Industrial Control Intrusion Detection Model Based on S7 Protocol

Providing network reliability as well as low and predictable latency is important especially for Industrial Automation and Control Networks. However, diagnosing link status from the control plane has high latency and overhead. In addition, the communication with the industrial controller may impose additional network latency. We present FastReact - a system enabling In-Network monitoring, control and caching for Industrial Automation and Control Networks. FastReact outsources simple monitoring and control actions to evolving programmable data planes using the P4 language. As instructed by the Industrial Controller through a Northbound API, the SDN controller composes control actions using Boolean Logic which are then installed in the data plane. The data plane parses and caches sensor values and performs simple calculations on them which are connected to fast control actions that are executed locally. For resiliency, FastReact monitors liveness and response of sensors/actuators and performs a fast local link repair in the data plane if a link failure is detected. Our testbed measurement show that FastReact can reduce the sensor/actuator delay while being resilient against several failure events.

Recent trends in automation technology lead to a rising exposition of industrial control systems (ICS) to new vulnerabilities. This requires the introduction of proper security approaches in this field. Prevalent in ICS is the use of access control. Especially in critical infrastructures, however, preventive security measures should be complemented by reactive ones, such as intrusion detection. Beginning from the characteristics of automation networks we outline the implications for a suitable application of intrusion detection in this field. On this basis, an approach for creation of self-learning anomaly detection for ICS protocols is presented. In contrast to other approaches, it takes all network data into account: flow information, application data, and the packet order. We discuss the challenges that have to be solved in each step of the network data analysis to identify future aspects of research towards learning normality in industrial control networks.

Industrial control network is a direct interface between information system and physical control process. Due to the lack of authentication, encryption, and other necessary security protection designs, it has become the main target of malicious attacks under the trend of increasing openness. In order to protect the industrial control systems, we examine the detection of abnormal traffic in industrial control network and propose a method of detecting abnormal traffic in industrial control network based on autoencoder technology. What is more, a new deep autoencoder model was designed to reduce the dimensionality of traffic data in industrial control network. In this article, the Kullback–Leibler divergence was added to the loss function to improve the ability of feature extraction and the ability to recover raw data. Finally, this model was compared with the traditional data dimensionality reduction method (principal component analysis (PCA), independent component analysis, and singular value decomposition) on gas pipeline dataset. The results show that the approach designed in this article outperforms the three methods in different scenes in terms of f1 score.

In response to the problem of difficulty in accurately extracting spectral trajectories of multi‐band non‐repetitive transient weak signals in industrial control networks under strong noise background, this paper proposes a method that introduces a fusion filtering algorithm to extract spectral trajectories of multi‐band non‐repetitive transient weak signals in industrial control networks. Build an XGBoost classifier for multi‐band signal states in industrial control networks, clarify the current non‐repetitive transient weak signal states in multi‐band industrial control networks, and achieve accurate identification of weak signal states. Based on the classifier results, combined with the Bloom filter, the classified signal sequence is deduplicated to eliminate redundancy caused by repeated transient signals. Further adopt a fusion filtering algorithm to filter the spectral trajectory of weak signals in multiple frequency bands of the input industrial control network, in order to restore the original signal; extract the single‐frequency spectral trajectory of multi‐band non‐repetitive transient weak signals through average sampling processing, and fuse the trajectory to obtain the complete weak signal spectral trajectory. The experimental data comparison results show that the proposed method can better extract weak signal spectral trajectory information under transient conditions, and the extraction effect is more stable and reliable, with high accuracy and anti‐interference ability.

The malware attacks targeting the industrial control network are gradually increasing, and the nonlinear phenomenon makes it difficult to predict the propagation behavior of malware. Once the dynamic system becomes unstable, the propagation of malware will be out of control, which will seriously threaten the security of the industrial control network. So, it is necessary to model and study the propagation of malware in the industrial control network. In this paper, a SIDQR model with dual delay is proposed by fully considering the characteristics of the industrial control network. By analyzing the nonlinear dynamics of the model, the Hopf bifurcation is discussed in detail when the value of dual delay is greater than zero, and the expression for the threshold is also provided. The results of the experiments indicate that the system may have multiple bifurcation points. By comparing different immune and quarantine rates, it is found that the immune rate can be appropriately increased and the isolation rate can be appropriately reduced in the industrial control network, which can suppress the spread of malware without interrupting the industrial production.

Industrial networks represent an important business for automation systems manufacturers that offer proprietary solutions and claim for the payment of license fees. However, automation can be achieved even by exploiting standard protocols in order to avoid or limit the use of proprietary solutions. The considered case study, related to the innovation of an oil refinery, illustrates a viable approach. In particular, it shows that, thanks to a suitable upgrade of its measurement and control hardware pursued with standard solutions, the industrial network of an oil refinery can be provided with improved performance and more flexible connectivity as well as be proficiently integrated with the commercial network of the considered enterprise.

With the rapid development of technology, the scale of traffics in industrial control networks is increasing day by day. More malicious traffics brought terrible impacts on industrial areas. Modbus plays a momentous role in the communications of Industrial Control Systems (ICS), but it’s vulnerable to Denial of Service attacks(DoS). Traditional methods cannot perform well on fine-grained detection tasks which could contribute to locating targets of DoS and preventing the destruction. Considering the temporal locality and high dimension of malicious traffic, we proposed a Neural Network architecture named MODLSTM, which consists of three parts: input preprocessing, feature recoding, and traffic classification. By virtue of the design, MODLSTM can perform high-precision identification and fine-grained classification of DOS attacks in the Modbus/TCP-based system. To test our model’s performances, we conducted experiments on our traffic dataset collected from the industrial control network, and the models achieved excellent performances in comparison with previous work(accuracy increased by 0.74%). The results show that our proposed method has satisfactory abilities to detect DoS attacks related to Modbus, it could help to build a reliable firewall to address the DoS traffic in industrial environments.

The integration of industrial control communication networks and the Internet into the Industrial Control System (ICS) increases their vulnerability to cyber-attacks, leading to devastating consequences. Traditional intrusion detection systems (IDS) mostly rely on predefined models and are trained mostly on specific cyber attacks, which means that traditional IDS cannot deal with unknown attacks In addition, most IDSs do not take into account the imbalance of ICS datasets, and therefore suffer from low accuracy and high false positives when used. In the article, we propose an NCO-double-layer DIFF_RF-OPFYTHON intrusion detection method for ICS, which consists of NCO modules, two-layer DIFF_RF modules, and OPFYTHON modules. Detected traffic will be divided into three categories by the two-layer DIFF_RF module: known attacks, unknown attacks, and normal traffic. Next, the known attacks will be classified by the OPFYTHON module into specific attacks according to the characteristics of the attack traffic. We use the NCO module to improve model inputs and improve model accuracy. The results show that the proposed method outperforms traditional intrusion detection methods such as XGboost and SVM. Detecting unknown attacks is also significant. The accuracy of the data set used in this article reaches 98.13%. The detection rate of unknown and known attacks reaches 98.21% and 95.1%, respectively. In this article, the basic modules of the classifier are shallow machine learning algorithms. This can be improved by using a more powerful neural network architecture. In the article, all detected unknown attacks are marked as one category. In further studies, the unknown attacks can be clustered and analyzed to further classify the detected unknown attacks. It is worth noting that the number of unknown attacks is only a small part, so it is difficult to classify unknown attacks using cluster analysis. Since training a more powerful neural network requires a lot of data, it is important to investigate how to train a new model when the number of samples belonging to that class is limited.

The deterministic and restricted nature of industrial control system networks sets them apart from more open networks, such as local area networks in office environments. This improves the usability of network security, monitoring approaches that would be less feasible in more open environments. One of such approaches is machine learning based anomaly detection. Without proper customization for the special requirements of the industrial control system network environment, many existing anomaly or misuse detection systems will perform sub-optimally. A machine learning based approach could reduce the amount of manual customization required for different industrial control system networks. In this paper we analyze a possible set of features to be used in a machine learning based anomaly detection system in the real world industrial control system network environment under investigation. The network under investigation is represented by architectural drawing and results derived from network trace analysis. The network trace is captured from a live running industrial process control network and includes both control data and the data flowing between the control network and the office network. We limit the investigation to the IP traffic in the traces.

In recent years, the increasing number of industrial infrastructure security incidents around the world has drawn public attention to industrial control networks (ICNs) security issues. Fault diagnosis of industrial devices is an indispensable part of the security system in ICNs. The mainstream fault diagnosis models rely on long-term training and massive fault data, which results in the inability to update the model effectively and timely when the environment changes. Thus, some researchers focus on developing cross-domain industrial fault diagnosis methods. However, they usually presume that the samples of the target and source domains share the same fault mode sets, and existing prior knowledge concerning the label spaces of these two domains. These are difficult to satisfy in actual ICNs. To respond to these challenges, we develop a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">transferability-measured adversarial adaptation network</i> (TAAN) to identify unknown classes without prior knowledge. It embeds the hybrid transferability estimation into an adversarial domain adaptive network to weigh the contribution of each sample. In this way, TAAN can properly classify samples in a public label space by selectively aligning source and target samples with high transferability. The experimental results obtained using two diagnosis datasets prove that the developed TAAN can achieve satisfactory diagnostic accuracy by effectively bridging the distribution discrepancy under various working conditions.

Cyber-physical infrastructures in industrial control systems, including critical infrastructure and manufacturing, heavily on cyber-physical infrastructures and embedded devices. As industrial control systems become more complex and network-centric, physical infrastructure becomes increasingly dispersed and vulnerable. In rapid growth within the competitive technology, we have seen an expressive increase in information security vulnerabilities against such systems, ranging from simple hacking tools to new generation intelligent attacks. With the growing reliance on industrial control networks and, of course, the growing number of attacks, the lack of cyber-security monitoring and forensic analysis of security incidents. Cyber-forensic analysis of ICS/SCADA systems is unlike standard forensic analysis of enterprise computer systems, the cyber-forensic specialist often has to be an expert in cyber-physical infrastructures systems, networks, and devices to determine where potential forensic evidence may be located. This paper discusses ICS/SCADA, typical attacks and vulnerabilities, problems with forensic analysis, and the development of forensic methodology/tools for such systems.

Enterprise integrated automation is the general trend of industrial control development. The combination of control network and information network provides comprehensive information services for enterprise as production information, production control, planning decisions and sales management as well. The industrial control network and information network integration can realize the information and resources sharing among the enterprises networks and further improve the enterprises informationization and integrated automation level so as to achieve the situation that the enterprise production and management is more efficient and more flexible. The study introduces the information integration of the fieldbus control network and the information network and analyze the information integration technologies such as internetworking, dynamic data exchange (DDE), Open Database Connectivity (ODBC), OLE for Process Control (OPC), control network and information network with unified protocol standards. the integration application of bus system is illustrated with the example of Controller Area Network (CAN) bus.

Smart grid is the goal of China’s power grid development, and the security problems can not be ignored during this period. In this paper, we focuse on security risks both in computer network and industrial control network while moving to smart grid. We compared various research works related to these area, and emphasized the importance of SCADA system security. We summarized main attacks on SCADA system and analyzed different approaches to mitigate these threats. We highlighted some achievements of research in SCADA system security, also discussed some shortages of these research. Finally, we discussed the role of testbed in smart grid security research, and compared different testbeds in types and scales, approved their prominent effect in industrial control system security research.

The development and integration of information technology and industrial control networks have expanded the magnitude of new data; detecting anomalies or discovering other valid information from them is of vital importance to the stable operation of industrial control systems. This paper proposes an incremental unsupervised anomaly detection method that can quickly analyze and process large-scale real-time data. Our evaluation on the Secure Water Treatment dataset shows that the method is converging to its offline counterpart for infinitely growing data streams.

In recent years, software defined networking (SDN) has been proposed for enhancing the security of industrial control networks. However, its ability to guarantee the quality of service (QoS) requirements of such networks in the presence of adversarial flow still needs to be investigated. Queueing theory and particularly queueing network models have long been employed to study the performance and QoS characteristics of networks. The latter appears to be particularly suitable to capture the behaviour of SDN owing to the dependencies between layers, planes and components in an SDN architecture. Also, several authors have used queueing network models to study the behaviour of different application of SDN architectures, but none of the existing works have considered the strong periodic network traffic in software-defined industrial control networks. In this paper, we propose a queueing network model for softwaredefined industrial control networks, taking into account the strong periodic patterns of the network traffic in the data plane. We derive the performance measures for the analytical model and apply the queueing network model to study the effect of adversarial flow in software-defined industrial control networks.