CYBER-PHYSICAL SYSTEMS SECURITY
1 1. VULNERABILITIES IN IOT DEVICES
Problem 1. An IoT device is vulnerable to the implementation of weak encryption algorithms.
Suppose an attacker can crack a weak encryption used by a smart thermostat in 10 minutes. If
the attacker has successfully cracked the encryption, what is the probability that the attacker can
control the thermostat within 30 minutes of starting the attack?
Additional context: Assume that once the encryption is cracked, the attacker can gain control
of the thermostat immediately.
Solution 1. Let’s calculate the probability that the attacker can crack the encryption and gain
control of the thermostat within 30 minutes.
The probability that the attacker does not crack the encryption in 10 minutes is 1−1
6=5
6(since
the attacker can crack it in 10 minutes, which is 1
6of 60 minutes).
Therefore, the probability that the attacker does not crack the encryption in 30 minutes is 5
63=
125
216 .
The probability that the attacker cracks the encryption and gains control of the thermostat within
30 minutes is 1−125
216 =91
216 ≈0.4213.
So, the probability that the attacker can control the thermostat within 30 minutes of starting the
attack is approximately 42.13
Problem 2. A smart home security system is vulnerable to a buffer overflow attack. If the
buffer overflow allows an attacker to execute arbitrary code on the system, and the attacker has a
1 in 50 chance of succeeding with each attempt, what is the probability that the attacker will gain
unauthorized access with 5 attempts?
Solution 2. The probability that the attacker fails in each attempt is 49
50 5≈0.9026.
Therefore, the probability that the attacker will succeed in gaining unauthorized access with 5
attempts is 1−0.9026 = 0.0974 or approximately 9.74
2 3. SECURING WIRELESS SENSOR NETWORKS
Problem 3. In a wireless sensor network, an attacker gains access to the network and is able
to inject false data packets with the goal of disrupting the network. The network uses an encryption
algorithm that requires a 128-bit key. The attacker manages to capture 64 bits of the key. Assuming
a brute force attack, calculate the number of possible combinations the attacker needs to try in order
to brute force the remaining 64 bits of the key.
Solution 3.
The total number of possible combinations for a 128-bit key is 2128 . Since the attacker already
has captured 64 bits of the key, he needs to brute force through the remaining 64 bits.
Therefore, the number of possible combinations for the attacker to try is:
264 = 18,446,744,073,709,551,616
So, the attacker needs to try over 18 quintillion combinations to successfully brute-force the
remaining 64 bits of the key.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
3 3. MALWARE ATTACKS ON AUTONOMOUS VEHICLES
Problem 3. A cyber-physical system controls an autonomous vehicle’s braking system. A
malware attack on the system causes the braking force to be reduced by 20%. If the original
braking force was 5000 N, calculate the new braking force after the malware attack.
Solution 3. a) The original braking force is 5000 N. After reducing it by 20%, the new braking
force can be calculated as follows:
New Braking Force =Original Braking Force ×(1 −Reduction %)
New Braking Force = 5000 ×(1 −0.20) = 5000 ×0.80 = 4000 N
Therefore, the new braking force after the malware attack is 4000 N.
I. Problem: LACK OF ENCRYPTION IN INDUSTRIAL CONTROL SYSTEMS
Problem 1:
An industrial control system communicates with a sensor using a vulnerable protocol that lacks
encryption. An attacker intercepts the messages and modifies the sensor readings before for-
warding them to the control system. The sensor measures a temperature of 50°C, but the attacker
changes it to 75°C. The control system has a threshold of 70°C for triggering an emergency shut-
down. If the control system lacks integrity checks, will the attack trigger the emergency shutdown?
Solution:
Since the attacker modifies the sensor reading to 75°C, which is above the threshold of 70°C, the
control system will be fooled into thinking that the temperature has exceeded the limit. Therefore,
the attack will trigger the emergency shutdown.
II. Problem: LACK OF SECURE BOOT IN EMBEDDED SYSTEMS
Problem 2:
A cyber-physical system uses an embedded device that lacks secure boot capabilities. An
attacker gains physical access to the device and manages to overwrite the bootloader with a mali-
cious firmware. When the device is rebooted, it loads the malicious firmware instead of the genuine
one. How can this attack compromise the security of the system?
Solution:
By overwriting the bootloader with malicious firmware, the attacker can gain persistent control
over the device. The malicious firmware may contain backdoors, malware, or unauthorized code
that can compromise the confidentiality, integrity, and availability of the system. This can lead to
unauthorized access, data leaks, and potential disruption of the system’s operation.
III. Problem: LACK OF AUTHENTICATION IN WIRELESS SENSOR NETWORKS
Problem 3:
A wireless sensor network used for environmental monitoring lacks proper authentication mech-
anisms. An attacker deploys a rogue sensor node that pretends to be a legitimate node in the
network. How can the presence of this rogue node impact the data collected by the network?
Solution:
The rogue sensor node can inject false data into the network, leading to incorrect environmental
monitoring readings. This can mislead decision-making processes based on the inaccurate data
collected. Moreover, the rogue node may also eavesdrop on the network traffic, compromising the
confidentiality of the communication and enabling further malicious activities.
3.1 5. BREACHES IN INDUSTRIAL CONTROL SYSTEMS
Problem 5. A critical infrastructure control system has a vulnerability that allows an attacker to
execute arbitrary code on the system. The attacker has gained access to the system and can inject
code to manipulate the control settings. The system uses a basic proportional-integral-derivative
(PID) controller to regulate a temperature process. The attacker injects a code snippet that con-
stantly adds a high value to the output of the PID controller.
Given the PID controller equation:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt ,
where: u(t)= controller output, e(t)= error = set point - process value, Kp= proportional gain, Ki
= integral gain, Kd= derivative gain, and the attacker’s code adds a constant value cto the output
u(t).
a) Determine the effect of the attacker’s code injection on the temperature process. Will the
temperature stabilize or oscillate?
b) How can the system’s security be improved to prevent such attacks in the future?
Solution 5.
a) The attacker’s code snippet adds a constant value cto the output of the PID controller.
Therefore, the modified controller equation becomes:
u(t) = Kpe(t) + KiZt
0
e(τ)dτ +Kd
de(t)
dt +c.
This constant addition effectively shifts the output u(t)of the controller by cunits. If cis a
positive value, this will cause the system to overshoot the set point, leading to oscillations in the
temperature process. If cis negative, the system will undershoot the set point. Therefore, the
temperature process will not stabilize but will oscillate around the set point.
b) To improve the system’s security and prevent such attacks in the future, various measures
can be taken: - Implement input validation to check data integrity. - Use encryption and secure
communication protocols to prevent unauthorized access. - Regularly update and patch system
software to fix vulnerabilities. - Implement intrusion detection systems to monitor for unusual be-
havior. - Conduct security audits and penetration testing to identify and address potential security
risks.
4 6. CYBER-PHYSICAL ATTACKS ON SMART HOMES
Problem 6. A smart home system consists of various IoT devices connected to a central hub
through a wireless network. An attacker gains unauthorized access to the smart home network
and starts launching Distributed Denial of Service (DDoS) attacks on the central hub. The attacker
creates 100,000 malicious packets and sends them to the hub every second, each packet being 1
kilobyte in size. The hub’s network interface card can handle up to 1 million packets per second.
Determine if the DDoS attack exceeds the hub’s processing capacity.
Solution 6. a) The total data rate of the attack can be calculated as follows:
Data rate =Number of packets ×Packet size
Data rate = 100,000 packets/second ×1kilobyte/packet = 100,000 kilobytes/second
b) To determine if the hub’s processing capacity is exceeded, we need to calculate the total
data rate in terms of packets per second. Given that the network interface card can handle 1
million packets per second, we convert the data rate in kilobytes to packets per second:
Data rate in packets/second =Data rate in kilobytes/second
Packet size
Data rate in packets/second =100,000 kilobytes/second
1kilobyte/packet = 100,000 packets/second
c) Since the data rate of the attack is equal to the hub’s processing capacity, the DDoS attack
is at the limit of the hub’s capabilities. Any additional packets sent by the attacker may overload
the hub and lead to a denial of service. It is crucial to implement security measures to detect and
mitigate such attacks in smart home systems.
5 7. DATA BREACHES IN SMART CITY INFRASTRUCTURE
Problem 7. A smart city infrastructure uses an IoT sensor network to monitor traffic flow at
different intersections. Each sensor sends data packets every 5 seconds to a central server through
a wireless network. If the data packets are not properly encrypted, an attacker can potentially
intercept and modify the information. Suppose an attacker successfully intercepts 10
a) The number of data packets the attacker intercepts and tampers with.
b) The percentage of data packets received by the central server that have been tampered with.
c) The total number of data packets that the central server receives without any tampering.
Solution 7.
a) The number of data packets the attacker intercepts and tampers with: The attacker success-
fully intercepts 10
Number of packets intercepted = 10% ×10,000 = 0.10 ×10,000 = 1,000
Therefore, the attacker intercepts and tampers with 1,000 data packets.
b) The percentage of data packets received by the central server that have been tampered
with: The total number of data packets received by the central server is 10,000. Out of these,
1,000 packets have been tampered with. So, the percentage of tampered packets is:
Percentage of tampered packets =1,000
10,000 ×100% = 10%
Thus, 10
c) The total number of data packets that the central server receives without any tampering: The
remaining data packets received by the central server without tampering can be calculated as:
Number of untampered packets = 10,000 −1,000 = 9,000
Therefore, the central server receives 9,000 data packets without any tampering.
6 8. INSIDER THREATS TO CRITICAL INFRASTRUCTURE
Problem 8. An insider threat analyst is investigating a cyber-physical system where an insider
has gained unauthorized access to critical infrastructure components. The analyst estimates that
the probability of the insider causing a catastrophic failure in the system is 0.15.
a) What is the probability that the insider does not cause a catastrophic failure?
b) If there are 5 critical infrastructure components in the system, what is the probability that at
least one component fails catastrophically due to the insider threat?
c) If the system can survive the failure of up to 2 critical components, what is the probability that
it will not be compromised by the insider’s actions?
Solution 8.
a) The probability that the insider does not cause a catastrophic failure is given by P(not failure) =
1−P(failure). Therefore, P(not failure)=1−0.15 = 0.85.
b) The probability that at least one component fails catastrophically due to the insider threat
can be calculated using the complement rule. Let Abe the event that at least one component fails
catastrophically. Then,
P(A)=1−P(no failure)
= 1 −(P(not failure)5)
= 1 −(0.85)5
≈1−0.4437
≈0.5563.
Therefore, the probability that at least one component fails catastrophically is approximately
0.5563.
c) The probability that the system will not be compromised by the insider’s actions can be
calculated as the sum of the probabilities of surviving with 0, 1, or 2 component failures. Let Bbe
the event that the system is compromised. Then,
P(not compromised) = P(0 failures) + P(1 failure) + P(2 failures)
=5
0(0.15)0(0.85)5+5
1(0.15)1(0.85)4+5
2(0.15)2(0.85)3
≈0.4437 + 0.3531 + 0.1613
≈0.9581.
Therefore, the probability that the system will not be compromised by the insider’s actions is
approximately 0.9581.
7 7. INTRUSION DETECTION SYSTEMS
Problem 7. An Intrusion Detection System (IDS) in a cyber-physical system has a false positive
rate of 0.03 and a false negative rate of 0.05. If the IDS detects an intrusion, what is the probability
that it is a real intrusion?
Solution 7. Let’s denote the following probabilities: - P(I)= Probability of an intrusion occur-
ring. - P(D)= Probability of the IDS detecting an intrusion. - P(D)= Probability of the IDS not
detecting an intrusion (false negative). - P(I)= Probability of no intrusion occurring. - P(D|I)=
Probability of the IDS detecting an intrusion when there is no actual intrusion (false positive).
We are given: - P(D|I) = 0.03 (False positive rate) - P(D|I) = 0.05 (False negative rate)
The probability of the IDS detecting an intrusion is:
P(D) = P(I)·(1 −P(D|I)) = P(I)·(1 −0.03) = 0.97P(I)
According to the total probability theorem, we have:
P(D) = P(I)·(1 −P(D|I)) + P(I)·P(D|I)
0.97P(I) = P(I)·0.97 + P(I)·0.05
Given that P(I) + P(I)=1, we can solve for P(I)by substituting P(I) = 1 −P(I):
0.97P(I) = P(I)·0.97 + (1 −P(I)) ·0.05
0.97P(I) = 0.97P(I)+0.05 −0.05P(I)
0.02P(I) = 0.05
P(I) = 0.05
0.02
P(I) = 0.625
Therefore, the probability that the IDS detected an actual intrusion is P(I)=0.625.
I. Problem:
Problem 1: A smart thermostat in a home communicates with a server to receive and send
temperature settings. The communication between the thermostat and the server is encrypted
using a symmetric key algorithm. If the key size is 128 bits, calculate the number of possible keys
that an attacker would need to try to break the encryption.
Solution:
The number of possible keys for a symmetric key algorithm with a key size of 128 bits is given
by 2128.
Therefore, the number of possible keys an attacker would need to try is:
2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456
Therefore, the attacker would need to try over 340 undecillion keys to break the encryption.
II. Problem:
Problem 2: A smart irrigation system in a farm uses wireless communication to receive com-
mands and updates. If a malicious attacker can intercept the wireless signals using a rogue receiver
placed near the farm, explain how this attack can compromise the system’s security and suggest
a countermeasure to mitigate this risk.
Solution:
The attacker’s ability to intercept wireless signals poses a significant threat to the smart irrigation
system’s security. By eavesdropping on the communication between the system components, the
attacker can potentially gather sensitive information such as user credentials, system commands,
or personal data. This data can be used for malicious purposes, leading to unauthorized access
to the system, manipulation of irrigation schedules, or even sabotage.
To mitigate this risk, the system can implement encryption techniques to secure the wireless
communication. By encrypting the data transmitted between the components using secure cryp-
tographic algorithms, the system can prevent eavesdroppers from understanding the information
even if they intercept the signals. Additionally, implementing authentication mechanisms such as
digital signatures or certificates can verify the integrity of the communication and ensure that only
authorized devices can interact with the system, thwarting attacks from rogue receivers and unau-
thorized entities.
8 9. ATTACKS ON MEDICAL DEVICES
Problem 9. A hospital uses a wireless sensor network to monitor the vital signs of patients.
Each sensor node can transmit 100 packets per second, with each packet size being 100 bytes.
An attacker floods the network with packets at a rate of 200 packets per second, each 150 bytes
in size. Calculate the percentage increase in the network traffic due to the attack.
Solution 9. Given data:
•Normal packet transmission rate: 100 packets per second
•Normal packet size: 100 bytes
•Attacker’s packet transmission rate: 200 packets per second
•Attacker’s packet size: 150 bytes
Let’s first calculate the normal network traffic and the network traffic during the attack:
Normal network traffic:
Normal packet size = 100 bytes
Normal packet rate = 100 packets/second
Normal traffic =Normal packet size ×Normal packet rate
= 100 bytes ×100 packets/second
= 10000 bytes/second
= 100 kBps
Network traffic during the attack:
Attacker’s packet size = 150 bytes
Attacker’s packet rate = 200 packets/second
Traffic during attack =Attacker’s packet size ×Attacker’s packet rate
= 150 bytes ×200 packets/second
= 30000 bytes/second
= 300 kBps
Now, let’s calculate the percentage increase in network traffic due to the attack:
Percentage Increase =Traffic during attack −Normal traffic
Normal traffic ×100%
=300 −100
100 ×100%
=200
100×100%
= 200%
Therefore, the percentage increase in network traffic due to the attack is 200
9 Cyber-Physical Systems Security
Problem: A smart grid system consists of 100 smart meters installed in a neighborhood. If
each smart meter has a vulnerability to a specific ransomware attack with a probability of 0.05,
what is the expected number of smart meters that will be affected by the ransomware?
Solution: Let Xbe the random variable representing the number of smart meters affected by
the ransomware attack. Xfollows a binomial distribution with parameters n= 100 (total number of
smart meters) and p= 0.05 (probability of each smart meter being affected).
The expected value of a binomial distribution is given by µ=np.
Therefore, the expected number of smart meters affected by the ransomware is:
µ=np
= 100 ×0.05
= 5
Thus, the expected number of smart meters that will be affected by the ransomware attack is
5.
I’d be happy to help with that! Could you please specify a particular topic or subtopic within
Cyber-Physical Systems Security that you would like the problem to be based on? This will help
me tailor the question to your needs.
I. Problem: An autonomous vehicle is equipped with a sensor that can detect obstacles in its
path. The sensor has a false positive rate of 10% and a false negative rate of 5%. If there is an
obstacle present, what is the probability that the sensor will correctly detect it?
Solution: Let’s denote the event of an obstacle being present as Oand the event of the sensor
detecting the obstacle as D. We are given that P(D|Oc)=0.10 (false positive rate) and P(D|O) =
0.95 (true positive rate).
The probability of the sensor correctly detecting the obstacle can be found using the law of total
probability:
P(D) = P(D|O)P(O) + P(D|Oc)P(Oc)
=P(D|O)P(O) + P(D|Oc)(1 −P(O))
= 0.95 ×0.95 + 0.10 ×0.05
= 0.9025 + 0.005
= 0.9075
Therefore, the probability that the sensor will correctly detect an obstacle is 0.9075 or 90.75%.
II. Problem: In a smart transportation system, a hacker gains control of traffic signal lights at an
intersection. The traffic lights are programmed to allow 60 seconds of green light for one direction
and 30 seconds of green light for the other direction. If the hacker constantly switches the lights to
green for 45 seconds each, what is the probability of a collision occurring at the intersection?
Solution: There are four possible scenarios where a collision can occur: 1. A vehicle crosses
the intersection during the 30-second green light period. 2. A vehicle crosses the intersection
during the 60-second green light period. 3. A vehicle crosses the intersection when the lights are
green for 45 seconds for both directions. 4. A vehicle crosses the intersection during the red light
period.
Let Cbe the event of a collision occurring. The probability of a collision happening is the sum
of probabilities of these scenarios:
P(C) = P(C|30s)P(30s) + P(C|60s)P(60s) + P(C|45s)P(45s) + P(C|red)P(red)
= 1 ×30
90 + 1 ×60
90 + 1 ×45
90 + 0 ×30
90
=30 + 60 + 45 + 0
90
=135
90
= 1.5
The probability of a collision occurring at the intersection in this compromised state is 1.5 or
150%. This indicates that a collision is certain under these conditions, which emphasizes the
critical importance of secure transportation systems.
I. Problem 1: In a drone communication system, a message is encrypted using a key of length
128 bits. If the encryption algorithm used is AES-128, what is the total number of possible keys
that can be used?
Solution: The AES-128 encryption algorithm uses a key length of 128 bits. Therefore, the total
number of possible keys is 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456.
II. Problem 2: A drone is flying at a speed of 10 m/s and is located at coordinates (0,0). After
5 seconds, it moves to coordinates (20,30). What is the average velocity of the drone during this
time period?
Solution: The displacement of the drone is p(20 −0)2+ (30 −0)2=√400 + 900 = √1300 ≈
36.06 meters. The time taken for the displacement is 5 seconds. Therefore, the average velocity
is 36.06m
5s= 7.21 m/s.
III. Problem 3: A drone is operating in an environment where an attacker is jamming the com-
munication signals. If the bit error rate (BER) due to jamming is 10−3, what is the probability that a
message consisting of 1000 bits will be received in error?
Solution: The probability that a single bit is received in error is the BER, which is 10−3. There-
fore, the probability that a 1000-bit message is received in error is (10−3)1000 = 10−3000.
I. REMOTE CODE EXECUTION VULNERABILITY IN INTERNET-CONNECTED THERMOSTATS
Problem:
A hacker discovers a remote code execution vulnerability in an internet-connected thermostat
system. By exploiting this vulnerability, the hacker gains access to the thermostat’s control systems
and is able to manipulate the temperature settings remotely.
Suppose the thermostat system has a default temperature setting of 72°F. The hacker lowers
the temperature to 65°F. Then, the hacker raises the temperature to 80°F. Finally, the hacker sets
the temperature back to the default setting of 72°F.
a) What is the overall change in temperature caused by the hacker’s actions?
b) If the hacker succeeded in keeping the temperature at 65°F for 3 hours, at 80°F for 2 hours,
and back at 72°F for 1 hour, what is the average temperature over this 6-hour period?
Solution:
a) The overall change in temperature caused by the hacker’s actions is given by:
Change = (Final Temperature) - (Initial Temperature) Change = 72°F - 65°F + 80°F - 72°F
Change = 7°F+8°F Change = 15°F
Therefore, the overall change in temperature caused by the hacker’s actions is a 15°F increase.
b) To find the average temperature over the 6-hour period, we calculate the total amount of
temperature "change" that occurred over the 6 hours and add it to the initial temperature setting of
72°F:
Total change = (65°F - 72°F) * 3 + (80°F - 72°F) * 2 + (72°F - 72°F) * 1 Total change = -21°F +
16°F+0°F Total change = -5°F
Average temperature = Initial temperature + (Total change / Total time) Average temperature =
72°F-5°F / 6 hours Average temperature = 67°F / 6 Average temperature 11.167°F
Therefore, the average temperature over the 6-hour period is approximately 67°F.
10 Cyber-Physical Systems Security
Problem 17. In a smart building, a sensor network is used to monitor the temperature in differ-
ent rooms. The network consists of 5 sensors, and each sensor has an average battery life of 2
years. If the network operates 24/7 and each sensor consumes 0.5 watts of power, calculate the
total energy consumed by the sensor network in kilowatt-hours over a period of 6 months.
Solution 17. a) First, calculate the energy consumed by a single sensor in 1 year:
Energy consumed by a single sensor in 1 year =Power ×Time
= 0.5watts ×24 hours/day ×365 days
= 0.5×24 ×365 watt-hours
= 4380 watt-hours
b) Since the battery life of each sensor is 2 years, the total energy consumed by a single sensor
over 2 years is:
Total energy consumed by a single sensor in 2 years = 2 ×4380 watt-hours
= 8760 watt-hours
c) To find the total energy consumed by the entire sensor network in 2 years, we multiply the
energy consumed by a single sensor in 2 years by the number of sensors:
Total energy consumed by the sensor network in 2 years = 5 ×8760 watt-hours
= 43800 watt-hours
d) Now, to convert the total energy consumed into kilowatt-hours, we divide by 1000:
Total energy consumed by the sensor network in 2 years (in kilowatt-hours) =43800 watt-hours
1000
= 43.8kilowatt-hours
e) Finally, to find the total energy consumed by the sensor network in 6 months, we divide the
energy consumption over 2 years by 2:
Total energy consumed by the sensor network in 6 months =43.8kilowatt-hours
2
= 21.9kilowatt-hours
Therefore, the total energy consumed by the sensor network in kilowatt-hours over a period of
6 months is 21.9 kWh.
11 Cyber-Physical Systems Security
Problem: A smart irrigation system in a farm is being targeted by a cyber attacker who tries to
disrupt the watering schedule. The system is designed to water the crops every 6 hours. The at-
tacker successfully tampers with the system and changes the watering interval to every 10 hours. If
the attack occurs at 8:00 AM, at what time will the crops be watered next according to the attacker’s
modified schedule?
Solution: a) The original watering schedule was every 6 hours, so the crops would have been
watered at 2:00 PM (6 hours after 8:00 AM). Let’s calculate how many hours have passed since
the last watering according to the attacker’s new schedule:
10 hours −6hours = 4 hours
b) Since 4 hours have passed since the last watering, the crops will be watered at 2:00 PM + 4
hours = 6:00 PM according to the attacker’s modified watering schedule.
Therefore, the crops will be watered next at 6:00 PM according to the attacker’s modified sched-
ule.
12 19. VULNERABILITIES IN CONNECTED ENERGY SYSTEMS
Problem 19. An energy management system in a smart grid uses a vulnerable communication
protocol that allows an attacker to inject false data into the system. A sensor reading of 150 kW
is manipulated to appear as 180 kW by the attacker. If the system operator uses this false data to
make decisions, how much extra revenue can the attacker generate by pushing the reading up for
10 minutes? Assume the system generates revenue at a rate of 0.15/kW h.
Solution 19. a) The difference between the actual and manipulated reading: 180 −150 = 30
kW
b) Duration for which the manipulated reading is used: 10 minutes
c) Revenue generated per kWh: 0.15/kW h
d) Extra revenue generated by the attacker:
Extra revenue =Difference in reading ×Duration ×Rate
Extra revenue = 30 kW ×10 minutes ×0.15 dollars/kWh
Extra revenue = 30 ×1
60 ×10 ×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×1
6×0.15
Extra revenue = 30 ×0.025
Extra revenue = 0.75 dollars
Therefore, the attacker can generate an extra revenue of 0.75bymanipulatingthesensorreadingfor10minutes.
I’m glad to help with that! Let’s dive into a numerical problem related to Cyber-Physical Systems
Security under the subtopic of Cyber-Physical Attacks on Robotics Systems.
13 20. CYBER-PHYSICAL ATTACKS ON ROBOTICS SYSTEMS.
Problem 20. Consider a robotic arm controlled by a microcontroller that receives commands
wirelessly. An attacker sends malicious commands to the microcontroller to manipulate the arm
to perform unauthorized actions. The microcontroller’s communication channel is encrypted with
a 128-bit AES algorithm. If the attacker intercepts 50,000 encrypted messages and has access
to significant computing power, estimate the time they would need to crack the encryption using a
brute-force attack.
Given data:
•Total number of possible keys for a 128-bit AES encryption: 2128
•Estimated time to check one key: 10−6seconds
Solution 20. a) The total number of possible keys for a 128-bit AES encryption is 2128.
b) The attacker has intercepted 50,000 encrypted messages. With each message, they could
potentially capture the encryption key used.
Hence, the probability of the attacker having intercepted the correct key among 50,000 inter-
cepted messages is given by the formula for the probability of at least one success in multiple trials
with replacement:
P(at least one success) = 1 −P(no success) = 1 −1−1
2128 50000
c) Now, let’s estimate the time the attacker would need to crack the encryption using a brute-
force attack.
Assuming an estimated time of 10−6seconds to check one key, the total time required to check
all possible keys is:
Total time =Number of possible keys ×Time to check one key
Total time = 2128 ×10−6seconds
Given the computing power available to the attacker, they would need to iterate through all
possible keys to find the correct one.
