Modern Methods for Analyzing Malware Targeting Control Systems

Abstract

Industrial control systems are critical infrastructure of nation. ICSs are sensor-actuator networks that control physical systems. The core components are Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA), distributed control systems (DCS). Traditional ICS had specialized hardware without Internet connection. Nowadays ICS are commodity computers comes with high configuration and internet connection which makes it defenseless for most common attacks. Defensive mechanism are limited because ICSs are not using typical solutions like anti-viruses. They developed a malware-tolerant ICS network architecture that operate in secure manner even if attacker can attack on some of components. They provide ProVerif proofs to show the correctness of the network protocol. They added self-healing mechanism they implemented it on top of FreeRTOS and ARM TrustZone. The architecture automatically repair ordinary and malicious faults is known as self-healing. Governmental organizations recommend a strategy called “defense in depth” which tries to deploy defenses at every layer of the network. But author of paper use new approach. They distribute trust over each component on the network so malware cannot break the security policies. This approach is called malware tolerant.