Abstract
Nowadays, the industrial control system (ICS) plays a vital role in critical infrastructures like the power grid. However, there is an increasing security concern that ICS devices are being vulnerable to malicious users/attackers, where any subtle changing or tampering attack would cause significant damage to industrial manufacturing. In this paper, we propose the iFinger , a novel detection approach designed to mitigate ICS attacks adapting to various industrial scenes. We take advantage of an important insight that industrial protocol packets include register status values that are used to reflect the physical characteristics of ICS controllers. The iFinger utilizes register states to generate ICS fingerprints to detect malicious attacks on industrial networks. Specifically, the boolean logic represents every register state sequence of the ICS controller, and the deterministic finite automaton (DFA) generates a device fingerprint. To discover the ICS attacks, we propose two detection approaches based on device fingerprints, including passive and active detection. We present a prototype of the iFinger and conduct real-world experiments to validate its performance. Results show that our approach achieves 97.1% F1 score in ICS device identification. Furthermore, we simulate two typical ICS attacks (replacement and code modification) to validate the effectiveness of our iFinger in industrial networks. Our device fingerprints would detect those malicious attacks within 2s latency at 98.0% recall.
Highlights
C YBER-PHYSICAL systems (CPS) intertwine software components and physical processes, which are pervasive in diverse industries [1], such as manufacturing, automotive, energy, and medical monitoring
Results show that our approach achieves 97.1% F1 score in industrial control system (ICS) device identification
We utilize an observation that register status values can reflect the physical characteristics of ICS controllers
Summary
C YBER-PHYSICAL systems (CPS) intertwine software components and physical processes, which are pervasive in diverse industries [1], such as manufacturing, automotive, energy, and medical monitoring. The control component plays a critical role in CPS, connecting cyberspace with. Date of publication March 16, 2020; date of current version May 7, 2020. Xin Chen is with the Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100864, China. Color versions of one or more of the figures in this article are available online at http://ieeexplore.ieee.org
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.