fusion, information sharing, situational awareness

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Data fusion provides a means for combining pieces of information that come from diverse sources and sensors. Fusing this information can help bolster the security of critical infrastructure assets such as power grids and water distribution networks by providing improved situational awareness that can significantly enhance decision making. Critical infrastructure assets typically aggregate information coming from their sensors for their own use and do not share information about their operational states with other infrastructures. This is because disseminating sensitive information to other infrastructures can pose security problems, a topic that has been investigated by several researchers (see, e.g., [START_REF] Sutton | The contribution of NEISAS to EP3R, in Critical Information Infrastructure Security[END_REF]). However, the lack of information sharing about disaster mitigation procedures negatively affects disaster recovery, as in the case of the Sri Lanka tsunami of 2004 [START_REF] Pathirage | Knowledge sharing in disaster management strategies: Sri Lankan post-tsunami context[END_REF].

The U.S. Department of Homeland Security has spearheaded the creation of information sharing and analysis centers (ISACs) to facilitate information sharing efforts in the various critical infrastructure sectors. In fact, during real-time situations, aggregating information about the operations of multiple infrastructures can be very effective. For example, physical damage to a system can be assessed and then repaired in different ways depending on its cause (e.g., flooding due to heavy rainfall versus the opening of a valve by a computer virus). An accurate assessment of a situation obtained via data fusion can lead to successful incident response. Such an assessment requires all the relevant data to be available at the same time.

Ducourthial et al. [START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF] have proposed a distributed algorithm that implements data fusion in an unknown network topology. The algorithm computes the confidence of each node by combining all the data coming from its neighboring nodes using a discounted cautious operator and without relying on a central node for data collection. The algorithm converges in finite time for any initial configuration and any unknown network topology. However, the algorithm requires the network topology to become stable (i.e., nodes and links are fixed, and agents do not perform any dynamic observations) in order to reach convergence.

Considerable research has been conducted on applying data fusion techniques to enhance the security of critical infrastructure assets. Flammini et al. [START_REF] Flammini | Wireless sensor data fusion for critical infrastructure security[END_REF] have proposed a theoretical centralized framework for correlating events detected by a wireless sensor network in the context of critical infrastructure protection. This framework was leveraged in an early warning system that enhances decision making on combating security threats by collecting data from various sources. However, the centralized nature of this and other approaches -where all the data must be collected by a single node that performs data aggregation -reduces their robustness to node failure.

In contrast, this research advances the state of the art by eliminating the common assumption of a static network topology in order to accommodate scenarios where link failures may occur due to natural disasters, cyber attacks or physical security breaches. Specifically, a distributed data aggregation algorithm for situational awareness in critical infrastructures is presented, where the network topology that describes the communications layer is unknown and may change with time. The algorithm converges in finite time without requiring a stable network topology by engaging the cautious rule of combination [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF] to aggregate data. This combination rule does not require the information sources to be independent or distinct and is, therefore, preferred to other rules (e.g., transferable belief model conjunctive rule [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF] and Dempster combination rule [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] that lack robustness when information with equal credibility is combined several times). Because the cautious rule of combination is appropriate when all the sources are considered to be reliable, the convergence response is defined when all the sources are non-distinct and reliable. The effectiveness of the proposed algorithm is demonstrated using a case study involving several interconnected and interdependent critical infrastructures that are subjected to physical failures. Addressing this challenging critical infrastructure protection scenario requires a novel distributed data fusion framework that can reduce the risk of cascading failures by dynamically sharing information between the infrastructures.

Preliminaries

The theory of evidence is a formalism for modeling imprecision and uncertainty without resorting to classical probability. This theory, introduced by Dempster [START_REF] Dempster | A generalization of Bayesian inference[END_REF] and Shafer [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF], also referred to as the Dempster-Shafer theory, associates a number between zero and one to model the degree of confidence in a proposition based on partial (uncertain or imprecise) evidence.

Let Ω = {ω 1 , ..., ω n } be a finite set of possible values of a variable ω whose elements ω i are assumed to be mutually exclusive. Let Γ(Ω) 2 Ω be the power set of Ω. The goal is to quantify the confidence of a proposition of the form: "The true value of ω is in γ" where γ ∈ 2 Ω . The set Ω is referred to as the frame of discernment.

Basic Belief

Assignment. A function m : 2 Ω → [0, 1] is called a basic belief assignment (BBA) m if γa∈2 Ω m(γ a ) = 1 with m(∅) = 0.
A basic belief assignment m can be equivalently represented by its associated commonality q : 2 Ω → [0, 1] defined as:

q(γ a ) = γ b ⊇γa m(γ b ), γ a ∈ 2 Ω (1)
Thus, for γ a ∈ 2 Ω , m(γ a ) is the portion of the confidence that supports exactly γ a . In other words, the true value of ω is in γ a but, due to the lack of further information, it does not support any strict subset of γ a .

A limitation of the Dempster-Shafer formulation is that the application of the Dempster combination rule [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF] produces counterintuitive results when strong conflicts exist among the sources to be combined [START_REF] Zadeh | On the Validity of Dempster's Rule of Combination of Evidence[END_REF]. Smets [START_REF] Smets | The combination of evidence in the transferable belief model[END_REF] attempted to address this problem by proposing the transferable belief model (TBM), which relies on the concept of the basic belief assignment, but removes the assumption m(∅) = 0. The removal of this assumption applies when the frame of reference is not exhaustive, so that it is reasonable to believe that another event, not modeled in the considered frame, will occur. This leads to the definition of the TBM conjunctive rule [START_REF] Dempster | Upper and lower probabilities induced by a multivalued mapping[END_REF], which is more robust than the Dempster combination rule in the presence of conflicting evidence.

TBM Conjunctive Rule.

The combination rule used in the transferable belief model removes the normalization constant in the Dempster combination rule. The new TBM conjunctive rule is defined as:

m ij (γ a ) = γ b ,γc;γ b ∩γc=γa m i (γ b )m j (γ c ) γ a ∈ 2 Ω (2)
The TBM conjunctive rule is associative and its use is appropriate when conflicts arise due to the low reliability of some of the data sources. However, this rule and the Dempster combination rule rely on the distinctness assumption of the sources; in other words, the information sources are independent. This limitation can be avoided using a combination rule with the idempotence property. Denoeux [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF] defines an associative, commutative and idempotent operator called the cautious rule of combination, which is appropriate when all the sources are considered to be reliable. This rule does not require the assumption of independence.

Weight Function. Let m be a generic basic belief assignment. Then, the weight function w : 2 Ω \ Ω → R + is defined as:

w(γ a ) = γ b ⊇γa q(γ b ) (-1) |γ b |-|γa|+1 ∀γ a ∈ 2 Ω \ Ω ( 3 ) = ⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ γ b ⊇γa,|γ b | / ∈2N q(γ b ) γ b ⊇γa,|γ b |∈2N q(γ b ) if |γ a | ∈ 2N γ b ⊇γa,|γ b |∈2N q(γ b ) γ b ⊇γa,|γ b | / ∈2N q(γ b )
otherwise Cautious Rule of Combination. Let m i and m j be two generic basic belief assignments in the transferable belief model with weight functions w i and w j , respectively. Then, their combination using the cautious conjunctive rule, denoted by w i j = w i w j , is defined by the weight function:

w i j (γ a ) = w i (γ a ) w j (γ a ) = min(w i (γ a ), w j (γ a )) ∀ γ a ∈ 2 Ω \ Ω (4)
The proposed data aggregation technique works with the weight function w, which is obtained from masses using the commonality function q that is derived from the initial set of basic belief assignments. The next two sections demonstrate how these functions are generated from an initial set of basic belief assignments and are used to test the convergence of the algorithm.

Distributed Data Fusion

Consider a network described by an undirected graph G = {V, E(t)} where

V = {v i : i = 1, .., N } is a set of nodes (agents) and E(t) = {e ij (t) = (v i , v j )}
is a set of edges that represent the available point-to-point communications channels. The term t k denotes the instant when the k th communication occurs in the network.

Four assumptions are made about the network of agents: (i) the network is described by a connected undirected graph; (ii) every node produces a local basic belief assignment expressed as a weight function called the direct con-

Algorithm 1 : Gossip algorithm. t = 0, s i (0) = C i (0) ∀ i ∈ 1, ..., N s i (t stop ) ∀ i ∈ 1, ...,
i (t + 1) = s i (t) s j (t) s i (t + 1) = s i (t) s j (t) t = t + 1 end while
fidence; (iii) agent communications are asynchronous -at every time instant t k only one pair of agents (i, j) interact; and (iv) each agent i can handle the storage of the current direct confidence and the edge confidence computed via aggregation with a node v j such that (v i , v j ) ∈ E(t).

In the proposed framework, interactions between agents are modeled using a gossip algorithm [START_REF] Boyd | Randomized gossip algorithms[END_REF]. An interaction is defined as a triplet {S, R, e} for which the following conditions hold:

S = {s 1 , ..., s n } is the set containing the local states s i ∈ R q of each agent i in the network such that s i (t) = (w i (t, γ 1 ), .., w i (t, γ q )) at time t with q = |2 Ω \ Ω|.
R is the interaction rule based on the operator that, for any two agents (i, j) with e ij ∈ E(t), yields R : R q × R q → R q such that:

s i (t) s j (t) = (w i j (t, γ 1 ), ..., w i j (t, γ q )) (5)
e is the edge selection process, which specifies the edge e ij ∈ E(t) that is selected at time t.

Algorithm 1 specifies the gossip algorithm used in this work. The term C i (0) in the algorithm denotes the initial direct confidence of agent i. Note that the algorithm does not require agents to have unique identifiers. In other words, agents are not required to know the identities of the neighbors with which they exchange information. This assumption is not cosmetic because security and confidentiality are common requirements in interdependent critical infrastructures [START_REF] Caldeira | Secure mediation gateway architecture enabling communications among critical infrastructures[END_REF].

Thus far, the gossip algorithm based on the R interaction rule has been presented. This update rule is similar to the min-consensus algorithm described by Cortes [START_REF] Cortes | Finite-time convergent gradient flows with applications to network consensus[END_REF]. The major difference is that the proposed framework considers a gossip scheme and, thus, the interactions are asynchronous while Cortes [START_REF] Cortes | Finite-time convergent gradient flows with applications to network consensus[END_REF] considers a consensus scheme where the interactions are synchronous.

Lemma 1: Consider a gossip algorithm {S, R, e} over a time-varying graph G = {V, E(t)} with S and R as defined previously. Assume that each agent i at time t = 0 provides an independent set of direct confidences described by the weight function values s i (0) = {w i (0, γ a ); γ a ∈ 2 Ω \ Ω} obtained from the basic belief assignments and commonality functions m i (0) and q i (0), respectively, via Equations ( 1) and [START_REF] Caldeira | Secure mediation gateway architecture enabling communications among critical infrastructures[END_REF]. If e is such that ∀ t there exists a Δt ∈ R where G(t, t + Δ t) is connected, then there exists a time t = t such that ∀ t > t, ∀ γ a ∈ 2 Ω \ Ω the following relation holds:

s(t ) = s 1 (0) s 2 (0) . . . s n (0) (6)
In other words, each agent i converges to the same weight function.

Proof: In order to prove the convergence of the algorithm to steady state, consider a generic network topology where |V | = N is the number of agents (i.e., critical infrastructures). Consider the network at different time intervals

[t 0 , t 0 + Δt 0 ], [t 1 , t 1 + Δt 1 ], ..., [t h , t h + Δt h ] with t 1 = t 0 + Δt 0 + 1, t h = t h-1 + Δt h + 1.
During each time interval Δt i , the agents interact using the interaction rule R to form a connected graph. In particular, for any pair v i and v j such that (v i , v j ) ∈ E(t) at time t, the cautious rule of combination is applied so that the two agents agree on the minimum of the weight function set values:

s i (t) s j (t) = (w 1 2 (t, γ 1 ), .., w 1 2 (t, γ z )) (7)
where z = |2 Ω \ Ω|. Without any loss of generality, consider γ a and assume that there exists an agent v q such that w q (0, γ a ) = w(0, γ a ) ≤ w m (0, γ a ) for v m ∈ V. Note that in each iteration, all the w(t, γ a ) values with γ a ∈ 2 Ω \Ω are compared between two agents to find the minimum value. For the sake of simplicity, consider a generic w(t, γ a ) (the reasoning below will hold for any w(t, γ a )). For each time interval Δt k such that the graph G (t k + Δt k ) is connected, a particular edge selection policy is used that updates only one agent to w(t k , γ a ). In addition, consider a partition of

P = {U, W } of V with U, W ⊆ V, U ∩ W = ∅, U ∪ W = V
where U contains the agents that have reached the w(t k , γ a ) and W = V \ U is the set of remaining agents. The worst-case scenario for the edge selection policy e, in terms of the number of interactions required to update the state of only one agent, is when it verifies that the connection between two agents v u ∈ U and v w ∈ W for which e uv = (v u , v w ) ∈ E (t k , t k + Δt k ) occurs as the last interaction and the graph

G (t k + Δt k ) = {U ∪ W, E (t k , t k + Δt k )} with e uv ∈ E (t k , t k + Δt k ) is connected.
Next, consider the worst-case topology of a network with N agents; this is the topology for which a larger number of updates is required to reach convergence when the worst-case edge selection policy is considered. Clearly, the worst-case scenario is the topology with the largest diameter d (i.e., line topology with d = N -1).

Figure 1 shows the convergence to steady state at different time intervals for the worst-case network topology with N = 5, where the agent with w(t i , γ a ) is placed on the extreme right so that the longest diameter is obtained. Note that Lemma 2: Consider an edge selection policy e such that ∀ t there exists a Δt ∈ N where G(t, t + Δ t) is connected. If ∀ t there exists a time M ∈ N : Δ t < M, then any agent converges by t = d • M where d is the diameter of the network. Proof: The proof follows directly from Lemma 1. In particular, recall that, in the worst-case scenario involving the topology, the network exhibits the largest diameter d so that d = N -1 and d • Δt i is the number of time intervals [t i , t i + Δt i ] after which all the nodes are updated. Assuming that an upper bound M is available on the time required for the network to be connected during each time interval [t i , t i + Δt i ], then the time required to update one agent is t i = M . By iterating using the same reasoning, the process takes t = d • M to update all the agents. Therefore, the overall time required for the algorithm to converge in the worst-case scenario for the topology is linear with respect to the diameter of the network topology G.

Case Study

The case study involves a set of critical infrastructures in which the occurrence of certain conditions are monitored by a set of n agents. The infrastructures, which are geographically distributed, generically represent the infrastructure assets of a city. Each infrastructure is monitored by a SCADA system which includes: (i) a SCADA management system (e.g., human-machine interface and historian) located in a SCADA control center for monitoring and controlling field equipment; (ii) field devices (i.e., sensors, programmable logic controllers, remote terminal units and intelligent electronic devices) that acquire and transmit process parameter values and implement control actions; and (iii) a communications network that supports message exchange between field devices and the SCADA management system. Although critical infrastructures exhibit different kinds of dependencies, they generally do not share information. In contrast, this case study assumes that each infrastructure is able to produce information about the possible causes of faults in the infrastructure. This information, which is produced by monitoring agents deployed on the field devices, is exchanged among the agents (i.e., infrastructures).

The information shared among the infrastructures is provided by two kinds of agents as shown in Figure 2: (i) monitoring agents that acquire measurements from the field devices (physical events, cyber events and physical security events) and; (ii) aggregation agents that assist a SCADA management system by collecting the information from neighboring monitoring agents and distributing the information to peer agents in the other infrastructures. The resulting system is modeled as a multi-agent platform for distributed data aggregation in which each agent produces a basic belief assignment associated with the cause of a critical event that can affect the functionality of an infrastructure.

The monitoring agents, which detect physical and cyber events, are connected to the aggregation agents via the SCADA communications network of the associated infrastructure. Monitoring agents detect events by leveraging a security patrol, which is shared by the infrastructures to identify wireless intruders that are proximal to the monitored infrastructures. A monitoring agent sends alarm condition notifications via wireless communications using the nearest infrastructure communications network. Every agent executes the algorithm presented in Section 3 in order to evaluate the direct confidence and to communicate with its neighboring nodes. Communications between the aggregation agents use virtual private network (VPN) links. Note that aggregation agents only aggregate information; their direct confidence values depend only on their neighboring nodes. The convergence of monitoring and aggregation agents occurs in finite time steps, providing the most credible cause(s) of a fault. According to Lemmas 1 and 2, algorithm convergence in finite time is ensured for any edge selection policy e that produces a connected graph. This property is especially important in a disaster environment (such as the considered scenario), where communications paths between pairs of nodes may be unavailable.

Since the security patrol is mobile, its links with peer aggregation agents change over time. For simplicity, it is assumed that the security patrol is connected to only one aggregation agent during each time step -in any case, according to Lemma 1, a violation of this assumption does not affect the convergence of the algorithm.

The proposed approach is distributed because it can be implemented in a network without a central node. It differs from the centralized approaches that are typically employed in traditional SCADA system architectures. In a centralized approach, the SCADA management system gathers and correlates events and security information originating from field equipment in order to detect malicious activities that are perpetrated in a distributed manner -such a centralized node is able to produce more accurate information about the state of the monitored system. In contrast, the proposed approach is distributed because the SCADA management system nodes (manifested by aggregation agents) act as neutral nodes with initial basic belief assignments such that m(Ω) = 1. These nodes provide valuable information when they perform aggregations in conjunction with other information agents.

Problem Formulation

The case study considers four interdependent critical infrastructures that can be affected by failures and/or threats. Each infrastructure is able to produce one or more basic belief assignments from physical, cyber and physical security events detected by the monitoring agents. The frame of discernment is Ω = {a, b, c, d} where a denotes a possible physical failure, b a possible cyber intrusion or attack, c a possible physical security threat and d a normal functioning level.

Figure 3 presents the case study scenario derived from [START_REF] Formicola | Assessing the impact of cyber attacks on wireless sensor nodes that monitor interdependent physical systems[END_REF], which involves a dam that feeds a hydroelectric power station that, in turn, feeds a power distribution substation through a transmission network (not modeled for simplicity). A base transceiver station (BTS) provides telecommunications services and receives electricity from the power distribution station. The dam provides water to the hydroelectric power station through a gate that is remotely controlled to release basin water and activate the power plant turbine. The water supply network feeds the water pumps and automation devices, all of which receive electricity from the power distribution station. Infrastructure failures potentially cause societal and economic disruptions in the city district.

Table 1 shows the monitoring agents considered in each infrastructure. The following sections present practical methods that can be implemented by the agents to generate the relative basic belief assignments from sensor measurements. Also, the convergence of the algorithm starting with an initial set of basic belief assignments is demonstrated.

Dam and Hydroelectric Power Station

The dam and hydroelectric power station are controlled by a SCADA system that utilizes a wireless sensor network. Water fed to the hydroelectric power station is conveyed through pipes called penstocks. Agent v 1 is configured to monitor unauthorized physical access to the SCADA control room of the dam. In particular, the agent receives information wirelessly from a radio frequency identification (RFID) door sensor installed in the SCADA control room and sends alerts about possible intrusions that could impact the proper functioning of the dam. When modeling the basic belief assignment of agent v 1 , it is necessary to consider the possibility that an intruder with access to the SCADA control room may be able to launch a cyber attack (Table 2).

Agent v 2 periodically monitors the water flow rates and water levels measured by the sensors and uses them to check for security violations that could cause a turbine control malfunction. As explained in [START_REF] Formicola | Assessing the impact of cyber attacks on wireless sensor nodes that monitor interdependent physical systems[END_REF], two conditions hold in a generic dam under normal conditions: (C1) the difference between the water flow rates as measured by two water flow sensors located at the extremes of the penstock (W F 1 and W F 2 in the scenario) should disappear within about three seconds; and (C2) the variation in the water level in the basin of the dam (W L in the scenario) should be consistent with the variations in the incoming and outgoing water flows. Although the violation of each individual condition cannot be considered to be a consequence of a cyber attack, but rather a physical failure, violations of both conditions can increase the credibility of a cyber attack. In fact, a possible attack scenario involves compromises of the water flow sensors in order to hide changes in the water flow rates in the penstock. Thus, the basic belief assignment generated by agent v 2 combines the verification/violations of the two security conditions (Table 3).

A m 2(A) C1, C2 ¬C1, C2 C1, ¬C2 ¬C1, ¬C2 d 0.9 - - - ab - - 0 . 2 0 . 3 ac - 0 . 3 0 . 1 - ad - 0 . 1 0 . 5 - bc - 0.2 - 0.5 abc - 0 . 1 - - Ω 0.1 0.3 0.2 0.2

Power Distribution Station

Earthquakes and hurricanes are known to have devastating effects on power distribution systems. Thus, reinforced concrete, fire-and explosion-resistant walls or barriers are installed between major pieces of equipment such as transformers, circuit breakers and regulators housed in power distribution facilities. Torrential rains caused by hurricanes can affect distribution systems more severely than generation and transmission systems. Floods caused by heavy rainfall can damage low-hanging lines in a power distribution system and cause power disruptions.

Agents v 3 and v 4 provide early warnings about possible physical faults induced by seismic events and floods, respectively. Agent v 3 obtains peak ground acceleration (PGA) data from a seismic sensor SS 1 installed in the substation building and estimates the credibility of a physical fault on the power distribution station based on the structural properties of the building. The building is assumed to have one story and to be a recent reinforced concrete construction. These properties are associated with a seismic vulnerability index I v = 0 from a value range of -6 to 60. Agent v 3 transforms the peak ground acceleration of a seismic event to a microseismic intensity index I MCS using the following equation for a building with the properties mentioned above [START_REF] Decanini | Formulation of elastic earthquake input energy spectra[END_REF]: log(P GA) = 0.594 + 0.197I MCS [START_REF] Ducourthial | Self-stabilizing distributed data fusion, in Stabilization, Safety and Security of Distributed Systems[END_REF] The following equations from [START_REF] Lagomarsino | Macroseismic and mechanical models for the vulnerability and damage assessment of current buildings[END_REF] relate I MCS and I v to the mean damage d to the building (value range of 0 to 5) and the corresponding damage factor f d (value range of 0 to 1): d = 0.5 + 0.45(arctan(0.55(I MCS -10.2 + 0.05I v )) ( 9)

f d = d 1.75 (10)
Based on these equations and the computed I MCS and I v values, agent v 3 can calculate the damage factor f d (Figure 4) and estimate the credibility of a physical fault affecting the power distribution station. Table 4 shows the basic belief assignment generated by agent v 3 based on the damage factor f d . Agent v 4 evaluates the rain precipitation in real time using a pluviometer sensor located in the substation; this data is used to assess the possible effects of flooding on the functionality of the substation. To accomplish this, a hotspot analysis was conducted over a two-year period for a residential urban area. Linear regression analysis was then performed between the average frequency of disconnections at a specific electrical substation and the amount of rain precipitation in the area of the substation. Data relative to the rain precipitation was provided by a pluviometer installed near the substation.

The linear regression results in Figure 5 reveal a high correlation between the average frequency of disconnections and the amount of rain precipitation. This suggests that the amount of rain precipitation is a reliable predictor of the disconnection frequency and, therefore, provides a metric for specifying the basic belief assignment for agent v 4 . Table 5 presents the credibility levels of physical faults in the substation of interest based on the daily quantity of rain precipitation denoted by Q (in mm).

Base Transceiver Station

A large number of base transceiver stations are installed in cities, often on the rooftops of buildings. This makes a base station vulnerable because an earthquake could damage the building housing the station, disrupting telecom- munications services in the area. Thus, agent v 5 could use the peak ground acceleration from the seismic sensor SS 2 installed in the building housing the base station to estimate the possible damage to the station based on the structural properties of the building. A building with the same structural properties as in Section 4.3, but with five stories (consistent with common base station installations) is considered. These properties can be associated with a seismic vulnerability index I v = 20 according to Equations ( 9) and [START_REF] Formicola | Assessing the impact of cyber attacks on wireless sensor nodes that monitor interdependent physical systems[END_REF]. Thus, agent v 5 is assigned the same basic belief assignment as agent v 3 in order to relate the damage level of the building to the occurrence of a physical failure to the base transceiver station.

Water Supply Network

Earthquakes are the most serious natural threat to a water supply network. They cause multiple types of damage to pipelines (e.g., longitudinal cracks, circumferential cracks and compression joint breaks) that result in severe water supply disruptions. To detect the effects of seismic events on the water supply network, agent v 6 acquires peak ground acceleration data from seismic sensor SS 3 installed in a pipeline that serves a residential area. The monitored segmented pipeline is assumed to have brittle iron pipes with bell-and-spigot joints, which is typical in water supply networks. The basic belief assignment generated by agent v 6 is determined by using the fragility curve for the specified pipeline as defined in [START_REF] Lanzano | Vulnerability of pipelines subjected to permanent deformation due to geotechnical co-seismic effects[END_REF] and diagrammed in Figure 6.

Table 6 shows the basic belief assignment generated by agent v 6 . The value is proportional to the severity of the peak ground acceleration detected during an earthquake.

Security Patrol

The security patrol manifested by agent v 7 is based on the security vehicle prototype presented in [START_REF] Patterson | Optimizing investments in cyber-security for critical infrastructure[END_REF]. The vehicle has equipment that detects wireless threats using the standard war-driving technique. The vehicle drives around a facility to collect and analyze wireless network traffic in order to detect potential intruders that are proximal to the facility. Predetermined security procedures are performed when threats are detected.

The security patrol vehicle can detect cyber and physical security threats. However, defining the basic belief assignment policy for this agent is application- dependent because it requires a deep analysis of the environment monitored by the vehicle and the wireless traffic data. Indeed, to quantify the credibility of cyber and physical security threats in the form of a basic belief assignment, several properties should be considered, including the signal strength of the emitter and the number of packets collected. The stronger the signal, the more accurate the location of a potential intruder. Moreover, the greater the number of wireless packets collected, the more likely it is that a cyber attack would be discovered.

In this scenario, it is assumed that the security patrol can, at each time step, specify the credibility of cyber and physical security threats in terms of a basic belief assignment. This information is communicated periodically via a wireless connection to the aggregation agent of the infrastructure of interest.

Numerical Example

This section presents the results of executing the distributed data fusion algorithm for a specific set of basic belief assignments and a random topology generated at each time step. In order to establish algorithm convergence based on Lemma 1, the edge selection policy e generated a random connected graph at each time step, where the edges between the agents may or may not have existed and the security patrol was connected to an aggregation agent that changed over time. This policy complies with the assumptions underlying the application of the algorithm in a disaster scenario where the communications network may undergo temporary or permanent disconnections.

Table 7 shows the set of basic belief assignments at time t = 0 corresponding to the network topology shown in Figure 3. It is assumed that the security patrol provides the same alarm conditions over time as agent m 7 in Table 7 when it monitors the water supply network. However, the security patrol provides no information (i.e., m(Ω) = 1) when it monitors other infrastructures. The last row in Table 7 shows the convergent basic belief assignment m(γ a ) at time t = 106, which was obtained using the weight function w(γ a ) as described in Section 2. The basic belief assignments m(γ a ) exhibit the highest credible values corresponding to the occurrence of a physical fault that affects the con-

Figure 1 .

 1 Figure 1. Steady-state convergence at different time intervals.

Figure 2 .

 2 Figure 2. Communications framework between infrastructures in the case study.

Figure 3 .

 3 Figure 3. Case study scenario.

Figure 4 .

 4 Figure 4. Expected damage [11, 15].

Table 4 .

 4 Basic belief assignment generated by agents v3 and v5.A m 3(A)f d = 0 f d = 1 f d = 2 f d = 3 f d = 4 f d = 5

Figure 5 .

 5 Figure 5. Correlation between the disconnection frequency and rain precipitation.

Figure 6 .

 6 Figure 6. Fragility curve of a segmented pipeline [12].

Table 1 .

 1 Monitoring agents considered in each infrastructure.

	Infrastructure	Agents
	Dam and Hydroelectric Station	v1, v2
	Power Distribution Station	v3, v4
	Base Transceiver Station	v5
	Water Supply Network	v6
	Security Patrol	v7

Table 2 .

 2 Basic belief assignment generated by agent v1.

	A	m 1(A)
		Door Closed Door Open
	d	0.9	-
	ac	-	0 . 3
	bc	-	0 . 4
	abc	-	0 . 2
	Ω	0 . 1	0 . 1

Table 3 .

 3 Basic belief assignment generated by agent v2.

Table 5 .

 5 Basic belief assignment generated by agent v4.

	a	-	-	-	0 . 6
	d	0.9	0.3	-	-
	ab	-	0.5	0.4	0.2
	ac	-	-	0 . 1	-
	ad	-	-	0 . 2	-
	Ω	0.1	0.2	0.3	0.2

A m 4(A) Q ≤ 20 20 < Q ≤ 35 35 < Q ≤ 50 Q > 50

Table 6 .

 6 Basic belief assignment generated by agent v6.

	A			m 6(A)
		PGA ≤ 0.2 0.2 < PGA ≤ 35 35 < PGA ≤ 50 35 < PGA ≤ 50 PGA > 50
	a	-	-	-	0 . 3	0 . 7
	b	-	-	-	-	-
	d	0.9	0.5	0.1	-	-
	ab	-	0.3	0.5	0.5	0.2
	ac	-	-	0 . 2	0 . 1	-
	bc	-	-	-	-	-
	Ω	0.1	0.2	0.2	0.1	0.1

m(t) 0.22 0.41 0.06 0.03 0.12 0.08 --0.04 0.04 sidered infrastructures. It is worth noting that the same convergent basic belief assignments are obtained using a centralized approach where all the basic belief functions, expressed as weight functions, are aggregated using the cautious operator.

Conclusions

The proposed distributed data fusion algorithm based on the transferable belief model is designed to provide situational awareness in critical infrastructures with link failures. A key result is that the algorithm converges in finite time for any connected network topology when the cautious rule of combination is used for data aggregation. The application of the algorithm to a realistic scenario involving interdependent critical infrastructures demonstrates its utility as an information sharing methodology. Information sharing among infrastructures is extremely useful for decision making during emergency situations, enabling the understanding of the most credible causes of service degradation and the implementation of timely countermeasures.

Future research will focus on integrating additional agents to address a broader range of events that affect infrastructure assets (e.g., lightning and landslides).


Evan Plumley

Mason Rice

Stephen Dunlap

John Pecarina

Categorization of cyber training environments for industrial control systems

Keywords: Industrial control systems, incident response, training environments

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the evening of April 17, 2013, an act of arson at a fertilizer plant in West, Texas resulted in an explosion that killed fifteen people, including ten first responders who were fighting the fire [START_REF] Fernandez | Fire that left 15 dead at Texas fertilizer plant is ruled intentional[END_REF][START_REF] Pell | Unprepared: Texas blast shows failure of emergency planning law, analysis shows[END_REF]. The first responders were not trained to handle a chemical fire and did not fully comprehend the explosive hazards posed by the materials in the plant. The U.S. Emergency Planning and Community Right to Know Act requires all companies to report hazardous chemicals stored in their facilities. However, there are no legal requirements for local first responders to be trained adequately based on the hazard reports.

To avoid disasters like the Texas explosion, it is imperative that incident responders receive training in environments that teach them the required incident response knowledge and skills as well as help assess the extent of the acquired knowledge and skills. Processes in an industrial environment are managed using industrial control systems that have limited or weak cyber security protections and can pose physical threats to personnel and equipment. The first responders tasked to respond to incidents in industrial control environments must be properly trained and prepared to deal with the complexity and diversity of cyber incidents.

This chapter proposes a framework for identifying and mapping industrial control system cyber incident response knowledge and skills to training environment components. This chapter also proposes a categorization of training environments based on practicality and realism. The categorization assists organizations in determining the cyber training environments that best align with their training needs and budgets.

Incident Response Training Environments

The lack of industrial control system defenses is a cause for concern in the community. Contributing factors include cost, system diversity, long lifecycles and organizations that are reluctant to make changes to their operational systems [START_REF]Recommended Practice: Developing an Industrial Control Systems Cybersecurity Incident Response Capability[END_REF]. Generally, the personnel employed at industrial control facilities do not have the skills to properly collect, analyze and examine the command and control traffic in their networks and they find it difficult to differentiate cyber attacks from non-cyber-induced malfunctions [START_REF] Fabro | Recommended Practice: Creating Cyber Forensics Plans for Control Systems[END_REF]. While most organizations are unable to provide high levels of training to their cyber response teams, they can support effective -albeit lower levels of -training that balance organizational goals and budgets. This section discusses the current state of industrial control system training and training environments at U.S. Government, industry and academic entities.

U.S. Government

The U.S. Department of Homeland Security Department is the U.S. Government entity that provides the vast majority of training programs in the area of industrial control systems. The training efforts primarily focus on the effects of attacks and the development of mitigation strategies as opposed to emergency incident response.

Training courses offered by the Industrial Control System Cyber Emergency Response Team (ICS-CERT) leverage a partial industrial control system to demonstrate exploits and their impacts; the courses culminate in a red and blue team exercise where participants attack and defend an industrial control system [START_REF]Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)[END_REF]. While the training environment is by no means a full-scale system, it incorporates realistic hardware and displays real physical effects. Participants in the advanced course are expected to have prior knowledge of information technology as well as industrial control systems. The advanced course encourages discussion between information technology and industrial control system professionals, which enhances the development of contextual knowledge in both communities. In a real incident response setting, profession-als from the two communities must communicate efficiently and effectively to avoid system damage and ensure successful recovery.

However, the exercises and training environment fall short in creating a complete and complex system; moreover, they lean heavily on traditional information technology attacks and defenses instead of focusing intensely on the industrial control domain. Participants must travel to the Idaho National Laboratory facility in Idaho Falls, Idaho for the five-day course. Idaho National Laboratory claims to be able to replicate the control system specifications of any participant, to conduct simultaneous attacks on multiple systems and to perform customized full-scale cyber attacks on an exact replica system [START_REF]Defending the Network Against Hackers, Fact Sheets: 21st Century Science and Technology[END_REF].

Sandia National Laboratories, which operates as a part of the U.S. Department of Energy National Nuclear Security Administration, is a leader in providing industrial control systems education and training to industry, government and academia [22]. Sandia offers a supervisory control and data acquisition (SCADA) assessment training course that covers the systems and devices in the critical infrastructure and industry. The primary purpose of the course is to provide methodologies and tools for assessing the security of industrial control systems. However, the course is only offered at Sandia's discretion to individuals on an invitation-only basis [22].

Several U.S. research laboratories have leveraged their expertise and capabilities in developing the National SCADA Test Bed [START_REF]National SCADA Test Bed, Enhancing Control Systems Security in the Energy Sector[END_REF]. The testbed incorporates full-scale realistic systems and is designed to support research and educational activities. While the emphasis on realism and fidelity ensure that the testbed emulates a real environment, the facility is not currently used to train cyber defenders or incident response teams [START_REF]National SCADA Test Bed, Enhancing Control Systems Security in the Energy Sector[END_REF].

Industry

Industry-provisioned training conducted by vendors is similar to government training; the courses primarily cover industrial control system fundamentals, security audits and assessments of vendor equipment and products. The environments typically provide hands-on laboratory experiences designed to familiarize trainees with programmable logic controllers that are networked to emulate real industrial control environments. The vendors often travel to various locations and offer specific courses to individuals and organizations [START_REF] Butts | How industrial control system security training is falling short[END_REF]. The classes are not tailored to train security experts; instead, they are designed for individuals who intend to operate or administer industrial control systems. While these courses are useful, they do not expose potential cyber responders to the complexity of complete systems.

Industry training environments also exist in the form of software simulations of industrial control systems. An example is the LogixPro-500 PLC Simulator that incorporates the RSLogix 500 engineering environment and the ProSim-II programmable process simulation that emulates a programmable logic controller [START_REF]The Learning Pit, LogixPro 500 PLC Simulator[END_REF]. While this simulation software is not security focused, it provides valuable hands-on experience to novices that advances their understanding of industrial controllers, with the goal of ultimately gaining expertise in industrial control systems security and first response.

Academia

Academia also uses assorted testbeds for education and research. Mississippi State University maintains a cyber security testbed that emulates a real-world industrial control system with physical processes [START_REF] Morris | A control system testbed to validate critical infrastructure protection concepts[END_REF]. Other academic entities have constructed industrial control system environments with fully-or partiallysimulated controllers and processes. Reaves et al. [START_REF] Reaves | An open virtual testbed for industrial control system security research[END_REF] have created a testbed that fully simulates an industrial control system environment, including control systems and physical processes. Wertzberger et al. [START_REF] Wertzberger | Towards a low-cost SCADA testbed: An open-source platform for hardware-in-theloop simulation[END_REF] have implemented a training environment that combines real-world control hardware with simulated physical processes and networking that is a step beyond full simulation. While these environments are adequate for introductory training, they lack the complexity of a full-scale system that is required to impart expertise related to emergency response procedures.

The SANS Institute, a cooperative research and education organization, provides training through online courses and in-class and mentored settings around the world. It has created the SANS CyberCity, a scaled model of a small city that incorporates computers, networks, control hardware and embedded devices that emulate infrastructure assets such as a power grid, water system, traffic system and heating, ventilation and air conditioning (HVAC) systems [START_REF]SEC562: CyberCity Hands-on Kinetic Cyber Range Exercise[END_REF]. This model city is used in an on-site course conducted in Austin, Texas, which exposes trainees to industrial control systems and their components, including human-machine interfaces, industrial protocols and data historians. The model city training environment enables trainees to view the physical effects of their cyber actions while operating realistic vendor-supplied technology. The course covers common security flaws and techniques for thwarting attacks on industrial control systems.

Bloom's Taxonomy

Educational frameworks have been created to provide insights into the cognitive value acquired from educational activities (e.g., assigned projects and homework). An educational psychologist named Benjamin Bloom sought to classify educational goals and objectives based on cognitive complexity [START_REF] Forehand | Bloom's Taxonomy, Emerging Perspectives on Learning, Teaching and Technology[END_REF]. The resulting Bloom's Taxonomy, which was revised in 2001, is widely used by teachers and professors for structuring courses that encourage students to learn, apply knowledge and develop an array of cognitive skills.

Bloom's revised taxonomy comprises the six major categories of educational goals listed in Table 1; the categories range from the least complex category (1) to the most complex category [START_REF] Cybati | [END_REF]. The taxonomy illustrates the progression of cognitive complexity from basic understanding to the creation of original ideas and concepts. It provides a means for aligning an educational tool to the level of skill and complexity that the tool is meant to invoke. [START_REF] Forehand | Bloom's Taxonomy, Emerging Perspectives on Learning, Teaching and Technology[END_REF][START_REF] Krathwohl | A revision of Bloom's Taxonomy: An overview[END_REF].

Remembering

Retrieving, recognizing and recalling relevant knowledge from long-term memory.

Understanding

Constructing meaning from oral, written and graphic messages through interpreting, classifying, summarizing, inferring, comparing and explaining.

Applying

Carrying out or using a procedure through executing or implementing.

Analyzing

Breaking material into constituent parts, determining how the parts relate to one another and their overall purpose through differentiating, organizing and attributing.

Evaluating

Making judgments based on criteria and standards through checking and critiquing.

Creating

Putting elements together to form a comprehensive view; reorganizing elements into a new pattern or structure through generating, planning or producing.

Relating the Taxonomy to Training Platforms

Bloom strongly recommended the acquisition of concrete knowledge before increasing the intricacy of a training environment presented to students. In many fields, especially those with a high risk of incurring damage to property or injury, a form of training simulation is often used to gradually introduce trainees (or students) to additional variables of complexity before attempting an authentic hazardous task.

Simulations have been used in several hazardous and highly technical professions (e.g., military weapons and vehicle operation, aircraft piloting and astronautics) to build a base of knowledge and comfort for trainees. The U.S. Army uses multiple tank simulators to qualify gunnery soldiers and drivers before they operate real tanks [START_REF] Baltos | Soldiers prepare on tank simulators for Saber Guardian exercise[END_REF][START_REF] Beckstrom | Tank gunnery simulator: Getting back to basics[END_REF]. The Army also uses simulations for generic marksmanship training for soldiers called the Engagement Skills Trainer. To take the training a step further, the Army uses a training tool called the Virtual Convoy Operations Trainer, which enables collective training to be practiced in a virtual environment and multiple soldiers to train together with increasing realism [START_REF] Chang | Simulators always valuable in military training[END_REF].

Several categories of simulations, called flight simulation training devices (FSTDs), are available for private helicopter pilot training. The European Aviation Safety Agency (EASA), a certifying authority for flight simulation training environments, has developed specifications that define each environment level. The specifications cover the exact capabilities that each level is required to provide for certification (e.g., form factor of the cockpit and auditory feedback to trainees) [START_REF]European Aviation Safety Agency, Certification Specifications for Helicopter Flight Simulation Training Devices, CS-FSTD(H)[END_REF]. The categories are:

Flight and Navigational Procedure Trainer (FNPT): A fixedbased generic system that is primarily used for initial and refresher helicopter training, including basic and safety procedures, emergencies, navigation, instrument rating and multi-crew cooperation.

Flight Training Device (FTD):

A fixed-based system that simulates a specific type of helicopter. In addition to the flight and navigational procedure trainer capabilities, a flight training device is designed for rating pilots on specific helicopter types. This flight simulation training device has limited checking/testing capabilities because it does not include a motion or vibration system.

Full Flight Simulator (FFS):

A motion-based system that provides, in addition to a flight training device, motion and vibration cues. It has the highest level of technical complexity and training capability and can be used for proficiency evaluation.

Other Training Device (OTD):

A training aid for which a complete cockpit or flight deck is unnecessary. No regulations cover other training devices, which can vary from desktop computers to helicopter dashboards. These training devices are often used to drill pre-flight tasks or familiarize a pilot with a single cockpit instrument.

Each category serves a different purpose by introducing new variables and increased realism. The simulation categories with increasing levels of realism were created to ensure that pilots demonstrate mastery of the equipment and procedures during training to reduce risk during real flights.

NASA houses numerous training simulators that familiarize its trainees with a variety of environments and situations (e.g., launch, landing, payload and rendezvous activities) [START_REF]Johnson Space Center: Training for Space, Astronaut Training and Mission Preparation[END_REF]. The simulations include fixed-based and motionbased simulators. Astronauts train for 300 hours in the simulators to qualify for real operations. NASA training also extends outside the virtual environment to space environments that are recreated using special aircraft and pools. This training is necessary for the astronauts to gain confidence before operating in the hazardous and unpredictable environment of space.

Every training environment provided by these organizations is intended to gradually assimilate trainees into a real, complex and diverse environment. Each environment serves a different purpose and is tailored to the needs of trainees. With every step forward in the training process, a new training platform is introduced that provides new concepts and builds the strong base of knowledge needed to operate in an unpredictable real environment.

Training Environment Development

The framework presented in this section identifies industrial control system first response training environment components that facilitate skill acquisition. The skills are divided into overarching phases of a cyber incident response based on the National Institute of Standards and Technology (NIST) Incident Response Lifecycle [START_REF] Cichonski | Computer Security Incident Handling Guide[END_REF]. The skills presented in each phase of the lifecycle are the result of the analysis and consolidation of multiple sources, including several NIST and U.S. Department of Homeland Security publications.

Preparation

When considering incident response preparation for an industrial control system, a defense-in-depth strategy is not always appropriate for a response team that, in most cases, will interact with the system only after an incident has occurred. Time-sensitive responses in unfamiliar environments require the preparation phase to focus on the acquisition of general knowledge about industrial control systems that can be used in a variety of environments.

The following skills are deemed to be necessary for incident response preparation:

Risk and Recovery Prioritization:

The ability to prioritize components that pose the principal security risks to a system as a whole and determine the components that should be addressed.

Attack Vector Assessment:

The ability to understand the attack path that an intruder may take when attempting to compromise a system. A responder must understand how an attacker can gain access and the techniques that could be used to manipulate and pivot in the system.

Communication with Asset Owners:

The ability to communicate with an asset owner and employees is essential to gain an understanding of system operation. It enables responders to gain insights into system and network layouts, the scope of the damage and the limitations of a response effort. This skill enables the execution of all other skills required during the preparation phase.

Competence with Control System Components:

The ability to understand the functions of control system components and how the components (e.g., engineering software, control hardware and control interfaces) operate in order to be able to identify irregularities, malfunctions and manipulations.

Preparing for cyber responses to an industrial control system requires training components that represent the system in a realistic manner.

The following components are deemed to be necessary for assessing preparation skills: System Familiarization Components: Examples of system familiarization components include descriptions of the devices that guide risk and recovery prioritization in a response plan and network maps that assess the ability of a trainee to understand the role of operational technology.

Control Hardware: Physical industrial control devices that manage the operation of a physical process include programmable logic controllers and remote terminal units.

Engineering Software: This software is used to program and configure industrial control system hardware. The software is often proprietary and is provided by the control hardware vendor.

Human Machine Interface (HMI) Software: This software supports the monitoring and control of a physical process. It enables a human operator to monitor, analyze and control the operational status of the process.

Real Control Process:

A realistic process is one that is encountered in an industrial setting and that provides trainees with opportunities to interact and experiment with the process and understand the physical effects.

Varied Industrial Control Vendor Exposure: It is important to expose trainees to multiple proprietary control technologies in a single training environment. This enables the trainees to grasp the similarities and differences between proprietary control components.

Detection and Analysis

One of the most challenging aspects of incident response is to accurately detect an attack and determine the scope of the problem [START_REF] Cichonski | Computer Security Incident Handling Guide[END_REF]. This phase is complicated by the wide range of detection technologies that may provide conflicting, inaccurate and/or incomplete information. Assets may also have malfunctions that were not necessarily caused by malicious activities. While an industrial control system response team is normally not the primary detector of an incident, the response team must be able to identify the potential signs of the problem and confirm, by applying detection and analysis methods, that the problem was caused by malicious activity. The team must be able to engage all sources of incident indicators, including intrusion detection systems, anti-virus systems, security information and event management systems (SIEMs), and network-based and operating-system-based logging systems.

While traditional detection devices are valuable, an industrial control system response team should be able to apply its industrial control knowledge to detect malicious effects that may be physically visible or inherent in control software. This adds a layer of complexity over and above traditional information technology intrusion detection systems.

The following skills are deemed to be necessary for detection and analysis:

Anomaly and Event Detection: The ability to use software and hardware detection systems to pinpoint anomalies and events that impact system operation.

System Component Monitoring:

The ability to monitor control components and their logical execution to analyze their functionality and detect abnormalities. This includes monitoring via physical means and software.

Traffic Monitoring and Analysis: The ability to monitor and filter traffic in order to track malicious behavior in an industrial control system and the ability to analyze and understand network traffic in the industrial control system.

Log Analysis:

The ability to forensically analyze system logs to trace an incident to its cause and track an attacker.

Assessing detection and analysis skills requires components that implement detection technologies, physical effects and realistic network activity.

The following components are deemed to be necessary for assessing detection and analysis skills: Physical Component Effects: These include the physical operations involved in a process (e.g., pumping of water in a wastewater treatment plant).

Anomaly Detection Tools: These software and hardware tools enable the detection of anomalies in a control system and network via analyses of the physical process and network traffic (e.g., Grassmarlin and Symantec anomaly detection systems for industrial control systems).

Realistic Industrial Network Traffic:

It is important to provide realistic industrial control network traffic corresponding to various industrial protocols (e.g., Modbus, EtherNet/IP and DeviceNet). This provides trainees with practical industrial control protocol exposure to perform analysis and monitoring.

System Logging: Components such as network logging tools and data historians must be available to log interactions and industrial process data. These components enable trainees to conduct forensic analyses of industrial control systems.

Containment, Eradication and Recovery

The containment, eradication and recovery phase focuses on the ability of a responder to select and apply appropriate strategies for isolation, evidence handling, source identification, threat eradication and restoration [START_REF] Cichonski | Computer Security Incident Handling Guide[END_REF].

Containment strategies include the complete disconnection of an attacker (or source of activity), sandboxing and network filtration. Implementing a temporary solution that decreases malicious activity and prevents further damage is also included in containment. A strategy for containing a threat must consider the possible consequences (e.g., internal damage and solution duration) [START_REF] Cichonski | Computer Security Incident Handling Guide[END_REF].

In an industrial control system environment, disconnection can lead to catastrophic effects to the control process, where components may depend on each other for interoperability. The same problem can arise during an attempt to filter traffic. It is important for an industrial control system incident responder to understand system operations before making any isolation or containment decisions.

Evidence must be gathered to document an incident and pursue legal proceedings. The evidence should also include all identifying information, information about the personnel who collected, handled and analyzed the evidence, the times and dates of occurrences and the evidence storage locations [START_REF] Cichonski | Computer Security Incident Handling Guide[END_REF].

To facilitate recovery, a responder or response team must accurately assess the cause of the problem and apply the proper fixes. After the threat has been completely eradicated and system operations are restored, a series of tests must be conducted to ensure the return to system normality.

The following skills are deemed to be necessary for containment, eradication and recovery:

Return of a System to the Operational State:

The ability to rapidly return a system to an operational state, mitigate physical and financial losses, and conduct tests to ensure that the system is restored properly.

Attacker Identification:

The ability to identify the source of the incident through a forensic investigation.

Attacker Disconnection or Sandboxing:

The ability to isolate an attack source from a network and ensure that no further damage can be done by the attacker.

Identification and Mitigation of Exploited Vulnerabilities:

The ability to identify the vulnerabilities that were exploited in an attack and mitigate the security weaknesses.

Evidence Gathering and Handling:

The ability to gather and handle evidence in a manner that does not compromise the investigation.

To assess the ability to mitigate, eradicate and document attacks, a training environment must include elements that enable a responder to perform actions that stop attacks while keeping the system functional to the extent possible.

The following components are deemed to be necessary for assessing containment, eradication and recovery skills:

Emergency Backup Operation Equipment: This enables the deployment of manual backup operations that prevent a critical process from failing completely. This enables a trainee to prioritize system operations.

Real Malware and Attack Scripts: These help produce realistic attack scenarios and genuine effects on a system that help trainees to detect and defend against attacks.

Physical Disconnection or Isolation Options: These enable the physical disconnection of portions of a system or the isolation of a portion of the system using some form of sandboxing.

Filtering Capabilities: These involve the deployment of filtering technology (e.g., firewalls) in an effective manner.

Acceptance Test Execution:

The execution of acceptance tests helps determine whether or not a system has recovered.

Post-Incident Activity

The post-incident activity phase involves the synthesis of conclusions from the gathered evidence.

The following skills are deemed to be necessary for post-incident activity:

Malware Handling and Analysis: The ability to understand the effects of malware and the proper way to analyze malware.

Incident Documentation:

The ability to synthesize conclusions from evidence and knowledge for accurate documentation and response justification.

In order to assess post-incident activity performance, a training environment must include elements that enable the responder to further analyze and properly document the incident in accordance with organizational standards.

The following components are deemed to be necessary for assessing postincident activity skills: Malware Analysis Tools: This software is used to dissect and analyze malware (e.g., IDA Pro, OllyDbg and WinDbg).

Documentation Standards:

These formalize the documentation process and ensure that it is performed as required by the organization.

Training Administration

Every environment should provide effective training as well as feedback to trainees. While it is not part of the incident response lifecycle, proper administration of training is vital to the educational experience of participants. Several components are necessary to ensure the complete monitoring of a training environment.

The following skills are deemed to be necessary for training administration:

Real-Time View of Physical Signal Exchange:

The ability of a training administrator to view the input and output signals at system endpoints (e.g., sensors and actuators). This helps ensure that the administrator can assess an accurate representation of an environment even when the integrity of the system monitoring components has been comprised and the components are untrustworthy for assessment purposes [START_REF] Yoon | Framework for Evaluating the Readiness of Cyber First Responders for Industrial Control Systems[END_REF].

Remote Administrative Monitoring:

The ability of a training administrator to assess trainees and control an exercise from a different physical location than the exercise environment.

Remote Participation:

The ability of a training administrator to administer exercises to trainees at remote physical locations.

Training Environment Levels

This section describes the different levels of industrial control system training environments based on their realism and the fidelity of their components and capabilities. While each level has varying capabilities, the primary delimiter between levels is the increased realism that the environment at the higher level provides in the context of a real industrial control system.

Level 1 Training Environment

A Level 1 training environment is completely software-based and simulates an industrial control device or control system. This type of environment can provide simplified education and training to inexperienced individuals in the areas of controller operations and process control logic.

Example environments are the LogixPro-500 programmable logic controller simulator [START_REF]The Learning Pit, LogixPro 500 PLC Simulator[END_REF] and the Honeyd programmable logic controller interaction software [START_REF] Winn | Constructing costeffective and targetable industrial control system honeypots for production networks[END_REF]. These environments do not provide real physical interactions, just software-defined capabilities. While basic interaction and programming features are supported, the simulation programs may not mimic the exact behavior of real control hardware and software. For example, the Honeyd simulation software supports 2,000 TCP requests per second with 65,536 hosts compared with real programmable logic controllers that support significantly fewer connections [START_REF] Winn | Constructing costeffective and targetable industrial control system honeypots for production networks[END_REF]. Level 1 environments are also limited by their inability to provide realistic defensive response interactions. Additionally, they do not allow for physical disconnection options that are available to defenders in a real environment.

Level 2 Training Environment

A Level 2 training environment is an emulated system that manifests real physical effects, but does not incorporate genuine control system hardware and software. This type of environment can be constructed using embedded devices (e.g., Arduino, Raspberry Pi and BeagleBone) or other computing devices that can be programmed to control physical sensors and actuators using common programming languages (e.g., C and Python).

Level 2 environments are used as training platforms and research testbeds by many organizations. Researchers at the Air Force Institute of Technology (AFIT) have created a Level 2 environment that emulates an automobile CAN bus, which is controlled by a BeagleBone Black (Figure 1). The environment, which serves as a research testbed, is used to test the effects of CAN bus attacks on vehicular control. The U.S. Industrial Control System Cyber Emergency Response Team (ICS-CERT) uses portable Level 2 training platforms to conduct basic industrial control system classes and exercises. The CybatiWorks Level 2 training kits incorporate Raspberry Pi control emulation devices representing stoplights that use mounted light-emitting diodes (LEDs) as acuators [START_REF] Cybati | [END_REF]. Siaterlis et al. [START_REF] Siaterlis | EPIC: A testbed for scientifically rigorous cyber-physical security experimentation[END_REF] have created a Level 2 industrial control system simulation testbed for assessing the effects of attacks on networked control systems. While Level 2 environments can manifest physical effects and emulate process control systems, the environments are restricted by the code that executes on the embedded devices. Thus, the environments cannot be guaranteed to mirror the exact behavior of real industrial control systems.

Level 3 Training Environment

A Level 3 environment comprises genuine process control hardware and software corresponding to a partial industrial control system. In the case of a wastewater treatment plant, an example Level 3 environment comprises the hardware and software that control the lift station portion of the wastewater treatment process. While a Level 3 environment is not fully realistic, it provides a scaled form of realism. Such an environment familiarizes trainees with vendor equipment, industrial networks, process control logic and portability, eliminating the need to construct and maintain a complete and expensive facility. Level 3 environments are used for a variety of security-related activities. The Sandia SCADA Security Development Laboratory, which is considered to be a Level 3 environment, is used to create and evaluate security practices, programs and protocols [21]. Other examples include the Air Force Institute of Technology stoplight system with Allen-Bradley MicroLogix programmable logic controllers that is used to teach industrial control system defense classes (Figure 2). The SANS CyberCity combines Level 2 and Level 3 components in a compact environment that provides robust learning experiences [START_REF]SEC562: CyberCity Hands-on Kinetic Cyber Range Exercise[END_REF].

A Level 3 environment may have genuine hardware and software components, but it still lacks the realism of a production system. This type of environment would not impart an in-depth understanding of a real-world system, especially scenarios where attacks have cascading effects due to interconnections with other systems [START_REF] Butts | How industrial control system security training is falling short[END_REF]. industrial facilities, each of which is a separate Level 4 environment. The facilities include a power plant, prison, hospital, subway station, power distribution system and wastewater treatment plant [START_REF]Atterbury/Muscatatuck, MUTC Overview, Edinburgh[END_REF]. The cyber portions of some of the Level 4 training environments are still under development.

Level 4 Training Environment

Mapping Training Environment Levels

As the level of a training environment increases, so does the level of cognitive complexity and thinking that can be assessed in the environment. The complexity of training scenarios that can be presented in an industrial control system environment depends on the amount of realism of observations and interactions. Bloom's Taxonomy can be mapped to the different levels of industrial control system training environments for training defenders. The taxonomy is hierarchical in nature and, therefore, an environment that can support exercises at the higher levels of Bloom's Taxonomy can also support exercises at the lower levels. Table 2 shows the mapping of the training environment levels to Bloom's Taxonomy.

A Level 1 fully-simulated industrial control system training environment can present exercises and problems that address the first two cognitive levels of Bloom's Taxonomy, specifically "remembering" and "understanding." The simulated training environment can help evaluate a trainee's ability to recall and retrieve facts that have been programmed into the simulation. The trainees can also interpret meanings from the lessons and make references and comparisons based on the presented facts. A simulation that provides simple programmable logic controller interactions can impart basic programmable logic controller concepts and behavior. However, there is no guarantee that the learnings will directly carry over to a real system. This constrains the ability of a Level 1 environment to support assessments at the higher levels of Bloom's Taxonomy. Another constraint is the limited ability of a trainee to implement realistic security measures. Since a simulated environment can only offer what it is programmed to do, a trainee cannot manipulate a network or make unanticipated configurations to control systems.

A Level 2 training environment in which emulated devices perform physical controller functions can help assess the "applying" and "analyzing" levels of Bloom's Taxonomy. In this type of environment, a trainee can dissect the environment, understand the components and control strategies, and implement external defenses (e.g., firewalls and network isolation). However, since a Level 2 environment does not incorporate real industrial control components, it cannot help evaluate a trainee at Bloom's "evaluating" level.

A Level 3 environment comprises vendor-supplied industrial control hardware and software, but it is not a comprehensive production system. Therefore, it supports training and exercises up to the "evaluating" level of Bloom's Taxonomy. This level of thinking is characterized by making judgments and critiques based on criteria and standards. Evaluative thinking in a Level 3 environment is accomplished by comparing data and observations against the standard operational criteria of control components. The real data enables participants to perform realistic defensive evaluations of the implemented industrial control systems. However, a Level 3 environment struggles to assess trainees at the "creating" level -the highest level of Bloom's Taxonomy.

A Level 4 environment can assess trainees at the highest "creating" level. This level of thinking is characterized by the ability to generate a comprehensive view of a situation. In the context of industrial control system defense and incident response, this type of cognitive complexity cannot be achieved without a complete functioning system. A Level 4 environment provides a trainee with opportunities to view and manipulate every possible element of a real industrial control system. Modifications to existing solutions and new solutions to defense problems can be applied and evaluated. A Level 4 environment also helps trainees discover, analyze and address real-world problems in a creative manner and to observe the ramifications of their actions (e.g., resilience and cascading effects).

Example Training Environments

This section presents example training environments at each of the four levels.

Level 1 Training Environments

The LogixPro-500 PLC simulator enables a trainee to create and manipulate ladder (control) logic, and to view the execution of the logic on simulated sensors and actuators [START_REF]The Learning Pit, LogixPro 500 PLC Simulator[END_REF]. Consider a scenario where a first responder must be able to analyze a ladder logic program in an industrial controller and determine if it has been tampered with. The trainee would have to understand how to read and write the logic to make these observations. A simulated environment can support the training of basic logic functions and controllers. The training scenarios in the simulated environment provide assessments up to the "understanding" level of Bloom's Taxonomy. They enable trainees to learn facts about control system operation and construct visual meanings and interpretations through the execution of the simulations. The LogixPro-500 PLC simulation training environment is available for user download at www.thelearningpit.com/lp/logixpro.html.

Ladder Logic Engineering Scenario.

Objective: Given engineering specifications for controlling a garage door with open and closed sensors in an industrial control environment, develop the logic that enables the control hardware to execute the specifications.

Description: Create a ladder logic program that enables a programmable logic controller to control a garage door with sensors that indicate when the door is opened or closed. The simulation should execute the logic provided by the trainee and visualize the physical response in the garage door simulator.

Type: Understanding the functionality and relationships between the control hardware and logic software.

Evaluation Criteria: Correctly engineer the required functionality within three hours.

References:

Engineering specifications for garage door logic, LogixPro-500 software help menu and Rockwell Automation RSLogix user guide.

LogixPro-500 Environment Components. The environment comprises a single computer system with the LogixPro-500 simulation software installed.

Control Hardware:

The control hardware comprises a simulated programmable logic controller that executes the ladder logic program developed by a trainee.

Engineering Software: The engineering software is a version of the Allen-Bradley RSLogix500 programming tool.

Human-Machine Interface Software:

The human-machine interface is a software simulation that presents an interactive visual representation of the sensors and actuators. The interface displays how the sensors and actuators react to the ladder logic program in the simulated control hardware.

Physical Component Effects:

The physical effects of the system are presented on the computer screen.

Level 2 Training Environments

Raspberry Pi emulation devices can be programmed to emulate a network of stoplights using LEDs. Consider a scenario where a controller is compromised in order to interfere with the timing of the lights. In this scenario, a trainee would have to determine the relationships between the components and identify the cause of the incident. This would correspond to the "analyzing" level of Bloom's Taxonomy. The cost of the training environment with four stoplights is approximately °200.

Stoplight Logic Manipulation Scenario.

Objective: Given a network of emulated stoplights that are out of sync, return the lights to normal functionality and find the compromised device.

Description: Monitor network traffic and analyze to determine which devices were impacted and find the source of the attack.

Type: Understanding the functionality and relationships between the control hardware and logic software, and applying response skills to mitigate the effects of the attack and return the system to normal functionality.

Evaluation Criteria: Return the system to normal functionality within three hours and find the source of the attack within one hour.

References: Network and system logs and code on the Raspberry Pi devices.

Stoplight Network Environment Components. The hardware required is a Raspberry Pi development platform that executes a logic program that controls LED lights.

Control Hardware:

The control hardware comprises a network of Raspberry Pi emulation controllers.

Human-Machine Interface Software:

The human-machine interface software is programmed to view and communicate with the Raspberry Pis.

Physical Component Effects:

The physical effects in the stoplight network are represented by LEDs.

System Logging: Logging is implemented in the network by the Rasberry Pi platforms and passive network monitoring software (e.g., Grassmarlin).

Physical Disconnect or Isolation Options:

The physical separation of controllers supports network segmentation and physical network disconnection.

Filtering Capabilities: Firewall filtering capabilities are built into the scenario to isolate the stoplight network from outside connections.

Level 3 Training Environments

Two examples of Level 3 environments are described: (i) wastewater treatment plant; and (ii) prison facility. All the components for each environment fit in a Pelican 1610 case (62.76 cm × 49.73 cm × 30.3 cm). The environments were created to be as cost effective as possible while incorporating genuine control devices. The scenarios support the assessment of thinking skills up to the "evaluating" level of Bloom's Taxonomy. Note that the descriptions of the environments are more detailed than the other levels to demonstrate that high levels of interaction with genuine industrial control components can be achieved at a relatively low cost while maintaining portability.

1. Wastewater Treatment Plant Environment. The Level 3 wastewater treatment plant environment models a wastewater aeration basin. If the oxygen levels are too high or low, alarms are triggered by two red lights in the exercise environment. The oxygen levels are adjusted by modifying the valve openings and the speed of blower fans. The closed loop control of oxygen level uses an Allen-Bradley programmable logic controller and an Allen-Bradley PowerFlex 40 AC variable frequency drive (VFD). The programmable logic controller controls the valve dilation and computes the oxygen levels while the variable frequency drive adjusts the fan speed based on the programmable logic controller calculations. The cost of this training environment is approximately °16,500.

An example training scenario involves a cyber attack on the wastewater treatment plant, which causes the programmable logic controller in the aeration basin to malfunction. This results in fluctuating oxygen levels.

Wastewater Treatment Aeration Basin Failure Scenario.

Objective: Restore the aeration basin to full functionality and find the source and cause of the incident. Description: By monitoring network traffic, the human-machine interface and the physical devices, the trainee must recognize when the system fails and effect system recovery by blocking attacker access. Also, the trainee must implement emergency procedures to restore the failed control hardware to its normal functionality.

Type: Evaluating the loss of system control and functionality.

Evaluation Criteria: Return the system to normal functionality within three hours and find the source of the attack within one hour.

References: ControlLogix programmable logic controller manual, Pow-erFlex 40 AC variable frequency drive manual, control hardware vulnerability reports and control network map.

Wastewater Treatment Plant Environment Components.

Control Hardware: The control hardware comprises an Allen-Bradley ControlLogix programmable logic controller and an Allen-Bradley Pow-erFlex 40 AC variable frequency drive (Figure 3).

Engineering Software: The engineering software used for programming and configuring the Allen-Bradley programmable logic controller is an RSLogix 5000 system (Figure 4).

Real Control Process:

The control process for the environment is modeled after a wastewater aeration basin. It controls oxygen diffusion in two zones using two valves and blower fans.

Vendor Exposure: The environment exposes trainees to the use of a programmable logic controller and variable frequency drive.

Physical Component Effects:

The physical effects are presented as voltmeter readings that indicate the extent of valve opening (controlled by the programmable logic controller) and the speed of the fans (controlled by the variable frequency drive).

Realistic Industrial Network Traffic Generation: Traffic generated by the human-machine interface workstation, engineering workstation, Filtering Capabilities: Filtering by an Ubiquiti EdgeRouterX router can be performed using simple firewall rules for network connections in the environment. [START_REF] Yoon | Evaluating the readiness of cyber first responders responsible for critical infrastructure protection[END_REF] enables an exercise administrator to view the operation of process control endpoints and the human-machine interface to track an ongoing attack (Figure 5).

Real-Time View of Physical Signal Exchange: Y-Box technology

Remote Administrative Monitoring:

The administration interface for the environment can be viewed using virtual network computing technology; this enables an exercise administrator to evaluate the status of the hardware and software.

Remote Participation: Remote participation is accomplished using remote access tools; this does not hinder the physical manipulation capabilities.

Prison Facility Environment The Level 3 prison facility training

environment is modeled after a prison cell block containing three prison cells with door lock controls and a mantrap access control system. An Omron programmable logic controller controls the operation of the locks, buttons, security lights and alarm. This equipment costs approximately °1,400.

An example training scenario involves the prison facility experiencing a cyber attack that causes a programmable logic controller to malfunction. This results in the prison door locks being opened.

Prison Control System Failure Scenario.

Objective: Restore the prison to full functionality and find the source and cause of the incident. Description: By monitoring network traffic, the human-machine interface and the physical devices, the trainee must understand when the system fails and effect system recovery.

Type: Evaluating the loss of system control and functionality.

Evaluation Criteria: Return the system to normal functionality within three hours and find the source of the attack within one hour. References: Omron CP1L programmable logic control manual, control hardware vulnerability reports and control network map.

Prison Facility Environment Components.

Control Hardware: The control hardware comprises an Omron CP1L programmable controller that controls the prison door locks, buttons, security lights and alarm (Figure 6).

Engineering Software: The engineering software comprises the Omron CX-Programmer.

Human-Machine Interface:

The human-machine interface for controlling the prison environment (Figure 7) was created using the Schneider Electric IGSS Free50 software.

Real Control Process:

The control process for the environment is modeled after a cell block in a prison in the United States.

Physical Component Effects:

The locks and lights are operated using the human-machine interface controls and by physically pressing the lock control buttons in the Pelican case housing the control equipment.

Realistic Industrial Network Traffic Generation: Traffic generated by the human-machine interface workstation, engineering workstation and programmable logic controller is visible in the network. The realistic Filtering Capabilities: Filtering by an Ubiquiti EdgeRouterX router can be performed using simple firewall rules for network connections in the environment.

Real-Time View of Physical Signal Exchange: Y-Box technology enables an exercise administrator to view the operation of the process control endpoints and the human-machine interface to track an ongoing attack (Figure 8).

Remote Administrative Monitoring:

The White Cell interface for the environment can be viewed using virtual network computing technology.

Remote Participation: Remote participation is accomplished using remote access tools; this does not hinder the physical manipulation capabilities.

Level 4 Training Environments

A Level 4 training environment functions at the "creating" level of Bloom's Taxonomy. It presents a trainee with a fully-realistic scenario that enables the trainee to use all the available skills and knowledge to arrive at new solutions to complex problems.

In the case of a power distribution plant, a suitable scenario for a Level 4 environment is the appearance of unusual traffic accompanied by unexplained power fluctuations. Given the complexity of the environment with its many components and connections, a trainee would have to appropriately plan a response by prioritizing components in the network, narrow down the root cause of the anomaly and apply fixes to manage the incident and ensure system recovery. If the incident results from cascading effects in a real system, it can be difficult to determine the root cause and craft an appropriate response. This is because most industrial systems are unique environments and the response of a trainee has to be tailored to the specific environment.

The components used to construct a Level 4 power plant environment are similar to those in a real power plant; however, significant additional engineering tasks would be necessary to implement exercise control and monitoring. A Level 4 training environment may not be suitable to train beginners due to the risk of facility damage if an exercise does not go as intended. Instead, a Level 1 or Level 2 environment could be used as a safe sandbox for beginners to make mistakes and learn from their mistakes.

Failsafe plans should also be considered when designing a Level 4 environment for unpredictable situations during exercises that could lead to facility damage. The cost of constructing a Level 4 power plant can be in the millions of dollars or more. While such a Level 4 training environment would certain not be mobile, it would provide remote access as in the case of a real infrastructure asset.

Conclusions

This chapter has specified four classes of training environments that are mapped to Bloom's Taxonomy, thus covering the various levels of cognitive complexity required in training programs for industrial control system first responders. Level 1 environments are appropriate for average plant operators while Level 4 environments are needed to prepare industrial control system first responders to handle genuine emergencies. The categorization of environments in terms of progressive complexity is necessary to ensure adequate training and readiness of first responders. The proposed categories also help determine the training environment levels that best align with the training goals and budgets of organizations. Well-designed exercise regimens that properly leverage the appropriate levels of training environments will greatly reduce the likelihood of tragic incidents like the explosion at the fertilizer plant in West, Texas that killed fifteen people, including ten first responders.

Note that the views expressed in this chapter are those of the authors and do not reflect the official policy or position of the U.S. Air Force, U.S. Army, U.S. Department of Defense or U.S. Government.

Figure 1 .

 1 Figure 1. Automobile CAN bus emulation testbed.

Figure 2 .

 2 Figure 2. Mounted stoplight control system.

A Level 4

 4 training environment is a genuine industrial control facility with functioning processes. Sample Level 4 training environments are located at the Atterbury-Muscatatuck Urban Training Center (MUTC) near Butlerville, Indiana. The training center, which is operated by the Indiana National Guard, is used for military and first responder training. The center houses multiple

Figure 3 .

 3 Figure 3. Level 3 wastewater treatment plant training environment.

Figure 4 .

 4 Figure 4. RSLogix 5000 engineering workstation software.

  programmable logic controller and variable frequency drive is visible in the network. The realistic network traffic comprises industrial protocol communications, including EtherNet/IP and Common Industrial Protocol (CIP) traffic.Real Malware or Attack Scripts: Attack scripts that leverage insecure configurations of the control components are incorporated in the training environment.Physical Disconnection or Isolation Options:All the machines in the network can be physically disconnected from their Ethernet ports and network isolation can be achieved via whitelisting and blacklisting by a Netgear ProSAFE network switch.

Figure 5 .

 5 Figure 5. Administrative interface for real-time viewing of attack and defense effects.

Figure 6 .

 6 Figure 6. Level 3 prison training environment.

Figure 7 .

 7 Figure 7. Human-machine interface.

Figure 8 .

 8 Figure 8. Administrative monitoring view.

Table 1 .

 1 Bloom's Taxonomy (revised)

Table 2 .

 2 Mapping of the training environment levels to Bloom's Taxonomy.

	Bloom's Taxonomy	Training Environment Levels
		Level 1 Level 2 Level 3	Level 4
	1. Remembering
	2. Understanding
	3. Applying	-
	4. Analyzing	-
	5. Evaluating	-	-
	6 .C r e a t i n g	-	-	-

Acknowledgement

This research was partially supported by the U.S. Department of Homeland Security Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).