Home Archives 2015

Yearly Archives: 2015

Rim Kaddah, Daniel Kofman, Fabien Mathieu, Michal Pioro

Proceedings of the 11th International Conference on Innovations in Information Technology (IEEE). Nov. 2015.
DOI: 10.1109/INNOVATIONS.2015.7381509

Abstract: The Internet of Things (IoT) paradigm brings an opportunity for advanced Demand Response (DR) solutions. Indeed, it enables visibility and control on the various appliances that may consume, store or generate energy within a home. It has been shown that a centralized control on the appliances of a set of households leads to efficient DR mechanisms; unfortunately, such solutions raise privacy and scalability issues. In this paper we propose an IoT-based DR approach that deals with these issues. Specifically, we propose and analyze a scalable two levels control system where a centralized controller allocates power to each house on one side and, each household implements an IoT- based DR local solution on the other side. A limited feedback to the centralized controller allows to enhance the performance with little impact on privacy. The solution is proposed for the general framework of capacity markets.

0 2219

3e Workshop du SEIDO LAB

Save the date

Nous avons le plaisir de vous convier
à la troisième édition du Workshop du laboratoire SEIDO,
le vendredi 11 décembre 2015

L’événement aura lieu à EDF R&D Clamart Labs
1 avenue du Général de Gaulle 92140 Clamart – France

 

Comme l’an passé, cet événement, après quelques introductions de référence dans les domaines de la Cybersécurité et de l’Internet Des Objets, sera le moment pour l’équipe du laboratoire de présenter ses travaux et d’échanger avec vous sur ces problématiques si passionnantes tant au niveau technique qu’au niveau sociétal.

Nous vous communiquerons le programme détaillé début novembre 2015. L’entrée au Workshop est libre sur inscription*, dans la limite des places disponibles.

* Inscription avant le 30 novembre 2015

Ziad Ismaïl, Jean Leneutre, Alia Fourati

Security of Industrial Control Systems and Cyber Physical Systems (Springer). Pages: 157-167, Sep. 2015.
DOI: 10.1007/978-3-319-40385-4_11

Abstract: The improved communication and remote control capabilities of industrial control systems equipment have increased their attack surface. As a result, managing the security risk became a challenging task. The consequences of attacks in an industrial control system can go beyond targeted equipment to impact services in the industrial process. In addition, the success likelihood of an attack is highly correlated to the attacker profile and his knowledge of the architecture of the system. In this paper, we present the Attack Execution Model (AEM), which is an attack graph representing the evolution of the adversary’s state in the system after each attack step. We are interested in assessing the risk of cyber attacks on an industrial control system before the next maintenance period. Given a specific attacker profile, we generate all potential attacker actions that could be executed in the system. Our tool outputs the probability and the time needed to compromise a target equipment or services in the system.

Ziad Ismaïl, Danai Symeonidou, Fabian Suchanek

Proceedings of the 24th International Conference on World Wide Web (ACM). Pages: 203-206, May 2015.
DOI: 10.1145/2740908.2742836

Abstract: Internet users typically have several online accounts – such as mail accounts, cloud storage accounts, or social media accounts. The security of these accounts is often intricately linked: The password of one account can be reset by sending an email to another account; the data of one account can be backed up on another account; one account can only be accessed by two-factor authentication through a second account; and so forth. This poses three challenges: First, if a user loses one or several of his passwords, can he still access his data? Second, how many passwords does an attacker need in order to access the data? And finally, how many passwords does an attacker need in order to irreversibly delete the user’s data? In this paper, we model the dependencies of online accounts in order to help the user discover security weaknesses. We have implemented our system and invite users to try it out on their real accounts.

Ziad Ismaïl, Jean Leneutre, David Bateman, Lin Chen

Proceedings of the 16th International Symposium on High Assurance Systems Engineering (IEEE). Jan. 2015.
DOI: 10.1109/HASE.2015.24

Abstract: The communication infrastructure is a key element for management and control of the power system in the smart grid. The communication infrastructure, which can include equipment using off-the-shelf vulnerable operating systems, has the potential to increase the attack surface of the power system. The interdependency between the communication and the power system renders the management of the overall security risk a challenging task. In this paper, we address this issue by presenting a mathematical model for identifying and hardening the most critical communication equipment used in the power system. Using non-cooperative game theory, we model interactions between an attacker and a defender. We derive the minimum defense resources required and the optimal strategy of the defender that minimizes the risk on the power system. Finally, we evaluate the correctness and the efficiency of our model via a case study.