Edge Computing and Security in Industrial Control Systems

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Machine learning has been widely studied in the security analysis of Industrial Control Systems (ICSs). However, in industrial scenarios, the amount of data as well as the speed of data generation are very different from standard machine learning data sets. Using these heterogeneous data and finding meaningful insights for practical security applications in ICSs is a big challenge. In addition, ICSs have been built for quite a long time. Security has not been seriously taken into account when ICSs were built. Security assessment or attack prevention cannot always be done in real time, as an ICS requires to be online all the time, especially when it comes to systems that affect critical infrastructure. In this work, we are motivated to a provide a clear and comprehensive survey of the state-of-the-art work that employs machine learning in security applications in ICSs, including vulnerability analysis, vulnerability detection and exploitation, anomaly detection and security assessment. Based on our in-depth survey, we highlight the issues of industrial protocol analysis with machine learning methods, provide the security applications with machine learning in ICSs and indicate the future directions.

Edge computing is widely recognized as a crucial technology for the upcoming generation of communication networks and has garnered significant interest from both industry and academia. Compared to other offloading models like cloud computing, it provides faster data processing capabilities, enhanced security measures, and lower costs by leveraging the proximity of the edge servers to the end devices. This helps mitigate the privacy concerns associated with data transfer in edge computing, by reducing the distance between the data source and the server. Raw data in typical edge computing scenarios still need to be sent to the edge server, leading to data leakage and privacy breaches. Federated Learning (FL) is a distributed model training paradigm that preserves end devices’ data privacy. Therefore, it is crucial to incorporate FL into edge computing to protect data privacy. However, the high training overhead of FL makes it impractical for edge computing. In this study, we propose to facilitate the integration of FL and edge computing by optimizing FL hyper-parameters, which can significantly reduce FL’s training overhead and make it more affordable for edge computing.

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Industry 4.0 is the German vision for the future of manufacturing, where smart factories use information and communication technologies to digitise their processes to achieve improved quality, lower costs, and increased efficiency. It is likely to bring a massive change to the way control systems function today. Future distributed control systems are expected to have an increased connectivity to the Internet, in order to capitalize on new offers and research findings related to digitalization, such as cloud, big data, and machine learning. A key technology in the realization of distributed control systems is middleware, which is usually described as a reusable software layer between operating system and distributed applications. Various middleware technologies have been proposed to facilitate communication in industrial control systems and hide the heterogeneity amongst the subsystems, such as OPC UA, DDS, and RT-CORBA. These technologies can significantly simplify the system design and integration of devices despite their heterogeneity. However, each of these technologies has its own characteristics that may work better for particular applications. Selection of the best middleware for a specific application is a critical issue for system designers. In this paper, we conduct a survey on available standard middleware technologies, including OPC UA, DDS, and RT-CORBA, and show new trends for different industrial domains.

Mobile Edge Computing (MEC) frameworks improve real-time data processing and system scalability by making networked game AI NPCs more responsive and flexible. MEC-based frameworks are tested for latency reduction and NPC real-time performance in complex and dynamic environments. Simulated and real-life user experiments evaluated the proposed system's response times, accuracy, and latency. Python simulations of network settings with different NPC concentrations and complexity produced massive datasets. NPC behaviour feedback was collected from 100 diverse users of various ages, genders, gaming experiences, and preferences. In low- to medium-density scenarios, the edge computing framework improved NPC responsiveness with low latency and high accuracy, enhancing player immersion. Due to the environment's complexity and NPC density, response times increased and accuracy decreased, requiring further optimisation for harsher conditions. Despite bugs and repetitive behaviours that suggested the Likert scale could be improved, the qualitative results praised the NPCs' lively conversation and realistic movements. Edge computing improves game AI and NPC realism with adaptive responses and real-time data processing. Scaling NPC densities and integrating edge computing with game architectures require more research. Next, improve NPC AI algorithms, reduce computational complexity and scalability, and expand testing environment game scenarios. Edge computing and AI techniques like deep learning and natural language processing can create immersive and engaging gaming experiences. This may present new gaming industry challenges and opportunities for innovation. Edge computing's real-time data processing and adaptive responses may change video game non-player characters.

With the evolution of fifth generation (5G) network technologies, network maintenance strategies have become increasingly complex, necessitating the use of predictive analysis enabled by Machine Learning (ML) algorithms. This paper emphasizes exploring how ML algorithms can further enhance predictive maintenance in 5G and future networks. It reviews the current literature on this interdisciplinary topic, identifying key ML models such as Decision Trees, Neural Networks, and Support Vector Machines, and discussing their benefits and limitations. Special attention is given to the methodologies in applying these models, handling of data stages, and the training process. Major challenges in implementing ML in the context of network maintenance, such as data privacy, data gathering, model training, and generalizability, are discussed. Furthermore, the research aims to go beyond predicting maintenance needs to introduce a proactive approach in improving overall network performance and pre-empting potential issues based on ML predictions. The paper also discusses possible future trends including advancements in ML algorithms, Automated Machine Learning (AutoML), Explainable AI, and others. The objective is to provide a comprehensive understanding of the current ML-based predictive maintenance field and outline possibilities for future research. The study finds that the application of ML algorithms continues to show promise in transforming the landscape of network management by improving predictive maintenance and proactive performance enhancement strategies. It remains a challenging yet important area in the context of 5G networks.

Detecting cyberattacks in industrial control systems using online learning algorithms

Purpose: The study sought to explore the impact of edge computing on real-time data processing. Methodology: The study adopted a desktop research methodology. Desk research refers to secondary data or that which can be collected without fieldwork. Desk research is basically involved in collecting data from existing resources hence it is often considered a low cost technique as compared to field research, as the main cost is involved in executive’s time, telephone charges and directories. Thus, the study relied on already published studies, reports and statistics. This secondary data was easily accessed through the online journals and library. Findings: The findings reveal that there exists a contextual and methodological gap relating to the impact of edge computing on real-time data processing. Preliminary empirical review reveled that edge computing significantly reduced latency and enhanced efficiency in real-time data processing across various industries by bringing computational resources closer to data sources. It highlighted the technology's ability to handle large volumes of IoT-generated data, improve security by localizing data processing, and drive innovation and economic growth through new applications and services. Edge computing's decentralized approach proved essential for reliable and robust data handling, particularly in critical sectors like healthcare and finance, ultimately solidifying its importance in the digital transformation landscape. Unique Contribution to Theory, Practice and Policy: The Diffusion of Innovations Theory, Resource-Based View (RBV) and Sociotechnical Systems Theory may be used to anchor future studies on edge computing on real-time data processing. The study recommended expanding theoretical frameworks to include the unique aspects of edge computing, investing in robust edge infrastructure, and developing standardized protocols and best practices. It emphasized the need for government incentives and supportive regulatory frameworks to promote adoption, and suggested that academic institutions incorporate edge computing into curricula. Additionally, the study called for ongoing research to address emerging challenges and opportunities, ensuring continuous advancement and effective implementation of edge computing technologies.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

The need for detection, identification and prediction of anomalies emerged just a short time ago. This task brings multiple challenges that are mainly associated with recording and detection of novel attacks and influences. It draws attention of experts in network security and diagnostics of information and industrial systems. Detection of anomalies in dynamic dataflows largely determines the efficiency of management of computer network information security within information and industrial systems. At the same time, the technology of dynamic dataflow prediction is also very important for building systems intended to detect anomalies in data protection within industrial control systems. Any automated systems are based on available computer capabilities and advances in management theory, mathematical modeling and optimizations methods. Processes that occur in industrial automated systems and that are reflected in dataflows being observed constitute complex multi-component processes, thus making it more complicated to predict such processes. In this case, complex multi-component time series data should be predicted at different (short-term, medium-term and long-term) time scales. A neural network architecture matching the structure of the multi-component time series being predicted should be built for generating a multi-component prediction. It is proposed to decompose the complex multi-component time series into several basic components using the digital signal processing technology, i. e. to perform a preliminary structural analysis of multi-component time series within the observed range of all time series that reflect operation of the industrial control system. Separate predictions with different time horizon are formed for each basic component of the multi-component time series using the available neural network architecture and machine learning taking into account dynamic characteristics of the above components. Anomalies in the observed range of multiple time series that reflect operation of the industrial control system are detected (identified) through component-wise comparison of each component (resulted from the above preliminary digital processing) of any time series within the observed range of all time series, with each prediction of the relevant component of the above time series within the observed range of all time series. This approach that implies component-wise comparison will allow to detect anomalies within the range of observed time series of the industrial control system separately by their different dynamic characteristics, and thus will improve the efficiency of management of information security within information and industrial systems.

The fusion of Artificial Intelligence (AI) and Machine Learning (ML) with the existing Indian Railways CCTV network provides revolutionary potential to improve safety, security, and operational efficiency. This research showcases the creation of an AI-based railway surveillance system that is meant to solve issues related to controlling congested stations, deterring crimes, and ensuring efficient workforce monitoring. Through the use of sophisticated video analytics, deep learning algorithms, and computer vision technology, the system facilitates real-time anomaly detection, prevention of unauthorized access, and predictive analytics to optimize crowd management. In addition, AI-powered facial recognition and behavioral analysis models optimize crime prevention by detecting suspicious behavior and known criminals. Modules for work monitoring guarantee compliance with safety procedures among staff and streamline station operations. The research also examines the technological and ethical aspects of having such a system, for instance, high-resolution cameras, edge computing, data privacy, and regulatory issues. The outcome identifies that AI-powered surveillance has the potential to significantly improve passenger safety, utilization of resources, and efficiency in operations, making Indian Railways ready to embrace a safer, brighter future Key Words: Artificial Intelligence, Machine Learning, Railway Surveillance, Video Analytics, Crime Prevention, Operational Efficiency.

The next generation of mobile networks, 6G, when compared to 5G is expected to offer faster speeds, lower latency, and increased capacity. At the same time, edge computing is becoming increasingly important for providing low-latency services and reducing the load on centralized data centers. Unikernels, a lightweight form of virtualization, have the potential to improve the performance and security of edge computing systems. This paper investigates the utility of unikernel-based edge computing in 6G networks. The paper will begin by providing an overview of the current state of unikernel-based edge computing and its advantages over traditional virtualization techniques. It will then investigate the potential of using unikernels in 6G networks, including the ability to improve network performance and security. The research will also look into the potential of using unikernels in edge computing systems, such as the ability to reduce the load on centralized data centers, improve the performance of low-latency services, and improve edge computing systems security. Finally, the paper will point towards the research’s implications and potential future work in the field.

Developments and upgrades in the field of industrial information technology, particularly those relating to information systems’ technologies for the collection and processing of real-time data, have introduced a large number of new threats. These threats are primarily related to the specific tasks these applications perform, such as their distinct design specifications, the specialized communication protocols they use and the heterogeneous devices they are required to interconnect. In particular, specialized attacks can undertake mechanical control, dynamic rearrangement of centrifugation or reprogramming of devices in order to accelerate or slow down their operations. This may result in total industrial equipment being destroyed or permanently damaged. Cyber-attacks against Industrial Control Systems which mainly use Supervisory Control and Data Acquisition (SCADA) combined with Distributed Control Systems are implemented with Programmable Logic Controllers. They are characterized as Advanced Persistent Threats. This paper presents an advanced Spiking One-Class Anomaly Detection Framework (SOCCADF) based on the evolving Spiking Neural Network algorithm. This algorithm implements an innovative application of the One-class classification methodology since it is trained exclusively with data that characterize the normal operation of ICS and it is able to detect divergent behaviors and abnormalities associated with APT attacks.

In recent decades, Industrial Control Systems (ICS) have been affected by heterogeneous cyberattacks that have a huge impact on the physical world and the people's safety. Nowadays, the techniques achieving the best performance in the detection of cyber anomalies are based on Machine Learning and, more recently, Deep Learning. Due to the incipient stage of cybersecurity research in ICS, the availability of datasets enabling the evaluation of anomaly detection techniques is insufficient. In this paper, we propose a methodology to generate reliable anomaly detection datasets in ICS that consists of four steps: attacks selection, attacks deployment, traffic capture and features computation. The proposed methodology has been used to generate the Electra Dataset, whose main goal is the evaluation of cybersecurity techniques in an electric traction substation used in the railway industry. Using the Electra dataset, we train several Machine Learning and Deep Learning models to detect anomalies in ICS and the performed experiments show that the models have high precision and, therefore, demonstrate the suitability of our dataset for use in production systems.