◇ OpenCyber Academy
Doctoral research · Chapter 3 · English

Chapter 3 — Original contribution proposal

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Original contribution proposal

Lesson map

Lesson 03 published. Map, example, EX015.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["3.1 Types of contribution"]
  N2["3.2 The mechanism as a physical invariant"]
  N3["3.3 Attacker model"]
  N4["3.4 Hypotheses and thresholds"]
  N5["3.5 Baselines and rivals"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX015"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["3.1 Types of contribution"]
  N2["3.2 The mechanism as a physical invariant"]
  N3["3.3 Attacker model"]
  N4["3.4 Hypotheses and thresholds"]
  N5["3.5 Baselines and rivals"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX015"]

[Learning outcomes and connection]
    |
    v
[3.1 Types of contribution]
    |
    v
[3.2 The mechanism as a physical invariant]
    |
    v
[3.3 Attacker model]
    |
    v
[3.4 Hypotheses and thresholds]
    |
    v
[3.5 Baselines and rivals]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX015]

Learning outcomes and connection

After this chapter you can (1) choose the type of contribution your thesis makes, (2) express a detection mechanism as a physical invariant, (3) define an explicit attacker model, (4) state hypotheses with thresholds and rivals, and (5) predeclare the conditions under which your contribution fails. It turns the gap of Chapter 2 into a study that Chapter 4 can pilot.

3.1 Types of contribution

An OT security thesis can contribute a mechanism (a new detector or protection), a measurement (a way to quantify impact or exposure), an empirical finding (how operators or plants actually behave), or a validated principle (a design rule that holds across contexts). The Setpoint Study contributes a measurement-backed comparison: it does not invent the CUSUM test (Page, 1954) or residual-based detection (surveyed by Giraldo et al.); it tests when a cross-sensor invariant helps against a specific, documented adversary goal — manipulation of view — and quantifies where it stops helping. Honest positioning of this kind is a strength in a defense, not a weakness.

3.2 The mechanism as a physical invariant

Plant A's tank obeys a discrete mass balance: next level = level + inflow − outflow, with outflow ≈ 0.02 × level through a fixed orifice in the synthetic model (equilibrium 50 units when inflow is 1.0). A level transmitter and a flow meter measure different quantities produced by the same physics. If an attacker replays old level readings while forcing the pump, the level estimate predicted from the flow meter diverges from the reported level. The residual r = reported level − predicted level should be near zero under normal operation and drift away under that attack. A CUSUM accumulates residual magnitude above an allowance k and alarms when the sum exceeds a threshold h; it is designed to catch small persistent shifts that a fixed band misses.

The invariant has an assumption written into it: the flow meter is honest. If the attacker controls both sensors (or the PLC that reports them), the invariant can be satisfied by a consistent lie. Stating this assumption is the beginning of the attacker model.

3.3 Attacker model

Write the model as capabilities, knowledge and goal:

Element Setpoint Study assumption
Capabilities Write access to the pump command and the level reading on the SCADA link (consistent with ATT&CK for ICS Modify Parameter and Spoof Reporting Message); class A: level sensor only; class B: level and flow sensors.
Knowledge Knows the band alarm limits; for class B also knows the detector.
Goal Raise the true level while keeping displayed values normal (manipulation of view).
Out of scope Compromise of the mechanical float valve; physical tampering.

3.4 Hypotheses and thresholds

Thresholds are justified, not decorative: 60 steps corresponds, in the synthetic time base, to the time the overfill takes to reach half of the margin to the high-high trip. H4 is a hypothesis you want to be able to confirm: a method whose limits are measured is more useful than one whose limits are unknown.

3.5 Baselines and rivals

The baselines are (a) the band alarm that a plant already has, (b) a network detector that flags any write to the level register — trivially effective if writes are rare, useless if the attacker replays at the sensor — and (c) an oracle with access to true level, giving the best possible delay. Rival explanations for any CUSUM advantage include threshold tuning on test data, a simulator that is too clean, and attack magnitudes chosen to suit the method. Each rival gets a test in Chapter 4 or 5.

3.6 Worked example and Lab 3

Lab 3 implements the model and both detectors for 100 seeded runs per condition.

# Lab 3 - Setpoint Study (synthetic): fixed-band alarm vs. physics-residual CUSUM on one tank.
# Python 3 standard library only. Attack: pump forced to over-fill while the level sensor replays
# nominal values ("replay"); variant "replay+flow" also spoofs the inflow meter.
import random

def run(seed, attack, detector, steps=600, onset=300):
    rng = random.Random(seed)
    true_level, s, first_alarm, max_dev = 50.0, 0.0, None, 0.0
    est = 50.0
    for t in range(steps):
        inflow = 1.0 + rng.gauss(0, 0.05)
        if attack and t >= onset:
            inflow += 0.05                      # forced pump: hidden extra inflow
        true_level += inflow - 0.02 * true_level
        level_meas = true_level + rng.gauss(0, 0.3)
        flow_meas = inflow + rng.gauss(0, 0.02)
        if attack and t >= onset:
            level_meas = 50.0 + rng.gauss(0, 0.3)   # replayed nominal level
            if attack == "replay+flow":
                flow_meas = 1.0 + rng.gauss(0, 0.02)
        est = est + flow_meas - 0.02 * est      # mass-balance prediction from flow meter
        if detector == "band":
            hit = abs(level_meas - 50.0) > 1.5
        else:
            s = max(0.0, s + abs(level_meas - est) - 0.6)
            hit = s > 6.0
        if hit and first_alarm is None:
            first_alarm = t
        if t >= onset:
            max_dev = max(max_dev, true_level - 50.0)
    return first_alarm, max_dev

for det in ("band", "cusum"):
    fa = sum(run(k, None, det)[0] is not None for k in range(100))
    for atk in ("replay", "replay+flow"):
        res = [run(k, atk, det) for k in range(100)]
        hits = [a - 300 for a, _ in res if a is not None and a >= 300]
        delay = f"{sum(hits)/len(hits):.1f}" if hits else "n/a"
        print(f"{det:5s} {atk:11s} false_alarm_runs={fa}/100 detected={len(hits)}/100 "
              f"mean_delay={delay} worst_true_overfill={max(d for _, d in res):.2f}")

Expected output:

band  replay      false_alarm_runs=9/100 detected=0/100 mean_delay=n/a worst_true_overfill=3.36
band  replay+flow false_alarm_runs=9/100 detected=0/100 mean_delay=n/a worst_true_overfill=3.26
cusum replay      false_alarm_runs=0/100 detected=100/100 mean_delay=31.8 worst_true_overfill=3.36
cusum replay+flow false_alarm_runs=0/100 detected=0/100 mean_delay=n/a worst_true_overfill=3.26

Reading the output against the hypotheses: H1 is supported in the model (100/100, delay 31.8 versus 0/100); H2 is supported (0 versus 9 false-alarm runs — the narrow ±1.5 band fires on noise); H4 is confirmed (class B evades completely). "Worst true overfill" is the maximum over the whole attack window, so H3 requires a separate measurement of overfill at the alarm time — an exercise below. All numbers are properties of a synthetic model, not of any plant.

3.7 Common errors and limits

Claiming a mechanism is novel when only its application is; omitting the honest-sensor assumption; choosing attack magnitudes after seeing detector behaviour; having no condition under which the hypothesis fails.

Each of these errors has a visible symptom in a proposal: a contribution sentence that claims to invent CUSUM, an attacker model without a class B, an attack gain changed after Lab 3 was run, or a hypothesis list without H4. Read the proposal for those symptoms before sending it to the committee, and fix them while the study is still cheap to change.

Exercises — chapter 3

Chapter synthesis

A strong proposal positions itself honestly, expresses the mechanism as a physical invariant, makes the honest-sensor assumption explicit through an attacker model, and predeclares hypotheses — including the one that marks where the contribution fails.

Continue studying — chapter 03 of 08

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →