1. Michigan Technological University
Analysis of Production Data Manipulation Attacks in Petroleum Cyber-Physical Systems
Professor Shiyan Hu
Michigan Technological University

2. Petroleum System Needs CAD
“The revolution in digital technologies could well transform the dynamics of world oil supply at a time when the industry faces major choices on investment.”
Daniel Yergin, Chair
Cambridge Energy Research Associates (CERA) 2

3. From Exploration To Production3

4. Petroleum CPS Data Collection Visualization Data Processing Device
Reservoir
Oil Well
Data Collection
Production
data
Visualization
Data Processing
Analysis
Simulation
Optimization
Network
Control network 4

5. Simplified View of Oil Production: Water-In-Oil-Out
Site
Water Injection
Site
Water Pipe
Oil Pipe
Oil Well
Water Well 5

6. Which Site to Choose? 6 Oil Production Site Water Injection Site
Water Pipe
Oil Pipe
Oil Well
Water Well 6

7. In Practice 7

8. Where is the oil and how fast should we inject water?
We Want To Model Wells
Where is the oil and how fast should we inject water? 8

9. Reservoir Modeling of Liquid Flow
How much incoming flow (oil, gas, and water) v.s. how much outgoing flow per square
Rock porosity ɸ and permeability K 9

10. History Matching Underground geographical properties are complicated
Modeling parameters rock porosity ɸ and permeability K are difficult to obtain
Probing method cannot detect everywhere in the reservoir
One can only estimate ɸ and K using historical production data 10

11. The History Matching Flow
Start with initial parameters
WCT: water cut or water over total liquid per volume, and large value reduces benefit
GOR: gas oil ratio, or gas over oil per volume, and large value leads to safety issues
BHP: bottom hole pressure, and large value leads to safety issues
Accurate Model
Production Optimization
Yes
Update Model Parameters
Machine Learning
Modeling
Small? No
Mismatch between simulated production data and historical production data? 11

12. TCAD16: Reduce PDE to The Connectivity Based Capacitive Model
Pressure terms
Production data terms
Interwell Connectivity 12

13. Hack The Petroleum CPS Cyberattack Production Data Visualization
Data Processing
Device
Analysis
Simulation
Reservoir
Production
data
Optimization
Oil Well
Network
Control network 13

14. Impact of Cyberattacks
The flow tries to minimize the mismatch to the attacked production data
Yes
Update Model Parameters
Machine Learning
Modeling
Satisfied? No
Inaccurate Model
Refined Model
Attacked Data
Damaged Production
Production Optimization 14

15. What is Worst-Case Impact?
Maximize mismatch between the actual production and the simulated production.
This is difficult as it involves PDE solving.
Optimize the cyberattack strategy from the hacker’s perspective through manipulating the field data collected at the production wells such that solving PDE generates the most inaccurate petroleum reservoir model
are true values of BHP, GOR and WCT，
are simulated values at well I, respectively. 15

16. Model Reference Adaptive Search (MRAS)
𝑚𝑎𝑥 𝑥∈𝐷 𝑓 𝑥 [𝑀𝑖𝑠𝑚𝑎𝑡𝑐ℎ]
𝛿 𝑟 =𝑃 𝑓 𝑋 ≥𝑟
𝑔 𝑥 𝑑𝑒𝑛𝑜𝑡𝑖𝑛𝑔 𝑡ℎ𝑒 𝑃𝐷𝐹 𝑜𝑓 𝑃𝐷𝐸 𝑚𝑜𝑑𝑒𝑙 𝑝𝑎𝑟𝑎𝑚𝑒𝑡𝑒𝑟 𝑠𝑒𝑡𝑡𝑖𝑛𝑔𝑠
𝑋 𝑏𝑒𝑖𝑛𝑔 𝑎 𝑠𝑒𝑡 𝑜𝑓 𝑠𝑎𝑚𝑝𝑙𝑒𝑠 𝑔𝑒𝑛𝑒𝑟𝑎𝑡𝑒𝑑 𝑎𝑐𝑐𝑜𝑟𝑑𝑖𝑛𝑔 𝑡𝑜 𝑔(𝑥) ?
𝑚𝑖𝑛 𝑟
𝑠.𝑡. 𝛿 𝑟 →0
𝛿 𝑟 →0 means that r is an upper bound of f(x)
𝑔 𝑥 𝑐𝑜𝑛𝑣𝑒𝑟𝑔𝑒𝑠 𝑡𝑜 𝑡ℎ𝑒 𝑜𝑝𝑡𝑖𝑚𝑢𝑚 𝑤𝑖𝑡ℎ →0 𝑣𝑎𝑟𝑖𝑎𝑛𝑐𝑒 16

17. Estimating δ(r) Importance Sampling
𝑀𝑜𝑛𝑡𝑒 𝐶𝑎𝑟𝑙𝑜 𝑠𝑖𝑚𝑢𝑙𝑎𝑡𝑖𝑜𝑛 𝑡𝑜 𝑒𝑠𝑡𝑖𝑚𝑎𝑡𝑒 𝛿 𝑟 ?
𝑊ℎ𝑒𝑛 𝛿 𝑟 →0, 𝑓 𝑥 ≥𝑟 𝑖𝑠 𝑎 𝑟𝑎𝑟𝑒 𝑒𝑣𝑒𝑛𝑡
𝑓 𝑥 a 𝑟
Importance Sampling 17

18. MRAS Details Initialization Sample Generation Evaluation Update 18
𝑁 𝜔 = 𝑁( 𝜇 𝐵𝐻𝑃,𝜔 , 𝜎 𝜔 2 , 𝐵𝐻𝑃 ) 𝑁( 𝜇 𝐺𝑂𝑅,𝜔 , 𝜎 𝜔 2 , 𝐺𝑂𝑅 ) 𝑁( 𝜇 𝑊𝐶𝑇,𝜔 , 𝜎 𝜔 2 , 𝑊𝐶𝑇 )
𝑆={ 𝑆 1 , 𝑆 2 ,⋯, 𝑆 𝑆 }
𝑆 𝑖 = 𝛽 𝜔 𝑖 , 𝛾 𝜔 𝑖 , 𝜔 𝜔 𝑖 ∀𝜔∈[1,𝑊]
𝑔 𝑗 =( 𝜙 𝑗 , 𝑘 ℎ 𝑗 , 𝑘 𝑣 𝑗 )
𝑎 𝑖 = 𝑗 ( 𝜙 𝑗 − 𝜙 𝑡 𝑗 + 𝑘 ℎ 𝑗 − 𝑘 ℎ,𝑡 𝑗 +| 𝑘 𝑣 𝑗 − 𝑘 𝑣,𝑡 𝑗 |)
𝜇 𝐵𝐻𝑃 ′ = 𝜇 𝐵𝐻𝑃,𝜔 + 𝑖=1 𝑘 ( 𝜇 𝐵𝐻𝑃,𝜔 − 𝛽 𝜔 𝑖 ) 𝑘
𝜎 𝜔 ′ = 𝜎 𝜔 ×0.9
Initialization
Sample Generation
Evaluation
Update 18

19. Cyberattack Defense
Markov Decision Process (MDP) based technique is used to analyze and correct the attacked data.
It models the interactions among states, actions and rewards. 𝑠 𝑠′
s′′
𝑠′′
𝑠′′′
Discount Factor: 0.5
×0.5 for 3pm
× 0.25
for 4pm
× 0.125
for 5pm
>
<
𝑅 0
𝑅 1
𝑅 2
𝑅 3
×1 for 2pm
𝑎 0
𝑎 1 19

20. Experimental Setup
The proposed approach has been applied to the testcase PUNQ-S3 which is based on an industrial petroleum field. The PUNQ-S3 testcase has five layers, and in each layer there are 19x28 grids. Each grid is with the size of 180x180 meters. There are 2660 grids in five layers, and 1761 out of 2660 grids are active ones.
The proposed MRAS based cyberattack is implemented in C++ and tested using a machine with 3.6 GHz i CPU with 16GB RAM and simulated by ECLIPSETM.
The top structure map of PUNQ-S3 20

21. Cyberattack Results
The portion of attacking data is set to be 1/2, 1/5 and 1/7.
The portion denotes the data set being attacked in the time horizon.
Weighted Mismatch 21

22. Mismatch Values
The mismatch values of BHP, GOR and WCT for the case where 1/2 portion of data being attacked.
Month
Month
Month 22

23. Detection Results
The weighted sum of mismatch values of BHP, GOR and WCT for the case where 1/2 portion of data being attacked.
Weighted Mismatch
Proposed attack Corrected data Data without attack 23

24. Detection Results (BHP, GOR and WCT)
BHP, GOR and WCT mismatch comparison for the case where 1/2 portion of data being attacked.
Data without attack
Data with proposed attack method
Corrected Data
Data without attack
Data with proposed attack method
Corrected Data
Data without attack
Data with proposed attack method
Corrected Data
Month
Month
Month 24

25. Conclusion The first work studying petroleum CPS security.
Based on MRAS, an innovative cyberattack strategy optimization framework is proposed to optimize the malicious manipulation of field data from the hacker’s perspective.
It can be used to evaluate the worst case impact due to the oil field data manipulation attacks.
Experimental results demonstrate that our method can significantly reduce the production quality comparing to a random attack. 25

26. Thanks

28. An Illustration 28