|Project Title:||CRitical Infrastructure Security AnaLysIS|
|Project Reference:||FP7-SEC-2011-1 Grant Agreement 285477|
|Project Type:||Collaborative Project|
|Project Duration:||40 months from 01.05.2012 – 31.08.2015|
|Budget:||Total: 5,319,670 €, EC Funding: 3,424,124 €|
|Man month resources:||497 MM|
The CRISALIS project aims at providing new means to secure critical infrastructure environments from targeted attacks, carried out by resourceful and motivated individuals. The discovery of malware such as Stuxnet and Duqu showed that these threats are already a reality. Their success in infiltrating Critical Infrastructure environments is calling attention on the ineffectiveness of standard security mechanisms at detecting them. Stuxnet is believed to have been operating undetected for almost one year leveraging multiple vulnerabilities that were previously unknown, and has been discovered only as a consequence to an operational anomaly that triggered the attention of the field operators. This fact clearly shows that our methods to find vulnerabilities and detect ongoing or successful attacks in critical infrastructure environments are not sufficient.
CRISALIS focuses on these two aspects: detection of vulnerabilities and attacks in critical infrastructure environments. We focus on two different, yet interlinked, use cases that are typical for the power grid infrastructure: control systems based on SCADA protocols and the Advanced Metering Infrastructure. CRISALIS leverages the unique characteristics of critical infrastructure environments to produce novel practical mechanisms and techniques for their security assessment and protection. This is achieved by pursuing three main research objectives: (i) providing new methodologies and techniques to secure critical infrastructure systems; (ii) providing new tools to detect intrusions; (iii) developing new, more effective, techniques to analyze infected systems. Particular attention is paid to ensure the practical implementation of these techniques in real-world environments, and to minimize the impact on operations, goals which are attainable thanks to the direct involvement in the process of end users and device manufacturers who provide expertise and realistic test environments to validate the proposed methodologies.
- Securing the systems: we will devise new techniques and develop tools to facilitate the automated analysis of critical infrastructure environments and the discovery of possible threat vectors, and we will embed these techniques into a comprehensive and practical methodology for vulnerability discovery.
- Detecting intrusions: typical detection techniques, based on a full knowledge of an attack vector or of the characteristics of malware samples, are not suitable to the protection of critical infrastructure environments. This is mainly due to the difficulty in coping with the heterogeneity of protocols, interactions and devices typical of these systems. We will address these limitations, and build new detection techniques that succeed in detecting targeted, unknown threats addressing the specific challenges posed by these environments.
- Analyzing successful intrusions: the Stuxnet incident underlined serious challenges in the analysis and in-depth understanding of the consequences of an infection on a critical infrastructure device. We will address this need by devising new techniques to facilitate the "post-mortem" analysis of critical infrastructure environments and the involved devices. This includes methodologies for the detection of suspicious modifications to the devices, but also forensic analysis tools for the analysis of embedded devices typically used in these environments.
- Siemens AG (coordinator), Germany
- Chalmers Tekniska Hoegskola AB, Sweden
- Enel Ingegneria e Innovazione SpA, Italy
- Institut Eurecom, France
- Liander NV, the Netherlands
- SecurityMatters BV, the Netherlands
- Universitaet Ulm, Germany
- Twente Universiteit, the Netherlands