Over the recent years, cyber attacks have increased constantly. Attacks targeting sensors networks, or exploiting the growing number of networked devices, are becoming even more frequent. This has led to the need to nd a way to train the teams responsible for defending computer systems in order to make them able to respond to any threats quickly. The fact that it is impossible to carry out training operations directly on corporate networks or critical infrastructure has led to the birth of Cyber Ranges, virtual or hybrid systems that allow training in safe and isolated environments. In this paper we present a model for the implementation of a Hybrid Cyber-Range (HCR), based on the model of a real Water Supply System WSS). The HCR shall combine the dynamism and exibility of virtualised Cyber-Ranges (CR) and the realism of Cyber-Physical Systems (CPS).
a type of CR that integrates, within it, also real components used in ICS and critical
infrastructures, to increase its realism [
In this paper we present EVA, an Hybrid Cyber Range based on the model of a Water Supply System. The objective of EVA is to provide a realistic testbed, representing in the best way, and as faithfully as possible, a real Water Supply System. Moreover it shall also provides the exibility of a CR in deploying di erent scenarios and the possibility to easily test new products and/or solutions before adopting them in a real system. The paper is structured as follows: rst a brief overview on CRs developed by both industry and academy and the de nition of the various teams that interact with a CR. Then the model and implementation of EVA, the emulator of a real aqueduct, is presented, continuing with the introduction of the model adopted for upgrading EVA from a CPS to a HCR. Some improvements and issues to be addressed in the near future are eventually presented. 2 2.1
A Cyber Range (CR) is a platform that can provide advanced cyber-security training exercises
for university students and professionals, changing the way to approach cybersecurity2. In as
document of 2018 [
Three di erent types of CR can be identi ed: Physical Cyber Ranges : the testbed faithfully recreates a network or computing infrastructure, guaranteeing the highest level of loyalty, often using real components of the reference infrastructure. This typology is, on the one hand, the best for gaining experience and gathering results with the aim of improving the defences of a given infrastructure. On the other hand, it has the disadvantages of (i) being less exible, since a modi cation may require the reconstruction of the entire CR, and (ii) requiring a very expensive set-up process.
Virtual Cyber Ranges : in the testbed all the components of the reference infrastructure are simulated, using virtualisation technologies, to obtain testbeds of di erent complexity. The main advantage of this approach is that the components needed to build it (servers for hosting virtual machines) can be easily found, at a relatively low cost, on the market. It is also possible, in this case, to get a high degree of exibility and scalability in changing the simulated environment. However, this approach has the disadvantage of not providing an experience very similar to the real one.
Hybrid Cyber Ranges : sometimes referred as Cyber-Physical Ranges, this typology is a hybrid of the two previous ones. It aims to combine the positive aspects of both approaches, having the exibility of a virtual environment with the realism resulting from the use of real-word hardware components of the reference infrastructure. 2.2
One of the most eminent and successful training activities that a Cyber-Range could o er is
the one in which it provides a battle eld where di erent teams oppose each other [
Blue Teams have the task of defending the scenario and have the mentality of the defenders
and are trained to detect, respond, and mitigate the attacks done by Red Teams. Members
of the Blue Team need to stop unauthorised or illegal activities by mitigating potential
vulnerabilities. The capabilities and expertises of Blue Team's strongly e ect the whole
exercise scenario [
White Team responsible for the design and construction of the scenario used for the exercises.
Moreover, the White Team acts as supervisor on exercises involving attack and defence paradigm, establishing the nal score. It is essential for the White Team to make sure that the exercise is conducted according to the scenario and according to the objective. Admin Team the administration team is responsible for the supervision of the entire cyber range, are in charge of monitoring the session and assigning scores to each team. Design Team is composed of the persons in charge of the design of the reference infrastructure on which the CR is based. 2.3 2.3.1
As far as Physical Cyber Ranges are concerned, it is very di cult to nd examples in literature of testbed with high level of delity with respect to the real-word target infrastructure, both because of the di culty of implementing this type of CRs and because the construction of such structures would often require the disclosure of business secrets and/or the precise topology of the internal network.
The most prominent and ambitious project of physical cyber range is Cybertropolis [
Ahmed et al. proposed a SCADA system testbed [
Aditya et al. proposed SWaT [
Virtual Cyber Ranges are the most common and used thanks to their exibility and relatively
low building and maintenance costs. KYPO Cyber Range is a Czech project [
The Michigan Cyber-Range4 is powered by Merit Network Network5, the nation's longestrunning research and education network. Above all, Michigan Cyber Range is the largest unclassi ed network, especially designed for cybersecurity training and It o ers courses including Penetration Testing, Ethical Hacking, Vulnerability Assessment, Secure Coding, and Digital and Networking Forensics.
Emulab and DETER are two of the most renowned emulation facilities for Virtual Cyber
Ranges developed in academia for performing cyber-security training and exercises. Emulab
[
DARPA (Defence Advanced Research Project Agency) commenced the (U.S.) National
Cyber-Range (NCR) plan to design the architecture and software tools required for a secure,
self-contained cyber testing amenity [
The Cisco Cyber Range [
The Hybrid Cyber Range, as mentioned above, aims to combine the versatility of virtualisation
with the realism of real components of the infrastructure that has to be recreated. There
are several projects in this eld, both academic and industrial, usually focused on critical
infrastructures such as Water Supply Systems and Power Plants [
In 2016 Ashok et al. proposed a testbed for assessing security of Smart Grid called
PowerCyber [
Tebekaemi et al. proposed an hybrid testbed [
Our goal is to implement a Hybrid Cyber Range (HCR) through which we can, on the one hand, assess the security of a CPS and, on the other hand, make serious gaming events and/or training teams while combining the exibility of a CR and the realism of a CPS.
As a rst step, EVA, an emulator of a real Water Supply System, was built. It is a fully functional small scale model of a WSS composed of industrial components and devices to achieve the maximum realism (see Section 4). Then was necessary to equip EVA with additional feature to make it able to serve also as a Cyber Range (CR). The HCR based on EVA must have some speci c features and need to be used in di erent context:
Training the Blue Teams: Blue Teams need isolated and secure environments where they can be trained. It is often unfeasible to use the real network or infrastructure for training activities. But the team responsible for defending the corporate infrastructure or network must be able to respond to real threats quickly. For this reason our HCR must have the necessary exibility to support the development of di erent attack scenarios while maintaining a good realism to have an experience of use and interaction as close as possible to the real one.
Training the Design Team: the Design Team can take advantage of the use of an HCR as this would give them the exibility to test new solutions before using them in the eld, having an isolated environment, but at the same time realistic and very similar to the real one.
Mock up: for our purposes it is necessary that the HCR is responsible for an easy and fast replacement and/or addition of new components and devices. This is because many companies, especially those operating in the eld of critical infrastructure, need a system with which to test new components before using them in the eld.
See Section 5 for more detail about EVA as a HCR. 4
EVA as a CPS
EVA (Emulatore di Vero Acquedotto - Emulator of a Real Aqueduct) is a CPS representing a functioning model of a real Water Supply System (WSS). Apart from the basic components such as tanks, pipes, pumps etc., EVA comprises sensors, actuators, communication protocol, and SCADA/ICS as a controller. The IT and OT part of EVA are composed of industrial components used in the real WSS, including the SCADA, but other component, such as pump and sensors, are low-quality equipment just used in this rst phase of building the model. The physical system was designed according to the architecture of a real WSS shown in Figure 17. As a general overview, the model works in the following way. The water is gathered from a source, that can represent a lake or aquifer. The water is then puri ed and collected in a dedicated storage system before being distributed to the customers (people houses, hospital or other infrastructures). 4.1
protocol has been chosen because is one of the most used in industrial facilities. The slaves Raspberry Pis are directly connected to sensors and actuators. In a rst phase data are collected and sent to the controller, in charge of analysing informations and decide whether or not to activate actuators and, thus, sending the appropriate commands to the slaves. Since sensor and actuators are low quality components the purpose of the Raspberry Pi slaves is to implement the communication protocol, Modbus, for communicating with the master controller. Finally, also the external environment, namely ecosystem, was implemented in order to give a more realistic view of the system. 5
In order to convert EVA into a Cyber Range, we must rst provide a way to quickly and easily change the behaviour of the system for representing di erent scenarios. In addition we should avoid changing a large part of the composition of the system to represent di erent scenarios, since this would require high maintenance costs. 5.1
EVA, as any other CPS, can be modelled splitting its architecture in term of several components, being them hardware or software; a possible model is shown in Figure 2, where components are exchanging information items (data, states, and controls) via proper physical communication infrastructures, wired or wireless, indi erently. In order to upgrade EVA to serve as a Cyber Range, a plenty of \ exibility" has to be introduced in its structure, to allow all the involved CR teams, 2, to properly work at their best. From both a conceptual and a practical point of view, the structure of Figure 2 has to be modi ed, inserting an additional Wrapper on top of each components, aimed at providing the possibility of dynamically changing the behaviour of the underlying component without physically modifying it. More details in the next section 5.2. In few words, through the use of the Wrapper it is possible to change the input and output of the given component, changing the source of these signal accordingly to the requirements of the scenario. 5.2
In the previous section the concept of Wrapper has been introduced. Within the CR model this new component will give the possibility to get the exibility required to serve di erent purposes, being them training, gaming or mock-up. As you can see in Figure 3, the Wrapper connects directly to all the inputs and outputs of each component of the CPS. It will therefore be possible to arbitrarily control the inputs and outputs of the component by choosing the appropriate source based on the scenario. In terms of model, the Wrapper is composed by: Wrapper Controlloer : this allows to control the behaviour of the Wrapper modifying the interconnection and data exchange inside it; Wrapper Data & Interconnection: managed by the Wrapper Controlle de nes how inputs and outputs of the component are routed.
Moreover Wrappers can communicate directly between each other by means of a dedicated interconnection, bypassing components or physical interconnections, this for allowing a greater exibility in the scenario de nition and implementation. In general the Wrapper can work in the following ways:
Normal Mode: the Wrapper does not interact with the component, not changing the component inputs and outputs in any way. This mode of operation can be used when it is necessary to study the properties of the CPS in general or the speci c component in particular to discover potential vulnerabilities.
Vulnerability Injection: the Wrapper takes control of the inputs and outputs of the component for inserting a vulnerability not previously present. This mode of operation is used by the White Team during the design and deployment of the scenario, this could mean, in practice, for example changing the software running on a speci c component. Vulnerability Remediation: the Wrapper take control only of the component inputs. In this mode of operation those who interact with the Wrapper, the Blu Team, should not notice its presence. The Blu Team will interact with the component, as it would do in a normal way, to be able to apply patches to vulnerabilities (perhaps introduced previously by the White Team).
Attack Injection: the Wrapper takes control of the component's inputs and outputs. The Red Team can use this mode to carry out a campaign of attacks. It is particularly useful in the training phase of the Blu Team as it allows the Red Team to simulate an attack even in the absence of a speci c vulnerability (think of the case of a sensor/actuator, the insertion of a vulnerability would require replacement of it). By modifying the component inputs, the Red Team will be able to simulate a direct attack on that component, while, by modifying the outputs appropriately, it will be able to simulate an attack starting from that component.
Behaviour Modi cation: the Wrapper takes control over the inputs and outputs of the connected component. The Design Team can take advantage of this mode to emulate new components or interconnections and protocols, bypassing the existing ones, thanks also to the direct interconnection between two Wrapper. It is therefore possible to test new solutions, both hardware and software, without the need to modify or rebuild the cyber physical model.
Mock Up: the exibility introduced by the use of Wrappers around each component can become useful also for mock-up operations. New components, being them hardware or software, can be easily added to the CPS without the need of rebuilding the entire system from scratch, while maintaining a good enough realism to gather information about the performance of the new components before adopting them in the real system. 6
Given the model proposed in the section 6.1 and the cyber physical model on which the proposed CR is based, we can now see some examples of attacks on similar systems and how these can be easily modelled with the proposed CR. 6.1
As reported in [
In the second case, instead, the Red Team will take control over the actuator inputs (Figure 4) sending, then, arbitrary command bypassing the ones coming from the central control unit.
In Section 5 the model for the Hybrid Cyber Range EVA has been presented. The work is still in development but it is possibile to identify which are the key issues to address during the project development.
The CINI Cybersecurity National Laboratory11 has started CyberRange.IT: a national project for creating a platform for the development of the future Italian cybersecurity community. This platform is a network of nodes distributed throughout the national territory and each specialized on di erent vertical domains. Each node must o er its users the facilities for learning, carrying out research, and practical training with cyber threats and challenges originated from the real world. EVA, within this project, must provide a testbed representing a Water Supply Systems.
Is therefore crucial that the HCR can be remotely accessible and can provide all the
functionalities to be interconnected with other CR to create a network of distributed testbed. Another
important aspect to be considered is the integration of an orchestrator, to manage the Wrapper
functionalities, for scenario deployment. In this case, as shown in [
In this paper we have presented a model of Hybrid Cyber Range with the aim of obtaining a system that is exible in its use but realistic. The model presented is valid for any CPS that wants to be transformed into HCR. In this speci c case, the modeling was based on EVA, a model of WSS.
Thanks to the introduction of a Wrapper for each component it has been possible to expand the functionality of EVA, while avoiding re-building the system, making it possible to deploy di erent scenarios for competitions or training.