Industrial Control Systems Security Research Articles

SIRT: A distinctive and smart invasion recognition tool (SIRT) for defending IoT integrated ICS from cyber-attacks

With the rise of smart industries, Industrial Control Systems (ICS) has to move from isolated settings to networked environments to meet the objectives of Industry 4.0. Because of the inherent interconnection of these services, systems of this type are more vulnerable to cybersecurity breaches. To protect ICSs from cyberattacks, intrusion detection systems equipped with Artificial Intelligence characteristics have been used to spot unusual system behavior. The main research problem focused on this work is to guarantee ICS security, a variety of security strategies and automated technologies have been established in past literary works. However, the main problems they face include a high proportion of incorrect predictions, longer execution times, more complex system designs, and decreased efficiency. Thus, developing and putting in place a Smart Invasion Recognition Tool (SIRT) to defend critical infrastructure systems against new cyberattacks is the main goal of this project. This system cleans and normalizes the supplied ICS data using a unique preprocessing technique called Variational Data Normalization (VDN). Furthermore, a novel hybrid technique called Frog Leap-based Ant Movement Optimization (FLAMO) is applied to choose the most important and necessary features from normalized industrial data. Furthermore, the methodology of Weighted Bi-directional Gated Recurrent Network (WeBi-GRN) is utilized to precisely distinguish between genuine and malicious samples from information collected by ICS. This work validates and evaluates the performance findings using many assessment indicators and a range of open-source ICS data. According to the study's findings, the proposed SIRT model accurately classifies the different types of assaults from the industrial data with 99 % accuracy.

A Survey of Cyber Security and Safety in Industrial Control Systems

A Survey of Cyber Security and Safety in Industrial Control Systems

A novel generative adversarial network-based fuzzing cases generation method for industrial control system protocols

With the interconnection and networking of industrial control systems (ICS), security vulnerabilities in ICS protocols have become a major source of threats to these systems. In order to discover these vulnerabilities and maintain ICS security, generative adversarial network-based fuzz testing (Fuzzing) has been introduced as a popular method to discover vulnerabilities in industrial control system protocols (ICSPs). However, the current approach based on generative adversarial network fuzz testing suffers from problems in terms of compatibility and repetitive generation of test examples, and low acceptance rate. To address these issues, this paper proposes a fuzzing approach based on the synergy of Wasserstein Generative Intelligent Networks (WGAN) and Variation Autoencoder (VAE). In addition, we design an intelligent fuzz framework, WGGFuzz, to efficiently generate a large number of test cases while ensuring the accuracy of the testing results for efficiently generating a large number of test cases in a short period of time. The framework, which does not incorporate ICSPs applicable to a wide range of, shows through experiments that WGGFuzz can be able to achieve 91% in terms of TCRR, 1.41 in terms of ATE, and better performance in terms of DGD.

Enhancing Data Preservation and Security in Industrial Control Systems through Integrated IOTA Implementation

Within the domain of industrial control systems, safeguarding data integrity stands as a pivotal endeavor, especially in light of the burgeoning menace posed by malicious tampering and potential data loss. Traditional data storage paradigms, tethered to physical hard disks, are fraught with inherent susceptibilities, underscoring the pressing need for the deployment of resilient preservation frameworks. This study delves into the transformative potential offered by distributed ledger technology (DLT), with a specific focus on IOTA, within the expansive landscape of the Internet of Things (IoT). Through a meticulous examination of the intricacies inherent to data transmission protocols, we present a novel paradigm aimed at fortifying data security. Our approach advocates for the strategic placement of IOTA nodes on lower-level devices, thereby streamlining the transmission pathway and curtailing vulnerabilities. This concerted effort ensures the seamless preservation of data confidentiality and integrity from inception to storage, bolstering trust in the convergence of IoT and DLT technologies. By embracing proactive measures, organizations can navigate the labyrinthine terrain of data management, effectively mitigate risks, and cultivate an environment conducive to innovation and progress.

An improved autoencoder-based approach for anomaly detection in industrial control systems

Security is a complex issue in critical infrastructure like industrial control systems (ICS) since its leakages cause critical damage. Protecting the ICS environment from external threats, cyber-attacks, and natural disasters is important. Various works have been done on anomaly detection in ICS, and it has been identified that these proposed approaches are the sole models associated with them. Although there is a research gap in anomaly detection methodologies because of their computational complexity. To overcome the research gap of high false positive rate (precision), accuracy, and computational complexity in the literature, the study presents an Improved autoencoder (ImpAE) anomaly detection methodology for anomaly detection in ICS. The proposed methodology is a deep learning-based model to build anomaly detectors that alarm the attacks affecting ICS security. This methodology follows a flexible and modular design that permits a group of numerous detectors to get suitable detection. To express the suitability of the proposed model, we implemented it on the Secure water testbed (SWat) dataset, which is collected from a working water treatment plant. Experimental work shows that by using ImpAE, gaining a precision of 0.993 and an accuracy of 96%, in comparision to the existing results in the literature. With precision and accuracy, we gained a recall of 0.673 and an F1-Score of 0.771, which is better than the average of the other works. The used dataset was attained from ITrust Center, Singapore University of Digital Science, reliable for anomaly detection in an ICS environment.

Feasibility of Using Seq-GAN Model in Vulnerability Detection of Industrial Control Protocols

Continuous improvement of internet technology has driven the continuous progress and improvement of industrial control systems, and provided more support for security vulnerability detection in this field. Combining the GAN model, the detection model based on Seq-GAN in industrial control protocol vulnerabilities constructed in this article provides more options for further improving the security of industrial control systems, and can detect and analyse security vulnerabilities in industrial control protocols more efficiently and accurately. By comparing the performance of different models for security vulnerability detection, the Seq-GAN model has smaller prediction errors, can also obtain higher G-mean and F1-score values, and has sufficient reliability. At the same time, it can also improve the efficiency of vulnerability detection in industrial control systems, and can achieve better comprehensive detection performance. Therefore, the application of the Seq-GAN model in industrial control protocol vulnerability detection can provide more support for improving security detection in this field.

Enhancing Industrial Control System Security: An Isolation Forest-based Anomaly Detection Model for Mitigating Cyber Threats

Enhancing Industrial Control System Security: An Isolation Forest-based Anomaly Detection Model for Mitigating Cyber Threats

Risk assessment for industrial control systems based on asymmetric connection cloud and Choquet integral

Once industrial control systems are targeted by cyber-attacks, the consequences can be severe, including asset loss, environmental pollution, and public security risks. Risk assessment is an important way to ensure that industrial control systems operate efficiently, steadily and safely. The purpose of this paper is to develop a risk assessment model for industrial control systems based on asymmetric connection cloud and Choquet integral, which fully takes into account the fact that values of risk indicators are often fuzzy, random, asymmetrically distributed in finite intervals, and there are interactions among different indicators. To do so, we first establish a risk assessment index system to ensure the full reflection of availability, integrity, and confidentiality in the results of risk assessment for industrial control systems. Then we establish classification standards for each evaluation indicator based on the importance of assets, vulnerabilities, and threats in evaluating the risk of industrial control systems. Next we develop a risk assessment model based on asymmetric connection cloud and Choquet integral to determine the risk level of industrial control systems. In the following, an example is provided to demonstrate the feasibility and reliability of this proposed model. The experimental results have demonstrated a high level of credibility in assessing cyber-attacks by the proposed model, indicating its potential for analyzing the current security and risk posture of industrial control systems.

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

Industrial Control Systems (ICSs) have become the cornerstone of critical sectors like energy, transportation, and manufacturing. However, the burgeoning interconnectivity of ICSs has also introduced heightened risks from cyber threats. The urgency for robust ICS security validation has never been more pronounced. This paper provides an in-depth exploration of using the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework to validate ICS security. Although originally conceived for enterprise Information Technology (IT), the MITRE ATT&CK framework’s adaptability makes it uniquely suited to address ICS-specific security challenges, offering a methodological approach to identifying vulnerabilities and bolstering defence mechanisms. By zeroing in on two pivotal attack scenarios within ICSs and harnessing a suite of security tools, this research identifies potential weak points and proposes solutions to rectify them. Delving into Indicators of Compromise (IOCs), investigating suitable tools, and capturing indicators, this study serves as a critical resource for organisations aiming to fortify their ICS security. Through this lens, we offer tangible recommendations and insights, pushing the envelope in the domain of ICS security validation.

Graph Attention Network and Informer for Multivariate Time Series Anomaly Detection.

Time series anomaly detection is very important to ensure the security of industrial control systems (ICSs). Many algorithms have performed well in anomaly detection. However, the performance of most of these algorithms decreases sharply with the increase in feature dimension. This paper proposes an anomaly detection scheme based on Graph Attention Network (GAT) and Informer. GAT learns sequential characteristics effectively, and Informer performs excellently in long time series prediction. In addition, long-time forecasting loss and short-time forecasting loss are used to detect multivariate time series anomalies. Short-time forecasting is used to predict the next time value, and long-time forecasting is employed to assist the short-time prediction. We conduct a large number of experiments on industrial control system datasets SWaT and WADI. Compared with most advanced methods, we achieve competitive results, especially on higher-dimensional datasets. Moreover, the proposed method can accurately locate anomalies and realize interpretability.

Techniques for Enhancing Security in Industrial Control Systems

Increasingly Industrial Control Systems (ICS) systems are being connected to the Internet to minimise the operational costs and provide additional flexibility. These control systems such as the ones used in power grids, manufacturing and utilities operate continually and have long lifespans measured in decades rather than years as in the case of Information Technology (IT) systems. Such industrial control systems require uninterrupted and safe operation. However, they can be vulnerable to a variety of attacks, as successful attacks on critical control infrastructures could have devastating consequences to the safety of human lives as well as a nation’s security and prosperity. Furthermore, there can be a range of attacks that can target ICS and it is not easy to secure these systems against all known attacks let alone unknown ones. In this paper, we propose a software enabled security architecture using Software Defined Networking (SDN) and Network Function Virtualisation (NFV) that can enhance the capability to secure industrial control systems. We have designed such an SDN/NFV enabled security architecture and developed a Control System Security Application (CSSA) in SDN Controller for enhancing security in ICS by achieving real time situational awareness and dynamic policy-driven decision making across the network infrastructure. In particular, CSSA can be used for establishing secure path for end-to-end communication between devices and also deal against certain specific attacks namely denial of service attacks, from unpatched vulnerable control system components and securing the communication flows from the legacy devices that do not support any security functionality. We also discuss how CSSA provides reliable paths for safety critical messages in control systems. We discuss the prototype implementation of the proposed architecture and the results obtained from our analysis.

Exploration of Quantum Cryptography Security Applications for Industrial Control Systems

Abstract The exploration of security applications of quantum cryptography for industrial control systems is a key research effort aimed at enhancing the security of industrial control systems through quantum cryptography. In this paper, we study the security threats faced by industrial control systems, including network attacks, data leakage, and system tampering, and propose to utilize quantum key distribution and quantum invisible state transfer algorithms to ensure the secure transmission of industrial control system data. The simulation test environment of the upper and lower computers of the industrial control system is built. The quantum encryption and decryption algorithms are deployed in the embedded environment and PCs to test the effectiveness of quantum cryptography to enhance the advanced encryption standard key scheme. The experimental results show that the quantum cryptography technology successfully realizes the encryption and decryption of data, and the total time consumed in the whole process is less than 61.8 seconds, which meets the requirements of a real-time industrial control system. Therefore, quantum cryptography is suitable for protecting field-level data in industrial control systems.

A Tree-based Scheme to Assess the Safety and Security for Industrial Control Systems

A Tree-based Scheme to Assess the Safety and Security for Industrial Control Systems

Scrutinizing Security in Industrial Control Systems: An Architectural Vulnerabilities and Communication Network Perspective

Scrutinizing Security in Industrial Control Systems: An Architectural Vulnerabilities and Communication Network Perspective

Construction of Big Data Information Security Protection System in Industrial Internet Environment

Abstract With the continuous development and integration of information technology and industrialization-related technologies, industrial Internet control system security attacks occur frequently, and it is more and more important to build an information security protection system. This study focuses on the research improvement from two aspects of access control and intrusion prevention and designs an industrial Internet security access control strategy based on the homomorphic encryption algorithm of the Hyper Elliptic Curve Cryptosystem (HCC) and the key splitting algorithm based on threshold. Meanwhile, the convolutional neural network, two-way gating loop unit, and multi-head attention mechanism are integrated to construct the CMAG intrusion detection model. The encryption algorithm and CMAG model are applied and analyzed. The encryption and decryption times of this paper’s algorithm are both relatively smooth, with an average time consumption of about 1.93ms and 0.46ms, respectively, and significantly better than other algorithms with the increase in the number of bits. The throughput of this paper’s encryption algorithm is 13.68 KB/s, which is approximately 2 times, 19 times, and 29 times higher than the throughput of GM, ElGamal, and Paillier algorithms, respectively. The other algorithms cannot match its throughput rate during decryption. The CMAG model has an accuracy of 99.14%, which is better than that of the other models, and its average checking accuracy, average recall, and average F1-Score are 0.9889, 0.9783, and 0.9834, respectively, which are 1.25%-5.16%, 4.31%-7.19%, and 3.32%, respectively, compared with that of the other three algorithms. 7.19% and 3.32%-6.76%, respectively. This paper is of great practical significance for the construction and optimization of a big data information security protection system in an industrial Internet environment.

Dynamic Data Abstraction-Based Anomaly Detection for Industrial Control Systems

Industrial control systems (ICS) are critical networks directly linked to the value of core national and societal assets, yet they are increasingly becoming primary targets for numerous cyberattacks today. The ICS network, a fusion of operational technology (OT) and information technology (IT) networks, possesses a broad attack vector, and attacks targeting ICS often take the form of advanced persistent threats (APTs) exploiting zero-day vulnerabilities. However, most existing ICS security techniques have been adaptations of security technologies for IT networks, and security measures tailored to the characteristics of ICS data are currently insufficient. To mitigate cyber threats to ICS networks, this paper proposes an anomaly detection technique based on dynamic data abstraction. The proposed method abstracts ICS data collected in real time using a dynamic data abstraction technique based on noise reduction. The abstracted data are then used to optimize both the update rate and the detection accuracy of the anomaly detection model through model adaptation and incremental learning processes. The proposed approach updates the model by quickly reflecting data on new attack patterns and their distributions, effectively shortening the dwell time in response to APTs utilizing zero-day vulnerabilities. We demonstrate the attack response performance and detection accuracy of the proposed dynamic data abstraction-based anomaly detection technique through experiments using the SWaT dataset generated from a testbed of an actual ICS process. The experiments show that the proposed model achieves high accuracy with a small number of abstracted data while rapidly learning new attack pattern data in real-time without compromising accuracy. The proposed technique can effectively respond to cyberattacks targeting ICS by quickly learning and reflecting trends in attack patterns that exploit zero-day vulnerabilities.

Threat Attribution and Reasoning for Industrial Control System Asset

Due to the widespread use of the industrial internet of things, the industrial control system has steadily transformed into an intelligent and informational one. To increase the industrial control system's security, based on industrial control system assets, this paper provides a method of threat modeling, attributing, and reasoning. First, this method characterizes the asset threat of an industrial control system by constructing an asset security ontology based on the asset structure. Second, this approach makes use of machine learning to identify assets and attribute the attacker's attack path. Subsequently, inference rules are devised to replicate the attacker's attack path, thereby reducing the response time of security personnel to threats and strengthening the semantic relationship between asset security within industrial control systems. Finally, the process is used in the simulation environment and real case scenario based on the power grid, where the assets and attacks are mapped. The actual attack path is deduced, and it demonstrates the approach's effectiveness.

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies.

Industrial Control Systems (ICS), which include Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and Programmable Logic Controllers (PLC), play a crucial role in managing and regulating industrial processes. However, ensuring the security of these systems is of utmost importance due to the potentially severe consequences of cyber attacks. This article presents an overview of ICS security, covering its components, protocols, industrial applications, and performance aspects. It also highlights the typical threats and vulnerabilities faced by these systems. Moreover, the article identifies key factors that influence the design decisions concerning control, communication, reliability, and redundancy properties of ICS, as these are critical in determining the security needs of the system. The article outlines existing security countermeasures, including network segmentation, access control, patch management, and security monitoring. Furthermore, the article explores the integration of machine learning techniques to enhance the cybersecurity of ICS. Machine learning offers several advantages, such as anomaly detection, threat intelligence analysis, and predictive maintenance. However, combining machine learning with other security measures is essential to establish a comprehensive defense strategy for ICS. The article also addresses the challenges associated with existing measures and provides recommendations for improving ICS security. This paper becomes a valuable reference for researchers aiming to make meaningful contributions within the constantly evolving ICS domain by providing an in-depth examination of the present state, challenges, and potential future advancements.

Industrial cyber-physical systems protection: A methodological review

Ubiquitous utilization of Information and Communication Technologies in modern manufacturing plants has transformed them into Cyber-Physical Systems (CPSs), making them susceptible to cyber-attacks, which can have huge economic and social impact.In this paper, we focus on the security issues that may affect the Industrial Control System (ICS) supervising an industrial establishment. The purpose of this work is to provide readers with an up-to-date view of the methodologies that current literature suggests as the most appropriate to defend an ICS against cyber-attacks. We firstly provide a classification of existing attacks according to the methodology used by the attacker. Subsequently, we propose a classification of defensive countermeasures in Model and Artificial Intelligence-based approaches by analyzing most recent research contributions. Furthermore, we describe the most used datasets in literature that are available to researchers and practitioners. We conclude the paper by discussing today's open issues, which need to be addressed to cope with the increasing complexity of ICS security.

Survey on Application of Trusted Computing in Industrial Control Systems

The Fourth Industrial Revolution, also known as Industrial 4.0, has greatly accelerated inter-connectivity and smart automation in industrial control systems (ICSs), which has introduced new challenges to their security. With the fast growth of the Internet of Things and the advent of 5G/6G, the collaboration of Artificial Intelligence (Al) and the Internet of Things (loT) in ICSs has also introduced lots of security issues as it highly relies on advanced communication and networking techniques. Frequent ICS security incidents have demonstrated that attackers have the ability to stealthily breach the current system defenses and cause catastrophic effects to ICSs. Thankfully, trusted computing technology, which has been a popular research topic in the field of information security in recent years, offers distinct advantages when applied to ICSs. In this paper, we first analyze the vulnerabilities of ICSs and the limitations of existing protection technologies. Then, we introduce the concept of trusted computing and present a security framework for ICSs based on Trusted Computing 3.0. Finally, we discuss potential future research directions.