A critical review of cyber-physical security for building automation systems

Li, Guowen; Ren, Lingyu; Fu, Yangyang; Yang, Zhiyao; Adetola, Veronica; Wen, Jin; Zhu, Qi; Wu, Teresa; Candan, K. Selcuk; O'Neill, Zheng

doi:10.1016/j.arcontrol.2023.02.004

A critical review of cyber-physical security for building automation systems

Journal Article · Thu Mar 09 00:00:00 UTC 2023 · Annual Reviews in Control

DOI:https://doi.org/10.1016/j.arcontrol.2023.02.004· OSTI ID:2331291

^[1]; Ren, Lingyu ^[2]; Fu, Yangyang ^[3]; Yang, Zhiyao ^[3]; Adetola, Veronica ^[4]; Wen, Jin ^[5]; Zhu, Qi ^[6]; Wu, Teresa ^[7]; Candan, K. Selcuk ^[7]; ^[3]

Texas A&M University, College Station, TX (United States); Texas A&M University
Raytheon Technologies Research Center, East Hartford, CT (United States)
Texas A&M University, College Station, TX (United States)
Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)
Drexel University, Philadelphia, PA (United States)
Northwestern University, Evanston, IL (United States)
Arizona State University, Tempe, AZ (United States)

Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.

View Accepted Manuscript (DOE)

Research Organization:: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Texas A & M Univ., College Station, TX (United States); Texas A&M Engineering Experiment Station, Bryan, TX (United States)

Sponsoring Organization:: USDOE; USDOE Office of Energy Efficiency and Renewable Energy (EERE), Energy Efficiency Office. Building Technologies Office

Grant/Contract Number:: AC05-76RL01830; EE0009150

OSTI ID:: 2331291

Alternate ID(s):: OSTI ID: 2439376
OSTI ID: 1975451
OSTI ID: 2567486

Report Number(s):: PNNL-SA--179500

Journal Information:: Annual Reviews in Control, Journal Name: Annual Reviews in Control Vol. 55; ISSN 1367-5788

Publisher:: International Federation of Automatic Control - ElsevierCopyright Statement

Country of Publication:: United States

Language:: English

References (51)

Extracting fuzzy attack patterns using an online fuzzy adaptive alert correlation framework Faraji Daneshgar, Fatemeh; Abbaspour, Maghsoud Security and Communication Networks, Vol. 9, Issue 14 https://doi.org/10.1002/sec.1483	journal	April 2016
Secure the Internet, one home at a time Xu, Kuai; Wang, Feng; Jia, Xiaohua Security and Communication Networks, Vol. 9, Issue 16 https://doi.org/10.1002/sec.1569	journal	July 2016
Leveraging Semantics for Actionable Intrusion Detection in Building Automation Systems Fauri, Davide; Kapsalakis, Michail; dos Santos, Daniel Ricardo Critical Information Infrastructures Security https://doi.org/10.1007/978-3-030-05849-4_9	book	December 2018
ZigBee Device Verification for Securing Industrial Control and Building Automation Systems Dubendorfer, Clay; Ramsey, Benjamin; Temple, Michael Critical Infrastructure Protection VII https://doi.org/10.1007/978-3-642-45330-4_4	book	January 2013
Leveraging operational technology and the Internet of things to attack smart buildings dos Santos, Daniel Ricardo; Dagrada, Mario; Costante, Elisa Journal of Computer Virology and Hacking Techniques, Vol. 17, Issue 1 https://doi.org/10.1007/s11416-020-00358-8	journal	June 2020
A robust control strategy for combining DCV control with economizer control Wang, Shengwei; Xu, Xinhua Energy Conversion and Management, Vol. 43, Issue 18 https://doi.org/10.1016/S0196-8904(01)00193-5	journal	December 2002
A review of machine learning in building load prediction Zhang, Liang; Wen, Jin; Li, Yanfei Applied Energy, Vol. 285 https://doi.org/10.1016/j.apenergy.2021.116452	journal	March 2021
Modeling and evaluation of cyber-attacks on grid-interactive efficient buildings Fu, Yangyang; O'Neill, Zheng; Yang, Zhiyao Applied Energy, Vol. 303 https://doi.org/10.1016/j.apenergy.2021.117639	journal	December 2021
Utilizing commercial heating, ventilating, and air conditioning systems to provide grid services: A review Fu, Yangyang; O'Neill, Zheng; Wen, Jin Applied Energy, Vol. 307 https://doi.org/10.1016/j.apenergy.2021.118133	journal	February 2022
Bibliographical review on reconfigurable fault-tolerant control systems Zhang, Youmin; Jiang, Jin Annual Reviews in Control, Vol. 32, Issue 2 https://doi.org/10.1016/j.arcontrol.2008.03.008	journal	December 2008
Resilient control under Denial-of-Service: Robust design Feng, Shuai; Tesi, Pietro Automatica, Vol. 79 https://doi.org/10.1016/j.automatica.2017.01.031	journal	May 2017
From information security to cyber security von Solms, Rossouw; van Niekerk, Johan Computers & Security, Vol. 38 https://doi.org/10.1016/j.cose.2013.04.004	journal	October 2013
Context aware intrusion detection for building automation systems Pan, Zhiwen; Hariri, Salim; Pacheco, Jesus Computers & Security, Vol. 85 https://doi.org/10.1016/j.cose.2019.04.011	journal	August 2019
Security of Building Automation and Control Systems: Survey and future research directions Graveto, Vitor; Cruz, Tiago; Simöes, Paulo Computers & Security, Vol. 112 https://doi.org/10.1016/j.cose.2021.102527	journal	January 2022
A flexible and generic functional mock-up unit based threat injection framework for grid-interactive efficient buildings: A case study in Modelica Fu, Yangyang; O’Neill, Zheng; Adetola, Veronica Energy and Buildings, Vol. 250 https://doi.org/10.1016/j.enbuild.2021.111263	journal	November 2021
A risk analysis of a smart home automation system Jacobsson, Andreas; Boldt, Martin; Carlsson, Bengt Future Generation Computer Systems, Vol. 56 https://doi.org/10.1016/j.future.2015.09.003	journal	March 2016
SDN-based cyber defense: A survey Yurekten, Ozgur; Demirci, Mehmet Future Generation Computer Systems, Vol. 115 https://doi.org/10.1016/j.future.2020.09.006	journal	February 2021
Active Model Discrimination with Applications to Fraud Detection in Smart Buildings * *This work is supported in part by an Early Career Faculty grant from NASA’s Space Technology Research Grants Program and DARPA grant N66001-14-1-4045. Harirchi, Farshad; Yong, Sze Zheng; Jacobsen, Emil IFAC-PapersOnLine, Vol. 50, Issue 1 https://doi.org/10.1016/j.ifacol.2017.08.1616	journal	July 2017
Understanding the physical and economic consequences of attacks on control systems Huang, Yu-Lun; Cárdenas, Alvaro A.; Amin, Saurabh International Journal of Critical Infrastructure Protection, Vol. 2, Issue 3 https://doi.org/10.1016/j.ijcip.2009.06.001	journal	October 2009
Passive Fault Tolerant Control of PEMFC air feeding system Lebreton, Carole; Damour, Cédric; Benne, Michel International Journal of Hydrogen Energy, Vol. 41, Issue 34 https://doi.org/10.1016/j.ijhydene.2016.06.210	journal	September 2016
Modeling, analyzing and predicting security cascading attacks in smart buildings systems-of-systems Hachem, Jamal EL; Chiprianov, Vanea; Babar, Muhammad Ali Journal of Systems and Software, Vol. 162 https://doi.org/10.1016/j.jss.2019.110484	journal	April 2020
Application of data-driven attack detection framework for secure operation in smart buildings Elnour, Mariam; Meskin, Nader; Khan, Khaled Sustainable Cities and Society, Vol. 69 https://doi.org/10.1016/j.scs.2021.102816	journal	June 2021
Two-Loop Robust Model Predictive Control for the Temperature Control of Air-Handling Units Huang, Gongsheng; Wang, Shengwei HVAC&R Research, Vol. 14, Issue 4 https://doi.org/10.1080/10789669.2008.10391026	journal	July 2008
Fault-tolerant optimal control of a building HVAC system Bengea, Sorin C.; Li, Pengfei; Sarkar, Soumik Science and Technology for the Built Environment, Vol. 21, Issue 6 https://doi.org/10.1080/23744731.2015.1057085	journal	March 2015
Study of Autoencoder Neural Networks for Anomaly Detection in Connected Buildings Legrand, Adrien; Niepceron, Brad; Cournier, Alain 2018 IEEE Global Conference on Internet of Things (GCIoT) https://doi.org/10.1109/GCIoT.2018.8620158	conference	December 2018
A Framework for Attack-Resilient Industrial Control Systems: Attack Detection and Controller Reconfiguration Paridari, Kaveh; O'Mahony, Niamh; El-Din Mady, Alie Proceedings of the IEEE, Vol. 106, Issue 1 https://doi.org/10.1109/JPROC.2017.2725482	journal	January 2018
Security and Privacy in Cyber-Physical Systems: A Survey of Surveys Giraldo, Jairo; Sarkar, Esha; Cardenas, Alvaro A. IEEE Design & Test, Vol. 34, Issue 4 https://doi.org/10.1109/MDAT.2017.2709310	journal	August 2017
The Evolution of Factory and Building Automation Sauter, Thilo; Soucek, Stefan; Kastner, Wolfgang IEEE Industrial Electronics Magazine, Vol. 5, Issue 3 https://doi.org/10.1109/MIE.2011.942175	journal	September 2011
Security in Building Automation Systems Granzer, Wolfgang; Praus, Fritz; Kastner, Wolfgang IEEE Transactions on Industrial Electronics, Vol. 57, Issue 11 https://doi.org/10.1109/TIE.2009.2036033	journal	November 2010
Critical State-Based Filtering System for Securing SCADA Network Protocols Nai Fovino, Igor; Coletta, Alessio; Carcano, Andrea IEEE Transactions on Industrial Electronics, Vol. 59, Issue 10 https://doi.org/10.1109/TIE.2011.2181132	journal	October 2012
Denial of Service Attacks on Network-Based Control Systems: Impact and Mitigation Long, M.; Wu, C. -H.; Hung, J. Y. IEEE Transactions on Industrial Informatics, Vol. 1, Issue 2 https://doi.org/10.1109/TII.2005.844422	journal	May 2005
A Taxonomy for the Security Assessment of IP-Based Building Automation Systems: The Case of Thread Liu, Yu; Pang, Zhibo; Dan, Gyorgy IEEE Transactions on Industrial Informatics, Vol. 14, Issue 9 https://doi.org/10.1109/TII.2018.2844955	journal	September 2018
Multilayer Data-Driven Cyber-Attack Detection System for Industrial Control Systems Based on Network, System, and Process Data Zhang, Fan; Kodituwakku, Hansaka Angel Dias Edirisinghe; Hines, J. Wesley IEEE Transactions on Industrial Informatics, Vol. 15, Issue 7 https://doi.org/10.1109/TII.2019.2891261	journal	July 2019
Resilient Model Predictive Control of Cyber–Physical Systems Under DoS Attacks Sun, Qi; Zhang, Kunwu; Shi, Yang IEEE Transactions on Industrial Informatics, Vol. 16, Issue 7 https://doi.org/10.1109/TII.2019.2963294	journal	July 2020
An Attack Surface Metric Manadhata, Pratyusa K.; Wing, Jeannette M. IEEE Transactions on Software Engineering, Vol. 37, Issue 3 https://doi.org/10.1109/TSE.2010.60	journal	May 2011
Model-Based Attack Detection and Mitigation for Automatic Generation Control Sridhar, Siddharth; Govindarasu, Manimaran IEEE Transactions on Smart Grid, Vol. 5, Issue 2 https://doi.org/10.1109/TSG.2014.2298195	journal	March 2014
On the security of security extensions for IP-based KNX networks Judmayer, Aljosha; Krammer, Lukas; Kastner, Wolfgang 2014 10th IEEE Workshop on Factory Communication Systems (WFCS 2014) https://doi.org/10.1109/WFCS.2014.6837593	conference	May 2014
Hardware and embedded security in the context of internet of things Kanuparthi, Arun; Karri, Ramesh; Addepalli, Sateesh Proceedings of the 2013 ACM workshop on Security, privacy & dependability for cyber vehicles https://doi.org/10.1145/2517968.2517976	conference	November 2013
Secure RTOS Architecture for Building Automation Wang, Xiaolong; Mizuno, Masaaki; Neilsen, Mitch Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or PrivaCy https://doi.org/10.1145/2808705.2808709	conference	October 2015
Hardware Trojans: Lessons Learned after One Decade of Research Xiao, K.; Forte, D.; Jin, Y. ACM Transactions on Design Automation of Electronic Systems, Vol. 22, Issue 1 https://doi.org/10.1145/2906147	journal	December 2016
Demand Response and Smart Buildings Qi, Junjian; Kim, Youngjin; Chen, Chen ACM Transactions on Cyber-Physical Systems, Vol. 1, Issue 4 https://doi.org/10.1145/3009972	journal	October 2017
Privacy-enhanced architecture for occupancy-based HVAC Control Jia, Ruoxi; Dong, Roy; Sastry, S. Shankar Proceedings of the 8th International Conference on Cyber-Physical Systems - ICCPS '17 https://doi.org/10.1145/3055004.3055007	conference	January 2017
Automatic Deployment of Specification-based Intrusion Detection in the BACnet Protocol Esquivel-Vargas, Herson; Caselli, Marco; Peter, Andreas Proceedings of the 2017 Workshop on Cyber-Physical Systems Security and PrivaCy https://doi.org/10.1145/3140241.3140244	conference	November 2017
Expat Yahyazadeh, Moosa; Podder, Proyash; Hoque, Endadul Proceedings of the 24th ACM Symposium on Access Control Models and Technologies https://doi.org/10.1145/3322431.3325107	conference	May 2019
Learning-based framework for sensor fault-tolerant building HVAC control with model-assisted learning Xu, Shichao; Fu, Yangyang; Wang, Yixuan Proceedings of the 8th ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation https://doi.org/10.1145/3486611.3486644	conference	November 2021
A survey of Cyber Attack Detection Strategies Raiyn, Jamal International Journal of Security and Its Applications, Vol. 8, Issue 1 https://doi.org/10.14257/ijsia.2014.8.1.23	journal	January 2014
Resilient Control in Cyber-Physical Systems: Countering Uncertainty, Constraints, and Adversarial Behavior Weerakkody, Sean; Ozel, Omur; Mo, Yilin Foundations and Trends® in Systems and Control, Vol. 7, Issue 1-2 https://doi.org/10.1561/2600000018	journal	January 2020
A Survey of Control Technologies in the Building Automation Industry Salsbury, Timothy I. IFAC Proceedings Volumes, Vol. 38, Issue 1 https://doi.org/10.3182/20050703-6-CZ-1902.01397	journal	January 2005
Securing SCADA Energy Management System under DDos Attacks Using Token Verification Approach Yang, Yu-Sheng; Lee, Shih-Hsiung; Chen, Wei-Che Applied Sciences, Vol. 12, Issue 1 https://doi.org/10.3390/app12010530	journal	January 2022
An Overview on Fault Diagnosis, Prognosis and Resilient Control for Wind Turbine Systems Gao, Zhiwei; Liu, Xiaoxu Processes, Vol. 9, Issue 2 https://doi.org/10.3390/pr9020300	journal	February 2021
Security and Availability Models for Smart Building Automation Systems Kharchenko, Vyacheslav; Ponochovnyi, Yuriy; Abdulmunem, Al-Sudani Mustafa Qahtan International Journal of Computing https://doi.org/10.47839/ijc.16.4.907	journal	December 2017

Similar Records

Development of A Hardware-In-the-Loop (HIL) Testbed for Cyber-Physical Security in Smart Buildings

Conference · Tue Feb 07 04:00:00 UTC 2023 · OSTI ID:2331282

Related Subjects

97 MATHEMATICS AND COMPUTING
Attack Detection and Defense
Attack detection and defense
Building Automation Systems
Building automation systems
Cyber Attacks
Cyber Vulnerabilities
Cyber attacks
Cyber vulnerabilities
Cyber-physical Security
Cyber-physical security
Resilient Control
Resilient control

A critical review of cyber-physical security for building automation systems

Citation Formats

References (51)

Similar Records

Related Subjects