Milos Manic, Ph.D.

Professor of Computer Science VCU College of Engineering

Richmond VA

Milos Manic, Ph.D., FIEEE., is director of VCU's Cybersecurity Center and an expert in cybersecurity and critical infrastructure protection.

Contact

VCU College of Engineering
View more experts managed by VCU College of Engineering

View all Experts

Spotlight

Aug 1, 2019

3 min

Cybersecurity expert aims to protect the power grid by hacking would-be hackers

For hackers, the U.S. energy grid is a treasure trove of classified information with vast potential for profit and mayhem. To be effective, the power grid’s protection system has to be a bit like a hacker: highly intelligent, agile and able to learn rapidly. Milos Manic, Ph.D., professor of computer science and director of VCU’s Cybersecurity Center, along with colleagues at the Idaho National Laboratory (INL), has developed a protection system that improves its own effectiveness as it watches and learns from those trying to break into the grid. The team’s Autonomic Intelligent Cyber Sensor (AICS) received an R&D 100 Award for 2018, a worldwide recognition of the year’s most promising inventions and innovations. “An underground war of many years” Manic calls foreign state actors’ ongoing attempts to infiltrate the power grid — and efforts to thwart them — “an underground war of many years.” These criminals aim to enter critical infrastructures such as energy systems to disrupt or compromise codes, screens login information and other assets for future attacks. The nightmare result would be an infrastructure shutdown in multiple locations, a so-called “Black Sky” event that would erase bank accounts, disable cell phones and devastate the economy. In that scenario, engineers would have less than 72 hours to restore the grid before batteries, food supplies, medicine and water run out. With high stakes and increasingly sophisticated attackers, artificial intelligence and machine learning are key to respond to the challenges of protecting the grid’s interconnected systems, according to Manic. “Hackers are much smarter than in the past. They don’t necessarily look at one particular component of the system,” Manic said. “Often they can fool the system by taking control of the behavior of two different components to mask their attack on a third.” A nervous system for the power grid Using artificial intelligence algorithms, AICS can look holistically at an array of interconnected systems including the electrical grid and adapt continually as attacks are attempted. It is inspired by the body’s autonomic nervous system, the largely unconscious functions that govern breathing, circulation and fight-or-flight responses. Once installed, AICS acts as a similar “nervous system” for a power grid, silently monitoring all of its components for unusual activity — and learning to spot threats that were unknown when it was first installed. To “hack” the hacker, AICS often deploys honeypots, shadow systems that appear to be legitimate parts of the grid but that actually divert, trap and quarantine malicious actors. These honeypots allow asset owners to gather information that can help identify both a threat and a potentially compromised system. “Honeypots can make a hacker think he has broken into a real system,” Manic said. “But if the hacker sees that the ‘system’ is not adequately responding, he knows it’s a honeypot.” For this reason, the system’s honeypots are also intelligently updating themselves. Manic developed AICS with his INL colleagues Todd Vollmer, Ph.D., and Craig Rieger, Ph.D. Vollmer was Manic’s Ph.D. student at the University of Idaho. The AICS team formed eight years ago, and Manic continued to work on the project when he came to VCU in 2014. He holds a joint appointment with INL.

Media

Social

Industry Expertise

Computer Software

Education/Learning

Research

Areas of Expertise

Computational Intelligence Techniques (Machine Learning) with Applications in Energy Cybersecurity and Human Machine Interfaces

Software Defined Networks

Fuzzy Neural Data Mining Techniques

Energy Security

Human-machine Interfaces

Accomplishments

Fellow of the Outstanding Foreign Scholar Program

The Brain Korea 21 Chungbuk Information Technology Center at Chungbuk National University, 2008

Best Young Faculty Award

University of Idaho, 2008 – 2009 Academic Year

IEEE IES 2012 J. David Irwin Early Career Award

for “Outstanding research contribution in computational intelligence and its applications in energy related problems, network security and infrastructure protection, and robotics”.

Education

University of Idaho

Ph.D.

Computer Science

2003

University of Nis

M.Sc.

Computer Science

1996

Media Appearances

AI in Cybersecurity: Balancing Digital Transformation and Trust - Ep. 23

Forcepoint online

2019-03-20

In this week's episode, Milos Manic, professor of computer science and director of the Virginia Commonwealth University's Cybersecurity Center joins the podcast to discuss the Autonomic Intelligent Cyber Sensor (AICS) he and his team have developed with funding from the Department of Energy to detect intruders, isolate them and even possibly retaliate against them.

Cybersecurity system evolves as it watches and learns from would-be hackers

Phys.org online

2019-01-16

Milos Manic, Ph.D., professor of computer science in the Virginia Commonwealth University College of Engineering and director of VCU's Cybersecurity Center, along with colleagues at the Idaho National Laboratory, has developed a protection system that improves its own effectiveness as it watches and learns from those trying to break into the grid.

Manic calls ongoing attempts to infiltrate the power grid—and efforts to thwart them—"an underground war of many years."

With high stakes and increasingly sophisticated attackers, artificial intelligence and machine learning are key to respond to the challenges of protecting the grid's interconnected systems, Manic said.

"Hackers are much smarter than in the past. They don't necessarily look at one particular component of the system," Manic said. "Often, they can fool the system by taking control of the behavior of two different components to mask their attack on a third."

"Honeypots can make a hacker think he has broken into a real system," Manic said. "But if the hacker sees that the 'system' is not adequately responding, he knows it's a honeypot." For this reason, the system's honeypots are also intelligently updating themselves.

Manic developed AICS with his Idaho National Laboratory colleagues Todd Vollmer, Ph.D., and Craig Rieger, Ph.D. The AICS team formed eight years ago, and Manic continued to work on the project when he came to VCU in 2014. He holds a joint appointment with Idaho National Laboratory.

INL takes four R&D 100 Awards at annual banquet

East Idaho News.com online

2018-11-25

Researchers Todd Vollmer, Craig Rieger and Milos Manic won with Autonomic Intelligent Cyber Sensor (AICS), an artificial intelligence breakthrough that can protect the nation’s critical infrastructure from devastating cyberattack.

Show All +

Selected Articles

Autonomic Intelligent Cyber-Sensor to Support Industrial Control Network Awareness

IEEE Transactions on Industrial Informatics

2013

The proliferation of digital devices in a networked industrial ecosystem, along with an exponential growth in complexity and scope, has resulted in elevated security concerns and management complexity issues. This paper describes a novel architecture utilizing concepts of autonomic computing and a simple object access protocol (SOAP)-based interface to metadata access points (IF-MAP) external communication layer to create a network security sensor. This approach simplifies integration of legacy software and supports a secure, scalable, and self-managed framework. The contribution of this paper is twofold: 1) A flexible two-level communication layer based on autonomic computing and service oriented architecture is detailed and 2) three complementary modules that dynamically reconfigure in response to a changing environment are presented. One module utilizes clustering and fuzzy logic to monitor traffic for abnormal behavior. Another module passively monitors network traffic and deploys deceptive virtual network hosts. These components of the sensor system were implemented in C++ and PERL and utilize a common internal D-Bus communication mechanism. A proof of concept prototype was deployed on a mixed-use test network showing the possible real-world applicability. In testing, 45 of the 46 network attached devices were recognized and 10 of the 12 emulated devices were created with specific operating system and port configurations. In addition, the anomaly detection algorithm achieved a 99.9% recognition rate. All output from the modules were correctly distributed using the common communication structure.

Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

IEEE Transactions on Industrial Informatics

2014

A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% of the monitored emulated devices.

FN-DFE: Fuzzy-Neural Data Fusion Engine for Enhanced Resilient State-Awareness of Hybrid Energy Systems

IEEE Transactions on Cybernetics

2014

Resiliency and improved state-awareness of modern critical infrastructures, such as energy production and industrial systems, is becoming increasingly important. As control systems become increasingly complex, the number of inputs and outputs increase. Therefore, in order to maintain sufficient levels of state-awareness, a robust system state monitoring must be implemented that correctly identifies system behavior even when one or more sensors are faulty. Furthermore, as intelligent cyber adversaries become more capable, incorrect values may be fed to the operators. To address these needs, this paper proposes a fuzzyneural data fusion engine (FN-DFE) for resilient state-awareness of control systems. The designed FN-DFE is composed of a three-layered system consisting of: 1) traditional threshold based alarms; 2) anomalous behavior detector using self-organizing fuzzy logic system; and 3) artificial neural network-based system modeling and prediction. The improved control system stateawareness is achieved via fusing input data from multiple sources and combining them into robust anomaly indicators. In addition, the neural network-based signal predictions are used to augment the resiliency of the system and provide coherent state-awareness despite temporary unavailability of sensory data. The proposed system was integrated and tested with a model of the Idaho National Laboratory's hybrid energy system facility known as HYTEST. Experiment results demonstrate that the proposed FNDFE provides timely plant performance monitoring and anomaly detection capabilities. It was shown that the system is capable of identifying intrusive behavior significantly earlier than conventional threshold-based alarm systems.

Building Energy Management Systems: The Age of Intelligent and Adaptive Buildings

IEEE Industrial Electronics Magazine

2016

Building automation systems (BAS), or building control systems (BCS), typically consist of building energy management systems (BEMSs), physical security and access control, fire/life safety, and other systems (elevators, public announcements, and closed-circuit television). BEMSs control heating, ventilation, and air conditioning (HVAC) and lighting systems in buildings; more specifically, they control HVAC's primary components such as air handling units (AHUs), chillers, and heating elements. BEMSs are essential components of modern buildings, tasked with seemingly contradicting requirements?minimizing energy consumption while maintaining occupants? comfort [1]. In the United States, about 40% of total energy consumption and 70% of electricity consumption are spent on buildings every year. These numbers are comparable to global statistics that about 30% of total energy consumption and 60% of electricity consumption are spent on buildings. Buildings are an integral part of global cyber-physical systems (smart cities) and evolve and interact with their surroundings. As buildings undergo years of exploitation, their thermal characteristics deteriorate, indoor spaces (especially in commercial buildings) get rearranged, and usage patterns change. In time, their inner (and outer) microclimates adjust to changes in surrounding buildings, overshadowing patterns, and city climates, not to mention building retrofitting. Thus, even in cases of ideally designed BEMS/HVAC systems, because of ever-changing and uncertain indoor and outdoor environments, their performance frequently falls short of expectations. Unfortunately, the complexity of BEMSs, large amounts of constantly changing data, and evolving interrelations among sensor feeds make identifying these suboptimal behaviors difficult. Therefore, traditional data-mining algorithms and data-analysis tools are often inadequate.This article provides an overview of issues related to modern BEMSs with a multitude of (often conflicting) requirements. Because of massive and often incomplete data sets, control, sensing, and the evolving nature of these complex systems, computational intelligence (CI) techniques present a natural solution to optimal energy efficiency, energy security, and occupant comfort in buildings. The article further presents an overall architecture where CI can be used in BEMSs and concludes with a case study of the practical applications of using CI techniques in the BEMS domain.