Integrating Cybersecurity into the Chemical Engineering Curriculum

With cybersecurity now a core subject for many higher education institutions, the National University of Singapore shares details of their process safety digitalisation course to inspire other institutions struggling with already packed curriculums

WITH the integration of Internet of Things (IoT) devices, cloud computing, and other digital technologies into chemical processes, the complexity and stealthiness of cyber-attacks have surged. In the critical landscape of chemical industrial processes, cyber-attacks represent a profound threat.

These processes are deeply integrated systems that form the infrastructure of countless industries, and when they are compromised, the consequences can be catastrophic, leading to significant operational disruptions, safety hazards, and economic losses. This vulnerability was illustrated by a 2017 cyber-attack on a petrochemical plant in Saudi Arabia, designed to sabotage operations and trigger an explosion.¹ The attackers were only foiled by a mistake in their computer code.

In response to this, the Engineering Council UK issued a new set of accreditation guidelines (AHEP4) in 2020 and subsequently the IChemE Education and Accreditation Forum in consultation with members and groups across IChemE issued a revised set of accreditation guidelines in 2021.² The new accreditation guidelines emphasise the inclusion of digital technologies in the curriculum and explicitly mention cybersecurity as a key topic. This development has resulted in many higher education institutions with accredited programmes at both undergraduate and postgraduate level introducing cybersecurity as a “core” topic. In the majority of cases, cybersecurity has been linked to process safety but with an already packed curriculum, the question is, “How do we manage this requirement?”

Process safety digitalisation at NUS

The department of Chemical & Biomolecular Engineering, National University of Singapore (NUS) offers both undergraduate and advanced degrees in chemical engineering, as well as a master’s in safety, health and environmental.

To better equip students with essential knowledge on the development and impact of digitalisation on chemical process operation and safety, we designed a new course on “process safety digitalisation” and offered it to students enrolled on both the chemical engineering, and safety, health and environmental technology master’s courses.

The course consists of three main sections; “Introduction to process digitalisation” covers digitalisation and automation tools in process monitoring, control, and operations, while “Industry case and app development” exposes students to low-code development platform (using Microsoft PowerPlatform), allowing them to identify safety use cases and develop customised solutions related to process safety. However, here our focus is the third part of our course, “Cybersecurity”.

Cybersecurity

We start with the introduction of cyber-attacks, and the information technology (IT) and operational technology (OT) that are commonly used in industry to handle cyber-attacks. Most companies and organisations now deploy a combination of traditional IT cybersecurity products and services with tailored OT-specific cybersecurity solutions.

Case studies, including Stuxnet and Ukrainian Power Grid attacks, are discussed to show the key functionalities and consequences of cyber-attacks, as well as some potential post-cyber-attack solutions. Additionally, two reference textbooks^3,4 and relevant research papers are recommended to provide an overview of cybersecurity issues^5,6,7 and recent academic advances of cybersecurity approaches to engineers in various industries, including chemical, pharmaceutical, food, and materials industries.^8,9

To handle cyber-attacks, we introduce two detection methods: model-based and data-based, in the context of OT solutions. A water level control problem is used as an example to show the development of model-based detection methods (eg Cumulative Sum (CUSUM)) for simple attacks such as min-max cyber-attacks. Specifically, a simple proportional integral controller is designed to control the water level at a predefined setpoint. This controller operates by continuously receiving real-time sensor readings of the water level and adjusting the inlet flow rate accordingly to achieve the desired control objective. However, in the presence of sensor cyber-attacks, the controller receives falsified sensor measurements, leading to erroneous control actions that deviate the water level from its setpoint. To counteract this threat, model-based detection techniques compare the actual sensor readings of the water level against the anticipated values provided by a known process model. Any significant disparities between the observed and predicted values serve as clear indicators of a potential sensor cyber-attack, allowing prompt intervention to maintain system cybersecurity. 

To better equip students with essential knowledge on the development and impact of digitalisation on chemical process operation and safety, we designed a new course on ‘process safety digitalisation’ and offered it to students enrolled on both the chemical engineering, and safety, health and environmental master’s courses

The increased use of data and the design of stealthy cyber-attacks that can avoid the detection of traditional model-based methods pose challenges to the development of timely detection methods. To develop advanced detection methods for intelligent cyber-attacks, we introduce machine learning (ML) techniques for data-based detection. Specifically, the fundamentals of ML, including its concept, math, and construction of neural networks are first discussed. The same example (ie water level control problem) is used to implement ML-based detection methods under surge attack (a stealthy cyber-attack). For while CUSUM is effective at detecting the disparity between sensor readings and predicted values using model-based detection methods, surge attacks can bypass CUSUM by introducing sudden spikes or drops in system before CUSUM has accumulated sufficient evidence to detect the change. Therefore, it is important to develop advanced data-based detection methods to address intelligent and stealthy cyber-attacks.

MATLAB is used throughout the cybersecurity lectures to design the process control system that controls the water level at the desired setpoint and implement different types of cyber-attacks (eg min-max, replay, geometric, and surge). Additionally, students are taught how to develop an ML-based detector that can use real-time sensor measurement to classify no attack and under attack using MATLAB Deep Learning Toolbox. Since the students on this course have diverse backgrounds (recent graduates, senior process engineers with 10+ years working experience etc), and not all of them use MATLAB extensively, it is important to review the basics of MATLAB such as numerical operators and data visualisation commands before proceeding with the Deep Learning Toolbox.

The assessment of this part consists of an individual simulation-based project which requires students to develop a neural network-based detector to classify 1) two classes: no attack, and under min-max attack, and 2) three classes: no attack, under attack, and under sensor noise. Historical sensor measurements under different classes are provided to students to develop the neural network and test its performance in terms of classification accuracy. The objective of this project is to help students deepen their understanding of ML methods in solving attack detection problems and gain hands-on experience with the MATLAB Toolbox for development of neural network models. The written reports demonstrate the majority of our students can successfully solve the project problems and interpret their results adequately.

Broadening the understanding of cybersecurity in the context of digitalisation both in higher education (eg undergraduate, postgraduate) and industry-based settings (eg via professional development courses) is paramount

Conclusion

Broadening the understanding of cybersecurity in the context of digitalisation both in higher education (eg undergraduate, postgraduate) and industry-based settings (eg via professional development courses) is paramount. Cybersecurity can be integrated into chemical engineering programmes, effectively linking these concepts not only to safety, control, and modelling but also directly to industrial practice. Cybersecurity is not only important from the perspective of safety but also in the broader sense of business operations. Recognising the importance of this topic in terms of risks and mitigation strategies that can be deployed in different cases is essential not only for students in chemical engineering programmes but also to those in industry to ensure safe operations and sustainable businesses. Like safety, cybersecurity is everyone’s responsibility.

References

1. N Perlroth and C Krauss, A Cyberattack in Saudi Arabia Had a Deadly Goal. Experts Fear Another Try, The New York Times, New York, NY USA, 2018
2. Leslie W Bolton, Jarka Glassey, and Esther Ventura-Medina. Updating chemical engineering degree accreditation in changing times, Education for Chemical Engineers 43 (2023): pp31–36
3. Managing Cybersecurity in the Process Industries: A Risk based Approach (2022). CCPS (Center for Chemical Process Safety) ISBN: 978-1-119-86180-5
4. Z Wu and PD Christofides. Process Operational Safety and Cybersecurity (2021). Springer International Publishing
5. Sandra Parker, Zhe Wu, and Panagiotis D Christofides. Cybersecurity in process control, operations, and supply chain, Computers & Chemical Engineering (2023): 108169
6. A Kopbayev, F Khan, M Yang, and SZ Halim. Fault detection and diagnosis to enhance safety in digitalized process system, Computers & Chemical Engineering (2022): 158, 107609
7. Y Hashimoto, T Toyoshima, S Yogo, M Koike, T Hamaguchi, S Jing, and I Koshijima. Safety securing approach against cyber-attacks for process control system, Computers & Chemical Engineering (2013): 57, pp181–186
8. S Narasimhan, NH El‐Farra, and MJ Ellis. Detectability‐based controller design screening for processes under multiplicative cyber-attacks, AIChE Journal (2022): 68(1), e17430
9. H Oyama and H Durand. Integrated cyberattack detection and resilient control strategies using Lyapunov‐based economic model predictive control, AIChE Journal (2020): 66(12), e17084.
10. www.icheme.org/cybersecurity: Resources are available through the IChemE DigiTAG website specifically devoted to cybersecurity

---

This is the fifth in a series of articles in which colleagues explore various aspects of digitalisation of engineering education in more detail