Operational Technology Networks Research Articles

Comparative Analysis of Classification Methods and Suitable Datasets for Protocol Recognition in Operational Technologies

The interconnection of Operational Technology (OT) and Information Technology (IT) has created new opportunities for remote management, data storage in the cloud, real-time data transfer over long distances, or integration between different OT and IT networks. OT networks require increased attention due to the convergence of IT and OT, mainly due to the increased risk of cyber-attacks targeting these networks. This paper focuses on the analysis of different methods and data processing for protocol recognition and traffic classification in the context of OT specifics. Therefore, this paper summarizes the methods used to classify network traffic, analyzes the methods used to recognize and identify the protocol used in the industrial network, and describes machine learning methods to recognize industrial protocols. The output of this work is a comparative analysis of approaches specifically for protocol recognition and traffic classification in OT networks. In addition, publicly available datasets are compared in relation to their applicability for industrial protocol recognition. Research challenges are also identified, highlighting the lack of relevant datasets and defining directions for further research in the area of protocol recognition and classification in OT environments.

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

The swift embrace of Industry 4.0 paradigms has led to the growing convergence of Information Technology (IT) networks and Operational Technology (OT) networks. Traditionally isolated on air-gapped and fully trusted networks, OT networks are now becoming more interconnected with IT networks due to the advancement and applications of IoT. This expanded attack surface has led to vulnerabilities in Cyber–Physical Systems (CPSs), resulting in increasingly frequent compromises with substantial economic and life safety repercussions. The existing methods for the anomaly detection of security threats typically use simple threshold-based strategies or apply Machine Learning (ML) algorithms to historical data for the prediction of future anomalies. However, due to the high levels of heterogeneity across different CPS environments, minimizing the opportunities for transfer learning, and the scarcity of real-world data for training, the existing ML-based anomaly detection techniques suffer from a poor predictive performance. This paper introduces a hybrid anomaly detection approach designed to identify threats to CPSs by combining the signature-based anomaly detection typically utilized in IT networks, the threshold-based anomaly detection typically utilized in OT networks, and behavioural-based anomaly detection using Ensemble Learning (EL), which leverages the strengths of multiple ML algorithms against the same dataset to increase the accuracy. Multiple public research datasets were used to validate the proposed approach, with the hybrid methodology employing a divide-and-conquer strategy to offload the detection of certain cyber threats to computationally inexpensive signature-based and threshold-based methods using domain knowledge to minimize the size of the behavioural-based data needed for ML model training, thus achieving a higher accuracy over a reduced timeframe. The experimental results showed accuracy improvements of 4–7% over those of the conventional ML classifiers in performing anomaly detection across multiple datasets, which is particularly important to the operators of CPS environments due to the high financial and life safety costs associated with interruptions to system availability.

Development of a stacked hybrid Decision Tree model leveraging the NSL-KDD dataset

Intrusion detection in information technology as well as operational technology networks is highly required in modern day systems due to the increased spate of cyber-attacks in both number and complexity. Anomaly-based intrusion detection systems which have the capacity to detect novel or zero-day attacks are highly employed in this regard. One important component of anomaly-based intrusion detection systems which ensures their behaviour is artificial intelligence in general and machine learning in particular. The burden in modern day cybersecurity research is to investigate and develop models that can outperform existing ones. This paper is aimed at developing a hybrid decision tree model using the stacking ensemble approach. Performances were measured on the basis of recall, precision, accuracy, F1-score, receiver operating characteristics and confusion matrices. The hybrid model presented a precision of 97%, accuracy of 81%, F1-score of 80% and AUC score of 0.96, respectively.

A hybrid methodology for anomaly detection in Cyber–Physical Systems

The rapid adoption of Industry 4.0 has seen Information Technology (IT) networks increasingly merged with Operational Technology (OT) networks, which have traditionally been isolated on air-gapped and fully trusted networks. This increased attack surface has resulted in compromises of Cyber–Physical Systems (CPS) with significant economic and life safety consequences. This paper proposes a hybrid model of anomaly detection of security threats to CPS by blending the signature-based and threshold-based Intrusion Detection Systems (IDS) commonly used in IT networks, with a Machine Learning (ML) model designed to detect behaviour-based anomalies in OT networks. This hybrid model achieves more rapid detection of known threats through signature-based and threshold-based detection strategies, and more accurate detection of unknown threats via behaviour-based anomaly detection using ML algorithms.

Cybersecurity Resilience Demonstration for Wind Energy Sites in Co-Simulation Environment

Sandia National Laboratories and Idaho National Laboratory deployed state-of-the-art cybersecurity technologies within a virtualized, cyber-physical wind energy site to demonstrate their impact on security and resilience. This work was designed to better quantify cost-benefit tradeoffs and risk reductions when layering different security technologies on wind energy industrial control system, operational technology networks. Standardized step-by-step attack scenarios were drafted for adversaries with remote and local access to the wind network. Then, the team investigated the impact of encryption, access control, intrusion detection, security information and event management, and security, orchestration, automation, and response (SOAR) tools on multiple metrics, including physical impacts to the power system and termination of the adversary kill chain. We found, once programmed, the intrusion detection systems could detect attacks and the SOAR system was able to effectively and autonomously quarantine the adversary, prior to impacting the power system. Cyber and physical metrics indicated good network and endpoint visibility were essential to demonstrate the resilience of the system. In particular, certain hardening technologies, like encryption, reduced access to the adversaries, but recognition and response were able to ensure there was no impact to the operation of the wind site generators.

Aggregate attack surface management for network discovery of operational technology

Interconnectivity has become a substratum of technology as the benefits of data-driven functionality are being realized in nearly all industries. Increased connectivity of Operational Technology (OT) exacerbates cyber risks because Industrial Control Systems (ICS) are becoming exposed to the Internet. These exposures are often done inadvertently through misconfigurations as additional network devices come online. Attack surface management (ASM) platforms can be used to identify vulnerabilities by performing external network discovery over the Internet using web spiders. These web spiders enable big data analytics of Internet of Things (IoT) devices as identifiable information of Internet-exposed equipment are archived in searchable databases that are made publicly available. There are a multitude of ASM service providers on the market. This study was conducted to evaluate several commonly known tools to determine the aggregate attack surface of control systems. Queries were crafted by targeting commonly known manufacturers and communication protocols found in OT networks. Identified devices were that categorized based on technology types. Each query was replicated between several tools to target identical ICS equipment. Findings in this paper suggested a significant variance in the exposures discovered by each tool, but unique contributions were identified for each tool when a merged attack surface was derived. Therefore, all tools should be used in aggregate.

A Study on Performance Metrics for Anomaly Detection Based on Industrial Control System Operation Data

Recently, OT (operational technology) networks of industrial control systems have been combined with IT networks. Therefore, OT networks have inherited the vulnerabilities and attack paths existing in IT networks. Consequently, attacks on industrial control systems are increasing, and research on technologies combined with artificial intelligence for detecting attacks is active. Current research focuses on detecting attacks and improving the detection accuracy. Few studies exist on metrics that interpret anomaly detection results. Different analysis metrics are required depending on the characteristics of the industrial control system data used for anomaly detection and the type of attack they contain. We focused on the fact that industrial control system data are time series data. The accuracy and F1-score are used as metrics for interpreting anomaly detection results. However, these metrics are not suitable for evaluating anomaly detection in time series data. Because it is not possible to accurately determine the start and end of an attack, range-based performance metrics must be used. Therefore, in this study, when evaluating anomaly detection performed on time series data, we propose a range-based performance metric with an improved algorithm. The previously studied range-based performance metric time-series aware precision and recall (TaPR) evaluated all attacks equally. In this study, improved performance metrics were studied by deriving ambiguous instances according to the characteristics of each attack and redefining the algorithm of the TaPR metric. This study provides accurate assessments when performing anomaly detection on time series data and allows predictions to be evaluated based on the characteristics of the attack.

A Deep Learning Assisted Software Defined Security Architecture for 6G Wireless Networks: IIoT Perspective

The 6G wireless network is expected to drive cyber-physical systems (CPS) from merely connected things to securely connected intelligence. While 6G will offer real-time communication between cyber and physical entities, due to convergence of operational technology (OT) and information technology (IT) networks, security, and trustworthiness of the massive amount of data shared between cyber and physical entities will remain of great concern. Attackers having AI capability will be able to mount massive numbers of automated and novel attacks on the future 6G network. Human security specialists teaming with an AI-powered adaptive defense mechanism will be needed to counter emerging AI-based attacks on the massively connected CPS through 6G wireless networks. 6G networks are expected to add industrial immunity to IT, OT, and IIoT networks with the help of AI. 6G is expected to offer deep learning (DL) assisted security function virtualization (SFV) to support software defined security (SDS) architecture for dynamic defense mechanisms, intelligently monitor network traffic anomalies at different network endpoints and segments, and offer increased visibility across attack surfaces. In this article, we study the security challenges in 6G networks posed by the recent convergence of OT and IT networks and propose distributed DL-assisted SDS for 6G vertical that will autonomously detect, localize, and isolate security threats via SFV. Finally, we present future directions and the challenges ahead.

An SDN-Enabled Architecture for IT/OT Converged Networks: A Proposal and Qualitative Analysis under DDoS Attacks

Real-time business practices require huge amounts of data directly from the production assets. This new thirst for accurate and timely data has forced the convergence of the traditionally business-focused information technology (IT) environment with the production-focused operational technology (OT). Recently, software-defined network (SDN) methodologies have benefitted OT networks with enhanced situational awareness, centralized configuration, deny-by-default forwarding rules, and increased performance. What makes SDNs so innovative is the separation between the control plane and the data plane, centralizing the command in the controllers. However, due to their young age, the use of SDNs in the industry context has not yet matured comprehensive SDN-based architectures for IT/OT networks, which are also resistant to security attacks such as denial-of-service ones, which may occur in SDN-based industrial IoT (IIoT) networks. One main motivation is that the lack of comprehensive SDN-based architectures for IT/OT networks making it difficult to effectively simulate, analyze, and identify proper detection and mitigation strategies for DoS attacks in IT/OT networks. No consolidated security solutions are available that provide DoS detection and mitigation strategies in IT/OT networks. Along this direction, this paper’s contributions are twofold. On the one hand, this paper proposes a convergent IT/OT SDN-based architecture applied in a real implementation of an IT/OT support infrastructure called SIRDAM4.0 within the context of the SBDIOI40 project. On the other hand, this paper proposes a qualitative analysis on how this architecture works under DoS attacks, focusing on what the specific problems and vulnerabilities are. In particular, we simulated several distributed denial-of-service (DDoS) attack scenarios within the context of the proposed architecture to show the minimum effort needed by the attacker to hack the network, and our obtained experimental results show how it is possible to compromise the network, thus considerably worsening the performance and, in general, the functioning of the network. Finally, we conclude our analysis with a brief description on the importance of employing machine learning approaches for attack detection and for mitigation techniques.

A scalable factory backbone for multiple independent time-sensitive networks

Convergence of time-sensitive machine control networks as part of the operational technology (OT) with the ubiquitous information technology (IT) networks is an essential requirement for the ongoing digitalization of production. In this paper, we review the fundamental differences between both technologies, the challenges to be solved, existing and upcoming solutions like TSN and their limitations. Furthermore, we introduce an Ethernet extension for a backbone network at factory scale and line rates of 10 - 100Gbit/s. The backbone is intended to carry massive amounts of IT traffic together with the traffic of multiple independent OT networks at the precision of leading-edge field bus technologies in the sub-microsecond range. The backbone remains transparent and does not require changes to the attached OT sub-networks. We prove our claims by prototype measurements, interoperability tests and field trials.

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework.

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures. Its innovative approach has been broadly welcomed by both vendors and enterprise customers in the industry. Its usage extends from adversary emulation, red teaming, behavioral analytics development to a defensive gap and SOC (Security Operations Center) maturity assessment. While extensive research has been done on analyzing specific attacks or specific organizational culture and human behavior factors leading to such attacks, a holistic view on the association of both is currently missing. In this paper, we present our research results on associating a comprehensive set of organizational and individual culture factors (as described on our developed cyber-security culture framework) with security vulnerabilities mapped to specific adversary behavior and patterns utilizing the MITRE ATT&CK framework. Thus, exploiting MITRE ATT&CK’s possibilities towards a scientific direction that has not yet been explored: security assessment and defensive design, a step prior to its current application domain. The suggested cyber-security culture framework was originally designed to aim at critical infrastructures and, more specifically, the energy sector. Organizations of these domains exhibit a co-existence and strong interaction of the IT (Information Technology) and OT (Operational Technology) networks. As a result, we emphasize our scientific effort on the hybrid MITRE ATT&CK for Enterprise and ICS (Industrial Control Systems) model as a broader and more holistic approach. The results of our research can be utilized in an extensive set of applications, including the efficient organization of security procedures as well as enhancing security readiness evaluation results by providing more insights into imminent threats and security risks.

From Brown-Field to Future Industrial Networks, a Case Study

The network infrastructures in the future industrial networks need to accommodate, manage and guarantee performance to meet the converged Internet technology (IT) and operational technology (OT) traffics requirements. The pace of IT–OT networks development has been slow despite their considered benefits in optimizing the performance and enhancing information flows. The hindering factors vary from general challenges in performance management of the diverse traffic for green-field configuration to lack of outlines for evolving from brown-fields to the converged network. Focusing on the brown-field, this study provides additional insight into a brown-field characteristic to set a baseline that enables the subsequent step development towards the future’s expected converged networks. The case study highlights differences between real-world network behavior and the common assumptions for analyzing the network traffic covered in the literature. Considering the unsatisfactory performance of the existing methods for characterization of brown-field traffic, a performance and dynamics mixture measurement is proposed. The proposed method takes both IT and OT traffic into consideration and reduces the complexity, and consequently improves the flexibility, of performance and configuration management of the brown-field.

Security intelligence for industrial control systems

While there is a broad corpus of security intelligence technologies and solutions for IT (information technology) networks, only moderate experience and investment exists in applying security intelligence approaches to OT (operational technology) networks. OT networks have traditionally been isolated from IT networks, and therefore, security has been of minor concern. Given the trend toward interconnecting OT and IT networks for business reasons, and given the disclosure of highly sophisticated attacks against OT environments, OT network operators increasingly recognize the need to deploy security solutions that are widely known in IT also to OT. OT networks are running critical control processes. Configuration changes are avoided to reduce the risk of misconfiguration or unforeseeable side effects detrimental to the network's operation. Therefore, passive non-intrusive security technologies are favored. Consequently, security intelligence applied to passively collected network data is the most acceptable technology to be deployed in OT networks. In this paper, we show how IT-specific security intelligence techniques can be applied to passively collected OT network data. The techniques have been developed for protecting SCADA (Supervisory Control and Data Acquisition) systems and have been validated in an industrial cyber security testing laboratory.