MSICST: Multiple-Scenario Industrial Control System Testbed for Security Research

Adversarial attacks targeting industrial control systems, such as the Maroochy wastewater system attack and the Stuxnet worm attack, have caused significant damage to related facilities. To enhance the security of industrial control systems, recent research has focused on not only improving the accuracy of intrusion detection systems but also developing techniques to generate adversarial attacks for evaluating the performance of these intrusion detection systems. In this paper, we propose a deep reinforcement learning-based adversarial attack framework designed to perform man-in-the-middle attacks on industrial control systems. Unlike existing adversarial attack methods, our proposed adversarial attack scheme learns to evade detection by the intrusion detection system based on both the impact on the target and the detection results from previous attacks. For performance evaluation, we utilized a dataset collected from the secure water treatment (SWaT) testbed. The simulation results demonstrated that our adversarial attack scheme successfully executed man-in-the-middle attacks while evading detection by the rule-based intrusion detection system, which was defined based on the analysis of the SWaT dataset.

Industrial Control Systems (ICS) monitor and control physical processes. The security of ICS has drawn the attention of many researchers since successful cyber-attacks against ICS can cause extensive damage in the physical world. Most of the existing literature describes solutions to protect an ICS against attacks directly targeting its underlying IT infrastructure. However, there are comparatively less works that focus on detecting cyber attacks against the physical process itself. Detection mechanisms that do so are said to be process aware. In this paper, we propose a time-based process aware intrusion detection system (IDS) that detects attacks against a physical process by leveraging its regular nature and temporal properties. The IDS learns the temporal behavior of the process variables and uses it to detect attacks. We evaluate the performance of our IDS on a public SCADA dataset and on a simulated SCADA system developed as part of this study, and we compare it with two other process-aware IDS proposed in the literature. The results show that our solution is able to detect attacks that are not detected by IDS that ignore temporal properties.

In order to ensure the reliable execution of the functional safety of industrial control systems and effectively resist more and more serious cyber attacks, it is necessary to explore a technical solution suitable for industrial control systems to effectively ensure the compatibility of cyber security and functional security measures. Taking typical SIL3 and SL3 industrial control systems as examples, based on functional safety measures, cyber security measures are analyzed one by one, and potential contradictions between them are identified. Coordination solutions of functional safety and cyber security are given by combining event tree and risk analysis. Finally, integrated protective measures of functional safety and cyber security of industrial control systems are obtained.The results show that the cyber security measures determined by the coordination method are compatible with the original functional safety measures, and the coordination method can be used to guide the cyber security design of industrial control systems.

Industrial control systems (ICSs) are transitioning from legacy-electromechanical-based systems to modern information and communication technology (ICT)-based systems creating a close coupling between cyber and physical components. In this paper, we explore the ICS cybersecurity landscape including: 1) the key principles and unique aspects of ICS operation; 2) a brief history of cyberattacks on ICS; 3) an overview of ICS security assessment; 4) a survey of “uniquely-ICS” testbeds that capture the interactions between the various layers of an ICS; and 5) current trends in ICS attacks and defenses.

Cyber physical systems (CPSs) utilised in many of the critical infrastructures including the smart grid. The operational activities of smart grid's CPS use different industrial solution such as industrial control systems (ICS) for monitoring and controlling the physical architecture of smart grid. Therefore, it is quite essential to keep these industrial control systems secure and safe from potential hazards and cyber world as it may be harmful for human safety, strategic infrastructure of a country and also for the economy. The study gathered the scattered guidelines, best practices and policies available from various organisations such as National Institute of Standards and Technology (NIST), ISO, and North American Electric Reliability Corporation (NERC) for the purpose of developing safe and secure ICS security systems and also the knowledge about the issues involved in ICS security and protection. A conceptual framework is proposed and developed to address the shortcomings in-order to protect the ICS systems in a smart grid environment. The proposed framework was developed by reviewing related studies, standards and utilising IT security working experience. This framework will not only expand the horizon of knowledge but also provides pathway for the development of existing activities of CPS applications such as smart grid.

As an important part of guard system, intrusion detection systems have great significance to the security of industrial control systems. Cause the industrial control systems of the on-site environment is often very complicated, the process data extracted on-site have a wide variety of features, and they always have complex associations and are not independent. The intrusion detection algorithms for traditional industrial control systems often do not solve this problem, which results in a decrease in the accuracy, precision and high false negative rate (FNR), false positives rate (FPR). Aiming at solving the current problems, this paper proposes an algorithm combining the Fast Independent Principal Component Analysis (FastICA) and Support Vector Machine (SVM). Finally compared with the SVM and PCA-SVM algorithms, the experimental results show that the accuracy rate has been significantly improved and slight FPR.KeywordsIntrusion detectionFastICASVM

Cyber-threats are one of the most significant problems faced by modern Industrial Control Systems (ICS), such as SCADA (Supervisory Control and Data Acquisition) systems, as the vulnerabilities of ICS technology become serious threats that can ultimately compromise human lives. This situation demands a domain-specific approach to cyber threat detection within ICS, which is one of the most important contributions of the CockpitCI FP7 project (http://CockpitCI.eu). Specifically, this paper will present the CockpitCI distributed Intrusion Detection System (IDS) for ICS, which provides its core cyber-detection and analysis capabilities, also including a description of its components, in terms of role, operation, integration, and remote management. Moreover, it will also introduce and describe new domain-specific solutions for ICS security such as the SCADA Honeypot and the Shadow Security Unit, which are part of the CockcpitCI IDS framework.

Detecting cyberattacks in industrial control systems using online learning algorithms

The architecture of Trusted Computing 3.0 provides an excellent way to enhance the security of industrial control systems (ICS). However, the implementation of this architecture needs to solve some technical issues such as access control and trust quantification in the ICS scene. This paper proposes an active defense architecture for ICS based on trusted computing 3.0, which defines the active immune operation mechanism of the industrial control system, establishes an immune architecture based on trusted two-node, multi-level fine-grained access control strategy, and the quantification of the trusted behaviors and decisions. Taking the protection of critical data in DCS as an example, we design a deployment scheme of the coordinated protection for ICS. The proposed method will guide the security enhancement based on trusted computing in ICS.

Information and cyber security of Industrial Control Systems (ICS) has gained considerable importance. Situation Awareness (SA) is an exciting mechanism to achieve the perception, comprehension and projection of the ICS information security status. Based on the Purdue Enterprise Reference Architecture (PERA), a situation awareness framework for ICS is presented considering the ICS cyber kill chain. The proposed framework consists of IT SA Centre, OT SA Centre, and Comprehensive SA Centre. Comprehensive SA Centre is responsible for creating and maintaining an integrated and high level of security visibility into the whole environments. The introduced framework can be used to guide the development of the situation awareness infrastructure in organization with industrial control systems.

With the advent of the smart industry, Industrial Control Systems (ICS) moved from isolated environments to connected platforms to meet Industry 4.0 targets. The inherent connectivity in these services exposes such systems to increased cybersecurity risks. To protect ICSs against cyberattacks, intrusion detection systems (IDS) empowered by machine learning are used to detect abnormal behavior of the systems. Operational ICSs are not safe environments to research IDSs due to the possibility of catastrophic risks. Therefore, realistic ICS testbeds enable researchers to analyze and validate their IDSs in a controlled environment. Although various ICS testbeds have been developed, researchers’ access to a low-cost, extendable, and customizable testbed that can accurately simulate ICSs and suits security research is still an important issue.In this paper, we present ICSSIM, a framework for building customized virtual ICS security testbeds in which various cyber threats and network attacks can be effectively and efficiently investigated. This framework contains base classes to simulate control system components and communications. Simulated components are deployable on actual hardware such as Raspberry Pis, containerized environments like Docker, and simulation environments such as GNS-3. ICSSIM also offers physical process modeling using software and hardware in the loop simulation. This framework reduces the time for developing ICS components and aims to produce extendable, versatile, reproducible, low-cost, and comprehensive ICS testbeds with realistic details and high fidelity. We demonstrate ICSSIM by creating a testbed and validating its functionality by showing how different cyberattacks can be applied.

Nuclear power plants are important industrial production facilities whose safety issues can have disastrous consequences for the social environment. With the deep fusion of industrialization and information, the nuclear power control system is gradually transformed into automatic digital systems. Such development improves the production efficiency and economic benefits, but introduce the security problem from traditional IT systems into industrial control systems. However, the existing power industrial control system of nuclear power plant mainly adopts firewall, anti-virus software, network gate and other passive security strategies, which lack the safety of active. Besides, only part of the data can be backed up locally and the remote backup is completed manually by operators regularly. The security of industrial control systems cannot be guaranteed and real-time remote backup cannot be realized. In this paper, we analyze and summarize the characteristics of industrial control systems used in nuclear power plants. Then we propose a Truly Private Network (TPN) for nuclear power plants based on the Multi-identifier network (MIN), which integrates blockchain, cryptography, and other security mechanisms to provide a trusted environment. Lastly, we build a network remote real-time backup scheme based on Mimic distributed storage technology providing data tamper-resistance and traceability for nuclear power plants.

The existing industrial control systems (ICS) security solutions cannot be directly used for secret or high sensitive areas, for lack of mature theory support and difficult engineering realization. In this paper, data shunt and one-way transmission security model based on defense-in-depth framework is put forward to ensure the production area availability as the primary goal. The key signals and instructions of production area are copied twice. One copy is used to production and the other one for cyber after photoelectric conversion device of isolation area. One-way transmission, response speed; data accuracy and product procurement are discussed. The results show that the circuit characteristics of one-way information transmission can prevent outside attack based on general industry protocol. The model has no influence on the transmission of the signals and instructions of production area. The time delay and the loss of data accuracy caused by model meet the actual needs. The components of mode are general and easy to purchase and be used in the practical engineering. The model can be extended to test various emerging ICS security solutions based on defense-in-depth.

The paper “Inadequacy of IT approaches to manage cyber security in ICS context” gives an overview of the application of different IT solutions to deal with cyber security for industrial control systems (ICSs). The real time aspect is important for ICSs to monitor and control effectively different processes. On the other hand, some traditional IT solutions for cyber security do not comply with it. After a careful analysis, it is concluded that there is no ISO 27001 requirement to meet the “non interference” cyber security goal, used by the working group PCSRF in the System Protection Profile for ICSs to ensure that the security functions are implemented in a non-interfering way and do not affect the performance constraints of ICSs. Therefore, a new component, called “Cyber Safety”, is proposed to be added to the existing ones (confidentiality, integrity and availability). Its role would be to check the safety requirements (controls or measures) before their implementations. It is proposed a new model for the management of the cyber security risks that reuses existing results issued from the safety risk analysis and may add safety requirements.

System safety and cyber security have a great effect on system reliability which is the foundation of keeping system running-normally. Although safety and security controls can reinforce each other mutually, contradictions between them also exist, such as resource competition that may cause serious damage. This paper puts forward a risk-based task scheduling approach for the integrated control of system safety and cyber security in industrial control systems (ICSs). In this approach, an integrated task model covering both safety task and security task is proposed, which describes the relationship between task and risk in detail. And the change of real-time risk during the enforcement of these tasks is analysed. These tasks are scheduled through an optimal scheduling scheme which means the risk decrease as soon as possible and is always acceptable based on genetic algorithm. Further, simulation results show that the proposed approach is effective for task scheduling and real-time risk control.