Michigan Technological University Analysis of Production Data Manipulation Attacks in Petroleum Cyber-Physical Systems Professor Shiyan Hu Michigan Technological University

Petroleum System Needs CAD “The revolution in digital technologies could well transform the dynamics of world oil supply at a time when the industry faces major choices on investment.” Daniel Yergin, Chair Cambridge Energy Research Associates (CERA) 2

From Exploration To Production 3

Petroleum CPS Data Collection Visualization Data Processing Device Reservoir Oil Well Data Collection Production data Visualization Data Processing Analysis Simulation Optimization Network Control network 4

Simplified View of Oil Production: Water-In-Oil-Out Site Water Injection Site Water Pipe Oil Pipe Oil Well Water Well 5

Which Site to Choose? 6 Oil Production Site Water Injection Site Water Pipe Oil Pipe Oil Well Water Well 6

In Practice 7

Where is the oil and how fast should we inject water? We Want To Model Wells Where is the oil and how fast should we inject water? 8

Reservoir Modeling of Liquid Flow How much incoming flow (oil, gas, and water) v.s. how much outgoing flow per square Rock porosity ɸ and permeability K 9

History Matching Underground geographical properties are complicated Modeling parameters rock porosity ɸ and permeability K are difficult to obtain Probing method cannot detect everywhere in the reservoir One can only estimate ɸ and K using historical production data 10

The History Matching Flow Start with initial parameters WCT: water cut or water over total liquid per volume, and large value reduces benefit GOR: gas oil ratio, or gas over oil per volume, and large value leads to safety issues BHP: bottom hole pressure, and large value leads to safety issues Accurate Model Production Optimization Yes Update Model Parameters Machine Learning Modeling Small? No Mismatch between simulated production data and historical production data? 11

TCAD16: Reduce PDE to The Connectivity Based Capacitive Model Pressure terms Production data terms Interwell Connectivity 12

Hack The Petroleum CPS Cyberattack Production Data Visualization Data Processing Device Analysis Simulation Reservoir Production data Optimization Oil Well Network Control network 13

Impact of Cyberattacks The flow tries to minimize the mismatch to the attacked production data Yes Update Model Parameters Machine Learning Modeling Satisfied? No Inaccurate Model Refined Model Attacked Data Damaged Production Production Optimization 14

What is Worst-Case Impact? Maximize mismatch between the actual production and the simulated production. This is difficult as it involves PDE solving. Optimize the cyberattack strategy from the hacker’s perspective through manipulating the field data collected at the production wells such that solving PDE generates the most inaccurate petroleum reservoir model are true values of BHP, GOR and WCT， are simulated values at well I, respectively. 15

Model Reference Adaptive Search (MRAS) 𝑚𝑎𝑥 𝑥∈𝐷 𝑓 𝑥 [𝑀𝑖𝑠𝑚𝑎𝑡𝑐ℎ] 𝛿 𝑟 =𝑃 𝑓 𝑋 ≥𝑟 𝑔 𝑥 𝑑𝑒𝑛𝑜𝑡𝑖𝑛𝑔 𝑡ℎ𝑒 𝑃𝐷𝐹 𝑜𝑓 𝑃𝐷𝐸 𝑚𝑜𝑑𝑒𝑙 𝑝𝑎𝑟𝑎𝑚𝑒𝑡𝑒𝑟 𝑠𝑒𝑡𝑡𝑖𝑛𝑔𝑠 𝑋 𝑏𝑒𝑖𝑛𝑔 𝑎 𝑠𝑒𝑡 𝑜𝑓 𝑠𝑎𝑚𝑝𝑙𝑒𝑠 𝑔𝑒𝑛𝑒𝑟𝑎𝑡𝑒𝑑 𝑎𝑐𝑐𝑜𝑟𝑑𝑖𝑛𝑔 𝑡𝑜 𝑔(𝑥) ? 𝑚𝑖𝑛 𝑟 𝑠.𝑡. 𝛿 𝑟 →0 𝛿 𝑟 →0 means that r is an upper bound of f(x) 𝑔 𝑥 𝑐𝑜𝑛𝑣𝑒𝑟𝑔𝑒𝑠 𝑡𝑜 𝑡ℎ𝑒 𝑜𝑝𝑡𝑖𝑚𝑢𝑚 𝑤𝑖𝑡ℎ →0 𝑣𝑎𝑟𝑖𝑎𝑛𝑐𝑒 16

Estimating δ(r) Importance Sampling 𝑀𝑜𝑛𝑡𝑒 𝐶𝑎𝑟𝑙𝑜 𝑠𝑖𝑚𝑢𝑙𝑎𝑡𝑖𝑜𝑛 𝑡𝑜 𝑒𝑠𝑡𝑖𝑚𝑎𝑡𝑒 𝛿 𝑟 ? 𝑊ℎ𝑒𝑛 𝛿 𝑟 →0, 𝑓 𝑥 ≥𝑟 𝑖𝑠 𝑎 𝑟𝑎𝑟𝑒 𝑒𝑣𝑒𝑛𝑡 𝑓 𝑥 a 𝑟 Importance Sampling 17

MRAS Details Initialization Sample Generation Evaluation Update 18 𝑁 𝜔 = 𝑁( 𝜇 𝐵𝐻𝑃,𝜔 , 𝜎 𝜔 2 , 𝐵𝐻𝑃 ) 𝑁( 𝜇 𝐺𝑂𝑅,𝜔 , 𝜎 𝜔 2 , 𝐺𝑂𝑅 ) 𝑁( 𝜇 𝑊𝐶𝑇,𝜔 , 𝜎 𝜔 2 , 𝑊𝐶𝑇 ) 𝑆={ 𝑆 1 , 𝑆 2 ,⋯, 𝑆 𝑆 } 𝑆 𝑖 = 𝛽 𝜔 𝑖 , 𝛾 𝜔 𝑖 , 𝜔 𝜔 𝑖 ∀𝜔∈[1,𝑊] 𝑔 𝑗 =( 𝜙 𝑗 , 𝑘 ℎ 𝑗 , 𝑘 𝑣 𝑗 ) 𝑎 𝑖 = 𝑗 ( 𝜙 𝑗 − 𝜙 𝑡 𝑗 + 𝑘 ℎ 𝑗 − 𝑘 ℎ,𝑡 𝑗 +| 𝑘 𝑣 𝑗 − 𝑘 𝑣,𝑡 𝑗 |) 𝜇 𝐵𝐻𝑃 ′ = 𝜇 𝐵𝐻𝑃,𝜔 + 𝑖=1 𝑘 ( 𝜇 𝐵𝐻𝑃,𝜔 − 𝛽 𝜔 𝑖 ) 𝑘 𝜎 𝜔 ′ = 𝜎 𝜔 ×0.9 Initialization Sample Generation Evaluation Update 18

Cyberattack Defense Markov Decision Process (MDP) based technique is used to analyze and correct the attacked data. It models the interactions among states, actions and rewards. 𝑠 𝑠′ s′′ 𝑠′′ 𝑠′′′ Discount Factor: 0.5 ×0.5 for 3pm × 0.25 for 4pm × 0.125 for 5pm > < 𝑅 0 𝑅 1 𝑅 2 𝑅 3 ×1 for 2pm 𝑎 0 𝑎 1 19

Experimental Setup The proposed approach has been applied to the testcase PUNQ-S3 which is based on an industrial petroleum field. The PUNQ-S3 testcase has five layers, and in each layer there are 19x28 grids. Each grid is with the size of 180x180 meters. There are 2660 grids in five layers, and 1761 out of 2660 grids are active ones. The proposed MRAS based cyberattack is implemented in C++ and tested using a machine with 3.6 GHz i7 4790 CPU with 16GB RAM and simulated by ECLIPSETM. The top structure map of PUNQ-S3 20

Cyberattack Results The portion of attacking data is set to be 1/2, 1/5 and 1/7. The portion denotes the data set being attacked in the time horizon. Weighted Mismatch 21

Mismatch Values The mismatch values of BHP, GOR and WCT for the case where 1/2 portion of data being attacked. Month Month Month 22

Detection Results The weighted sum of mismatch values of BHP, GOR and WCT for the case where 1/2 portion of data being attacked. Weighted Mismatch Proposed attack Corrected data Data without attack 23

Detection Results (BHP, GOR and WCT) BHP, GOR and WCT mismatch comparison for the case where 1/2 portion of data being attacked. Data without attack Data with proposed attack method Corrected Data Data without attack Data with proposed attack method Corrected Data Data without attack Data with proposed attack method Corrected Data Month Month Month 24

Conclusion The first work studying petroleum CPS security. Based on MRAS, an innovative cyberattack strategy optimization framework is proposed to optimize the malicious manipulation of field data from the hacker’s perspective. It can be used to evaluate the worst case impact due to the oil field data manipulation attacks. Experimental results demonstrate that our method can significantly reduce the production quality comparing to a random attack. 25

Thanks

An Illustration 28