Industrial Control Systems Research Articles

Security Assessment of Industrial Control System Applying Reinforcement Learning

Industrial control systems are often used to assist and manage an industrial operation. These systems’ weaknesses in the various hierarchical structures of the system components and communication backbones make them vulnerable to cyberattacks that jeopardize their security. In this paper, the security of these systems is studied by employing a reinforcement learning extended attack graph to efficiently reveal the subsystems’ flaws. Specifically, an attack graph that mimics the environment is constructed for the system using the state–action–reward–state–action technique, in which the agent is regarded as the attacker. Attackers may cause the greatest amount of system damage with the fewest possible actions if they have the highest cumulative reward. The worst-case assault scheme with a total reward of 42.9 was successfully shown in the results, and the most badly affected subsystems were recognized.

GlareShell: Graph learning-based PHP webshell detection for web server of industrial internet

With the explosive growth of the Industrial Internet scale, cyberattacks targeting industrial control systems also increased. The management and operation of Industrial Internet are usually performed via web servers which retain a large attack surface. In the Industrial Internet, attackers usually exploit vulnerabilities to inject malicious codes for remotely executing commands, stealing confidential data, and invading web servers. Existing approaches capture statistical and contextual dependence information from Webshell using machine learning (ML) or deep learning (DL) algorithms. However, the semantic feature mining of program code within Webshell is not sufficient when entering new types of Webshell. In this paper, we propose a graph learning-based PHP Webshell detection framework, GlareShell, using the word embedding technique, a risk weight allocation mechanism, and the graph neural network (GNN). First, GlareShell leverages static analysis to extract interprocedural control flow graphs (ICFGs) from PHP script files and then prunes these ICFGs to remove noisy statements. Then, word embedding techniques are employed to generate semantic representations from PHP statements. Next, we design a risk weight allocation mechanism to derive the risk levels of statements and concatenate them with word embeddings as attributions. The identified risk levels could guide the passing of potential attack patterns inside GNN models. Finally, GlareShell builds a GNN classifier directly from the ICFG with corresponding node attributions to identify the malicious PHP scripts. Experiment results on collected datasets prove the promise of our graph learning framework in the Webshell detection domain.

Feasibility of Using Seq-GAN Model in Vulnerability Detection of Industrial Control Protocols

Continuous improvement of internet technology has driven the continuous progress and improvement of industrial control systems, and provided more support for security vulnerability detection in this field. Combining the GAN model, the detection model based on Seq-GAN in industrial control protocol vulnerabilities constructed in this article provides more options for further improving the security of industrial control systems, and can detect and analyse security vulnerabilities in industrial control protocols more efficiently and accurately. By comparing the performance of different models for security vulnerability detection, the Seq-GAN model has smaller prediction errors, can also obtain higher G-mean and F1-score values, and has sufficient reliability. At the same time, it can also improve the efficiency of vulnerability detection in industrial control systems, and can achieve better comprehensive detection performance. Therefore, the application of the Seq-GAN model in industrial control protocol vulnerability detection can provide more support for improving security detection in this field.

Effective application of operator training simulator in experiential education

AbstractConnecting the chemical industry with the academic environment has created a unique opportunity to apply experiential learning in many areas of teaching. A new approach of using the existing operator training simulator, which is basically a digital twin of a new dicyclopentadiene plant, was used to educate and train students from technical universities. Using this simulator, students can gain adequate knowledge for control, process optimization, and problem solving under nonstandard operating conditions. Simulating a dynamic process in the Aspen HYSYS interface along with elements of a real industrial control system and control interface, and especially the online visualization of the results, helps students understand the physicochemical principles through their own intervention and experience of the consequences. The training simulator's ability to accurately reflect ongoing processes can be verified by students during a guided tour of a production plant. The experience with student learning so far shows that this is a very attractive and, above all, effective tool for extending the teaching of chemical engineering, control, and automation of chemical processes.

Advancing IoT Cybersecurity: Adaptive Threat Identification with Deep Learning in Cyber-Physical Systems

Securing Internet of Things (IoT)-enabled Cyber-Physical Systems (CPSs) can be challenging because security solutions intended for typical IT/OT systems may not be as effective in a CPS setting. The goal of this study is to create a mechanism for identifying and attributing two-level ensemble attacks that are specifically designed for use against Industrial Control Systems (ICSs). An original ensemble deep representation learning model is combined with decision tree algorithm to identify assaults on unbalanced ICS environments at the first level. An attack attribution network, which constitutes a collection of deep neural networks, is formed at the second level. The proposed model is tested using real-world datasets, notably those pertaining to water purification and gas pipelines. The results demonstrate that the proposed strategy outperforms other strategies with comparable computing complexity and that the recommended model outperforms the existing mechanisms.

Design and Implementation of Chopper Control System for HIAF

The chopper control system which is synchronized by the White Rabbit timing network is designed and implemented to meet the requirements of the chopper of ion source for the High-Intensity Heavy Ion Accelerator Facility (HIAF). The hardware system consists of timing modulation controller, waveform acquisition, parameter setting, and remote control of the chopper power supply. The software includes low-level drivers and top-level applications which are based on Experimental Physics and Industrial Control System (EPICS). The combination of hardware and software completes the interaction of timing messages with the White Rabbit network, waveform acquisition, the setting of timing modulation parameters in several running modes, and remote control of the chopper power supply, etc. The test results show that the system can achieve timing modulation with a resolution of 8 ns and waveform acquisition of embedded EPICS IOC (input/output controller) at a 125 MHz sample rate. The design, implementation, and test of the chopper control system are described in this paper.

Fuzzy logic Based Seagull Optimization Algorithm for Efficiency and Security in Wireless Sensor Networks

Wireless sensor networks (WSN) find applications in diverse fields such as environmental monitoring, healthcare, and industrial control systems. The pivotal components of these networks are the sensor nodes, which, unfortunately, consume a substantial amount of energy when transmitting information directly to the base station (BS). To mitigate energy consumption associated with direct transmission, this paper proposes a two-phase approach utilizing hybrid clustering and routing algorithms. The proposed approach incorporates fuzzy and seagull techniques for clustering and adopts optimal CH (cluster head) selection, CBRP (Cluster-Based Routing Protocol), and AES (Advanced Encryption Standard) for secure routing. The system employs rule-based fuzzy logic to correlate input values in both clustering and routing algorithms. Decision-making is based on factors such as the residual energy of sensor nodes, distance from the BS, and the number of nodes within the communication range. Input variables' crisp values are transformed into diverse fuzzy values, and the fuzzy output values are converted back to crisp values using the centroid defuzzification method. Selection of cluster heads and routers is determined by the output values, with sensor nodes being allocated to respective cluster heads based on their load-handling capacity. The routing path is then generated considering the capacity of routers. Simulations are conducted to evaluate energy consumption, active sensor nodes per round, and the sustainability period of the network. This proposed hybrid clustering and routing system aim to enhance the overall efficiency of wireless sensor networks by optimizing energy consumption and ensuring secure data transmission. The optimization model identifies the most suitable nodes in the routing cycle, starting with chosen cluster heads. The overarching goal is to enhance network indicators, including network lifespan, power consumption per node, and packet delivery percentage. The proposed solution achieved a network lifetime of 100 hours and a data delivery rate of 98%. additionally, it consumed the least amount of energy, measuring at 95,000 joules.

Digital Twin-Based Cyber-Attack Detection Framework for Cyber-Physical Manufacturing Systems

Smart manufacturing (SM) systems utilize run-time data to improve productivity via intelligent decision-making and analysis mechanisms on both machine and system levels. The increased adoption of cyber-physical systems in SM leads to the comprehensive framework of cyber-physical manufacturing systems (CPMS) where data-enabled decision-making mechanisms are coupled with cyber-physical resources on the plant floor. Due to their cyber-physical nature, CPMS are susceptible to cyber-attacks that may cause harm to the manufacturing system, products, or even the human workers involved in this context. Therefore, detecting cyber-attacks efficiently and timely is a crucial step toward implementing and securing high-performance CPMS in practice. This paper addresses two key challenges to CPMS cyber-attack detection. The first challenge is distinguishing expected anomalies in the system from cyber-attacks. The second challenge is the identification of cyber-attacks during the transient response of CPMS due to closed-loop controllers. Digital twin (DT) technology emerges as a promising solution for providing additional insights into the physical process (twin) by leveraging run-time data, models, and analytics. In this work, we propose a DT framework for detecting cyber-attacks in CPMS during controlled transient behavior as well as expected anomalies of the physical process. We present a DT framework and provide details on structuring the architecture to support cyber-attack detection. Additionally, we present an experimental case study on off-the-shelf 3D printers to detect cyber-attacks utilizing the proposed DT framework to illustrate the effectiveness of our proposed approach. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —This work is motivated by developing a general-purpose and extensible digital twin-enabled cyber-attack detection framework for manufacturing systems. Existing works in the field consider specialized attack scenarios and models that may not be extensible in practical manufacturing scenarios. We utilize digital twin (DT) technology as a key enabler to develop a systematic and extensible framework where we identify the abnormality of a resource and detect if the abnormality is due to an attack or an expected anomaly. We provide several remarks on how our proposed framework can extend existing industrial control systems (ICS) and can accommodate further extensions. The presented DTs utilize data-driven machine learning models, physics-based models, and subject matter expert knowledge to perform detection and differentiation tasks in the context of expected anomalies and model-based controllers that control the manufacturing process between multiple setpoints. We utilize a model predictive controller on an off-the-shelf 3D printer to run the process, and stage anomalies and cyber-attacks that are successfully detected by the proposed framework.

Power line Communication: Revolutionizing data transfer over electrical distribution networks

Power Line Communication (PLC) is an emerging technology that utilizes existing electrical power infrastructure for data transmission. It enables communication over power lines, allowing devices to exchange information and access the internet through the power grid. This method offers numerous advantages, including widespread availability, cost-effectiveness, and easy deployment without the need for additional cabling. PLC has found applications in various domains, including smart grid management, home automation, industrial control systems, and Internet of Things (IoT) connectivity. This abstract provides an overview of PLC, highlighting its benefits, challenges, and key technologies. It also discusses the potential of PLC in transforming power distribution networks into intelligent and interconnected systems. Additionally, emerging trends and future directions for PLC research and development are explored, emphasizing the potential for enhanced reliability, speed, and efficiency in data transmission over power lines. This paper proposed a two way communication from source to load sides using BPSK and QPSK modulation techniques. Monte Carlo simulation is used to predict the transformer theoretical channel (AWGN) and compare the efficiency of the proposed methods. Randomly selected data from 10 k to 50 k size are used to compare the performance curve. Moreover, a test sound data is sent from the source side to the load side and it is observed that using the QPSK modulation technique has almost zero Bit Error Rate (BER).

ADT: Time series anomaly detection for cyber-physical systems via deep reinforcement learning

Cyber-physical systems (CPS) play a vital role in modern society across various sectors, ranging from smart grid to water treatment, and their security has become one of the major concerns. Due to the significantly growing complexity and scale of CPS and cyber-attacks, it is imperative to develop defense and prevention strategies specifically for CPS that are adaptive, scalable, and robust. An important research and application direction in this domain is time series anomaly detection within CPS utilizing advanced machine learning techniques, such as deep learning and reinforcement learning. However, many anomaly detectors fail to balance between detection performance and computational overhead, limiting their applicability in CPS. In this paper, we introduce a novel agent-based dynamic thresholding (ADT) method based on the deep reinforcement learning technique, i.e. deep Q-network (DQN), to model thresholding in anomaly detection as a Markov decision process. By utilizing anomaly scores generated from an autoencoder and other useful information perceived from a simulated environment, ADT performs the optimal dynamic thresholding control, facilitating real-time adaptive anomaly detection for time series. Rigorous evaluations were conducted on realistic datasets from water treatment and industrial control systems, specifically SWaT, WADI, and HAI, comparing against established benchmarks. The experimental results demonstrate ADT's superior detection performance, dynamic thresholding capability, data-efficient learning, and robustness. Notably, ADT, even when trained on minimal labeled data, consistently outperforms benchmarks with F1 scores ranging from 0.995 to 0.999 across all datasets. It is effective even in challenging scenarios where the environmental feedback is noisy, delayed, or partial. Beyond its direct application as an advanced anomaly detector, ADT possesses the versatility to act as a lightweight dynamic thresholding controller, boosting other anomaly detection models. This underscores ADT's considerable promise in sophisticated and dynamic CPS environments.

Deceptive Patch Solutions for Protecting Industrial Control Systems Based on Discovered Vulnerabilities

An increase has been observed in concerns about cyber security threats in smart energy management on a global scale. Industrial Control Systems, or simply ICSs, are frequently present in industries and essential infrastructures, e.g., water treatment facilities, nuclear and thermal plants, heavy industries, power production, and distribution systems. ICS devices are high-risk targets for attacks and exploitation with significant security difficulties for ICS vendors and asset owners. Like many consumer electronics, industrial systems are susceptible to a bevy of vulnerabilities that hackers can exploit to launch cyber attacks. Extensive use of ICSs in Critical Infrastructures (CI) increases the vulnerability of CI to cyber attacks and makes their protection a critical subject. This study first contributes to a novel line of research considering how deception can be used by defenders in strategic terms with the objective of introducing uncertainty into an adversary’s perception of a system patch management process in order to protect ICSs. Thus, we mention the advantages of patch models to improve the vulnerabilities of ICSs. We explore deceptive patch management models for the purpose of providing better insight into developing future cyber security techniques for ICS attacks. We propose deceptive patch management solutions as case studies for common ICS attacks.

Research on the Method of Light Intensity Detection based on Kalman Filtering

A light intensity detection algorithm using Kalman filtering is proposed for the usage of data fusion in multi-sensor scenarios, like industrial control, machine vision, and navigation systems. In traditional measurements, the result is often faced with noise interference, causing accuracy problems. This algorithm Kalman filtering can be a good solution to noise signal reduction and provide optimal estimation in various domains that need prediction. As Kalman filtering is suitable for light intensity measurements, This work experimented with the steps shown below. First, the light intensity data is reported by sensors, and the mean and standard deviation of the measurement data are calculated; Second, by introducing a Kalman filtering model into the detecting model, the precision of estimating is improved, and the reliability of the system is enhanced; Finally, the data and diagram are exported by Matlab, and the Kalman filtering algorithm is compared with classical algorithms like moving average, median filtering. The experimental data shows Kalman filtering can be better applied to state estimation and signal processing domains, and the average light intensity data is 949.744. This result supports that Kalman filtering provides a robust and efficient method and it bed-covers the future research in improving the precision in light intensity measurements.

Securing Industrial Control Systems: A Deep Dive into AI Approaches

In the era of increasingly interconnected infrastructures and the emergence of the Internet of Things (IoT), industrial control systems (ICS) are encountering a growing susceptibility to cyber threats. This paper delves into the growing adoption of artificial intelligence (AI) as a means to mitigate cybersecurity risks for ICS. AI-driven solutions play a pivotal role in detecting anomalies, pinpointing potential threats, and executing real-time responses to curtail risks. The authors extensively discuss the application of AI-based cybersecurity measures for ICS, encompassing techniques like anomaly detection, intrusion detection, and behavioral analysis. Furthermore, the narrative explores the challenges associated with implementing AI-centric cybersecurity solutions, such as concerns related to data privacy, system intricacies, and the imperative for continuous monitoring and updates. The authors draw upon case studies showcasing successful deployments of AI-driven cybersecurity solutions in industrial settings. Concluding the discussion, the authors propose a novel hybrid machine learning approach designed for anomaly detection in ICSs. This chapter serves as a comprehensive resource, shedding light on the role of AI in fortifying cybersecurity for industrial control systems. Its insights aim to enhance resilience against cyber-attacks, minimize the potential for system disruptions, and mitigate the risk of data breaches.

Safety and Security Risk Assessments in Cyber Physical Space

As technological advancements continue to bridge the gap between the digital and physical worlds, the integration of Cyber-Physical Systems (CPS) has become pervasive in critical infrastructure, industrial processes, and daily life. This research paper explores the multifaceted landscape of Cyber-Physical Systems Security, addressing the intricate challenges and emerging threats posed by the convergence of the digital and physical realms. The study investigates the vulnerabilities inherent in CPS, encompassing critical infrastructure systems, industrial control systems, and interconnected smart devices. Additionally, the paper examines contemporary security measures, risk mitigation strategies, and the role of advanced technologies in fortifying Cyber-Physical Systems against malicious cyber threats. Through a comprehensive analysis of existing frameworks and real-world case studies, this research aims to contribute valuable insights to the ongoing discourse on safeguarding the integrity, confidentiality, and availability of Cyber-Physical Systems in our interconnected and technology-driven society. The findings of this research are anticipated to inform cybersecurity practitioners, policymakers, and researchers alike, fostering a more resilient and secure foundation for the future of Cyber-Physical Systems.

Meta learning-based few-shot intrusion detection for 5G-enabled industrial internet

AbstractWith the formation and popularization of the 5G-enabled industrial internet, cybersecurity risks are increasing, and the limited number of attack samples, such as zero-day, leaves a short response time for security protectors, making it substantially more difficult to protect industrial control systems from new types of malicious attacks. Traditional supervised intrusion detection models rely on a large number of samples for training and their performance needs to be improved. Therefore, there is an urgent need for few-shot intrusion detection. Aiming at the above problems, this paper proposes a detection model based on a meta-learning framework, which aims to effectively improve the accuracy and real-time performance of intrusion detection, and designs a meta-learning intrusion detection model containing a sample generation module, a feature mapping module and a feature metric module. Among them, the sample generation module introduces the residual block into the Natural GAN and proposes a new method to generate high-quality antagonistic samples—Res-Natural GAN, which is used to enhance the antagonism of the generated samples and the feature mining degree, to improve the accuracy of malicious traffic detection; the feature mapping module proposes a new attention mechanism, the multi-head fast attention mechanism, which is applied to the encoder structure of the transformer and combined with a parameter optimization algorithm based on particle swarm mutation to shorten the mapping time and improve the real-time performance of the model while mapping the features effectively; the feature metric module proposes a prototype structure based on a prototype storage update algorithm and combines it with a prototype network to achieve correct classification by measuring the Euclidean distance between the detected samples and the class of prototypes, and to shorten the inference time while ensuring the detection accuracy; finally, the three modules are combined to form a real-time meta-learning intrusion detection model. To evaluate the proposed model, five different types of experiments are conducted on multiple public datasets. The experimental results show that the model has higher detection accuracy than the traditional model for both few-shot and zero-shot malicious attacks, and is not only applicable to 5G-enabled industrial internet, but also generalized to different network environments and attack types.

Energy Management for Hybrid Energy Storage System in Electric Based on Deep Deterministic Policy Gradient

In this paper, an intelligent control system design scheme based on deep deterministic policy gradient (DDPG) algorithm is proposed for the complex continuous action space problem in the hybrid energy storage system of electric vehicles. Firstly, the basic principle and internal logic of DDPG algorithm are introduced, including key elements such as Actor-Critic architecture, experience playback, target network, reward signal, policy gradient and value function update. Then, how to apply the DDPG algorithm to the industrial control system is described in detail. The Actor network learns the optimal strategy, the Critic network evaluates the value of the state-action pair, and uses the experience playback and the target network to improve the system stability and performance. Finally, the effect of the intelligent control system based on DDPG algorithm in complex environment is verified by simulation experiments. The results show that the system can effectively optimize the control strategy, improve the response speed and stability of the system, and has a good engineering application prospect.

Semi-supervised attack detection in industrial control systems with deviation networks and feature selection

Semi-supervised attack detection in industrial control systems with deviation networks and feature selection

NCMFuzzer: Using non-critical field mutation and test case combination to improve the efficiency of ICS protocol fuzzing

Industrial control systems (ICSs) have many vulnerabilities owing to the lack of protective measures. Once exploited, such vulnerabilities can result in significant economic loss and security concerns because an ICS controls the entire production process. Although fuzzing is a prevalent technique for finding potential vulnerabilities, current approaches have the disadvantages of blind mutations and low efficiency in vulnerability mining. In this study, we propose a personalized fuzzing method for ICS protocols based on non-critical field mutations and test case combinations. In our approach, we select appropriate protocol fields for personalized mutations based on the information entropy of each output, which can increase the diversity of test cases while preserving their availability. We developed a novel test case sending method that improves the efficiency of finding specific vulnerabilities by grouping related test cases. Our approach also introduces a detection method based on expected message validation to locate triggered vulnerabilities quickly. Compared to Peach and Boofuzz, our method improved the test target anomaly rate by 63.53% and 34.95%, respectively, and found one 0-day vulnerability and five n-day vulnerabilities.

Strategies for Software and Hardware Compatibility Testing in Industrial Controllers

Mass customization, small batch sizes, high variability of product types and a changing product portfolio during the life cycle of an industrial plant are current trends in the industry. Due to an increasing decoupling of the development of software and hardware components in an industrial context, compatibility problems within industrial control systems arise more and more frequently. In this publication, a strategy concept for compatibility testing is derived and discussed by means of a literature review and applied research. This four-phase strategy concept identifies incompatibilities between software and hardware components in the industrial control environment and enables test engineers to detect problems at an early stage. By automating the compatibility test on an external I-PC, the test can be run both when new software is installed on the industrial controller and when the controller is restarted. Thus, changes to the components are constantly detected and incompatibilities are avoided. Furthermore, early incompatibility detection can ensure that a system remains permanently operational. Based on a discussion, additional strategies are identified to consolidate the robustness and applicability of the presented concept.

Deriving Exact Mathematical Models of Malware Based on Random Propagation

The advent of the Internet of Things brought a new age of interconnected device functionality, ranging from personal devices and smart houses to industrial control systems. However, increased security risks have emerged in its wake, in particular self-replicating malware that exploits weak device security. Studies modeling malware epidemics aim to predict malware behavior in essential ways, usually assuming a number of simplifications, but they invariably simplify the single most important subdynamics of malware: random propagation. In our previous work, we derived and presented the first exact mathematical model of random propagation, defined as the subdynamics of propagation of a malware model. The propagation dynamics were derived for the SIS model in discrete form. In this work, we generalize the methodology of derivation and extend it to any Markov chain model of malware based on random propagation. We also propose a second method of derivation based on modifying the simplest form of the model and adjusting it for more complex models. We validated the two methodologies on three malware models, using simulations to confirm the exactness of the propagation dynamics. Stochastic errors of less than 0.2% were found in all simulations. In comparison, the standard nonlinear model of propagation (present in ∼95% of studies) has an average error of 5% and a maximum of 9.88% against simulations. Moreover, our model has a low mathematical trade-off of only two additional operations, being a proper substitute to the standard literature model whenever the dynamical equations are solved numerically.