Detecting cyberattacks in industrial control systems using online learning algorithms

PdGAT-ID: An intrusion detection method for industrial control systems based on periodic extraction and spatiotemporal graph attention

The integration of industrial control communication networks and the Internet into the Industrial Control System (ICS) increases their vulnerability to cyber-attacks, leading to devastating consequences. Traditional intrusion detection systems (IDS) mostly rely on predefined models and are trained mostly on specific cyber attacks, which means that traditional IDS cannot deal with unknown attacks In addition, most IDSs do not take into account the imbalance of ICS datasets, and therefore suffer from low accuracy and high false positives when used. In the article, we propose an NCO-double-layer DIFF_RF-OPFYTHON intrusion detection method for ICS, which consists of NCO modules, two-layer DIFF_RF modules, and OPFYTHON modules. Detected traffic will be divided into three categories by the two-layer DIFF_RF module: known attacks, unknown attacks, and normal traffic. Next, the known attacks will be classified by the OPFYTHON module into specific attacks according to the characteristics of the attack traffic. We use the NCO module to improve model inputs and improve model accuracy. The results show that the proposed method outperforms traditional intrusion detection methods such as XGboost and SVM. Detecting unknown attacks is also significant. The accuracy of the data set used in this article reaches 98.13%. The detection rate of unknown and known attacks reaches 98.21% and 95.1%, respectively. In this article, the basic modules of the classifier are shallow machine learning algorithms. This can be improved by using a more powerful neural network architecture. In the article, all detected unknown attacks are marked as one category. In further studies, the unknown attacks can be clustered and analyzed to further classify the detected unknown attacks. It is worth noting that the number of unknown attacks is only a small part, so it is difficult to classify unknown attacks using cluster analysis. Since training a more powerful neural network requires a lot of data, it is important to investigate how to train a new model when the number of samples belonging to that class is limited.

Cyber-threats are one of the most significant problems faced by modern Industrial Control Systems (ICS), such as SCADA (Supervisory Control and Data Acquisition) systems, as the vulnerabilities of ICS technology become serious threats that can ultimately compromise human lives. This situation demands a domain-specific approach to cyber threat detection within ICS, which is one of the most important contributions of the CockpitCI FP7 project (http://CockpitCI.eu). Specifically, this paper will present the CockpitCI distributed Intrusion Detection System (IDS) for ICS, which provides its core cyber-detection and analysis capabilities, also including a description of its components, in terms of role, operation, integration, and remote management. Moreover, it will also introduce and describe new domain-specific solutions for ICS security such as the SCADA Honeypot and the Shadow Security Unit, which are part of the CockcpitCI IDS framework.

Industrial Control Systems (ICS) monitor and control physical processes. The security of ICS has drawn the attention of many researchers since successful cyber-attacks against ICS can cause extensive damage in the physical world. Most of the existing literature describes solutions to protect an ICS against attacks directly targeting its underlying IT infrastructure. However, there are comparatively less works that focus on detecting cyber attacks against the physical process itself. Detection mechanisms that do so are said to be process aware. In this paper, we propose a time-based process aware intrusion detection system (IDS) that detects attacks against a physical process by leveraging its regular nature and temporal properties. The IDS learns the temporal behavior of the process variables and uses it to detect attacks. We evaluate the performance of our IDS on a public SCADA dataset and on a simulated SCADA system developed as part of this study, and we compare it with two other process-aware IDS proposed in the literature. The results show that our solution is able to detect attacks that are not detected by IDS that ignore temporal properties.

Adversarial attacks targeting industrial control systems, such as the Maroochy wastewater system attack and the Stuxnet worm attack, have caused significant damage to related facilities. To enhance the security of industrial control systems, recent research has focused on not only improving the accuracy of intrusion detection systems but also developing techniques to generate adversarial attacks for evaluating the performance of these intrusion detection systems. In this paper, we propose a deep reinforcement learning-based adversarial attack framework designed to perform man-in-the-middle attacks on industrial control systems. Unlike existing adversarial attack methods, our proposed adversarial attack scheme learns to evade detection by the intrusion detection system based on both the impact on the target and the detection results from previous attacks. For performance evaluation, we utilized a dataset collected from the secure water treatment (SWaT) testbed. The simulation results demonstrated that our adversarial attack scheme successfully executed man-in-the-middle attacks while evading detection by the rule-based intrusion detection system, which was defined based on the analysis of the SWaT dataset.

As an important part of guard system, intrusion detection systems have great significance to the security of industrial control systems. Cause the industrial control systems of the on-site environment is often very complicated, the process data extracted on-site have a wide variety of features, and they always have complex associations and are not independent. The intrusion detection algorithms for traditional industrial control systems often do not solve this problem, which results in a decrease in the accuracy, precision and high false negative rate (FNR), false positives rate (FPR). Aiming at solving the current problems, this paper proposes an algorithm combining the Fast Independent Principal Component Analysis (FastICA) and Support Vector Machine (SVM). Finally compared with the SVM and PCA-SVM algorithms, the experimental results show that the accuracy rate has been significantly improved and slight FPR.KeywordsIntrusion detectionFastICASVM

Ensuring the integrity of Ethernet-based networks is a challenging and constantly evolving domain. This problem is exacerbated for those operational technology (OT) networks supporting industrial control systems (ICS) since much of that equipment was originally designed to be on a network that was isolated and generally considered free of malefactors. Increasing pressure to bridge these systems with traditional information technology (IT) networks has introduced a bevy of new threats. In response, both academia and industry have responded with security solutions tailored to ICS environments. Deploying these protection systems often involves several configuration choices. While some of these choices are clear (e.g., block/enable protocol X) others are far more subjective (e.g. alert threshold == 3.43). Further complicating the situation, while often similar to IT networks, OT networks have unique challenges and characteristics that make the task of protecting them simultaneously more difficult and straight forward.Extant solutions for quantifying the relative security of intrusion detection systems fail to effectively support the operators of said systems with understanding the impact of various configuration changes. Further, they assume that the attacks are static and not subject to manipulation or alteration in the face of defenses. In this paper, we present a threat-based method for quantifying the relative impact of various security settings for intrusion detection systems (IDSs) within ICS environments. This method provides operational staff with a clear understanding of the relative impact of their settings and assumes that the attacks levied against them are dynamic. The model is described in detail, we apply the model to a synthetic data set, and discuss the inferences that can be made and what types of decisions they could be used to support.

With the continuous development of information technology, industrial control systems have become an importantpart of the national information infrastructure, and the network security risks are further complicated. It’s imperative to use new technologies and methods to detect and defend against attacks.This paper constructs the LightBGM-SVM model, tests it combined with the experimental data of industrial control system, and compares the differences of three common intrusion detection models in detection rate, false alarm rate and response time.The verificationresults show that the LightBGMSVM model is significantly better than the other two models in the test set verification. The application of this model to the intrusion detection of industrial control system has better accuracy, and further defines the optimization direction of intrusion detection for more complex industrial control system.

In this paper, we develop a specification-based, process-aware, Intrusion Detection System (IDS) for complex Industrial Control Systems (ICSs). Complex ICSs are distributed and hierarchical control systems built on top of local control loops which are the system's elementary building blocks. Process-aware attacks are sophisticated cyberattacks that aim to compromise the safety of the controlled physical process.Our approach aims to link safety specifications and security properties. Thus, we use international and industry standards specifications concerning local safety, global safety and networks of the industrial process, in order to obtain security properties. The obtained security properties are cybersecurity related requirements. They are translated into security patterns in order to be runtime monitored by our network IDS. This latter relies on a distributed monitoring framework, capturing network traffic between the local loops and the distributed control level, as well as between distributed control and supervisory control. We implemented and evaluated our IDS on a real ICS. We experimentally show that our IDS detects a large spectrum of attacks. We also show that our distributed IDS is scalable since its detection response time as a function of the number of monitored security patterns, is linear. A demonstrator comprising code extracts is made available.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

Industrial control systems (ICSs) operate a variety of critical infrastructures such as waterworks and power plants using cyber physical systems (CPSs). Abnormal or malicious behavior in these critical infrastructures can pose a serious threat to society. ICS networks tend to be configured such that specific tasks are performed repeatedly. Further, for a specific task, the resulting pattern in the ICS network traffic does not vary significantly. As a result, most traffic patterns that are caused by tasks that are normally performed in a specific ICS have already occurred in the past, unless the ICS is performing a completely new task. In such environments, anomaly-based intrusion detection system (IDS) can be helpful in the detection of abnormal or malicious behaviors. An anomaly-based IDS learns a statistical model of the normal activities of an ICS. We use the nearest-neighbor search (NNS) to learn patterns caused by normal activities of an ICS and identify anomalies. Our method learns the normal behavior in the overall traffic pattern based on the number of network packets transmitted and received along pairs of devices over a certain time interval. The method uses a geometric noise model with lognormal distribution to model the randomness on ICS network traffic and learns solutions through cross-validation on random samples. We present a fast algorithm, along with its theoretical time complexity analysis, in order to apply our method in real-time on a large-scale ICS. We provide experimental results tested on various types of large-scale traffic data that are collected from real ICSs of critical infrastructures.

In this study, a hybrid deep belief network (DBN) cyber intrusion detection system was proposed to provide a secure network by controlling network traffic in Industrial control systems (ICS). The disadvantages of DBN have been analyzed and improved to create attack detectors in network traffic. The output is combined with Softmax Regression for effective intrusion detection and classification detection. Training and testing of the hybrid DBN model were carried out with the actual and original data set generated by ICS. DBNs are a much-preferred approach for detecting malicious attacks in network traffic. In instances where there is a lot of data, it is important to select the most appropriate structure for the DBN model. Therefore, in the model the hidden layers are updated by contrastive divergence (CD), and the output layer is combined with the Softmax classifier. The proposed model architecture has proved successful in many limitations, such as the complexity and size of training data. The proposed hybrid DBN model provided 99.72% accuracy in intrusion detection and classification. These results showed that the model achieved better performance than the existing intrusion detection system (IDS). It also provided approximately 5% more accuracy improvements with the hybrid model than with older DBN-based systems.

A security testbed is an important aspect of Industrial Control System (ICS) security research. However, existing testbeds still have many problems in that they cannot fully simulate enterprise networks and ICS attacks. This paper presents a Multiple-Scenario Industrial Control System Testbed (MSICST), a hardware-in-the-loop ICS testbed for security research. The testbed contains four typical process scenarios: thermal power plant, rail transit, smart grid, and intelligent manufacturing. We use a combination of actual physical equipment and software simulations to build the process scenario sand table and use real hardware and software to build the control systems, demilitarized zone, and enterprise zone networks. According to the ICS cyber kill chain, the attacker is modeled, and two typical attack scenarios are constructed in the testbed. Through research into this security solution, whitelist-based host protection and a new Intrusion Detection System (IDS) are proposed and tested.

With the advent of the smart industry, Industrial Control Systems (ICS) moved from isolated environments to connected platforms to meet Industry 4.0 targets. The inherent connectivity in these services exposes such systems to increased cybersecurity risks. To protect ICSs against cyberattacks, intrusion detection systems (IDS) empowered by machine learning are used to detect abnormal behavior of the systems. Operational ICSs are not safe environments to research IDSs due to the possibility of catastrophic risks. Therefore, realistic ICS testbeds enable researchers to analyze and validate their IDSs in a controlled environment. Although various ICS testbeds have been developed, researchers’ access to a low-cost, extendable, and customizable testbed that can accurately simulate ICSs and suits security research is still an important issue.In this paper, we present ICSSIM, a framework for building customized virtual ICS security testbeds in which various cyber threats and network attacks can be effectively and efficiently investigated. This framework contains base classes to simulate control system components and communications. Simulated components are deployable on actual hardware such as Raspberry Pis, containerized environments like Docker, and simulation environments such as GNS-3. ICSSIM also offers physical process modeling using software and hardware in the loop simulation. This framework reduces the time for developing ICS components and aims to produce extendable, versatile, reproducible, low-cost, and comprehensive ICS testbeds with realistic details and high fidelity. We demonstrate ICSSIM by creating a testbed and validating its functionality by showing how different cyberattacks can be applied.

Introduction In the last chapter, we explored how to determine a cyber-attacker's optimal strategy for attacking a computer system based on malware and exploits available on the darkweb. In this chapter, we look at the case where the attacker is focused on industrial control systems (ICS): IT infrastructure that controls physical systems (electricity, water, industrial machinery, etc.). A critical feature of these complex ICS systems is the interdependencies among various components. However, despite the prevalence of markets for malware and exploits, and their potential threat to ICS, existing paradigms, including the framework presented in the previous chapter, do not account for the complex nature of ICS systems consisting of multiple interconnected components. In particular, it would prove useful to simulate a cyber-attack on a model of an existing system, to assess its degree of vulnerability. Such a model would also prove useful for automated cybersecurity systems that can learn defense and contingency strategies based on the model's simulations. This chapter takes the first steps toward addressing this need. In particular, we introduce a framework that allows for modeling of ICS systems with highly interconnected components (Section 7.3) and study this model through the lens of lattice theory [57]. We then turn our attention to the problem of determining the optimal/most dangerous strategy for a cyber-adversary with respect to this model and find it to be an NPComplete problem (Section 7.4). Next, we present a suite of algorithms for this problem based on A* search and introduce provably correct algorithms (Section 7.5). Our intuition is that these algorithms will obtain satisfactory performance in practice due to heuristic functions (for which we show admissibility). We demonstrate the performance of these algorithms by implementing them and performing a suite of experiments using both simulated and actual vulnerability data (Section 7.6). This chapter also includes some background on ICS (Section 7.2) and a brief overview of related work (Section 7.7). Background Contemporary cyber threat actors rely on a variety of malware and exploits purchased through various channels such as the darkweb [99] in order to carry out their attacks. The trend toward automation of industrial control systems (ICS) and toward “smart” utilities [50] has made understanding such adversarialbehavior directed against ICS a priority. For instance, code from the infamous Stuxnet [97] attack against Iranian nuclear facilities is available for public download.