Daniel Schlette

Florian Menges

Thomas Baumer

Günther Pernul

Security Enumerations for Cyber-Physical Systems

Enumerations constitute a pivotal element of Cyber Threat Intelligence (CTI). References to enumerated artifacts support a universal understanding and integrate threat information. While traditional IT systems and vulnerabilities are covered by security enumerations, this does not apply to Cyber-Physical Systems (CPS). In particular, complexity and interdependencies of components within these systems demand for an extension of current enumerations. Taking on a CPS security management perspective this work identifies deficiencies within the Common Platform Enumeration (CPE) and the Common Vulnerabilities and Exposures (CVE) enumeration. Models for CPS are thus proposed to cover comprehensiveness and usability. A prototype is used to evaluate the feasibility by demonstrating key features of security enumerations for CPS.

Motivation

At present we are experiencing an encompassing transition of our daily life and environment caused by the availability of technology and the efficient processing of information. Formerly separate domains such as physical processes and IT systems become interconnected and can now be remotely controlled. The resulting Cyber-Physical Systems (CPS) allow for exciting new applications. Since this development is accompanied by a continuous increase in complexity, it is also an essential factor for the emergence of many vulnerabilities of CPS. Even for security experts it is a challenging task to keep track of all vulnerabilities that may cause an issue for their organization and require quick countermeasures.

It is evident that a reduction of the given complexity is necessary to solve this issue. Security enumerations are suitable to make complexity manageable as they cover various Cyber Threat Intelligence (CTI) artifacts such as platforms, vulnerabilities or even natural hazards. In general, they are designed to enhance the information flow between organizations by setting up a common and usable reference for considered objects. CTI makes use of security enumerations not only to describe cyber attacks but also to share and collaboratively improve valuable threat information via dedicated platforms and data formats [START_REF] Mavroeidis | Cyber threat intelligence model: an evaluation of taxonomies, sharing standards, and ontologies within cyber threat intelligence[END_REF][START_REF] Menges | A comparative analysis of incident reporting formats[END_REF].

Two of the most notable enumerations are the Common Vulnerabilities and Exposures (CVE) enumeration and the Common Platform Enumeration (CPE). They are, for example, used to describe different properties of the TRITON malware which we will use in our case study. More specifically, CVE-2018-7522 provides a standardized identifier, an additional description and further references about the leveraged TRITON vulnerability found in Cyber-Physical Systems. Besides, the firmware component "Schneider Electric -Triconex Tricon MP 3008" affected by the aforementioned CVE entry is encoded as CPE name cpe:2.3:o:schneider-electric:triconex tricon mp 3008 firmware:10.0. This name covers key characteristics of the platform including vendor, product and version.

While CVE and CPE provide guidance for communicating about vulnerabilities and platforms, the US National Vulnerability Database (NVD) goes one step further. By collecting and linking entries of both security enumerations a connected CPE and CVE search engine is realized. Ultimately, this search engine allows to check whether a vulnerability affects a specific device or vice versa.

However, in appreciation for the NVD and its community there are still improvements targeting complexity as well as the search engine possible. Focusing on CPS, one issue while working with the NVD is the requirement imposed on the user to know the CPE names of her own assets prior to searching for related vulnerabilities. The complexity and heterogeneity of CPS make a comprehensive overview of the deployed components already a challenging task [START_REF] Roman | On the features and challenges of security and privacy in distributed internet of things[END_REF][START_REF] Rinaldi | Identifying, understanding, and analyzing critical infrastructure interdependencies[END_REF]. Additionally, CPS introduce novel components for the enumerations such as Supervisory Control And Data Acquisition (SCADA) systems, Programmable Logic Controllers (PLC), actuators and sensors which need to be managed alongside existing components. Security management of CPS also requires highly specific knowledge about CPS as well as cyber security which combined may constitute an obstacle to recognize vulnerabilities and to act quickly according to them. This culminates in the three following research questions tackled in this paper addressing the reduction of complexity within security management of CPS:

1. How can the overview of numerous and heterogeneous CPS components in a given organization be improved? 2. How can novel classes of CPS components be added to CPE? 3. How can usability of CPE and CVE for users without specific domain knowledge be enhanced?

The remainder of this paper proceeds as follows: First a review of background information on CPS and security enumerations is given in Section 2. We then describe our conceptual approach and perform a detailed analysis of CPS characteristics in Section 3. Deficiencies found in the two security enumerations CPE and CVE lead towards extensions proposed in our concept. Our prototypical implementation is demonstrated based on a use case in section 4. Subsequently, we give an overview on related work in the areas of CPS and enumerations in Section 5 and conclude the paper in Section 6.

Background

In this section we briefly introduce Cyber-Physical Systems, Common Platform Enumeration (CPE) as well as Common Vulnerabilities and Exposures (CVE).

Cyber-Physical Systems (CPS)

Digital transformation has reached areas from industrial production to medical applications and household sectors. Accordingly, the concept of CPS is applied to describe the deep integration of physical elements into computing and control processes of the cyber domain [START_REF] Lee | Cyber-physical systems-are computing foundations adequate[END_REF]. The cyber domain categorizes traditional IT, such as servers or workstations, while the physical domain describes physical entities, such as mechanical or chemical processes and components. CPS also cover advanced functionalities and scenarios based on spatial proximity, such as real-time data processing or feedback loops. While these characteristics are desirable from a functionality perspective they introduce complexity as it is often the case for highly connected systems containing multiple components [START_REF] Alur | Principles of Cyber-Physical Systems[END_REF].

Common Platform Enumeration (CPE)

In the context of cyber security, enumerations define a naming schema for standardization purposes. They provide unique names to cyber threat intelligence (CTI) artifacts and support, for instance, the identification of IT assets, vulnerabilities, attack patterns as well as quality aspects [START_REF] Schlette | Measuring and visualizing cyberthreat intelligence quality[END_REF].

The Common Platform Enumeration (CPE) describes IT assets and is maintained by the National Institute of Standards and Technology (NIST). It fulfills two main objectives. First, it allows to assign unique names to classes of applications, operating systems and hardware devices [START_REF] Cheikes | Common Platform Enumeration: Naming Specification Version 2[END_REF]. Secondly, it provides matching mechanisms, including details on how to search and compare CPE names [START_REF] Parmelee | Common Platform Enumeration: Name Matching Specification Version 2.3[END_REF].

The naming specification includes three distinct naming methods. A given CPE name is either described as well-formed CPE name (WFN), formatted string (FS) or Uniform Resource Identifier (URI), allowing to define product classes [START_REF] Cheikes | Common Platform Enumeration: Naming Specification Version 2[END_REF]. While WFN is an abstract set of attribute-value pairs, both FS and URI names are machine-readable encodings [START_REF] Cheikes | Common Platform Enumeration: Naming Specification Version 2[END_REF]. Listing 1 shows the structure and the individual components of a FS encoding. The values for the listed attributes are implemented as strings. In case values are unspecified (ANY) or there is no meaningful value (NA) these are encoded respectively. cpe : 2 . 3 : CPE is in particular useful to link classes of IT assets to vulnerabilities. It is easy to infer that based on CPE entries, context relevant threat information can be retrieved and information security workflows realized. As a result CPE and CVE are oftentimes applied together [START_REF] Takahashi | Toward Automated Vulnerability Monitoring using Open Information and Standardized Tools[END_REF]. Decision making, the creation of information security policies adapted to the prevalent IT infrastructure and the configuration of platforms are additional use case scenarios of CPE.

{ part } : { vendor } : { product } : { v e

Common Vulnerabilities and Exposures (CVE)

Enumerations not only focus on platforms found in CPE but also target security artifacts directly. The Common Vulnerabilities and Exposures (CVE) enumeration describes vulnerabilities that may lead to exploitation of systems or violations of security policies1 . Central element to the CVE enumeration are CVE entries, which serve as unique, common identifiers for publicly known information security vulnerabilities. Essentially, each CVE entry consists of the three main components: CVE ID, description and references.

However, these only show an excerpt of the CVE data model capabilities. The CVE automation working group maintains a repository2 with the specification of a CVE JavaScript Object Notation (JSON) schema with additional elements. Figure 1 The CVE features are integrated in security products based on the CVE data format. CVE entries are also enhanced by metrics like the Common Vulnerability Scoring System (CVSS). Linking CVE entries to CPE entries can further be of value to organizations trying to protect their IT assets.

Conceptual Approach

To introduce essential characteristics of CPS into security enumerations our work follows a conceptual approach. First, based on formal CPS specifications we examine common characteristics to derive relevant requirements and deficiencies within existing security enumerations. Then, extensions to the data models of CPE and CVE are proposed. Here, the perspective of a domain expert is incorporated to put focus on complexity and usability aspects. Finally, the approach is implemented in a prototypical search engine to evaluate the previous findings.

Requirements

Our twofold requirements analysis addresses CPS and security issues in CPS as well as the two security enumerations CPE and CVE in the following.

Assumption 1 (Secure CPS) The security of CPS is a positive property.

Common characteristics of CPS go beyond of traditional IT systems. CPS leverage reactive computation and concurrency. Feedback control via designated controllers, real-time computation and utilization in safety-critical scenarios are part of CPS [START_REF] Alur | Principles of Cyber-Physical Systems[END_REF]. The characteristics are realized with sensing, actuating and control components and lead to interdependencies [START_REF] Rinaldi | Identifying, understanding, and analyzing critical infrastructure interdependencies[END_REF]. However, this opens various attack vectors. As prior analysis shows, attacks on nuclear facilities and other critical infrastructures do occur and can have far-reaching consequences [START_REF] Mclaughlin | The cybersecurity landscape in industrial control systems[END_REF].

Besides that, most CPS include a multitude of different components like sensors and actuators on the field level. Additionally, Programmable Logic Controllers (PLC) are included as direct control elements. SCADA systems provide another control layer. CPS are thus best described as systems of systems.

There are also diverse application areas for CPS, such as energy systems, healthcare and transportation [START_REF] Khaitan | Design Techniques and Applications of Cyberphysical Systems: A Survey[END_REF]. While security experts know about the application scenarios of CPS, they have much less knowledge about procedures inside CPS. In consequence, these CPS are black boxes from a security perspective.

CPS security must also consider different attack vectors due to various interfaces, operating systems and protocols [START_REF] Maidl | Pattern-based modeling of cyber-physical systems for analyzing security[END_REF]. Since security assessments and measures require a thorough understanding, formal attack detection, security testing and threat modelling [START_REF] Fernandez | Threat Modeling in Cyber-Physical Systems[END_REF][START_REF] Caselli | A security assessment methodology for critical infrastructures[END_REF] have received the researchers' attention. Although, guidelines and tools for CPS security management exist [START_REF] Stouffer | Guide to industrial control systems (ICS) security[END_REF], usability for component and vulnerability identification can be improved.

Assumption 2 (Enumerations) Security enumerations support security management through identification and searchability of artifacts.

In an organizational setting, information security workflows are aligned to structured data formats. Security management based on CPE is of great importance in the asset management domain and permits risk analyses. CVE further allows to pinpoint security flaws and vulnerabilities of managed IT assets.

Mapping CPS characteristics to the data models of CPE and CVE reveals a number of deficiencies. While there are security products (e.g. NVD) that combine and link CVE and CPE data there is no properly maintained direct reference. This generic deficiency is further accompanied by deficiencies broadly categorized as component-based and system-based.

Component-based deficiencies: Currently, CPE supports traditional IT assets but CPS specifics are missing. This is mainly because CPS components contain specific programming languages or protocols. With a focus on multiple elements contained within CPS the CPE data model also neglects various technical aspects. The embedded nature of components and their interfaces are aspects left aside. As these properties implicate possible attack vectors and allow the identification of CPS, integration into CPE is deemed necessary.

System-based deficiencies: From a system perspective CPS represent a new concept of highly-connected components. Grouping multiple components described by their CPE names and linking related vulnerabilities is not supported by CPE and CVE data models. System-based deficiencies are thus related to the usability of the enumerations by security analysts with minor CPS knowledge.

Combining the assumptions it can be concluded that there is a need to support a more comprehensive presentation of the CPS, as this is key to enable the search for vulnerabilities. Our extensions to CPE and CVE aim to foster a better understanding of CPS and a reduction of complexity. Integrating enumerations and making security of CPS manageable is a first step towards secure CPS.

Conceptual Meta Model

Our proposed model is built upon the findings of the requirements phase and describes a formal structure and relationships between entities of CPE and CVE. In our enhancements we explicitly take into account compatibility with earlier versions. To achieve this, new attributes are added while the existing ones remain unchanged. Following the identified CPS characteristics as well as CPE and CVE deficiencies we group extensions into four categories. The applied naming convention of these categories documents central features that are addressed by our proposal. Extensions relating to CPS characteristics missing in CPE are specified within technically exhaustive security enumerations. Bundling CPS components leads to recursive security enumerations. Application-oriented security enumerations include extensions with usability focus. Last but not least, coupled security enumerations address extensions connecting CPE and CVE directly.

Technically exhaustive security enumerations streamline representation of the various components within CPS. We include new elementary attributes and change attribute values as shown in Table 1 to provide a detailed technical description. In this context, the CPS architecture hints at the importance and embedded nature (inseparable software and hardware) of some CPS components [START_REF] Maidl | Pattern-based modeling of cyber-physical systems for analyzing security[END_REF]. Thus, we introduce embedded as a new possible attribute value that covers components within the part attribute of CPE names. Interdependencies of CPS are targeted by the new attributes protocol and interface added to CPE as these allow to express means of communication and connection. Applications used in CPS oftentimes rely on specific programming languages. CPE is extended by a programming language attribute to cover this CPS property.

Recursive security enumerations address the system of systems concept which is inherent to CPS. We therefore propose the extension of CPE with an additional CPS Bundle entity type. As a result, multiple connected components of a CPS can be referenced within the model and build a self-contained unit. The attributes of a CPS Bundle reflect the recursive nature of CPS and are specified as ID, description and references shown in Table 1. Due to the fact, that CPS are different and contextually dependent we envision a customization option to describe CPS with a CPS Bundle. It is thus possible to provide a brief description of a CPS according to a given situation. The purpose of the description attribute is to facilitate a first understanding of these systems on a higher level of abstraction. Also, recursive reference to another CPS Bundle in the references attribute is possible and supports hierarchical structuring. Application-oriented security enumerations include requirements imposed by security experts without detailed knowledge about CPS. Extensions to CPE with focus on application areas of CPS are aimed to make their security manageable regardless of technical background. Our approach captures usability from a security management perspective through the new sector and capability attributes shown in Table 1. We thereby assume that some knowledge about CPS in the form of capabilities or application area is present at all times.

Attribute

Coupled security enumerations introduce a closer tie between CVE and CPE. Focusing on the JSON data schema for CVE we propose an extension for the attribute values captured with the references attribute. Besides references to external data sources documenting the vulnerability, the references attribute is able to capture CPE names shown in Table 1. In consequence, CVE and CPE are coupled and vulnerabilities affecting a given CPS can be retrieved more easily.

The meta model for our CPS security enumerations search engine is shown in Figure 2. First, to cover coupled security enumerations multiple vulnerabilities (CVE) can be associated with an IT asset (CPE). In addition, Figure 2 describes recursive security enumerations as CPE entities can be part of an individual CPS Bundle entity. Any CPS bundle can also contain other CPS bundles.

CPS Bundle contains

(0,1)

CPE part of (0,n) (0,n) CVE concerns (0,n) (0,n) (0,n) Figure 2

. Meta model of CPS security enumerations search engine

At last, note that migration of data previously described with either CPE or CVE and integration with our model is feasible. Also, CPE entries do not need to contain values for all (new) attributes. Our model is explicitly designed to capture CPS, as these are currently neglected by security enumerations.

Use Case

In this section we outline a use case to evaluate our concept. A CPS security enumerations search engine analogous to the generic NVD is central to security management in an organizational setting. Related security processes and common associations are schematically depicted in Figure 3. In general, a security enumerations search engine proves viable by allowing vulnerabilities and IT assets to be identified and eventually patched. The reduction of complexity and improved usability for security management experts without detailed CPS knowledge is the aim of our concept and prototype. Ultimately, if fulfilled this can lead to a better security posture. In the following, the applied technology of our CPS security enumerations search engine and a case study are presented.

Case Study

To demonstrate our concept we refer to the TRITON malware used for attacks on oil and gas production facilities in 2017. The malware manipulates Safety Instrumented Systems (SIS) that aim to prevent incidents causing severe damage to assets, environment or even humans. Instead of extreme and uncontrollable events, SIS initiate a safe shut down of industrial processes as a last line of automated defence [START_REF] Pinto | Triton: The first ICS cyber attack on safety instrument systems[END_REF]. Since the attackers behind TRITON were able to interact with SIS controllers, there was a risk of unforeseeable disasters, which the SIS was supposed to prevent. Although, TRITON has not yet destroyed physical assets, it has halted production causing financial losses.

Considering the enumerations CPE and CVE, two aspects of the TRITON malware are of relevance. First, it concerns both hardware and operating systems in multiple versions. A standardized description with CPE names is thus an necessity to avoid miscommunication. Despite of its significance for industrial facilities, relevant elements of the TRITON attacks are not yet properly described by CPE and CVE. While NVD lists related CVE entries and mentions affected components 3 , CPE names cannot be found in the dictionary.

In our concept for CPS security enumerations we provide relevant extensions to improve the representation of e.g. cyber attacks using the TRITON malware. We allow the grouping of multiple CPS components within a CPS Bundle as our concept includes recursive security enumerations. Despite the fact, that the malware itself mainly targets the "Triconex Tricon MP 3008" controller and its firmware, other CPS components are also affected. To conduct their attack, the attackers leveraged further vulnerabilities of networks, operating systems and workstations prior to infecting the SIS. A comprehensive representation capturing these additional elements is supported by the CPS Bundle and part of the recursive security enumerations we designed. Table 2 shows an exemplary Petrochemical CPS Bundle related to TRITON with multiple components.

ID Description

References (abbreviated) Application oriented security enumerations ensure complexity reduction and usability through CPS properties known to security experts without detailed CPS knowledge. This is achieved by capturing the "oil and gas production" sector as well as "safety instrument" capabilities within a CPE name as shown in Listing 2. These rather generic CPS properties lead to further described information about an entire petrochemical CPS and potential vulnerabilities.

When CPE and CVE are not properly linked it is an impediment for usability and effective security workflows. Integration of both security enumerations is the focal point of coupled security enumerations. Within our CPS security enumerations search engine we provide the option to relate entries of CPE and CVE. E.g., the missing link between the "Triconex Tricon MP 3008" firmware and CVE-2018-7522 is established and persisted in the database.

Prototypical Implementation

In order to demonstrate the practical applicability of our concept, we have implemented a prototypical CPS search engine for our enumeration concept. The source code of the prototype is available online4 . It consists of two main components. The conceptual model is implemented using a MySQL database and the application was created with JavaEE 6. The database contains CPE, CVE and CPS Bundle as central entity tables. The references within the database and the functional scope of the application are based on the NVD and extend it to the components presented in this work. As this is a prototype application, additional tools are available for editing the data inventory and creating new CPE, CVE and CPS Bundle objects. The application also offers functionalities to search for CPE and CVE entries and to display the available links between them. The search for CPS bundles also displays the relationships within the bundles.

The data building the basis for our prototypical implementation reflects the state of CPE and CVE from February 2020. In addition, we provide two small sample CPS containing multiple components as exemplary data for CPS bundles.

Related Work

Information security and CTI [START_REF] Kampanakis | Security Automation and Threat Information-Sharing Options[END_REF][START_REF] Mavroeidis | Cyber threat intelligence model: an evaluation of taxonomies, sharing standards, and ontologies within cyber threat intelligence[END_REF][START_REF] Menges | A comparative analysis of incident reporting formats[END_REF] use security enumerations to describe relevant artifacts [START_REF] Menges | Unifying cyber threat intelligence[END_REF][START_REF] Vielberth | Human-as-a-security-sensor for harvesting threat intelligence[END_REF]. To the best of our knowledge, there is no academic literature on extending security enumerations although security enumerations evolved and raised their version numbers. It is therefore reasonable to assume, that extensions to security enumerations are driven by dedicated communities.

A multitude of work focuses on CPS due to their prominent role in critical infrastructures [START_REF] Alur | Principles of Cyber-Physical Systems[END_REF][START_REF] Lee | Cyber-physical systems-are computing foundations adequate[END_REF]. Related work on security of CPS approached the topic through the Internet of Things [START_REF] Roman | On the features and challenges of security and privacy in distributed internet of things[END_REF]. From there on, the various different areas of security are applied to CPS research. While a number of surveys and overview articles aim to cover CPS security at large [START_REF] Humayed | Cyber-Physical Systems Security-A Survey[END_REF], attack detection [START_REF] Mitchell | A survey of intrusion detection techniques for cyberphysical systems[END_REF], vulnerability analysis [START_REF] Coffey | Vulnerability analysis of network scanning on scada systems[END_REF][START_REF] Upadhyay | SCADA (Supervisory Control and Data Acquisition) systems: Vulnerability assessment and security recommendations[END_REF] and formal approaches [START_REF] Yampolskiy | A language for describing attacks on cyber-physical systems[END_REF][START_REF] Fernandez | Threat Modeling in Cyber-Physical Systems[END_REF] are extensively considered.

Work about both, security enumerations and CPS, is rare. Closest to our research is the work by Upadhyay and Sampalli [START_REF] Upadhyay | SCADA (Supervisory Control and Data Acquisition) systems: Vulnerability assessment and security recommendations[END_REF]. It discusses vulnerabilities within SCADA systems, highlighting the necessity of awareness about vulnerabilities within SCADA software and protocols. Here, a strong focus is placed on a review of existing vulnerabilities partially described by CVE. Similar, Nicholson et al. [START_REF] Nicholson | Scada security in the light of cyber-warfare[END_REF] point to unpatched software as a major flaw in SCADA systems.

Maidl et al. [START_REF] Maidl | Pattern-based modeling of cyber-physical systems for analyzing security[END_REF] provide interesting research results by defining a pattern to structure CPS and classifying the individual components. In addition, the authors outline security considerations about attack vectors for these systems.

McLaughlin et al. [START_REF] Mclaughlin | The cybersecurity landscape in industrial control systems[END_REF] present a methodology for security assessment of industrial control systems. They are characterizing parts and features of these systems as a starting point for a more comprehensive description with security enumerations. In a more general perspective Takahashi et al. [START_REF] Takahashi | Toward Automated Vulnerability Monitoring using Open Information and Standardized Tools[END_REF] show the use of security enumerations for security management.

Conclusion and Future Work

With our work we aim to make security of CPS more accessible for security experts. Our analysis showed that CPS and their interdependent components are not yet completely covered by security enumerations. To remediate the identified deficiencies, we propose an extension of CPE and CVE enabling a comprehensive description of CPS. Effective security management also relies on the integration of data from CPE and CVE to attribute vulnerabilities to the affected IT assets.

The meta model we propose extends the security enumerations and provides an overview of the numerous and heterogeneous CPS components. Our search engine realizes the adaptation of CPS to a organization setting and addresses the 1 st research question outlined in Section 1 of this paper. Our work extends the CPE data model with technical features to capture the embedded nature of CPS components. This allows us to address the 2 nd research question. Comprehensiveness and usability aspects relevant for security management are incorporated in our extended CPE. To respond to the 3 rd research question we introduce sector and capability attributes lowering entry knowledge to CPS. The concept is evaluated through a prototype using TRITON as use case.

Although, our work's results are a first step towards security enumerations for CPS several topics demanding further research remain.

First, future work should address the alignment with other standardization efforts and products. While we propose a concept for a CPS security enumerations search engine the usage may be within existing products such as NVD. Other standards for IT asset identification and their integration or conversion to CPE should also be considered. Moreover, management processes related to an IT asset inventory and vulnerabilities will be future points of reference.

Second, further extensions to our proposed meta model might become necessary due to additional user requirements and CPS development. It will be favourable to conduct a user study to determine precise requirements of security management experts beyond the ones described in academic literature. The results can then be used to trigger further improvements and might either culminate in a stand-alone security product or lead towards additional modifications.

A third topic of interest is the collection of data for CPS Bundles. Gathering and maintaining the data can include vendors and operators of CPS. The model can also be complemented by predefined vocabularies for specific attributes to avoid ambiguity and ease usability.

Figure 1 .

 1 Figure 1. CVE simplified JSON data schema

Figure 3 .

 3 Figure 3. Simplified use case for a CPS security enumerations search engine

cpe: 2 Listing 2 .

 22 .3:h:schneider -electric:triconex_tricon_mp_3008:*:*:*:*:*:*:*:* :Oil_Gas_Production:Safety_Instrument:*:*:NCM Exemplary extended CPE name

Table 1 .

 1 Conceptual meta model entity extensions

			Description	Examples
		part	The part attribute shall have a new value: "e"	e
			-embedded component
		sector	The sector attribute should capture areas	energy; healthcare;
	CPE Extension	capability protocol	where systems are typically deployed The capability attribute should capture phys-ical functionalities The protocol attribute should capture means of communication	transportation pressure; viscosity; acceleration Profinet; OPC-UA; DNP3; Modbus; IP
		programming	The programming language attribute should	Ladder Diagram; C;
		language	capture notations for computer programs	Java; Instruction List
		interface	The interface attribute should capture means	USB; PCI; SCSI;
			of connection	SATA; RJ-45
		Attribute	Description
	CPS Bundle	ID description references	The ID attribute should capture unique IDs for a CPS bundle The description attribute should capture essential CPS information The reference attribute should capture CPE names of the CPS com-ponents and different CPS bundle IDs
	CVE Ext.	CVE ID description references	The CVE ID attribute should capture assigned CVE IDs The description attribute should capture vulnerability information The references attribute should capture external data sources de-scribing the given vulnerability as well as CPE name representations

Table 2 .

 2 Exemplary CPS composed of multiple componentsAn extension to CPE names addressing technical details of CPS components is part of our concept. We propose technical exhaustive security enumerations that cover the "NCM" network modules of hardware affected by the TRITON malware. Listing 2 shows an exemplary CPE name adhering to the extended model. Furthermore, our model can recognize embedded components like SIS.

	1 Petrochemical CPS:	cpe:2.3:h:schneider-electric:triconex
	Interconnected components	tricon mp 3008 [...];
	deployed in an industrial setting	cpe:2.3:e:weatherford:maximizer [...];
	to refine oil and gas	[...]

https://cve.mitre.org/about/terminology.html

https://github.com/CVEProject/automation-working-group

https://nvd.nist.gov/vuln/detail/CVE-2018-7522

https://github.com/tarnschaf/cyberphysical


Jeyamohan Neera
email: jeyamohan.neera@northumbria.ac.uk

Xiaomin Chen

Nauman -9267-355x]

Aslam

Zhan Shu

Local Differentially Private Matrix Factorization with MoG for Recommendations

Keywords: Local differential privacy, Matrix Factorization, Bounded Laplace Mechanism, Mixture of Gaussian

Unethical data aggregation practices of many recommendation systems have raised privacy concerns among users. Local differential privacy (LDP) based recommendation systems address this problem by perturbing a user's original data locally in their device before sending it to the data aggregator (DA). The DA performs recommendations over perturbed data which causes substantial prediction error. To tackle privacy and utility issues with untrustworthy DA in recommendation systems, we propose a novel LDP matrix factorization (MF) with mixture of Gaussian (MoG). We use a Bounded Laplace mechanism (BLP) to perturb user's original ratings locally. BLP restricts the perturbed ratings to a predefined output domain, thus reducing the level of noise aggregated at DA. The MoG method estimates the noise added to the original ratings, which further improves the prediction accuracy without violating the principles of differential privacy (DP). With Movielens and Jester datasets, we demonstrate that our method offers a higher prediction accuracy under strong privacy protection compared to existing LDP recommendation methods.

Introduction

Recommendation systems are often used to help users to find products or services that could interest them. Collaborative Filtering (CF) is a prominent technique used in recommendation systems. CF-based recommendation systems collect and analyse user information to offer better and personalized user experience. However, aggregation and analysis of user information can cause privacy violation. Narayanan et.al [START_REF] Narayanan | Robust de-anonymization of large datasets (how to break anonymity of the netflix prize dataset)[END_REF] demonstrated how analyzing an individual's historical ratings can reveal sensitive information such as user's political preference, medical conditions and even religious disposition. Therefore, it is crucial for recommendation systems to protect the privacy of the users while simultaneously providing high-quality recommendations.

Differential privacy (DP) has become a popular tool in various domains to protect the privacy of users even if the adversary possesses a substantial amount of auxiliary information about the aggregated data [START_REF] Dwork | demp[END_REF]. Several studies have proposed differential privacy based CF mechanisms [START_REF] Mcsherry | Differentially private recommender systems: Building privacy into the netflix prize contenders[END_REF][START_REF] Roy | Airavat: Security and privacy for mapreduce[END_REF][START_REF] Zhu | Differential privacy for neighborhoodbased collaborative filtering[END_REF] to safeguard against privacy attacks in recommendation systems. However, most of the existing mechanisms imply that the data aggregator (DA) is trusted. Unfortunately, many DAs are inclined to collect more data than required and abuse the privacy of users for their benefits. Due to the concerns over untrusted DAs, many researchers [START_REF] Shen | Epicrec: Towards practical differentially private framework for personalized recommendation[END_REF][START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF][START_REF] Hua | Differentially private matrix factorization[END_REF][START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] have adopted Local Differential Privacy (LDP) for collaborative filtering. LDP based CF requires each user to locally perturb their data and sends the perturbed data to DA. However, this approach yields low prediction accuracy compared to DP based CF because each user's data is noised locally as opposed to adding noise to aggregates of the user's data. Therefore, it is necessary to design a LDP based recommendation system where each user can protect the privacy of their data from DA and at the same time, DA can perform recommendations with satisfactory prediction accuracy.

Our work aims to design a novel LDP based recommendation system which yields high data utility under strong privacy guarantee. We perturb user's original ratings locally using a Bounded Laplace mechanism (BLP) before sending to the DA. Furthermore, we reduce the prediction error by using MF with MoG at the DA. We estimate the added BLP noise using MoG [START_REF] Dempster | Maximum likelihood from incomplete data via the em algorithm[END_REF], and Expectation-Maximization (EM) method is used to estimate the parameters of MoG. We demonstrate that our BLP-based recommendation system can provide substantial privacy protection and meanwhile achieve a satisfactory recommendation accuracy. The contribution of our work is as follows:

-We use a Bounded Laplace mechanism (BLP) to perturb each user's ratings locally in their devices. To the best of our knowledge, this is the first work which uses BLP to perturb each user's rating in recommendation systems. BLP ensures that the perturbed ratings fall within a predefined output domain without violating the principles of LDP. Additionally, BLP does not require complex computations to be performed in the user's side contrary to some existing solutions which require users to calculate their latent factors locally in their devices. -We significantly improve the rating prediction accuracy of LDP based recommendation system. Local rating perturbation induces large error which grows linearly with the number of users and items. However, BLP compared to the Laplace mechanism introduces limited noise to aggregated ratings. Additionally, MoG is used to model the noise before MF to further increase the prediction accuracy. We demonstrate empirically using Movielens and Jester datasets that our proposed method can achieve satisfactory prediction accuracy under strong privacy guarantee and outperforms the works of [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] and [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF]. -The communication cost of our proposed method is significantly less compared to other existing solutions, such as [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] as our method only requires users to transmit the perturbed ratings once to the DA, so there is no additional communication cost is introduced, unlike other methods that involve multiple iterations of information exchanges between a user and the DA.

Related Work

LDP is used to protect the user's privacy against untrusted DA in many applications. For example, Google uses LDP to collect each user's chrome usage statistics privately [START_REF] Erlingsson | Rappor: Randomized aggregatable privacypreserving ordinal response[END_REF]. Likewise, LDP is also used in CF to protect the privacy of users. For instance, [START_REF] Shen | Epicrec: Towards practical differentially private framework for personalized recommendation[END_REF] introduced an LDP based rating perturbation algorithm which perturbs users' preference within an item category. Even though this mechanism hides a user's preference towards an item from an untrusted data aggregator, it can still reveal users' preferences towards an item category. Hua et.al [START_REF] Hua | Differentially private matrix factorization[END_REF] proposed another LDP based Matrix Factorization for untrusted DA. In their method initially, item profile vectors are learned using a private matrix factorization algorithm. Then these item vectors are sent to the user to derive user profile vectors. As each user's profile vectors do not depend on other users' data, they can easily compute their profile vectors locally instead of centrally. Users send their updated item profile vectors back to DA which then used to update the item profile vectors. The method used an objective function perturbation to achieve differential privacy. However, this method adds additional processing and communication overhead at user side. Shin et.al [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] also proposed a method similar to [START_REF] Hua | Differentially private matrix factorization[END_REF] which requires the DA to send item profile vectors to each user. However, [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] used a randomized response perturbation mechanism instead of the objective perturbation mechanism and users send back the gradient instead of latent factors to DA. Their method also induces more communication and processing cost as users locally compute their user profile vectors over multiple iterations. Another LDP based rating perturbation mechanism was proposed by [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] where the original ratings are perturbed using Laplace mechanism. However, this proposed method used a clamping method to restrict the out-of-range ratings and used off-shelf optimization problems solvers such as SGD (Stochastic Gradient Descent) and ALS (Alternating Least Squares) in their MF algorithm.

Local Differential Privacy Based Recommendation System

In this work, we consider an untrustworthy data aggregator with whom the users are not willing to share any sensitive information. In our proposed system the original ratings are perturbed using Bounded Laplace mechanism and perturbed ratings are aggregated by DA. At DA, we use a MF with MoG for noise estimation and rating predictions. Our proposed rating prediction model will help the DA to reconstruct the original ratings from perturbed ratings without violating the privacy of users. Dwork et.al [START_REF] Dwork | demp[END_REF] proved that any mechanism that satisfies ε-differential privacy is resilient to post-processing. It implies that our perturbed rating from the local differentially private mechanism can be utilised in further processes without producing any additional privacy risk. Fig. 1 shows the system architecture for the proposed recommendation system.

LDP Rating Perturbation

Rating Normalization As different recommendation systems use distinct rating scales, to produce a generalized theoretical model, we adopt the Min-Max scaling approach to normalize the rating scale between 0 and 1. Given an actual rating of r • , the normalized true rating r can be generated as:

r = r • -r • min r • max -r • min (1)
in which r • max is the highest possible rating score on the rating scale, and r • min is the lowest. Local sensitivity is the maximum change rating perturbation mechanism can cause in a rating dataset, which is the difference between the maximum and the minimum rating. In a normalized dataset, the maximum rating is 1 and the minimum rating is 0. Therefore, the local sensitivity of the rating perturbation mechanism is ∆r = 1.

Bounded Laplace mechanism

Our system perturbs the user's normalized rating using the BLP mechanism. Bounded Laplace mechanism is used to sanitize the output results of the Laplace mechanism with bounding constraints. BLP satisfies -DP by ignoring out of bound values and re-samples noise for a given input rating r until a value within the given bound is obtained. BLP mechanism can be defined as follows: Definition 1. (Bounded Laplace Mechanism) Given a scale parameter b and a domain rating interval of (l, u), the Bounded Laplace mechanism M BLP : R → R * is given by a conditional probability density function as follows:

f r * |r (r * |r) = 1 Cr(b) 1 2b exp(-|r * -r| b ), if r * ∈ [l, u] 0, if r * / ∈ [l, u] (2)
where C r (b) = )dr * is a normalization constant dependent on input rating r and r * is the perturbed output.

The normalization constant C r (b) can be given as:

C r (b) = 1 - 1 2 exp(- r -l b ) + exp(- u -r b ) (3)
It can be easily proven that the result of integration will yield Eqn. [START_REF] De La Torre | A framework for robust subspace learning[END_REF]. It has been shown in [START_REF] Holohan | The bounded laplace mechanism in differential privacy[END_REF] that when local sensitivity ∆f = l-u, BLP mechanism satisfies ε-local differential privacy. Using BLP in our proposed mechanism ensures that the perturbed output range is limited to [l, u]. However, the mechanism still guarantees that the adversary is unable to obtain any information about the original data by observing the output and thus preserves the privacy of the user. The privacy budget ε will be determined by the DA and will be shared with user when they register with DA. The BLP mechanism (as given in Algorithm 1) will run every-time a user want to send rating to DA.

Algorithm 1 Bounded Laplace Mechanism

Input: Rating (r) in Output: Perturbed Rating (r * ) out 1: Generate a noise sample from the distribution Lap(0, b) 2: Calculate perturbed rating r * = r + Lap(0, b)

3: if l ≤ r * ≤ u then 4:
Set the perturbed rating to r * 5: else 6:

repeat Step 1 7: end if 8: return Perturbed rating to DA

Noise Estimation with MoG

Let R m×n be the original normalized rating matrix and R * m×n be the perturbed rating matrix of m users over n items. The perturbed ratings can be decomposed as:

R * = R + E (4)
where E m×n consists of BLP noise. Each element in the noised rating matrix can be represented as:

r * ij = r ij + e ij = (u T i )v j + e ij (5)
where u i is a column vector in user latent factor matrix U and v j is a column vector in item latent factor matrix V . As any unknown noise distribution can be modelled as a mixture of Gaussian, we assume that noise e ij in Eqn. ( 4) is drawn from MoG distribution [START_REF] Dempster | Maximum likelihood from incomplete data via the em algorithm[END_REF]:

p(e ij | Π, Σ) ∼ K k=1 π k N (e ij | 0, σ 2 k ) (6)
where Π = (π 1 , π 2 , ....π k ), Σ = (σ 1 , σ 2 , ....σ K ), σ 2 k is the variance of Gaussian component k and K is the total number of Gaussian components. π k is the mixing proportion and K k=1 π k = 1. Therefore, the probability of each perturbed rating r * ij of R can be represented as:

p(r * ij | u i , v j , Π, Σ) = K k=1 π k N (r * ij | (u T i )v j , σ 2 k ) (7)
The likelihood of R * can thus be given as:

p(R * | U, V, Π, Σ) = i,j∈Ω K k=1 π k N (r * ij | (u T i )v j , σ 2 k ) ( 8
)
where Ω is the set of non-missing data points in perturbed rating matrix R * . Given a dataset R * , our goal is to compute the parameters U, V, Π and Σ such that the maximum log-likelihood of R * is achieved.

max U,V,Π,Σ log p(R * | U, V, Π, Σ) = i,j∈Ω, log K k=1 π k N (r * ij | (u T i )v j , σ 2 k ) (9)

Expectation Maximization for MoG

As maximum log-likelihood function given in Eqn.( 9) cannot be solved using a closed-form solution, Expectation-Maximization (EM) algorithm is used to estimate model parameters U, V, Π and Σ. The EM algorithm introduced in [START_REF] Dempster | Maximum likelihood from incomplete data via the em algorithm[END_REF] has two steps, Expectation and Maximization. In E-step we compute posterior responsibility using the current model parameters U, V, Π and Σ for each noise point e ij as:

γ ijk = π k N (r * ij | (u T i )v j , σ 2 k ) K k=1 π k N (r * ij | (u T i )v j , σ 2 k ) (10)
The posterior responsibility reflects the probability that it is Gaussian component k generates the noise data point e ij . In M-step we re-estimate each model parameter U, V, Π, Σ using the posterior responsibilities such that the maximum log-likelihood Eqn.( 11) is obtained [START_REF] Meng | Robust matrix factorization with unknown noise[END_REF].

max U,V,Π,Σ i,j∈Ω K k=1 γ ijk log π k -log √ 2πσ k - (r * ij -(u T i )v j ) 2 2σ 2 k (11)
To solve the problem given in Eqn. [START_REF] Mcsherry | Differentially private recommender systems: Building privacy into the netflix prize contenders[END_REF], we first update Π and Σ:

N k = ∀i,j γ ijk π k = N k N σ 2 k = 1 N k ∀i,j γ ijk (r * ij -(u T i )v j ) 2 (12)
where N k is the sum of posterior responsibilities for kth Gaussian component and N is the total number of data points. The portion of Eqn. [START_REF] Mcsherry | Differentially private recommender systems: Building privacy into the netflix prize contenders[END_REF] related to U and V can be rewritten as:

i,j∈Ω K k=1 γ ijk - (r * ij -(u T i )v j ) 2 2σ 2 k = - i,j∈Ω K k=1 γ ijk 2σ 2 k ((r * ij -(u T i )v j ) 2 ) =-|| W (X -U V T ) || L2 ( 13
)
where W is the weight matrix in which the element w ij is the weight for rating r ij and can be defined as:

w ij = K k=1 γ ijk 2σ 2 k , if i, j ∈ Ω 0, if i, j / ∈ Ω (14)
The problem defined by Eqn.( 13) is equivalent to a weighted L2 low rank matrix factorization problem and any weighted L2-norm solvers such as WPCA [START_REF] De La Torre | A framework for robust subspace learning[END_REF], WLRA [START_REF] Srebro | Weighted low-rank approximations[END_REF] and DN [START_REF] Buchanan | Damped newton algorithms for matrix factorization with missing data[END_REF] can be used to solve it. We used WPCA in our evaluation. The process of our noise estimation and rating prediction is given in Algorithm 2. The convergence is achieved when the change between two consecutive U latent factor matrices is smaller than a predefined threshold or if the maximum number of iterations is reached.

Algorithm 2 MoG based Noise Estimation and Prediction

Input: Noised Ratings (R * ) in Output: Predicted Rating out Initialization : random initialization of U, V, Π and Σ 1: (E-Step) Estimate posterior responsibility γ ijk using Eqn. [START_REF] Hua | Differentially private matrix factorization[END_REF] 2: for until convergence occurs do 3:

(M-Step for Π and Σ) Estimate MoG parameters Π and Σ using Eqn.(12) 4:

(M-Step for U, V ) Estimate U and V by solving Eqn.(13) 5: end for 6: return Predict ratings using inner product of user and item latent factor matrices U and V

Results

Bounded Laplace noise distribution In this experiment, we generated noise samples using Laplace and Bounded Laplace mechanisms. We generated 100,000 random noise samples for both mechanisms while setting their privacy budget to 0.1 and 1 respectively using Movielens dataset. As expected prediction accuracy of all the methods except the Non-private MF method improves with increase in privacy budget. Because, an increase in privacy budget implies that the magnitude of privacy leakage the mechanism allows is substantial, which in turn, leads to an increase in the utility, i.e. the prediction accuracy.

Secondly, we compare BLP-MoG-MF with ISGD [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] by varying the privacy budget ε from 0.1 to 3 for both Movielens and Jester datasets. shows that the prediction accuracy of BLP-MoG-MF outperforms ISGD for all values of privacy budget ε. The results also show that BLP-MoG-MG produces a higher increase in prediction accuracy for Jester than Movielens for all the values of privacy budget ε. Jester dataset RMSE values show 35% and 28% of improvement in prediction accuracy when privacy budget ε is 0.1 and 1 respectively. However, the improvement percentage for Movielens dataset is 21% and 16% for the same values of privacy budget ε. This implies that BLP-MoG-MF outperforms ISGD even better when the data is sparse.

Communications Cost

We compare the communication cost of our approach to [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] and [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] in Table 1. In BLP-MoG-MF and ISGD approaches, regardless of the number of items that a user rates, the user always transmits each perturbed rating individually to the DA, once. PG-MF method requires the user to transmit only the perturbed gradient to DA. BLP-MoG-MF and ISGD methods do not require the DA to transmit any information back to the user. However, PG-MF method requires the DA to transmit updated item latent vectors matrix back to the user. The estimated transmission size for PG-MF method is approximately 0.15 MB for Movielens dataset [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF], whereas BLP-MoG-MF and ISGD methods will be transmitting approximately 1 byte of data each time user send their data to DA. [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF] Single Perturbed Rating No Data PG-MF [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] Single Perturbed Gradient Item Latent Factor Matrix

Conclusion

In this work, we propose a local differentially private matrix factorization with mixture of Gaussian (BLP-MoG-MF) method under the consideration of an untrustworthy data aggregator. Our proposed recommendation system guarantees strong user privacy and completely hides a user's preferences over an item from DA. It also pursues better prediction accuracy than the existing LDP based solutions [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF] and [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF]. Additionally, our method does not incur any additional communication cost to the user side. In future, we intend to explore approaches to improve the robustness of achieved local minima for the non-convex cost function used in MF with MoG.

Fig. 1 .

 1 Fig. 1. Local differential privacy based recommendation

u l 1 2b

 1 exp(-|r * -r| b

  Fig 2(a) and 2(b) illustrates the frequency of noise under Laplace and Bounded Laplace mechanism. The noise samples generated using Laplace mechanism approximates to a Laplace distribution while the noise samples generated using BLP produces an unknown continuous distribution. As BLP follows a conditional probability density function (see Definition.1), it no more produced noise that can approximate to a Laplace distribution. Hence, MoG is effective in estimating the noise generated by BLP.

(a) ε = 0. 1 (b) ε = 1 Fig. 2 .

 112 Fig. 2. Laplace Vs Bounded Laplace Noise Distribution

  Fig 4(a) and 4(b) illustrate the RMSE values for both methods and Non-Private MF. The RMSE values of Jester dataset are larger than that of Movielens as Jester is sparser than Movielens. Fig 4(a) and 4(b)

Fig. 3 .Fig. 4 .

 34 Fig. 3. PG-MF vs BLP-MoG-MF RMSE Comparison

Table 1 .

 1 Communication Cost Comparison

	Method	User to DA	DA to User
	BLP-MoG-MF	Single Perturbed Rating	No Data
	ISGD

Evaluation

In this section, we discuss the evaluation of our proposed BLP based MF with MoG approach (BLP-MoG-MF). To demonstrate the effectiveness of our proposed approach, we compare it with the following methods:

-Non-Private Matrix Factorization (Non-Private MF): This is the baseline method we compare our approach with. This method does not perturb any user's ratings and uses SGD based matrix factorization for rating prediction. RMSE value of the baseline method reflects the lower bound for prediction error that can be obtained without any privacy constraints. -Input Perturbation SGD Method (ISGD) [START_REF] Berlioz | Applying differential privacy to matrix factorization[END_REF]: ISGD method perturb ratings using Laplace mechanism and clamp the resulting perturbed ratings using a clamping parameter locally at the user's device. DA uses MF with SGD method for rating prediction. -Private Gradient-Matrix Factorization (PG-MF) [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF]: In this method initially DA computes item latent factors and sends to each user. Then each user computes their latent factors locally in their device and submits a perturbed gradient to DA. DA updates the item latent factors using the aggregated perturbed gradients from each user.

Datasets

We used two popular public rating datasets in our evaluation: Movielens [START_REF] Harper | The movielens datasets: History and context[END_REF] and Jester [START_REF] Goldberg | Eigentaste: A constant time collaborative filtering algorithm[END_REF]. Among several different version of Movielens dataset, we used the dataset which consists of 100k ratings of 1682 movies rated by 943 users. The minimum rating given is 0.5 and the maximum rating is 5. The Jester dataset consists of 2M ratings of 100 jokes rated by 73,421 users. The minimum rating given in this dataset is -10 and maximum rating given is +10.

Evaluation Metrics

We measure the accuracy of prediction using the metric Root Mean Squared Error (RMSE) given by:

in which r i is the actual rating, ri is the predicted rating and n is the total number of ratings. We use 10-fold cross-validation to train and evaluate our proposed BLP-MoG-MF approach for both Movielens and Jester datasets over various privacy budget ε. The prediction accuracy is dependent on the privacy budget ε, higher values of ε lead to weaker privacy protection levels. As there can be discrepancies while introducing noise through the Bounded Laplace mechanism, the computed RMSE is averaged across multiple runs.