SFC로 기술된 매니지먼트 스텝에 의한 개선된 인터록의 실현

This paper considers a whitelisting system for programmable logic controllers (PLCs). In control systems, controllers are final fortresses to continues the operation of field devices (actuators/sensors), but they are fragile with respect to malware and zero-day attacks. One of the countermeasures applicable for controllers is a whitelisting system which registers normal operations of controller behavior in a “whitelist” to detect abnormal operations via a whitelist. The previous research of the current author proposed a PLC whitelisting system with a control via a ladder diagram (LD). LD representations have a wide applicability because LDs can be implemented for all PLCs and security functions without hardware/firmware updates. However, the current status requires that all instances are manually entered in the whitelist. In this talk, we show how the setting up of the can be automatized whitelist from the PLC behavior. This paper introduces an auto-generation approach for the whitelist using sequential function chart (SFC) instead of the LD. SFC and LD are compatible representations for the PLC. Using Petri Net modeling, this paper proposes how to generate the whitelist from the SFC and how to detect abnormal operations via the whitelist. We call the SFC-based approach the model-based whitelist, the Petri Net based approach the model-based detection. Further, this paper carries out an experimental validation of the algorithms using an OpenPLC based testbed system.

According to the requirements of IEC61131-3 standard, the system of Programmable Logic Controller (PLC) using Sequential Function Chart (SFC) as the main programming language is build. Aiming at the requirements of the SFC programming system, the framework of SFC is established, on this basis, a suit of data structure based on Object-Oriented thinking is designed. It describes the data structure of SFC mainly, and in this way, the functions of SFC, including edit, modify and compile, etc, are realized.The syntax check and logic check of SFC are achieved by traveling recursively and iterating the layers of the nested data structure of SFC. After making SFC into intermediate code, eventually the intermediate code is translated into the corresponding object code.

After investigating the conception and features of PLC (Programmable Logic Controller) and embedded system, in this paper the conception of a Quasi-PLC is proposed, which combine the advantages of PLC and embedded system. The architecture of Quasi-PLC and a Top-Down design method with collaboration design of software and hardware for Quasi-PLC embedded control system are researched then. Finally, setting the large-scale industrial valve control system as an example, the conception of Quasi-PLC and related technologies are used in industrial valve control system, and a satisfied application effect is obtained, which proves the rationality of the conception of Quasi-PLC and related technologies.

The Industrial Control System (ICS) is a public facility that provides services to lots of users; thus, its security has always been a critical factor in measuring its availability. Recently, a new type of attack on ICS has occurred frequently, which realizes the extortion of users by invading the information domain and destroying the physical domain. However, due to the diversity and unavailability of an ICS control logic, the targets of such attacks are usually limited to PCs and servers, leaving more disruptive attack methods unexplored. To contribute more possible attack methods to strengthen the immunity of ICS, in this paper, we propose a novel ransomware attack method named Industrial Control System Automatic Ransomware Constructor (ICS-ARC). Compared to existing ICS ransomware, ICS-ARC can automatically generate an International Electrotechnical Commission (IEC) compliant payload to compromise the Programmable Logic Controller (PLC) without a pre-known control logic, dramatically reducing adversary requirements and leaving room for error. To evaluate the attack capability of ICS-ARC, we built a tap water treatment system as the simulation experiment target for verification. The experimental results determine that ICS-ARC can automatically generate malicious code without the control logic and complete the attack against target PLCs. In addition, to assist the related research on future attacks and defenses, we present the statistical results and corresponding analysis of PLC based on Shodan.

Semantic Modelling of Hybrid Controllers for Robotic Cells

Programmable logic controllers are commonly used in automation systems. Continuously growing demands result in the growth of control program complexity. The classic approach, based on programmatic serial-cyclic execution, results in an unacceptable extension of response time. To overcome long response time massive parallel program execution is proposed. It utilize direct in hardware program implementation in field programmable devices. The paper brings a formal method of representing control programs using flow graphs and enabling single cycle computations. The developed method accepts ladder diagrams (LD) and sequential function charts (SFC), according to IEC61131-3 standard requirements. It is capable of handling logic and arithmetic computations, enabling its hardware mapping. The intermediate form is optimized using flow graph representation and BDDs for analyzing logic dependencies. The BDD representation of logic dependencies enables direct mapping to lookup tables of a selected FPGA family. All the above steps deliver high-performance and direct hardware implementation of the control program given by standard languages. The controller response time is short, predictable, and independent from logic conditions during program execution.

A Programmable Logic Controller (PLC) is a very common industrial control system device used to control output devices based on data received (and processed) from input devices. Given the central role that PLCs play in deployed industrial control systems, it has been a preferred target of ICS attackers. A quick search in the ICS-CERT repository reveals that out of a total of 589 advisories, more than 80 target PLCs. Stuxnet attack, considered the most famous reported incident on ICS, targeted mainly PLCs. Most of the PLC reported incidents are rooted in the fact that the PLC being accessed in an unauthorized way. In this paper, we investigate the PLC access control problem. We discuss several access control models but we focus mainly on the commonly adopted password-based access control. We show how such passwordbased mechanism can be compromised in a realistic scenario as well as the list the attacks that can be derived as a consequence. This paper details a set of vulnerabilities targeting recent versions of PLCs (2016) which have not been reported in the literature.

In recent years, more and more researchers were contributed to the research for the security of ICS (Industrial Control System) with the emphasis on the safety of ICS. As a lure for attackers, honeypots provide the researchers with great assistance of industrial security research, and also plays a certain role in the protection of industrial system security. Honeypot is designed to a vulnerable system with the purpose of luring attackers to compromise it. Simultaneously, it also collects valuable data from attackers under the ground, then researchers will extract useful information from the data and then convert it to threat intelligence, which can be used to found attackers' behaviors or strategies and protect realistic systems. The honeypot for ICS need not only meet the needs of traditional information control technology, such as cost and maintainability, but also meet the needs of ICSs, such as timing and decision strategies. The research focuses on the design and implementation of high interactive honeypot for ICSs. It puts forward a method, which improves the interaction of the ICSs' honeypot from two aspects-HMI (Human Machine Interface) and industrial protocols' simulation. At the same time, we designed and implemented a virtual and high interactive honeypot and deployed it which is based on the improved conpot project to simulate SIEMENS S7-400 series' PLCs (Programmable Logic Controllers).

Control systems are used in a number of different industrial sectors and critical infrastructures, including manufacturing, distribution, and transportation. Failure of these control systems because of malware or other faults would be catastrophic for critical infrastructure and would result in significant losses. Adverse operating conditions, such as those found in networked control systems, exacerbate the likelihood of vulnerability to malware attacks. The prospect of severe adversarial assaults such as buffer overflow, conventional faults, and especially stealthy Ladder Logic Bombs is a serious cause of concern in Industrial Control Systems (ICS) with novel attacks such as Struxnet. Decoupled at-distance Electromagnetic spectrum-based monitoring of faults and malware is more robust and can likely be integrated into Industrial Control System frameworks. Our failure analysis and Machine Learning (ML) modeling approach is fundamentally different from traditional methods in that we propose a Hybrid Quantum Artificial Intelligence-based Electromagnetic (EM) Spectral domain-based analysis approach that is completely decoupled from the controller processor and can predict PLC fault/malware conditions, including stealth Ladder Logic Bombs and buffer overflow attacks. Further, robust Supervisory Control Systems (SCSs) that interface with programmable logic controllers (PLCs) are essential components of Industrial Control Systems (ICSs) that handle critical infrastructure. Modern industrial control systems, on the other hand, are made up of densely linked Internet of Things (IoT) nodes. Because of their networked nature, supervisory control systems are also susceptible to widespread cyberattacks. As a result, in the case of a coordinated attack on IoT control systems, the dependability of Supervisory control decision-making procedures is jeopardized and need to be decoupled from the attacks. This work also develops a Fuzzy inference Engine-based supervisory monitoring technology based on the characteristics of the Hybrid Quantum AI-based analysis of the EM spectrum to reduce industrial plant downtime and false alarms by localizing adversarial attacks/faults, risk severity levels, and impacted nodes, as well as having dependability and malware immunity in networked Industrial control systems. The Hybrid QAI technique improved prediction accuracy by up to 88 percent when identifying different control system viruses and defects in 6-stage pipelined processors. The Fuzzy inference engine in the Mamdani Inference System architecture has been found to reduce the risk of false alarms and downtime.

Traffic lights are commonly used in the intersection in urban areas nowadays. In fact a network of the traffic lights regulating the urban vehicle can be viewed as a complex discrete-event system (DES). It is proved that Petri nets are one of the methodologies for modeling, analyzing and controlling on DES. A new approach via programmable logic controller (PLC) and Petri net synthesis is proposed in this paper. Firstly, we described the typical urban traffic lights control using Petri nets. Having compared with three methods for Petri nets realization, the best implementation method of the traffic lights control system was one which made with the PLC. The sequential function chart (SFC) of the PLC system is also given in the thesis. The result shown that the method has many advantages at improving flexibility and troubleshoots of system and reducing the difficulty in its realization.

Industrial control systems (ICS) are required to be operated safely under cyberattacks. Fallback control is necessary for the safe operation of ICS. As one of fallback control systems, we develop a resilient third-party monitoring system. This system consists of Programmable Logic Controllers (PLCs) for normal control and for fallback control. The normal PLC controls field devices, and the fallback PLC takes over the control after the normal PLC is attacked. The fallback control of this paper is the control takeover of a robot arm control system. To quickly transition to this fallback control, it is necessary to incorporate a supervisor function to manage each PLC function in an integrated manner. This paper aims to propose a modeling method of ICS functions and its analysis method to ensure that the supervisor can work properly under cyberattacks. For modeling, we use UPPAAL, specializing in formal verification by timed automata. We implement the models of each PLC and supervisor on UPPAAL. To quantitatively analyze whether the supervisor can really realize the incident response during cyberattacks, we give the specifications necessary for fallback control to the supervisor model using Timed Computation Tree Logic (TCTL) and verify its feasibility.

The Programmable Logic Controller (PLC) is located at the junction of the virtual network and physical reality in the Industrial Control System (ICS), which is vulnerable to attacks due to its weak security. Specifically, firmware tampering attacks take the firmware under the PLC operating system as the primary attack target. The firmware provides the bridge between PLC’s hardware and software, which means tampering against the firmware can be more destructive and harmful than other attacks. However, existing defense and forensics methods against firmware tampering attacks are asymmetrical, which directly leads to the proliferation of such attacks and the difficulty of forensic tracing. How to accurately, quickly, and efficiently conduct forensics for such attacks is an urgent problem. In this paper, we designed and implemented a reliable detection method based on Joint Test Action Group (JTAG) and memory comparison—Aye, which can detect mainstream firmware tampering attacks reliably. To determine the effectiveness and reliability of Aye, we selected a widely used PLC to observe Aye’s performance in defense and forensics by simulating the two latest PLC firmware tampering attack methods. The experimental results show that Aye can effectively defend against firmware tampering attacks, helping improve the efficiency and accuracy of such attack detection and forensics.

Powerful advantages of programmable logic controller (PLC) dominate process industries. Scan time of PLC increases with the number of inputs, rungs added in ladder diagram (LD). Researchers have identified and proved that field programmable gate array (FPGA) is more suitable than PLC for high speed applications. PLC executes the instructions represented through LD. PLC programmers are not familiar with FPGA programming. But, FPGA does not support LD based programming. This work has developed application software to generate equivalent VerilogHDL code for LD using LabVIEW. Novelty in this work is that each rung is defined using an "assign" statement which helps simultaneous execution of all the rungs. A data acquisition system was created to monitor the digital signals handled by the FPGA. The software was verified with a case study of substances mixing and traffic light control system.

A stability test chamber simulates specific environmental conditions and tests a product or material in the manufacturing stage. The tested product or material is then analyzed about its shelf-life estimation related to the state and durability of the product for a certain period. The main parameter that must control accurately is temperature. Programmable Logic Controller (PLC) as an industrial computer control system has been widely used. In this paper, the temperature control system was designed based on PLC and supervisory control and data acquisition (SCADA). The PLC and SCADA would indirectly control the heater. The PLC was feeded from the temperature sensor for real-time temperature inside the test chamber. Received temperature value, compared to the temperature set point. The validation and verification of controlled temperature inside the chamber were also investigated. The system was designed on a miniaturized chamber using commercial PLC and SCADA, Stepper motor, slide regulator, heater, and the temperature sensor PT100. The temperature test point for validation and verification was performed at 35 °C, 45 °C, and 55 °C. The result showed that The PT100 successfully had an excellent response to the temperature test point. The correction value for temperature is as high as 0.6 °C with a deviation of 1 %.

PLC 제어 시스템은 SFC 언어를 사용하여 설계할 경우, SFC 언어를 사용하면 제어의 흐름을 이해하기 쉽고, 유지보수가 용이하며 프로그램의 기술성이 뛰어나다. SFC 언어는 단일 시퀀스, 선택 시퀀스, 병렬 시퀀스로 나누어지며, 선택 시퀀스로 프로그래밍 하면 단일 시퀀스로 프로그램할 때보다 메모리의 크기가 커져야 한다. 본 논문에서는 선택 시퀀스의 기능을 단일 시퀀스로 구현하여 메모리의 크기를 줄여서 메모리의 효율을 향상시키는 방법을 제시하고, 실례를 통해 타당성을 확인하였다.