Security-Aware Dynamic Scheduling for Real-Time Optimization in Cloud-Based Industrial Applications

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

The implementation of automated regulatory control has been around since the middle of the last century through analog means. It has allowed engineers to operate the plant more consistently by focusing on overall operations and settings instead of individual monitoring of local instruments (inside and outside of a control room). A similar approach is proposed for cyber security, where current border-protection designs have been inherited from information technology developments that lack consideration of the high-reliability, high consequence nature of industrial control systems. Instead of an independent development, however, an integrated approach is taken to develop a holistic understanding of performance. This performance takes shape inside a multiagent design, which provides a notional context to model highly decentralized and complex industrial process control systems, the nervous system of critical infrastructure. The resulting strategy will provide a framework for researching solutions to security and unrecognized interdependency concerns with industrial control systems.

This paper addresses the pressing challenges of building secure and resilient Industrial Control Systems (ICS) by focusing on rapid attack detection, recovery, and maintaining monotonicity in online monitoring systems. Traditional methods often fail to quickly identify threats, leaving systems vulnerable to prolonged downtime. Specifically, classical online monitoring systems struggle to preserve monotonicity, as they typically detect only isolated anomalies during operation, which can mask subsequent deviations in system behavior. This research presents an advanced approach to resilient cyber-physical systems (CPS) that utilizes Signal Temporal Logic with Global Time (STL-GT) in combination with an Autotuning mechanism for robust realtime monitoring, multi-point anomaly detection, and recovery. This innovative framework enables prompt detection of attacks and faults, along with rapid system recovery. Our STL-GT online monitoring system incorporates a syntactic separation technique based on a partition rule to address monotonicity issues and improve the system's ability to detect and respond to multiple anomalies during system execution. The autotuning mechanism, based on Internal Model Control (IMC) PID tuning rules, enables swift and adaptive system recovery in the event of disruptions. We validated our methodology using the Tennessee Eastman Plant model, a complex chemical plant simulator designed to study industrial processes and control systems. Experimental results demonstrate that our approach provides effective security and resilience of the CPS by consistently detecting anomalies and restoring the system with zero overshoot and minimal oscillations, eliminating violation masking and missed alarms. These findings highlight the effectiveness of our approach in fortifying critical systems against adversarial attacks and operational faults.

Industry 4.0 is the German vision for the future of manufacturing, where smart factories use information and communication technologies to digitise their processes to achieve improved quality, lower costs, and increased efficiency. It is likely to bring a massive change to the way control systems function today. Future distributed control systems are expected to have an increased connectivity to the Internet, in order to capitalize on new offers and research findings related to digitalization, such as cloud, big data, and machine learning. A key technology in the realization of distributed control systems is middleware, which is usually described as a reusable software layer between operating system and distributed applications. Various middleware technologies have been proposed to facilitate communication in industrial control systems and hide the heterogeneity amongst the subsystems, such as OPC UA, DDS, and RT-CORBA. These technologies can significantly simplify the system design and integration of devices despite their heterogeneity. However, each of these technologies has its own characteristics that may work better for particular applications. Selection of the best middleware for a specific application is a critical issue for system designers. In this paper, we conduct a survey on available standard middleware technologies, including OPC UA, DDS, and RT-CORBA, and show new trends for different industrial domains.

All studies recently published agree. Industrial Automation and Control Systems (IACS) increasingly constitutes a target for cyber-attacks aiming at disturbing Member States’ economies, at disabling our critical infrastructures or at taking advantage from our people. Such hostile acts take place in a context of geostrategic tensions, for the satisfaction of organised crime’s purposes, or else in support of possible activist causes. In this context, the ERNCIP Thematic Group (TG) “Case studies for the cybersecurity of Industrial Automation & Control Systems” was started in January 2014 to answer the question: “Do European critical infrastructure operators need to get IACS’ components or subsystems tested and “certified” (T&C) with regards to their cybersecurity?” And should the answer have been yes, it had to answer a corollary question: “What are (roughly) the conditions of feasibility for implementing successfully a European IACS components cybersecurity Compliance & Certification Scheme?” This TG’s undertaking was a research project, not a task force seeking to deliver an immediately applicable standard. It mobilised representatives of IACS vendors, industrial operators, European Istitutions and national cybersecurity authorities.

Computer facilities and microprocessor-based technology have been successfully used in the energy industry. For protection and equipment control, this technology has been used in SCADA, remote control and monitoring applications. Particular attention is paid to the cyber security sector for automation and control systems. Protective application of the equipment and control, SCADA, monitoring and remote control, uses the technology with microprocessor. Due to the great importance of the power supply process, there is no question of being left in a state of vulnerability and neglect. Security is not perfect and will never be. For this reason, there will always be security breaches and incidents. Also, for this reason, not only protection mechanisms are in place, but also mechanisms for rapid detection of incidents and which are able to react effectively to the isolation of problems and to ensuring security. Processes security for systems will continue to evolve in the future. By definition, there are no communication systems that are 100% safe. Attacks against critical industrial infrastructures marked an increase not only in terms of number but also of the level of complexity. The destruction of the industrial control system (ICS) and critical processes were interrupted. For many organizations, the security improvement in ICS systems is great. The extreme sensitivity to ensure the availability and performance of industrial processes has led to a more conservative and rigorous approach to how security measures are implemented. Cyber-attacks that could compromise the availability, integrity, and confidentiality of ICS systems may come from within systems or from outside ICS systems. Among the ICS system infection vectors from the perspective of the SANS Institute (2014) include: external threats (state attacks, hacking etc.), malware, exploiting tools, phishing, internal attacks, cyber security protocols, and industrial espionage. This chapter addresses the cyber security issues required for the protection, automation, control and communications systems of transformation stations as well as methods that could be used to prevent computer attacks that can have a significant impact on the availability of the system Electro-energetic effect with serious consequences on extended area interruptions.

The oil and gas industry, a vital lifeline fueling the global economy, find itself at a pivotal juncture where the convergence of operational technology (OT) and information technology (IT) has ushered in unprecedented opportunities and challenges. As digital transformation sweeps across this sector, the imperative to fortify cybersecurity defenses against ever-evolving threats has become paramount. Innovative and forward-looking oil and gas organizations across the globe are adopting the Cloud in many forms because of their digital transformation initiatives. Data lakes, edge technology, machine-to-machine communication, and machine learning (ML) algorithms have been enabling this industrial digital transformation. This transformation is also driving changes to the OT landscape, and as these environments continue to evolve, OT environments are leveraging well proven IT solution patterns to improve the productivity and efficiency of production operations. Industrial customers often start their digital transformation journey by sending OT data to the cloud for analysis and analytics without sending commands back to the industrial automation and control systems (ICAS). This process is often called "open loop" operations, since there is one-way communication from edge to cloud. Customers generally find this relatively easy to secure and manage. However, more often we are witnessing requirements to optimize operations by generating an automatic or operator-initiated response in the oil and gas production operation, rig management based on insights gained from cloud analytics. This process is often referred to as "closed loop" operations with two-way communication between edge and cloud. The security and compliance practices for closed loop operations are more rigorous because closed operations manipulate OT devices remotely. Developing these practices should be rooted in a cyber risk assessment to help businesses understand and prioritize security concerns. In this paper we propose how strengths of Cloud computing can become key enabler for oil and gas organizations in helping them enhance their overall security posture and manage risks within OT environments. We have deployed solution patterns described in this paper as the foundational pillar of several Oil and Gas organization's overall OT system architecture to unlock both "open loop" and "closed loop" operations in a secure, reliable and cost-effective manner. The specific scope items we will cover in this paper focus on a custom security uplift framework having four foundational components – 1) Cloud led architecture patterns to provide next generation network segmentation strategies in OT De-militarized Zone 2) OT asset inventory and vulnerability management 3) Centralized security monitoring and incident response with help of Artificial Intelligence and most recently providing Generative AI based virtual assistant to query security event data from OT systems. For organizations to plan their industrial digital transformation safely and securely, it is recommended that a multi-layered approach to secure the Industrial Control Systems (ICS)/OT and Cloud environments be implemented as captured in ten security golden rules in the following paper [1]. In addition to this, in the paper we propose a comprehensive architecture framework that aligns with established cybersecurity framework (CSF) such as NIST. The use case studies discussed in the paper will highlight how customer have been able to remediate critical security vulnerabilities within weeks post implementation by deploying a comprehensive asset inventory discovery and vulnerability assessment. This has help reduce mean time to identify and mitigate vulnerabilities from months to days with automated testing in pre-production environments, ensure quick detection and response towards security incidents with help of advanced security monitoring and incident response playbooks, covering 100% of the OT assets through this capability and leverage advanced data analytics, machine learning to perform log mining, data cleansing, data validation, log mining and analysis through natural language processing such as conversational AI assistants powered by large language model (LLM) in the Cloud.

Introduction In the last chapter, we explored how to determine a cyber-attacker's optimal strategy for attacking a computer system based on malware and exploits available on the darkweb. In this chapter, we look at the case where the attacker is focused on industrial control systems (ICS): IT infrastructure that controls physical systems (electricity, water, industrial machinery, etc.). A critical feature of these complex ICS systems is the interdependencies among various components. However, despite the prevalence of markets for malware and exploits, and their potential threat to ICS, existing paradigms, including the framework presented in the previous chapter, do not account for the complex nature of ICS systems consisting of multiple interconnected components. In particular, it would prove useful to simulate a cyber-attack on a model of an existing system, to assess its degree of vulnerability. Such a model would also prove useful for automated cybersecurity systems that can learn defense and contingency strategies based on the model's simulations. This chapter takes the first steps toward addressing this need. In particular, we introduce a framework that allows for modeling of ICS systems with highly interconnected components (Section 7.3) and study this model through the lens of lattice theory [57]. We then turn our attention to the problem of determining the optimal/most dangerous strategy for a cyber-adversary with respect to this model and find it to be an NPComplete problem (Section 7.4). Next, we present a suite of algorithms for this problem based on A* search and introduce provably correct algorithms (Section 7.5). Our intuition is that these algorithms will obtain satisfactory performance in practice due to heuristic functions (for which we show admissibility). We demonstrate the performance of these algorithms by implementing them and performing a suite of experiments using both simulated and actual vulnerability data (Section 7.6). This chapter also includes some background on ICS (Section 7.2) and a brief overview of related work (Section 7.7). Background Contemporary cyber threat actors rely on a variety of malware and exploits purchased through various channels such as the darkweb [99] in order to carry out their attacks. The trend toward automation of industrial control systems (ICS) and toward “smart” utilities [50] has made understanding such adversarialbehavior directed against ICS a priority. For instance, code from the infamous Stuxnet [97] attack against Iranian nuclear facilities is available for public download.

With the rapid development of Industrial Internet of Things technology, the industrial control system (ICS) faces more and more security threats, which may lead to serious risks and extensive damage. Naturally, it is particularly important to construct efficient, robust, and low-cost protection strategies for ICS. However, how to construct an objective function of optimal security protection strategy considering both the security risk and protection cost, and to find the optimal solution, are all significant challenges. In this paper, we propose an optimal security protection strategy selection model and develop an optimization framework based on Q-Learning particle swarm optimization (QLPSO). The model performs security risk assessment of ICS by introducing the protection strategy into the Bayesian attack graph. The QLPSO adopts the Q-Learning to improve the local optimum, insufficient diversity, and low precision of the PSO algorithm. Simulations are performed on a water distribution ICS, and the results verify the validity and feasibility of our proposed model and the QLPSO algorithm.

Industrial control system (ICS) devices with IP addresses are accessible on the Internet and become an essential part of critical infrastructures. The adoption of ICS devices also yields cyber-attacks targeted specific port based on proprietary industrial protocols. However, there is a lack of comprehensive understanding of these ICS threats in cyberspace. To this end, this paper uniquely exploits active interaction on ICS-related ports and analysis of long-term multi-port traffic in a first attempt ever to capture and comprehend ICS automated attacks based on private protocols. Specially, we first propose a minimal-interaction scheme for ICS honeypot(MirrorPot), which can listen on any port and respond automatically without understanding the protocol format. Then, we devise a preprocessing algorithm to extract requests payload and classify them from long-term honeypot-captured data. Finally, to better characterize the ICS attacks based on private industrial protocols, we propose a Markov state transition model for describing their attack complexity. Our experiments show that there are several unknown probing methods have not been observed by previous works. We concur that our work provides a solid first step towards capturing and comprehending real ICS attacks based on private protocols.

This article presents an analysis of industrial control system (ICS), its multilevel structure and operation conditions. The ICS infrastructure is considered as a part of enterprise information system (EIS). The problem of information security of ICS is discussed. The reasons why ICS information security has become one of the most discussed issues of our time is defined. A model of EIS infrastructure comprising industrial control system is suggested. A verbal model of ICS as a protection object of information security system (ISS) is developed. The model takes into account all computer equipment, communication lines, channels, components of the three ICS levels. The necessary of a development of such models is substantiated according to the system analysis method. Modeling is an effective tool for studying the characteristics of complex systems and makes it possible to have a closer look at their structure. A successful development of ISS depends on the adequacy of a protection object model (ICS), taking into account its specific features.

In the automated Industrial Control System (ICS) where advanced technology is being integrated with core infrastructure, technology development is ahead of the application of security solutions. Our city, power, and transportation control systems are getting smarter and more efficient, but new connectivity and interoperability are making them more vulnerable than ever before. Accordingly, various studies have been conducted for anomaly detection in ICS. In this paper, we propose an unsupervised stacked bidirectional Long Short-Term Memory (LSTM) model for automated anomaly detection in large-scale ICS and introduce a method for performance improvement. In addition, it was written based on participation in HAICon2020, an ICS security threat detection contest hosted by the National Security Research Institute. We use the HAI 2.0 dataset published at HAICon2020 and use Time-series Aware Precision and Recall (TaPR), which is suitable for anomaly detection evaluation in ICS. As a result of submission of test data, we were awarded 2nd place at HAICon2020. We have detected anomalies in ICS. As a follow-up work, we will do further research to identify the sensor and actuator that caused the anomaly and to quickly respond and recover.

Detecting cyberattacks in industrial control systems using online learning algorithms

Cyber-physical infrastructures in industrial control systems, including critical infrastructure and manufacturing, heavily on cyber-physical infrastructures and embedded devices. As industrial control systems become more complex and network-centric, physical infrastructure becomes increasingly dispersed and vulnerable. In rapid growth within the competitive technology, we have seen an expressive increase in information security vulnerabilities against such systems, ranging from simple hacking tools to new generation intelligent attacks. With the growing reliance on industrial control networks and, of course, the growing number of attacks, the lack of cyber-security monitoring and forensic analysis of security incidents. Cyber-forensic analysis of ICS/SCADA systems is unlike standard forensic analysis of enterprise computer systems, the cyber-forensic specialist often has to be an expert in cyber-physical infrastructures systems, networks, and devices to determine where potential forensic evidence may be located. This paper discusses ICS/SCADA, typical attacks and vulnerabilities, problems with forensic analysis, and the development of forensic methodology/tools for such systems.

In order to evaluate the network security risks and implement effective defenses in industrial control system, a risk assessment method for industrial control systems based on attack graphs is proposed. Use the concept of network security elements to translate network attacks into network state migration problems and build an industrial control network attack graph model. In view of the current subjective evaluation of expert experience, the atomic attack probability assignment method and the CVSS evaluation system were introduced to evaluate the security status of the industrial control system. Finally, taking the centralized control system of the thermal power plant as the experimental background, the case analysis is performed. The experimental results show that the method can comprehensively analyze the potential safety hazards in the industrial control system and provide basis for the safety management personnel to take effective defense measures.