Live forensics of software attacks on cyber–physical systems
Introduction
Cyber–physical Systems (CPS) can be defined as the result of integration between computations and physical processes, in which computations affect the physical processes and vice versa [[1], [2], [3]].However, due to the recent technological advances in computations and communications, more of these CPS systems are connected to the Internet and communicating with each other and with traditional computing machines [4]. These machines can be hijacked and compromised by perpetrators, who may intend to do harmful actions or compromise the functionalities of these CPS systems. This mandates the need to elevate the security measurements, including the Digital Forensics (DF) capabilities. Digital Investigators (DI) need to be able to detect the perpetrator’s activities; including the ability to find and identify any possible harmful or illegal concession made on the system and to uncover the perpetrator.
Though, often these perpetrators utilize computers and software to execute or cover their attacks. Locating the presumed software on their machine’s hard disk might not be a strong evidence about its actual usage. A definite evidence might be needed to prove that the perpetrator has actually used the software [5]. This evidence can be found in several places, one of which is the Main Memory (RAM) of the used machine. RAM encompasses vital information about the very recent states of a system such as its active processes and their execution states [[6], [7]].
A software current execution state resides in RAM. However, often program’s execution states are formalized by the execution paths of the encountered source code. Identifying this path can help in detecting the control-flow and data-flow of the presumed software and then characterizing the possible values of various variables that ought to be scattered over different RAM pages. Obviously, the use of object oriented programs increases the complexity of execution states, evidenced in part by the difficulty of its software testing process [8]. Software variables of an OOP can be categorized based on their scopes, access modifiers, and execution lifetimes. A variable’s scope and its access modifier determine the visibility of a variable and where it can be accessed within the program’s source code. Hence, a variable’s storage, which is defined by the memory type such as stack and heap, determines the duration in which its value is allocated and released [9]. On the other hand, variables can be classified based on whether they are allowed to be changed during execution and how these changes are visible within various parts of the program’s source code. For example, in Java, the program do not change variables’ values that are marked with once they are assigned, such variables are often initialized with literal values. These literals might be unique to the executable program and its execution state. Moreover, many other non-constant variables might be assigned with literal values too. When these literals are unique to the presumed program’s source code and some of its execution paths, then retaining these values in RAM can be used to establish the Digital Evidences (DE), define the actual software usage and assert its distinct execution path.
Common DF tools and techniques are not designed and developed to stop an attack, but to identify the source of an incident, determine its type, preserve the DE, and analyze the findings [10]. This paper focuses on the Memory Forensics (MF) of the Java-based software usage. It identifies various DE that would be employed to confirm the software usage and its association with the crime. The research methodology presented in this paper is relying solely on mining the core dumps of the physical memory of the host machine and assuming no information is available from the Operating System (OS) or the used Java Virtual Machine (JVM).
In order to verify our approach, various experiments and scenarios are established, for each of which a RAM dump is created and analyzed. During the analysis process, various variables’ scopes and memory types are assumed. Our experiments are designed to establish the DE between source code related values that obtained from the execution states of a running Java program and compare these DE when the internal implementation of the used JVM is different. JVMs that are running on all of MS Windows, Mac OS X, and Fedora Linux are investigated and the obtained DE are compared between similar scenarios.
Our results show that regardless of whether the program is running, the JVM is active or just stopped, the DI can employ knowledge from the presumed program’s source code such as static and instance level variables and their potential values in order to confirm the actual usage of the software; based on identifying these values in corresponding RAM dumps. Hence, some values of local variables are not expected to be successfully located when their corresponding stack frames are not active, though most of which are successfully identified. Additionally, values of static variables and local variables of static methods are often found to have longer duration in memory than the instance related values. Furthermore, in most cases, dynamically allocated values are identified in RAM dumps even after the Garbage Collector (GC) is explicitly invoked or even after the program is terminated. A comprehensive comparison between our findings during various possible scenarios and variable states are ascertained on all investigated platforms.
The rest of this paper is organized as follows. Section 2 presents a deeper look at CPS systems, in which our research motivations are presented and the needed security measurements are highlighted. Section 3 reviews some of the background knowledge used in this paper. Section 4 presents our investigation model and explains how it employs information available in the program’s source code to confirm that the program is actually used in the attack. Section 5 describes our experiments whereas our results are presented in Section 6. Section 7 presents our related work. Finally, our planned future work is presented in Section 8 whereas Section 9 concludes our findings.
Section snippets
CPS systems: New usage & security needs
The idea of Cyber–physicalProcesses (CPP) is not new. The term embedded systems is used, long before CPS, to describe engineered systems that combine physical parts of a system with a software that is built into it. Recently, this term is modernized to include the applications that are parts of aircrafts, autonomous cars, home appliances, weapons, robots, and more [11]. Hence, when such systems are closed boxes that do not expose their computing capabilities to the outside world, they are
Background
A software process may employ various variables. In OOP languages such as Java, these variables can be classified into class level and method level. Class level variables can be further categorized into instance and static. Most of the time, a variable’s type defines the duration of its value in RAM. For example, the values of static variables are allocated by the runtime system before instances (objects) are created. These variables might be initialized with default values whenever they are
Investigation model
Our investigation model aims at identifying the software that is used during the illegal attack on a CPS system and to confirm its definite usage. Fig. 1 shows a threat model that would be assumed by the DI, in which a software is allegedly used to organize the attack or to hide the invasion by applying any of the anti-forensic techniques [[44], [45], [46]].
The DI goal is to validate whether the subject software has been used during this attack. This validation can be reached by various means,
Experiments
Our experimentations explore the possibility of locating potential variables’ values, which are used within an object oriented program that is written in Java. The fundamental information from the source code and its object oriented principles are used to identify different execution states and potential values in the RAM dump of the used machine. These identified states can be used to evidence the software usage in a legal demonstration.
Results
All captured memory dumps are analyzed and a comparison is made between the findings of Java based source code related values from the program execution states in corresponding RAM dumps that are captured during various scenarios. These findings are compared on each of the investigated platforms; same program and execution scenario but different implementations of the JVM that are hosted on different platforms.
In particular, a comparison is made, from the MF point of view, between the memory
Related work
Many researchers are making use of existing forensic research in related areas such as cloud forensics, mobile forensics, virtualization forensics, and storage forensics in order to facilitate the forensics of CPS Systems [[22], [23], [47]]. Others, are focused on the forensics of a particular type of CPS systems. For example, Hahn et al. evaluated a smart grid security testbed, in which several potential attack scenarios are assumed to explore the security of the CPS system [48]. Zonouz et al.
Discussions and future work
In this paper, in order to facilitate the ability to find live evidence about the actual software usage that are used to organize an attack on a CPS system, experimentally we established the approach of utilizing potential variables’ values from the program’s source code and their associations with various in RAM program execution states to evidence the actual software usage. Based on the possible data-flow and control-flow of the subject program, we investigate an object oriented program that
Conclusion
Increasingly, our modernized aspects of life is depending on various Cyber–physical Systems (CPS). In the same time, the speed of securing these systems does not match the speed of our adaption of these CPS, which are vulnerable to be attacked and compromised by various means. This emphasizes the need to invest more in related research. The focus of this paper is the Memory Forensics and the post-mortem analysis that can be employed to investigate these attacks and help apprehend the criminals.
Ziad A. Al-Sharif is currently an assistant professor at Jordan University of Science and Technology, Irbid, Jordan. He joined the Department of Software Engineering in February of 2010. Dr. Al-Sharif received his Ph.D. degree in Computer Science in December of 2009 from the University of Idaho, USA. He also received his MS. degree in Computer Science in August of 2005 from New Mexico State University, USA. His research interests are in digital forensics, software engineering, cloud computing,
References (71)
- et al.
Smart cyber society: Integration of capillary devices with high usability based on cyber–physical system
Future Gener. Comput. Syst.
(2016) - et al.
Cybermatics: Cyber–physical–social–thinking hyperspace based science and technology
Future Gener. Comput. Syst.
(2016) - et al.
Advances in volatile memory forensics
Digit. Investig.
(2017) - et al.
Memory forensics: The path forward
Digit. Investig.
(2017) - et al.
Picking up the trash: Exploiting generational gc for memory analysis
Digit. Investig.
(2017) - et al.
Robust cyber–physical systems: Concept, models, and implementation
Future Gener. Comput. Syst.
(2016) - et al.
Mobile edge computing fog et al.: A survey and analysis of security threats and challenges
Future Gener. Comput. Syst.
(2018) - et al.
A survey on security control and attack detection for industrial cyber-physical systems
Neurocomputing
(2018) - et al.
Nonlane-discipline-based car-following model for electric vehicles in transportation- cyber-physical systems
IEEE Trans. Intell. Transp. Syst.
(2018) - et al.
Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy
Digit. Investig.
(2016)
Utilizing data lifetime of tcp buffers in digital forensics: Empirical study
Digit. Investig.
Cufa: A more formal definition for digital forensic artifacts
Digit. Investig.
Acquisition and analysis of compromised firmware using memory forensics
Digit. Investig.
Introduction to Software Testing
Forensic-by-design framework for cyber-physical cloud systems
IEEE Cloud Comput.
Smt-based observer design for cyber-physical systems under sensor attacks
ACM Trans. Cyber-Phys. Syst.
Cyber physical computing
Information and communications technologies for sustainable development goals: State-of-the-art, needs and perspectives
IEEE Commun. Surv. Tutor.
Reservoir computing meets smart grids: Attack detection using delayed feedback networks
IEEE Trans. Ind. Inf.
Big data meet green challenges: Big data toward green applications
IEEE Syst. J.
Big data meet green challenges: Greening big data
IEEE Syst. J.
Enabling cyber-physical communication in 5g cellular networks: challenges, spatial spectrum sensing, and cyber-security
IET Cyber-Phys. Syst.: Theory Appl.
Achieving sustainable ultra-dense heterogeneous networks for 5g
IEEE Commun. Mag.
Context-aware collect data with energy efficient in cyber–physical cloud systems
Future Gener. Comput. Syst.
Vehicular fog computing: Architecture, use case, and security and forensic challenges
IEEE Commun. Mag.
Smart grid forensic science: applications, challenges, and open issues
IEEE Commun. Mag.
Cyber-physical security of a smart grid infrastructure
Proc. IEEE
Safety and security in cyber-physical systems and internet-of-things systems
Proc. IEEE
Feature interaction augmented sparse learning for fast kinect motion detection
IEEE Trans. Image Process.
Bi-level semantic representation analysis for multimedia event detection
IEEE Trans. Cybern.
Cited by (38)
The effects of document's format, size, and storage media on memory forensics
2024, Forensic Science International: Digital InvestigationFool me once: A systematic review of techniques to authenticate digital artefacts
2023, Forensic Science International: Digital InvestigationForensic readiness of industrial control systems under stealthy attacks
2023, Computers and SecurityCitation Excerpt :To demonstrate a potential use-case of our approach, we consider tools that can perform live forensics in ICS, i.e., investigating potential attacks while the system is running. Due to the safety-criticality of ICS and the difficulty associated with shutting them down, methods for live forensics activities (Al-Sharif et al., 2018) have been proposed to avoid such difficulties. One important requirement for such methods is that they need to minimise interference with the safety-critical control operations (Eden et al., 2016).
Research on unsupervised feature learning for Android malware detection based on Restricted Boltzmann Machines
2021, Future Generation Computer SystemsCitation Excerpt :These threats have made Cybersecurity become one of the main concerns to be addressed by society [8]. In order to protect mobile users from attacks [9], different kinds of techniques have been researched, such as designing privacy aware Apps [10], analyzing the requested Permissions in apps [11,12] and researching malware detection method [13,14]. The anti-virus products, such as Norton, Lookout and Coodo Mobile security, mainly use signature-based matching methods to detect attacks [1].
A reputation score policy and Bayesian game theory based incentivized mechanism for DDoS attacks mitigation and cyber defense
2021, Future Generation Computer SystemsCitation Excerpt :We develop Bayesian pricing and auction mechanism where maliciousness can be rendered ineffective for regular users due to uncertainty about other user’s behaviour. Further, in our previous work [14], we have proposed a marginal utility based malicious user detection mechanism in which a user whose marginal utility is greater than the service provider’s utility is detected as malicious [15–18]. To extend this mechanism, we propose a reputation assessment and updating mechanism where payment and participation parameters are considered to quantify user’s reliability.
Blockchain-based authentication and authorization for smart city applications
2021, Information Processing and ManagementCitation Excerpt :In these cases, the supporting platforms must accomplish a high degree of security as mission-critical data being exchanged and stored, by avoiding unauthorized users to have access to their functionalities and/or data, and to avoid any information leakage. Several approaches have been proposed in order to provide the suitable security and protection degree for smart city solutions (Al-Sharif, Al-Saleh, Alawneh, Jararweh, & Gupta, 2020; Bhushan & Gupta, 2019; Li, Deng, Gupta, Wang, & Choi, 2019). In particular, this means that proper means to authenticate and authorize users must be implemented within all the main solutions, mainly compliant to the main standard, such as the XACML (Standard, 2005) in the FIWARE platform (Alonso et al., 2019).
Ziad A. Al-Sharif is currently an assistant professor at Jordan University of Science and Technology, Irbid, Jordan. He joined the Department of Software Engineering in February of 2010. Dr. Al-Sharif received his Ph.D. degree in Computer Science in December of 2009 from the University of Idaho, USA. He also received his MS. degree in Computer Science in August of 2005 from New Mexico State University, USA. His research interests are in digital forensics, software engineering, cloud computing, and collaborative virtual environments.
Mohammed I. Al-Saleh is an associate professor in the Computer Science Department at Jordan University of Science and Technology. He earned his Ph.D. in 2011 from The University of New Mexico (UNM) and his MSc degree from New Mexico State University (NMSU) in 2007. His research interests include digital forensics, cyber security, antivirus testing and evaluation, and dynamic information flow tracking.
Luay Alawneh is an assistant professor in the Department of Software Engineering at Jordan University of Science and Technology, Irbid, Jordan. His research interests are software engineering, software maintenance and evolution, big data analytics, parallel processing and high performance computing systems. Luay received a Ph.D. in electrical and computer engineering from Concordia University. In addition to his research achievements, Luay possesses excellent industrial experience gained from prestigious North American firms.
Yaser Jararweh received his Ph.D. in Computer Engineering from University of Arizona in 2010. He is currently an associate professor of Computer Science at Jordan University of Science and Technology, Jordan. He has co-authored about seventy technical papers in established journals and conferences in fields related to cloud computing, HPC, SDN and Big Data. He was one of the TPC Co-Chair, IEEE Globecom 2013 International Workshop on Cloud Computing Systems, and Networks, and Applications (CCSNA). He is a steering committee member for CCSNA 2014 and CCSNA 2015 with ICC. He is the General Co-Chair in IEEE International Workshop on Software Defined Systems SDS-2014 and SDS 2015. He is also chairing many IEEE events such as ICICS, SNAMS, BDSN, IoTSMS and many others. Dr. Jararweh served as a guest editor for many special issues in different established journals. Also, he is the steering committee chair of the IBM Cloud Academy Conference.
B.B. Gupta received his Ph.D. degree from Indian Institute of Technology Roorkee, India in the area of Information and Cyber Security. He spent more than six months in University of Saskatchewan (UofS), Canada to complete a portion of his research work. Dr. Gupta has excellent academic record throughout his carrier, was among the college toppers, during Bachelor’s degree and awarded merit scholarship for his excellent performance. In addition, he was also awarded Fellowship from Ministry of Human Resource Development (MHRD), Government of India to carry his Doctoral research work. He has published more than 70 research papers (including 01 book and 08 chapters) in International Journals and Conferences of high repute including IEEE, Elsevier, ACM, Springer, Wiley Inderscience, etc. He has visited several countries, i.e. Canada, Japan, Malaysia, Hong-Kong, etc to present his research work. His biography was selected and publishes in the 30th Edition of Marquis Who is Who in the World, 2012. He is also working principal investigator of various R&D projects. He is also serving as reviewer for Journals of IEEE, Springer, Wiley, Taylor & Francis, etc. Currently he is guiding 08 students for their Master’s and Doctoral research work in the area of Information and Cyber Security. He also served as Organizing Chair of Special Session on Recent Advancements in Cyber Security (SS-CBS) in IEEE Global Conference on Consumer Electronics (GCCE), Japan in 2014 and 2015.