Industrial Control Systems Security Research Articles

Design Considerations for Building Credible Security Testbeds: Perspectives from Industrial Control System Use Cases

ABSTRACT This paper presents a mapping framework for design factors and an implementation process for building credible Industrial Control Systems (ICS) security testbeds. The security and resilience of ICSs has become a critical concern to operators and governments following widely publicised cyber security events. The inability to apply conventional Information Technology security practice to ICSs further compounds challenges in adequately securing critical systems. To overcome these challenges, and do so without impacting live environments, testbeds are widely used for the exploration, development, and evaluation of security controls. However, how a testbed is designed and its attributes, can directly impact not only its viability but also its credibility. Combining systematic and thematic analysis, and the mapping of identified ICS security testbed design attributes, we propose a novel relationship map of credibility-supporting design factors (and their associated attributes) and a process implementation flow structure for ICS security testbeds. The framework and implementation process highlight the significance of demonstrating some design factors such as user/experimenter expertise, clearly defined testbed design objectives, simulation implementation approach, covered architectural components, core structural and functional characteristics covered, and evaluations to enhance confidence, trustworthiness and acceptance of ICS security testbeds as credible. These can streamline testbed requirement definition, improve design consistency and quality while reducing implementation costs.

Information Security and Adoptable Solutions in the Implementation of Industry 4.0 Strategy for the Fourth-generation Industrial Revolution

Industry 4.0 is recognized as the fourth-generation industrial revolution, which can drive the development of the world’s smart manufacturing industry. The information security in the implementation of Industry 4.0 strategy was analyzed in this article. The specific measures to ensure the information security of Industry 4.0 were proposed from the perspectives of industrial control system security strategy, security measures, security awareness, data security protection, data security responsibility, and encryption technology. Furthermore, the distributed control system and IT network security communication platform construction are applied to solve the information security problem of Industry 4.0. The adoptable solutions will provide an important reference to maintain the information security of Industry 4.0.

A Risk-Based Dynamic Decision-Making Approach for Cybersecurity Protection in Industrial Control Systems

Decision-making is a key component of industrial control system (ICS) security. However, due to the stability and real-time requirements of ICSs, current decision-making approaches typically designed for IT systems are not entirely suitable for ICSs. In this paper, with consideration of the characteristics of ICSs, a risk-based multistep dynamic decision-making approach for protecting ICSs is proposed. Following this proposal, multiple models, including multilayer Bayesian network, process model, and attack-defense strategy model are built first. On this basis, a state controller is designed to ensure the safe degradation/upgradation of ICSs. Finally, a game theory-based optimal defense strategy generation approach is presented. To verify the effectiveness of the proposed approach, a simulation on a simplified chemical reactor control system is conducted in MATLAB. The simulation results clearly demonstrate that the proposed dynamic decision-making approach has the ability to generate the optimal defense strategy to minimize system loss.

Managing Cyber Security Risks of the Cyber-Enabled Ship

One aspect of the digital transformation process in the shipping industry, a process often referred to as Shipping 4.0, is the increased digitization of on board systems that goes along with increased automation in and autonomy of the vessel. This is happening by integrating Information Technology with Operation Technology systems that results in Cyber Physical Systems on which the safe operations and sailing of contemporary and future vessels depend. Unavoidably, such highly interconnected and interdependent systems increase the exposure of the vessel’s digital infrastructure to cyber attacks and cyber security risks. In this paper, we leverage the STRIDE and DREAD methodologies to qualitatively and quantitatively assess the cyber risk of Cyber Physical Systems on board digitalized contemporary and future ships. Further, we propose appropriate cyber security baseline controls to mitigate such risks, by applying a systematic approach using a set of criteria that take into account the security requirements; the cyber risks; the possible attacks; and the possibly already existing controls, to select from the list of controls provided in the Industrial Control Systems (ICS) overlay of the NIST Guide to ICS Security. The results are expected to support the decision-making and the design of a security architecture for the cyber-enabled ship.

False data injection attacks and the insider threat in smart systems

Smart networks and smart city systems, which are increasing in use with new approaches every day, are now in the investment plan of each state. At many points, these two concepts combine. Industrial Control Systems (ICS), which constitute the infrastructure of these systems, have opened to external networks due to the requirements of the era. Once smart grids are integrated with smart cities, ICS left its isolated structure. This process has emerged more security vulnerabilities. In this study, False Data Injection (FDI) attack was carried out to change the memory address values of Programmable Logic Controller (PLC)s which is an important component of ICS. Initially, the feasibility of the attack was examined. Thereafter, in the event of an attack, the effect on the systems was revealed. Eventually, important software and hardware solution suggestions to prevent the attack are mentioned. Thus, in the possible cyber attacks that may occur, it is aimed to recover critical systems with minimum damage and make them to be operational as soon as possible. It is considered that this study will make important contributions to other studies regarding ICS security.

Attack signal estimation for intrusion detection in industrial control system

Intrusion detection is one of the key techniques for the security of industrial control systems. Most existing intrusion detection methods only detect the existence and type of attacks without a more specific description of the attacks. Knowing the specific waveform of the attack signals can greatly facilitate the design of defense strategy. This paper investigates the attack signal estimation for intrusion detection of actuator false data injection attacks. Taking advantage of extended state observer, the attack signal is described as system disturbance and can be estimated. We propose two attack signal estimators, i.e., linear attack signal estimator (LASE) and nonlinear attack signal estimator (NASE). Through the analysis in the frequency domain, the influence of the attack signal frequency on the estimation performance of LASE is obtained. Both simulation and experimental results illustrate that the proposed estimators can achieve good performance.

A security study for Control Network: Security Threat Using Control Protocol

Unlike a general IT environment, an industrial control system is an environment where stability and continuity are more important than security. In the event of a security accident in the industrial control system, physical motion can be controlled, so physical damage can occur and physical damage can even result in personal injury. Cyber attacks on industrial control systems are not simply cyber damage, but terrorism. However, the security of industrial control systems has not been strengthened yet, and many vulnerabilities are actually occurring. This paper shows that the PLC can be remotely controlled by analyzing the connection process and packets for the PLC protocol used in the industrial control system and bypassing the security mechanism existing in the protocol. Through this, we intend to raise the security awareness of the industrial control system.

Industrial Control Systems (ICS): Cyber-attacks & Security Optimization

Cyber-security of digital industrial control system in reality is complex and challenging research area, due to various interconnections of electro-mechanical related components driving national critical infrastructures. These networked system components performs monitoring and controlling tasks in several industries and organization through the access of Internet connectivity across the world. More recently, there are myriad of security threats and attacks by malicious elements on ICS which now presents a priority to organizations and researchers for optimal security solutions. Development of the Internet and communication systems has also exacerbated such security concerns. Activities of cyber-attacks malicious elements on ICS may result in serious disaster in industrial environments, human casualties and loss. This paper critically looks at the SCADA/industrial control systems, architecture, cyber-attacks. Other aspect of the paper examines current ICS security technologies including a computational secured algorithm for PLC

A deep convolution generative adversarial networks based fuzzing framework for industry control protocols

A growing awareness is brought that the safety and security of industrial control systems cannot be dealt with in isolation, and the safety and security of industrial control protocols (ICPs) should be considered jointly. Fuzz testing (fuzzing) for the ICP is a common way to discover whether the ICP itself is designed and implemented with flaws and network security vulnerability. Traditional fuzzing methods promote the safety and security testing of ICPs, and many of them have practical applications. However, most traditional fuzzing methods rely heavily on the specification of ICPs, which makes the test process a costly, time-consuming, troublesome and boring task. And the task is hard to repeat if the specification does not exist. In this study, we propose a smart and automated protocol fuzzing methodology based on improved deep convolution generative adversarial network and give a series of performance metrics. An automated and intelligent fuzzing framework BLSTM-DCNNFuzz for application is designed. Several typical ICPs, including Modbus and EtherCAT, are applied to test the effectiveness and efficiency of our framework. Experiment results show that our methodology outperforms the existing ones like General Purpose Fuzzer and other deep learning based fuzzing methods in convenience, effectiveness, and efficiency.

Industrial control system security taxonomic framework with application to a comprehensive incidents survey

In recent years, the number of cyber-physical incidents in industrial control systems (ICSs) has increased. Providing a framework for ICS threat intelligence is of utmost importance because of the critical role of ICSs in the nations' critical infrastructures. In this paper, after a short review of various threats and security incidents’ taxonomies in the cyber-physical scope, we propose the Hierarchical Taxonomic Framework (HTF) with required characteristics for classifying attacks and security incidents in ICSs. We applied the HTF to analyze 268 available public security incidents on ICSs reported between 1982 and 2018. Among these 268 incidents, there are 147 attacks and 121 non-attack security incidents. The HTF and the analytical incidents study are carried out to extract the useful patterns and key points for organizing threat intelligence in ICSs and critical infrastructures to improve their security level according to the cyber-attacks trends.

Measuring cyber-physical security in industrial control systems via minimum-effort attack strategies

In recent years, Industrial Control Systems (ICS) have become increasingly exposed to a wide range of cyber-physical attacks, having massive destructive consequences. Security metrics are therefore essential to assess and improve their security posture. In this paper, we present a novel ICS security metric based on AND/OR graphs and hypergraphs which is able to efficiently identify the set of critical ICS components and security measures that should be compromised, with minimum cost (effort) for an attacker, in order to disrupt the operation of vital ICS assets. Our tool, META4ICS (pronounced as metaphorics), leverages state-of-the-art methods from the field of logical satisfiability optimisation and MAX-SAT techniques in order to achieve efficient computation times. In addition, we present a case study where we have used our system to analyse the security posture of a realistic Water Transport Network (WTN).

Vulnerability Mining Method for the Modbus TCP Using an Anti-Sample Fuzzer.

Vulnerability mining technology is used for protecting the security of industrial control systems and their network protocols. Traditionally, vulnerability mining methods have the shortcomings of poor vulnerability mining ability and low reception rate. In this study, a test case generation model for vulnerability mining of the Modbus TCP based on an anti-sample algorithm is proposed. Firstly, a recurrent neural network is trained to learn the semantics of the protocol data unit. The softmax function is used to express the probability distribution of data values. Next, the random variable threshold and the maximum probability are compared in the algorithm to determine whether to replace the current data value with the minimum probability data value. Finally, the Modbus application protocol (MBAP) header is completed according to the protocol specification. Experiments using the anti-sample fuzzer show that it not only improves the reception rate of test cases and the ability to exploit vulnerabilities, but also detects vulnerabilities of industrial control protocols more quickly.

Reinforcement learning-based detection method for malware behavior in industrial control systems

Due to the popularity of intelligent mobile devices, malwares in the internet have seriously threatened the security of industrial control systems. Increasing number of malware attacks has become a major concern in the information security community. Currently, with the increase of malware variants in a wide range of application fields, some technical challenges must be addressed to detect malwares and achieve security protection in industrial control systems. Although many traditional solutions have been developed to provide effective ways of detecting malwares, some current approaches have their limitations in intelligently detecting and recognizing malwares, as more complex malwares exist. Given the success of machine learning methods and techniques in data analysis applications, some advanced algorithms can also be applied in the detection and analysis of complex malwares. To detect malwares and consider the advantages of machine learning algorithms, we developed a detection framework for malwares that threatens the network security of industrial control systems through the combination of an advanced machine learning algorithm, i.e., reinforcement learning. During the implementation process, according to the actual needs of malware behavior detection, key modules including feature extraction, policy, and classification networks were designed on the basis of the intelligent features of reinforcement learning algorithms in relation to sequence decision and dynamic feedback learning. Moreover, the training algorithms for the above key modules were presented while providing the detailed functional analysis and implementation framework. In the application experiments, after preprocessing the actual dataset of malwares, the developed method was tested and the satisfactory classification performance for malware was achieved that verified the efficiency and effectiveness of the reinforcement learning-based method. This method can provide an intelligent decision aid for general malware behavior detection.

A Review of Cybersecurity Incidents in the Water Sector

This study presents a critical review of disclosed, documented, and malicious cybersecurity incidents in the water sector to inform safeguarding efforts against cybersecurity threats. The review is presented within a technical context of industrial control system architectures, attack-defense models, and security solutions. Fifteen incidents were selected and analyzed through a search strategy that included a variety of public information sources ranging from federal investigation reports to scientific papers. For each individual incident, the situation, response, remediation, and lessons learned were compiled and described. The findings of this review indicate an increase in the frequency, diversity, and complexity of cyberthreats to the water sector. Although the emergence of new threats, such as ransomware or cryptojacking, was found, a recurrence of similar vulnerabilities and threats, such as insider threats, was also evident, emphasizing the need for an adaptive, cooperative, and comprehensive approach to water cyberdefense.

An IIoT Based ICS to Improve Safety Through Fast and Accurate Hazard Detection and Differentiation

Safety and security of Industrial Control Systems (ICS) applied in many critical infrastructures is essential. In these systems, hazards can be due either to system failure or cyber-attacks factors. Accurate hazard detection and reducing reconfiguration time after hazard is one of the most important objectives in these systems. One of the procedures that can reduce the reconfiguration time is determining the cause of hazards and, based on the aforementioned factors, adopting the best commands in reconfiguration time. However, it is difficult to differentiate between different types of hazard because their effects on the system can be similar. With the advent of IoT into ICS, known as IIoT, it has become possible to differentiate the hazards through the adoption of data from different IIoT sensors in the environment. In this article, we propose a risk management approach that identifies hazards based on the physical nature of these systems with the support from the IIoT. The identified hazards fall into four categories: stealthy attack, random attack, transient failure, and permanent failure. Then, the reconfiguration process is run based on the proposed differentiation, which provides a better performance and reconfiguration time. In the experimental section, a fluid storage system is simulated, showing 97% correct differentiation of hazards and reducing in 60% the lost time in the system recovery reconfiguration.

ПРИНЦИПЫ ПОСТРОЕНИЯ МОДЕЛИ НАДЕЖНОСТИ СИСТЕМЫ УПРАВЛЕНИЯ КИБЕРБЕЗОПАСНОСТЬЮ АСУ ТП

The article considers the possibility of applying the reliability engineering theory for the quantification of cyber security level of industrial automation and control systems security. The reliability model was built and the reliability function for each component of the subsystem was determined. Analytical expressions for the cybersecurity management system uptime probabil-ity calculation are also given, and a system reliability model was built taking into account its subsystems.

Identifying Honeypots from ICS Devices Using Lightweight Fuzzy Testing

The security issues of industrial control systems (ICSs) have become increasingly prevalent. As an important part of ICS security, honeypots and antihoneypots have become the focus of offensive and defensive confrontation. However, research on ICS honeypots still lacks breakthroughs, and it is difficult to simulate real ICS devices perfectly. In this paper, we studied ICS honeypots to identify and address their weaknesses. First, an intelligent honeypot identification framework is proposed, based on which feature data type requirements and feature data acquisition for honeypot identification is studied. Inspired by vulnerability mining, we propose a feature acquisition approach based on lightweight fuzz testing, which utilizes the differences in error handling between the ICS device and the ICS honeypot. By combining the proposed method with common feature acquisition approaches, the integrated feature data can be obtained. The experimental results show that the feature data acquired is effective for honeypot identification.

Cyber Safety System by Implementing Integration of Expert Learning and Data Mining Concepts

the continuous growth in the rate of cyber-attacks in recent years uplifts the worry for the cyber security of industrial control systems. The current efforts of the cyber security system are depended on firewalls, data diodes and other basic methods for prevention of infringement. A cyber threat, intrusion or infringement detection system detects malicious or noxious activities by scanning a system and investigate digitally by employing “machine learning” and “data digging” techniques for handling dynamic and complex functioning of malicious assaults in computer systems and extracting essential information from an input data. In this research paper, the techniques we have used to complete this research may bring advancement in recognition rates, decrease the fault rate which also led to a decrease in the cost factor..

Industrial Control Intrusion Detection Approach Based on Multiclassification GoogLeNet-LSTM Model

Intrusion detection is essential for ensuring the security of industrial control systems. However, conventional intrusion detection approaches are unable to cope with the complexity and ever-changing nature of industrial intrusion attacks. In this study, we propose an industrial control intrusion detection approach based on a combined deep learning model for communication processes that use the Modbus protocol. Initially, the network packets are classified as carrying information and noncarrying information based on key fields according to the communication protocol used. Next, a template comparison approach is employed to detect the network packets that do not carry any information. Furthermore, an approach based on a GoogLeNet-long short-term memory model is used to detect the network packets that do carry information. This approach involves network packet sequence construction, feature extraction, and time-series level detection. Subsequently, the detected intrusions are classified into multiple categories through a Softmax classifier. A gas pipeline dataset of the Modbus protocol is used to evaluate the proposed approach and compare it with existing strategies. The accuracy, false-positive rate, and miss rate are 97.56%, 2.42%, and 2.51%, respectively, thus confirming that the proposed approach is suitable for intrusion detection in industrial control systems.

Cybersecurity in industrial control systems: Issues, technologies, and challenges

Industrial Control Systems (ICSs) play an important role in today’s industry by providing process automation, distributed control, and process monitoring. ICS was designed to be used in an isolated area or connected to other systems via specialised communication mechanisms or protocols. This setup allows manufacturers to manage their production processes with great flexibility and safety. However, this design does not meet today’s business requirements to work with state-of-the-art technologies such as Internet-of-Things (IoT) and big data analytics. In order to fulfil industry requirements, many ICSs have been connected to enterprise networks that allow business users to access real-time data generated by power plants. At the same time, this new design opens up several cybersecurity challenges for ICSs.We review possible cyber attacks on ICSs, identify typical threats and vulnerabilities, and we discuss unresolved security issues with existing ICS cybersecurity solutions. Then, we discuss how to secure ICSs (e.g., using risk assessment methodologies) and other protection measures. We also identify open security research challenges for ICSs, and we present a classification of existing security solutions along with their strengths and weaknesses. Finally, we provide future research directions in ICS security.