Industrial Control System Network Research Articles

A Conceptual Architecture Design - Building Cyber Security Architecture for Industrial Control Systems Networks and for Critical Infrastructures

A Conceptual Architecture Design - Building Cyber Security Architecture for Industrial Control Systems Networks and for Critical Infrastructures

One-Dimensional Convolutional Wasserstein Generative Adversarial Network Based Intrusion Detection Method for Industrial Control Systems

The imbalance between normal and attack samples in the industrial control systems (ICSs) network environment leads to the low recognition rate of the intrusion detection model for a few abnormal samples when classifying. Since traditional machine learning methods can no longer meet the needs of increasingly complex networks, many researchers use deep learning to replace traditional machine learning methods. However, when a large amount of unbalanced data is used for training, the detection performance of deep learning decreases significantly. This paper proposes an intrusion detection method for industrial control systems based on a 1D CWGAN. The 1D CWGAN is a network attack sample generation method that combines 1D CNN and WGAN. Firstly, the problem of low ICS intrusion detection accuracy caused by a few types of attack samples is analyzed. This method balances the number of various attack samples in the data set from the aspect of data enhancement to improve detection accuracy. According to the temporal characteristics of network traffic, the algorithm uses 1D convolution and 1D transposed convolution to construct the modeling framework of network traffic data of two competing networks and uses gradient penalty instead of weight cutting in the Wasserstein Generative Adversarial Network (WGAN) to generate virtual samples similar to real samples. After a large number of data sets are used for verification, the experimental results show that the method improves the classification performance of the CNN and BiSRU. For the CNN, after data balancing, the accuracy rate is increased by 0.75%, and the accuracy, recall rate and F1 are improved. Compared with the BiSRU without data processing, the accuracy of the s1D CWGAN-BiSRU is increased by 1.34%, and the accuracy, recall and F1 are increased by 7.2%, 3.46% and 5.29%.

Unknown Attack Traffic Classification in SCADA Network Using Heuristic Clustering Technique

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition

Over the past few years, massive penetrations targeting an Industrial Control System (ICS) network intend to compromise its core industrial processes. So far, numerous advanced methods have been proposed to detect anomalous patterns in the numeric data streams with respect to the heterogeneous field devices involved in the industrial processes. These methods, despite reporting decent results, usually conduct system-wise detection instead of fine-grained anomalous pattern recognition at the device level. Furthermore, lacking explicit consideration of the exclusive process-related features with respect to each differentiated device, the fitness of their application in specified industrial processes is undermined. To tackle these issues, a GNN-based Attributed Heterogeneous Graph Analyzer (the AHGA) is designed to perform device-wise anomalous pattern detection via in-depth process-oriented associativity learning. The AHGA’s framework is constructed with four building blocks: a graph processor, a feature analyzer, a link inference decoder, and an anomaly detector. Its performance is assessed and compared against multiple link inference and anomaly detection baselines over 2 popular ICS datasets (SWaT and WADI). Comparative results demonstrate the AHGA’s reliability in capturing sophisticated process-oriented relations among heterogeneous devices as well as its effectiveness in boosting the performance of anomalous pattern recognition at device-level granularity.

A Conceptual Architecture Design - Building Cyber Security Architecture for Industrial Control Systems Networks and for Critical Infrastructures (Critical Architecture Protection Theory (CAP))

A Conceptual Architecture Design - Building Cyber Security Architecture for Industrial Control Systems Networks and for Critical Infrastructures (Critical Architecture Protection Theory (CAP))

Optimal switching control design for industrial networked control system with uncertain exogenous dynamics

Industrial networked control system performance can be compromised through introduction of intended attacks by intruders. Several ways have been reported in literature to introduce attacks like denial-of-service, packet dropout, and delays etc. in Industrial networked control system. Attacks may be designed based on the system knowledge gathered through eavesdropping process. This article deals with problem of constrained optimal switching control design with industrial networked control system (iNCS) through avoiding performance deteriorating uncertain exogenous dynamics. To characterize and detect the abnormal behaviour of iNCS a random distribution process is adopted which represent the attack sequence in the process on the plant side. The delays and packet loss are introduced through Bernoulii distribution process to express uncertainty of network and also attack introduced by intruders on either side of tightly coupled component. The iNCS performance is evaluated with uncertain exogenous dynamics i.e. packet loss 0%, 10%, 20%, 30%, delays, and malicious attack. The proposed design guarantees the transient and steady state performance of linear-time-invariant iNCS. The proposed design methodology evaluated under switching of optimal predictive control performance of networked system with simulation of numerical problem.

Detection and mitigation of field flooding attacks on oil and gas critical infrastructure communication

Industrial Cyber-Physical Systems (ICPS) are highly dependent on Supervisory Control and Data Acquisition (SCADA) for process monitoring and control. Such SCADA systems are known to communicate using various insecure protocols such as Modbus, DNP3, and Open Platform Communication (OPC) Data Access standards (providing access to real-time automation data), which are vulnerable to a range of attacks. This leads to increased cyber risks faced in critical infrastructures, especially in the Oil and Gas sector. One of the most popular and critical attacks deployed against such infrastructure is Denial of Service (DoS), as it can have severe consequences that range from financial loss to loss of life. Such attacks can disrupt the ability of an operator to control hazardous operations leading to potentially unsafe scenarios. A novel Field Flooding attack is described which takes advantage of the packet memory structure of the Modbus protocol to perform a DoS attack. This attack can cause overflowing of the memory bank allocated in the Programmable Logic Controller (PLC) for Modbus operations. The attack is deployed and evaluated on a real industrial testbed and its impact against the Mitre ATT&CK framework is assessed, in order to identify which tactics an adversary could use to compromise the system. A novel mechanism that utilises supervised machine learning to detect this attack in industrial control system networks is also described. Experimental results show that the proposed mechanism, using the XGBoost algorithm, can identify this attack with 99% accuracy.

Optimal Transmission Power and Controller Design for Networked Control Systems Under State-Dependent Markovian Channels

This article considers a codesign problem for industrial networked control systems to ensure both stability and efficiency properties of such systems. This problem is particularly challenging due to the fact that wireless communications in industrial environments are not only subject to shadow fading, but also stochastically correlated with their surrounding environments. This article first introduces a novel state-dependent Markov channel (SD-MC) model that explicitly captures the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">state-dependent features</i> of industrial wireless communication systems by defining the proposed model’s transition probabilities as a function of both environments’ states and transmission power. Under the SD-MC model, sufficient conditions on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Maximum Allowable Transmission Interval</i> are presented to ensure both <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">asymptotic stability in expectation</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">almost sure asymptotic stability</i> properties of a nonlinear control system with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">state-dependent fading channels</i> . Based on these stability conditions, the codesign problem is then formulated as a constrained polynomial optimization problem (CPOP), which can be efficiently solved using semidefinite programming methods for the case of a two-state SD-MC model. The solutions to such a CPOP represent optimal control and power strategies that optimize the average expected joint costs in an infinite time horizon while respecting the stability constraints. For a general SD-MC model, this article further shows that suboptimal solutions can be obtained from linear programming formulations of the considered CPOP. Simulation results are given to illustrate the efficacy of the proposed codesign scheme.

Modeling and reliability verification of industrial control network protocol based on time state transition matrix

SummaryWith the improvement of industrial informatization, various industrial control system network protocols have also been widely used. The reliability of these protocols will directly affect the safety of industrial control systems. As an effective method that can automatically analyze system reliability, model checking has been widely used in the verification of various safety‐critical systems. In this paper, we propose a modeling design method for industrial control network protocol based on time semantic reconstruction of time state transition matrix (TSTM). In addition, we provide a TSTM model checking method based on linear temporal logic (LTL). In order to effectively alleviate the state space explosion, the method adopts bounded model checking (BMC) technology. Furthermore, we implement a TSTM model verification tool called ICPV. Finally, we apply the above method to the modeling and verification of the industrial control network protocol Powerlink and through a comparison experiment with UPPAAL to illustrate the effectiveness of the method proposed in this paper.

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach.

False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. However, research using deep learning to reduce false alerts often requires the physical and cyber sensor data to be trustworthy. Implicit trust is a major problem for artificial intelligence or machine learning (AI/ML) in cyber-physical system (CPS) security, because when these solutions are most urgently needed is also when they are most at risk (e.g., during an attack). To address this, the Inter-Domain Evidence theoretic Approach for Inference (IDEA-I) is proposed that reframes the detection problem as how to make good decisions given uncertainty. Specifically, an evidence theoretic approach leveraging Dempster–Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from supervised-learning classifiers. Using this model, a location-cum-domain-based fusion framework is proposed to evaluate the detector’s performance using disjunctive, conjunctive, and cautious conjunctive rules. The approach is demonstrated in a cyber-physical power system testbed, and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, and general Bayesian theorem-based metrics as decision functions. To improve the performance, a multi-objective-based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.

Identification of Private ICS Protocols Based on Raw Traffic

With the development of the Industrial Internet in recent years, security issues have been a hot topic of the industrial control system (ICS) network management. Identifying the protocol traffic in the communication process of the ICS is an important prerequisite to avoid security problems, especially in ICSs that use many private protocols. The private protocols cannot be analyzed due to the unknown internal structure of the protocols, which makes the ICS protocol identification work more difficult. However, the Internet-oriented protocol identification method is not applicable to the scenario of the private ICS protocols network environment. With this problem in mind, this paper proposes a method of ICS protocol identification based on the raw traffic payload. The method firstly performs data preprocessing such as data selection, interception, cleaning conversion, and labeling on the raw traffic of the protocol based on the characteristics of the industrial control protocol. Then it uses an AM-1DCNN + LSTM deep learning model to extract temporal and spatial features of the ICS raw traffic, and performs protocol identification. This method can effectively extract ICS protocol features in scenarios where protocol parsing is impossible compared with existing methods. We constructed a dataset for ICS protocol identification based on open-source data and tested the proposed method for experiments, and the identification accuracy rate reached 93%.

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Design of an Adaptive Scheduling Algorithm for a Warp Knitting Machine Industrial Wireless Network Based on Fuzzy Control

Aiming at resolving the technical bottlenecks existing in current warp knitting machine control systems, such as the distributed industrial wireless networked control system, in this study the architecture of a warp knitting machine industrial wireless networked control system based on the WIA-PA international standard is proposed which provides a design idea for building a „smart factory”. Secondly, according to the WIA-PA specification, an allocation plan of time slots in a super-frame for intra-cluster and inter-cluster communication is given. Third, in order to enhance the real-time access of equipment, expand the network capacity, and reduce the energy consumption of the system, based on the carrier sense multiple access (CSMA) mechanism supported by IEEE STD 802.1 5.4:2006, an adjustment algorithm of the super-frame structure based on fuzzy control was designed. The effectiveness of the design method was verified by simulation.

Analysis of Cyber Threats in the Connection Section of the Control System and Countermeasures Required

In the past, the general practice for the control system network that manages and controls industrial facilities such as electric power, gas, oil, water, chemicals, automobiles, etc. was to install and operate this as an independent system, but over time the practice has gradually shifted toward the use of an open and standardized system. Until recently, most industrial control systems consisted of an independent network, and the possibility of cyber threat infringement was very low. As information storage media such as laptops or USB are connected to the control system for maintenance or management purposes, the possibility of cyber infringement is increasing. When the use of the control system's operational information increases due to beingVinked with the internal business system network or the Internet, countermeasures against external cyber threats must be provided.This paper analyzes and organizes the cyber threat factors that exist in the linking section connected to the industrial control system and other networks, examining domestic and foreign incidents of hacking of control systems to identify the vulnerabilities and security measures for each scenario in the control system network linkage section. Through this analysis, a method is suggested for establishing a control network that secures both availability and security, which are important in the control system, as well as the safe relay system in the configuration of the linkage between the control network and the business network, while addressing the vulnerabilities in the structure due to long-term use of the control system.This study analyzes cyber threat factors and real-life examples of infringements with the aim of providing approaches that will ensure industrial control systems can be operated safely and the risk of cyber hacking threats that occur in connection with other networks can be managed, and suggesting cyber security measures for the control system connection sections.

A three-tiered intrusion detection system for industrial control systems

Abstract This article presents three-tiered intrusion detection systems, which uses a supervised approach to detect cyber-attacks in industrial control systems networks. The proposed approach does not only aim to identify malicious packets on the network but also attempts to identify the general and finer grain attack type occurring on the network. This is key in the industrial control systems environment as the ability to identify exact attack types will lead to an increased response rate to the incident and the defence of the infrastructure. More specifically, the proposed system consists of three stages that aim to classify: (i) whether packets are malicious; (ii) the general attack type of malicious packets (e.g. Denial of Service); and (iii) finer-grained cyber-attacks (e.g. bad cyclic redundancy check, attack). The effectiveness of the proposed intrusion detection systems is evaluated on network data collected from a real industrial gas pipeline system. In addition, an insight is provided as to which features are most relevant in detecting such malicious behaviour. The performance of the system results in an F-measure of: (i) 87.4%, (ii) 74.5% and (iii) 41.2%, for each of the layers, respectively. This demonstrates that the proposed architecture can successfully distinguish whether network activity is malicious and detect which general attack was deployed.

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Cyberattacks can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyber-physical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injection-based Man-in- The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.

Review of Anomaly Detection Systems in Industrial Control Systems Using Deep Feature Learning Approach

Industrial Control Systems (ICS) or SCADA networks are increasingly targeted by cyber-attacks as their architectures shifted from proprietary hardware, software and protocols to standard and open sources ones. Furthermore, these systems which used to be isolated are now interconnected to corporate networks and to the Internet. Among the countermeasures to mitigate the threats, anomaly detection systems play an important role as they can help detect even unknown attacks. Deep learning which has gained a great attention in the last few years due to excellent results in image, video and natural language processing is being used for anomaly detection in information security, particularly in SCADA networks. The salient features of the data from SCADA networks are learnt as hierarchical representation using deep architectures, and those learnt features are used to classify the data into normal or anomalous ones. This article is a review of various architectures such as Convolutional Neural Network (CNN), Recurrent Neural Network (RNN), Stacked Autoencoder (SAE), Long Short Term Memory (LSTM), or a combination of those architectures, for anomaly detection purpose in SCADA networks.

Optimal Algorithm for Shared Network Communication Bandwidth in IoT Applications

In recent years, a variety of wired and wireless network communication protocols in the field of industrial control have become increasingly mature. The purpose of this paper is to provide a Shared network communication bandwidth optimization management algorithm for large-scale industrial networked control systems in Internet of things applications. This algorithm is based on the generalized geometric convex optimization method and can realize the optimal allocation of Shared network communication bandwidth resources. L2 networked control systems is used in this paper for the establishment of various numerical relations between the control performance and the communication network parameters. Based on the generalized geometric convex optimization method for the numerical relationship between convex analysis and fitting, convexity, and with the convex analysis and the numerical relationship between convexity fitting as constraint conditions, the results of integrity for networked control systems with large-scale resource allocation target will share the optimal management of network resources as a generalized geometric convex optimization problem. Using convex optimization software package for optimizing the optimal global solution of management problem, i. e. the optimal allocation of resources, the algorithm realizes the stability of each networked control system and achieve optimal L2 control performance. It is concluded that the predetermined transmission rate between the network node one and network node two, the data flow information sent by the network node two to the network node one is read, the delay time and packet loss rate between the two nodes are determined, the delay time is reduced by about 8 seconds, and the packet loss rate is greatly reduced by 78%.

Methodology to Determine the Device-Level Periodicity for Anomaly Detection in EtherCAT-Based Industrial Control Network

Continuous operation and monitoring of critical infrastructure networks are crucial to ensure their sustainability and security. To achieve these, industrial control system (ICS) networks and supervisory control and data acquisition (SCADA) systems are deployed in critical infrastructure assets. Many events in ICS networks present strong periodical patterns because of process repetition or cyclic communication. From the security viewpoint, inferring the periodicity primarily in the device-level communications where the actuator/sensor, field, and the cell-level transmissions are performed is important for detecting anomalies. The synchronization period and traffic pattern need to be known for anomaly detection. This article presents a novel periodicity detection approach specifically for Ethernet for control automation technology (EtherCAT) networks. It uses protocol-specific operations and fields for detecting device-level periodicity. Using the period, an anomaly detection method that uncovers traffic pattern statistics is also proposed. The periodicity can be detected with different precision, significance levels, and lag sizes. Four programmable logic controller (PLC) programs were developed to demonstrate the feasibility of the periodicity detection approach, and the periodicity was automatically obtained with high accuracy. As any malicious activity on the system causes variances in the periodic pattern, the approach was also tested on synthetic traffic traces that contain denial of service (DoS) and code-injection attacks. The traffic patterns were uncovered by an anomaly detection module, which was developed on a Snort intrusion detection/prevention system (IDS/IPS) and used the captured period. The tests demonstrated that intrusions that exploit communication patterns are fully flagged.

MODELING AND VALIDATING A SECURE INTERCONNECTION BETWEEN INDUSTRIAL CONTROL SYSTEM AND CORPORATE NETWORK USING COLORED PETRI NET

Industrial Control Systems (ICS) networks offer a high level of automation combined with high levels of control, quality,and process improvement. Since network corporate users have to access the ICS environment, these networks have to be interconnected. However, this interconnection can introduce risks to the systems and manufacturing processes, which leads to the need to ensure the interconnection is done safely. The objective of this paper is to perform modeling and validation of a proposed secure interconnection between ICS and corporate networks using Colored Petri Networks (CPN). In addition to the best practices published in related works, this paper recommends some integrated features like the use of terminal server service, secure manual uplinks, and unidirectional security gatewayto enhance environmental security. However, our main contribution is the validation process performed in a CPN, which made it possible to execute queries in the state space resulting from the simulation -that works as a proof of concept. As a result, thepaper presents a secure and validated model of interconnection between ICS and corporate networks, capable of being applied to any interconnection environment