Safety Of Industrial Control Systems Research Articles

Modeling and reliability verification of industrial control network protocol based on time state transition matrix

SummaryWith the improvement of industrial informatization, various industrial control system network protocols have also been widely used. The reliability of these protocols will directly affect the safety of industrial control systems. As an effective method that can automatically analyze system reliability, model checking has been widely used in the verification of various safety‐critical systems. In this paper, we propose a modeling design method for industrial control network protocol based on time semantic reconstruction of time state transition matrix (TSTM). In addition, we provide a TSTM model checking method based on linear temporal logic (LTL). In order to effectively alleviate the state space explosion, the method adopts bounded model checking (BMC) technology. Furthermore, we implement a TSTM model verification tool called ICPV. Finally, we apply the above method to the modeling and verification of the industrial control network protocol Powerlink and through a comparison experiment with UPPAAL to illustrate the effectiveness of the method proposed in this paper.

Control System Cyber Incidents Are Real—and Current Prevention and Mitigation Strategies Are Not Working

There is a disconnect between the assumptions and practices within the IT and operational technology communities. This article highlights the disparities in the context of the security and safety of industrial control systems.

Abnormal flow detection in industrial control network based on deep reinforcement learning

Industrial control systems are the brain and central nervous system of a country’s vital infrastructure. Once the control system collapses, the consequences are unimaginable. Therefore, the safety of industrial control system has become the top priority in the field of safety. Aiming at the problem that the traditional abnormal flow detection model in the industrial control system is not accurate in identifying abnormalities, we combine the perception ability of deep learning with the decision-making ability of reinforcement learning, and propose an abnormal flow detection model based on deep reinforcement learning. The neural network is used to extract the features of the preprocessed dataset, and then the learning strategy can be adjusted according to the special advantages of strengthening the decision-making ability of learning and feedback. The experimental results show that the model based on deep reinforcement learning can achieve 98.06% accuracy in abnormal flow detection.Compared with various methods proposed by peers in current literature, this method is superior to other technologies in four evaluation indexes including accuracy rate, accuracy rate, recall rate and F1 score, among which the accuracy is increased by 2 percentage points.

A User-Friendly Verification Approach for IEC 61131-3 PLC Programs

Programmable logic controllers (PLCs) are special embedded computers that are widely used in industrial control systems. To ensure the safety of industrial control systems, it is necessary to verify the correctness of PLCs. Formal verification is considered to be an effective method to verify whether a PLC program conforms to its specifications, but the expertise requirements and the complexity make it hard to be mastered and widely applied. In this paper, we present a specification-mining-based verification approach for IEC 61131-3 PLC programs. It only requires users to review specifications mined from the program behaviors instead of model checking for specified specifications, which can greatly improve the efficiency of safety verification and is much easier for control system engineers to use. Moreover, we implement a proof-of-concept tool named PLCInspector that supports directly mining LTL specifications and data invariants from PLC programs. Two examples and one real-life case study are presented to illustrate its practicability and efficiency. In addition, a comparison with the existing verification approaches for PLC programs is discussed.

Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network

The massive use of information technology has brought certain security risks to the industrial production process. In recent years, cyber-physical attacks against industrial control systems have occurred frequently. Anomaly detection technology is an essential technical means to ensure the safety of industrial control systems. Considering the shortcomings of traditional methods and to facilitate the timely analysis and location of anomalies, this study proposes a solution based on the deep learning method for industrial traffic anomaly detection and attack classification. We use a convolutional neural network deep learning representation model as the detection model. The original one-dimensional data are mapped using the feature mapping method to make them suitable for model processing. The deep learning method can automatically extract critical features and achieve accurate attack classification. We performed a model evaluation using real network attack data from a supervisory control and data acquisition (SCADA) system. The experimental results showed that the proposed method met the anomaly detection and attack classification needs of a SCADA system. The proposed method also promotes the application of deep learning methods in industrial anomaly detection.

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Facing the increasingly serious security problems in ICS, how to classify and generate threat intelligence effectively is of great importance in improving the safety of industrial control systems, helping them identify security threats and making corresponding preventions. In this paper, according to the classification of security events in the threat intelligence platform, we classify ICS security topic texts as information leakage, security vulnerabilities, network security, security suggestions, invasion, malware, or security events. Based on the OpenIOC framework, automatically analysis on the massive ICS security data can be done to generate the corresponding IOC file and obtain threat intelligence.