In this episode of Season 1, our guest is Professor Manimaran Govindarasu from the Department of Electrical and Computer Engineering (ECpE) at Iowa State University (ISU). Here, we talk about his research in cybersecurity with applications to electric power grids, including the cyber physical testbeds and facilities available for student training and education. We also learn about the recent five-year ECE Strategic Plan that was drafted under his leadership. This episode was conceptualized, recorded, edited, and produced by Santosh Pandey from the ECpE Department of Iowa State University. The communications and digital hosting was handled by Kristin Clague from the ISU ECpE Department. The music was provided by Coma-Media from Pixabay (Track Title: Relaxation Optimistic).
In this episode of Season 1, our guest is Professor Manimaran Govindarasu from the Department of Electrical and Computer Engineering (ECpE) at Iowa State University (ISU). Here, we talk about his research in cybersecurity with applications to electric power grids, including the cyber physical testbeds and facilities available for student training and education. We also learn about the recent five-year ECE Strategic Plan that was drafted under his leadership. This episode was conceptualized, recorded, edited, and produced by Santosh Pandey from the ECpE Department of Iowa State University. The communications and digital hosting was handled by Kristin Clague from the ISU ECpE Department. The music was provided by Coma-Media from Pixabay (Track Title: Relaxation Optimistic).
Welcome to our ECpE podcast series where we talk about exciting activities within our department. I'm your host Santosh Pandey. Our guest today is Professor Manimaran Govindarasu from the Department of Electrical and Computer Engineering at Iowa State University. Dr. Manimaran, thank you for joining our listeners today. We want to hear about your research in cybersecurity with applications in electric power grids, the strategic vision of the department and its potential impact on student learning and outreach. To start with, could you describe what is cybersecurity and its relevance to protecting our cyber infrastructure? Hey, Santosh. First of all, thank you so much for giving me this opportunity to have this conversation. As you all know, cybersecurity is a very, very important topic. I'm going to introduce some of the research and educational opportunities that are there in our department. Digitization and cyber technologies are integral part of our modern society. And also if you see, the pace of digitization and automation keeps growing every year which is good in many ways and bad in some other ways. For example, if you think about enterprise, the increase of cyber technology has improved the efficiency, productivity, and hence the profit for the organization, but it also introduced several cyber security concerns, including data security, data privacy, disruption to service due to cyber attacks - all kinds of things - you know, there are negative impacts or negative consequences. So technology innovation is important. Digitization is important, but we need to also make sure those are secure, safe, and they ensure data privacy and all other things that the society cares about. So I'm happy to discuss about this topic. In particular, some of the research that has been going on at Iowa state for the last decade or so is securing the critical infrastructures, such as the energy infrastructure, transportation infrastructure, manufacturing infrastructure, and so on. The Department of Homeland Security in the United States, they have identified 18 critical infrastructures for the society. When you look at energy infrastructure, it is a cyber physical infrastructure- the power grid, for example. The modern power grid is highly automated - lots of sensor, lots of communication, lot of analytics. So much automation that is there, which means the attack surface has grown significantly. That makes the grid infrastructure susceptible to cyber attacks. The goal of cyber security in those environments, it is called cyber physical system security (CPS) that has been a major research issue for the past decade or so in the United States. And also Iowa state has been playing major role in building capabilities, research infrastructure, graduating students in this important area. You already touched on some of the hot button topics in this area. Could you elaborate a little bit more on some of the specific topics that would be interesting for computer engineers? Yes. As you can imagine, the cyber security for critical infrastructure. It's an interdisciplinary research, interdisciplinary program, even from the education perspective. Computer engineers, yes, they need to know about embedded systems, software development, those kind of things, but, they are applicable to critical infrastructure. So essentially, the students working in these kind of projects or working in these kind of research settings, they need to acquire knowledge in both the cyber - the computer engineering or cyber security or software engineering, those disciplines. And also they should be able to work within a team involving electrical engineers. So it provides an excellent opportunity for interdisciplinary research and education. That's what we are promoting at Iowa state in this particular area. So for example, we are discussing, this is a hot button issue. There is a growing tension between Russia and Ukraine at present right now. There is a real fear that Russia might attack Ukraine's critical infrastructure like the power grid. A similar incident actually happened in 2015. Russia hackers, they targeted the Ukrainian grid. And they brought down the regional grid infrastructure for several hours. So it was a major eyeopener for the Western world - Oh, one could use cyber weapon to create physical damage and causing blackout in the national grid. So, it is a very, very important issue. These kind of tools could become a playground. One could use those tools and techniques to target other developed nations like United States. That's why it is a very, very important issue, not only for wherever it is happening, but, it is for every advanced nations like United States. That's why these kind kind of research and education is extremely important. Iowa state is proud that we have a great research and also cybersecurity engineering undergraduate program to educate our students. That's great. So could you describe some of the specific research projects in cybersecurity that your group has been doing towards making better and more resilient, smart grids around the country? Thank you so much. About 10 years ago, this notion of CPS security, cyber physical system security, itself was not very well understood. People know about cyber security. People know about physical security, like fencing and monitoring and so on. But CPS security is about the interdisciplinary field where cyber and physical systems interact. How do you secure such an integrated system? We were one of the early research groups in the United States, broadly in academic universities, to lead this kind of CPS security research and roadmap and building capabilities, and, in particular, developing the framework for CPS security. How do you protect, detect, mitigate, and keep the grid resilient? And also how do you attribute attack attribution? So we developed a life cycle for cyber security, for critical infrastructure. As part of this life cycle, we developed various analytical tools for systematically assessing the risk on critical infrastructure, cyber risk in particular. When it comes to cyber risk, we are thinking about adversaries who are very sophisticated or different types of adversaries. Modeling the adversaries is extremely hard. So we have attempted to solve that problem through using game theory and other kind of stochastic models. How do you model the adversary and how do you model the probability of adversary targeting the infrastructure, and also quantifying what would be the consequence? So we have developed risk assessment methodology for cyber risk assessment for the grid infrastructure. And also we have developed various tools and algorithms for reducing the risk. And we have also utilized machine learning and other advanced tools to develop anomaly detection and mitigating anomalies in the grid, and keeping the grid itself resilient. So we kind of conducted research in the entire life cycle that I mentioned before for protecting the grid. The other important thing is we are have also developed a test bed infrastructure to test, evaluate, and validate a lot of technologies that we developed so that these technologies, not just in academic research, but they also find practical deployment. So the test beds provide a conduit between academic research and industry practice. So we have successfully pioneered developing the cyber physical system security test bed for the smart grid and utilized industry grade platforms, tools, and other kind of technologies. And utilizing this test bed, we have tested lot of technologies and some of them, we actually field tested in the actual Electric Utility environment. Those are some of the noteworthy accomplishments that we have done at Iowa State. On. A related question in your field specifically, how long does it take to go from academic research to technology adoption in the field? That's a great question. As you know, grid is a legacy infrastructure. There are a lot of technologies of different capabilities and there are regulations that are in place. So it is extremely important that we test these technologies in the university or the lab environment. Then we demonstrate in the field demonstration. Then there are various checks and balances they have to go through. So depending upon what software we are talking, where exactly it is going to be deployed, the time cycle could differ. And different regulations govern deployment of such software at different locations. So I would say it's not too long, like flight control system. And at the same time, it is not too short, like hosting a website. It is somewhere in between. But the key challenges are that it's the legacy infrastructure - interoperability of the new technology with the legacy infrastructure is very, very challenging. While we are deploying this new technology, we need to make sure that the new technology does not negate the grid operation, or any critical function of the grid. It should not introduce any unacceptable latency or other side effects. We need to make sure those things are properly analyzed and verified and validated for such a deployment to successfully happen. So could you describe some of the facilities available in the department to support your research in this field? For example, in terms of data storage, data analysis and modeling of cyber attack and defense. So we have the test bed infrastructure that we have built, as I mentioned, over a period of 7-8 years which was funded by National Science Foundation and Department of Homeland Security. Subsequently it was funded by Department of Energy to build a test bed infrastructure, wherein industry grade grid, software, and also devices and controllers are integrated with the simulation platform. It is a hardware-in-the-loop simulation platform wherein we can create realistic attack scenarios and realistic defenses to mitigate those attack scenarios. So we have built such a test bed- Power Cyber Test Bed at Iowa state. In fact, we utilized the test bed to demonstrate the Ukrainian 2015 grid attack in our environment. We also demonstrated how we can mitigate such an attack. So it is not only modeling the attack within our test bed, but also modeling the differences within our test bed. And, we have also hosted a workshop in partnership with USAID and National Association of Regulatory Utility Commissioners. These are national organizations at Iowa state for Black Sea countries like Ukraine and other neighboring countries, four countries - their professionals to help them to protect their infrastructures against such attacks. So we have taken this research platform for international collaboration, like the one I mentioned, Black Sea countries, and also, with Japan, India, and other countries. We have collaborated on this test bed. This test bed has also been utilized for industry training. Actually we have conducted cyber security training for utility and energy industry professionals. We have hosted more than a dozen industry workshops, totaling more than 400 professionals benefited utilizing this test bed. Essentially it provides a sort of toy environment wherein they can sort of create attacks and defenses and see how these things work, so that they can enhance their learning about cyber security, both from a different side, and also possible attacks that can happen. So in a way, this test bed, we are proud that it is developed at Iowa state with the funding from federal government and support from Iowa state, but it serves multiple purposes - research, education, I think developing a sort of modular test beds, which could be configurable to suit different needs, I think that is one of the innovations we should be thinking about rather than you build something where you can't sort of configure and mold it to something else. Then it becomes rigid. It's hard to sustain, but having a modular architecture - that is what enabled us to keep growing. And in fact, in recent years, we have expanded that capability with the more renewable energy, cybersecurity on renewable energy, those kind of emerging research that we are conducting using the test bed. So how can our undergraduate and graduate students get access to these test beds and to the research that is happening in. This field? Yeah. Thank you so much. So I have several graduate students, and also post-doc. They have been working and utilized the test bed for their research, whether it is a Master's thesis or PhD dissertation - heavily utilized. Then I also teach a course, Computer Engineering, CprE 539. This is the cyber security for smart grid course. This has been in existence more than seven years now. It is one of the earliest courses in this area at the graduate level. We utilize this test bed extensively as part of this course for providing this hands-on learning experience for the students in the class, leading to building project in the course itself. So the graduate students benefit. I also have several undergraduate REU students (Research Experience for Undergraduate students) who utilize the test bed for their own experimentation. And I also advise or mentor senior design students who also utilize the test bed. In fact, these students, not only they utilize the test bed, they also contribute to the development of test bed with the newer capabilities. In fact, we have successfully utilized undergraduate student, Capstone Design Project students, for building newer capabilities into the test bed as it evolved. So it, sort of, provides a learning environment for them, but also they contribute that environment to grow even beyond where it was. And the third type of benefit it offers is to industry professionals, as I mentioned to you before. We conducted a lot of training programs in the State of Iowa, at the national level. And also some international organization have utilized the test beds for training purpose. So I presume you would need a significant degree of collaboration from companies and national labs, especially to have access to their field data and to see what's the latest data modeling tools that they're using, for example, for cyber attack modeling. Could you comment on that? Yeah, that's a great question. We have had extensive collaboration with the Department of Energy national labs over the years through DOE projects, for example, Pacific Northwest National Lab, Argonne National Laboratory, Idaho National laboratory. Those are some of the common collaborators for us. Many times, we are part of a project team. As part of the project team, there are a lot of opportunities for research interactions. That is one important component. The other important component is understanding the use cases - use cases from an attack perspective, also from a defense perspective. And the third thing is, some of the capabilities that we have at Iowa State, the national labs also have similar capabilities. Sometimes they have a more enriched capability because of advanced resources they have. So we have benefited by sharing models, models of power system, for example. It takes enormous amount of time to build high fidelity models of power systems. These models are already built within the national lab. We benefited getting those models for our own experimentation. That is one tangible thing we can point out. There are other ways we have also contributed to security interfaces that we have figured out, or we have worked out at Iowa state successfully. We have shared those kind of knowledge to national labs while they were trying to expand their test bed capabilities. So it is a sort of knowledge exchange, it goes both ways. We learn from the national labs, national labs also benefit through our collaboration. So it is a synergistic partnership. That's why I put it. The other important thing of this collaboration, many of my graduate students who worked on this project, they have been successfully recruited by these national labs. That means, they found value in the kind of education that we provide in particular, the CPS, the cyber physical system, interdisciplinary perspective. Many of my students currently working at the national labs focusing on this particular area. So what specific skill sets are being sought from your graduate students when they get hired in cybersecurity engineering? I would say that national labs, in particular like PNNL or NREL or Idaho national lab - these kind of national labs. They're looking for cyber physical system security, which means understanding not only the cybersecurity, but also understanding the operation of the grid. So it's inherently an interdisciplinary area. So they are looking for that expertise. Then, most of the work they do is R & D in nature, which means they build new models. They build new cyber security tools. They develop analytical framework. They also deploy them in their test bed environment, validate. They also collaborate with the industries to make tech transfer, and so on. In the broad area of cyber security, I used to work in cyber security for the internet, internet infrastructure security. That is my previous area. Many of those students, they have been successfully employed in companies like Microsoft Qualcomm, Intel, PriceWaterHouse Cooper (PWC). Some of my recent students, they work at GE for example, GE research. Many of my former students who worked in cyber security or internet of things, these kind of areas, they have been successful in major companies actually like Google, Amazon, Apple, Microsoft, MetaVerse. You name it, all major companies. They are quite successful and some of them are in a leadership position right now. That's great. So I understand from what you're saying is access to the different test beds and the evolution of the test beds for at-scale applications - that is critical for students to contribute to this field. So is there scope for open source software? Yes, that's a great question. In fact, many of the projects that we have worked on, whether it was funded by NSF DHS or by DOE, one of the key expectations is to disseminate the knowledge for broad research and R & D community. So we have developed libraries, GitHub, those kind of open source platforms. We shared some of the intrusion detection capabilities there. Also the test bed itself that we have developed, we have made it available for a lot of universities to access our test bed and also for industries to utilize our test bed to test their tools and platforms because building such a test bed takes a lot of resources, a lot of expertise, actually. So when we developed these things through those projects, we made this test bed available to others, and we also developed a lot of learning module. Those learning models were disseminated. So I will say that it's sort of, uh, multi-pronged approach. One is the test bed made available to other researchers, educational modules made available to other researchers and through open source platforms, sharing some of the models and libraries for others to use. So we have adapted all those combination of strategies. Of course, we can do lot more, but we are working towards those things happen in the future. So changing the topic of our discussion, you have helped several leadership roles within the department. Could you elaborate on some of the leadership roles you your prized achievements in these roles? Yeah, thanks for reminding some of my past leadership roles. I started several years ago as the founding director for the Student Professional Development. In fact, I must tell an interesting story. When our department chair at the time, Professor Arun Somani, called me, he wanted to have a conversation to make me as the Director for Graduate Education. Then I basically suggested these are the things we should enhance for our students. And then he said, no, this is a lot more work needs to be done. Probably then he suggested why don't we create a new position, which is called the Student Professional Development. I was the founding Student Professional Development Director. So through that, we have achieved quite a bit those years in terms of promoting students, getting national fellowship, NSF graduate fellowship, IBM PhD fellowship, then other prestigious fellowships like that. We had a concerted effort in the department. Several students were very successful getting those fellowship. Then also the REU, research experience for undergraduate program. We tried to ramp up through that initiatives those years. Subsequently I became associate department chair in that role. I served seven years. During that time, there were several things that happened in the department through the effort of the whole faculty and staff successfully. A few major things I want to highlight. One is laboratory upgrade. As you know, Iowa state is known for hands on experiential learning. Iowa state students really benefit through hands-on learning. So we wanted to keep the laboratories up-to-date and modern. Several electrical engineering and computer engineering labs were upgraded. In fact, we utilized the senior design projects to sort of build newer capabilities, newer lab modules through that experience. That way we have modernized several labs in the department. The senior design project experience itself is revamped - the whole methodology, two semester sequence mimicking the industrial project experience. So we revamped that process that resulted a large percentage, most of the projects becoming successful or mostly successful. That is a great achievement, I would say. Then the third emphasis we did was, building research infrastructures, like test bed I mentioned before, not the interdisciplinary research I did, but similar kind of capabilities in computer networks or cyber security or microelectronics and so on in multiple areas, building research infrastructures so that we can educate our students to really understand the experimental side of research and also have a collaboration with the industry and, explore bigger project opportunities and so on. So we sort of enabled research infrastructure upgrade and, building those capabilities in the department. The final thing is student professional development, as I mentioned, to sort of promote student clubs, like IEEE, HKN, Digital Women and so on. In fact, I must tell you at that time, Professor David Jiles, when he was the department chair and I was the associate chair, HKN, which is the honor society within IEEE, Iowa state student chapter won Best Student Chapter Award for five years consecutively. Those are some of the highlights I want to mention to you at this point. So you have recently led the initiative to draft the five year ECE strategic plan that covers topics on undergraduate education, graduate education, research, diversity & inclusion, resources, outreach, and engagement. So could you briefly talk about the overarching vision and the mission for the department? Yeah. Thank you for asking this question. This is a strategic plan that was developed in the 2018 timeframe when our current chair was during his first term Professor Ashfaq Khokkar. When he became department chair, the department embarked on developing strategic plan for the department - five year plan. The important thing about this strategic plan, compared to any other ones in the past, it's not about just research. It is about different aspects of our program as part of the strategic plan. And that's why we sort of structured the six thrusts there. One is diversity and inclusion. That is the number one thrust. Then undergraduate education, graduate education, research, outreach, and engagement and resources. That's how it is structured. And each thrust is equally important. So as part of this process, we have engaged the faculty and staff and students in the department, solicitating inputs from them to develop this strategic plan. And we engage our alumni and external advisory board. So we came up with this strategic plan that closely aligns with the university and college strategic plan. Essentially what it does. We have a vision, then we have mission. Those things are nicely posted in our website. I don't want to go through each and everything in detail, but I just want to read out. Our vision is - we aim to be recognized as a leading department of electrical and computer engineering among land grant universities, and to be known around the world for quality and originality of our research for academic excellence, for value in education, and for our commitment to engagement with society. So it's a nicely crafted vision for our department. As part of this, each thrust area, for each one of them, we have strategic objectives and key action items. For example, for undergraduate education, the strategic objectives includes - develop undergraduate curricula that respond to industrial and societal needs through agile and flexible education. So that is a one of the strategic objectives. Then, we have several key action items. So same way for graduate education, research, diversity and inclusion - the strategic objectives are there and also key actions. The other important thing I want to point out, we not only develop this strategic plan, we also have an accompanying implementation plan. We have key performance indicators, a timeline for achieving those indicators. So that way we not only just have a plan, but also implement the plan and attune the implementation so that we are able to show tangible results from implementing the plan. So I think it has been a great success so far. We have reviewed some time back, recently, to find out how are we doing with respect to this implementation. We have achieved quite well tracking with our progression, but still some more to go. And it is a journey in all those six thrust areas that are listed in the strategic plan. It is found in our departmental website, I encourage students or listeners to go and visit the strategic plan. So I'm sure the pandemic may have hampered some of the implementation plan that you had. That's great. Yeah. One thing that had impact was the graduate students recruitment, especially international graduate students, recruitment. It sort of was a little bit disrupted in some years. But now it's going up again. Hopefully that was just a temporary phenomenon. The other challenge is especially with the undergraduate education and graduate education, we wanted to upgrade some laboratories, modernize, some of the experiments, and so on. What has happened that we had to migrate from in-person lab to virtual lab. A Lot of effort went in migrating in-person to virtual. Of course, virtual also enables newer opportunities for students to learn and experience. In way it is a progression, but it's the amount of time and effort went in is lot more because of the pandemic than we would've spent on in a typical timeframe. So that's kind of little bit, not necessarily slowed down, but it kind of tweaked our plan in the undergraduate education perspective. When it comes to research, there is no major impact. In fact, more interdisciplinary collaborations have happened over this period. A lot of newer projects who have been awarded successfully. Our department has won major awards in recent years, whether it is rural broadband or cyber security, or energy related areas. The momentum is picking up in the right direction. Hopefully whatever minor setback we had with the respect to COVID, we overcome those things and sort of, spring forward to achieve greater heights as we go forward. Thank you. On a last note, do you have any final word of advice for our students? I would say the computing field is a fast changing field. There is so much to learn. In fact, as a professor, we find it extremely hard to keep pace with the developments and technology innovations that are happening every year. So the bottom line in my view is, whatever you learn in a university environment essentially it provides a foundation for lifelong learning. So when a student is here, for example, undergraduate students, it is important the student learns both theory, whatever taught in the lectures and also the practical lab-based experiential learning. Both are important. The other important thing is that students need to, sort of, get accustomed to teamwork and also understanding contemporary issues what's happening, in terms of their professional societies, what is happening in real world application, whatever they're learning. Those are emphasized in those courses. I think they need to see the connection. Otherwise learning becomes more ritual. Learning is done to solve real world problem in this case, complex engineering problems- computer engineering, or electrical engineering or cybersecurity engineering. So, the university education provides foundation for lifelong learning. I think that is very, very important for graduate students, my advice would be doing research is great, whatever innovation they make as part of research, that's great publications and impacts and so on. Equally important thing is to know how to do research. That is the process of doing research is extreme important because tomorrow they may be solving different problems. They may be completely working in a totally different area. Like I mentioned to you before, some of my students, they did research in one area, they are doing R & D in a completely different area. When I talk to them, they say the foundation for doing research - that serves well. So the training that student goes through in doing research is equally important. I think the students, they need to benefit in that process and there are multiple steps to that process. That means not just interaction with the major professors, but peer to peer interactions and, interacting with, listening to professional lectures or experts coming to the department. So benefiting through the whole ecosystem, leveraging the resources and expertise and opportunities available as part of the ecosystem. That is what makes the education meaningful and sort of, beneficial to their overall success, as opposed to just to focusing on just one aspect of research and publishing. So that is my advice. Yeah. Right. Well, Dr. Manimaran. Thank you so much for sharing your thoughts today. I think we covered all the important topics. We really appreciate all your leadership efforts in the department. And thank you again so much. Thank you so much, San. Really keep in touch. Bye. Thank you.