Industrial automation and control systems (IACS) today are often based on common IT technologies. However, they often lack security mechanisms and those available in enterprise IT environments are often not suitable for IACS. Other mechanisms require significant manual maintenance which is error prone. In this paper we present an approach that leverages the unique characteristics of IACS, in particular their deterministic behavior and often available formal system description, to reliably detect anomalies and reproducibly generate configurations for security mechanisms such as firewalls. In particular, we extend common IDS technology to also detect an IACS specific anomaly: the missing of required traffic.

Building automation systems (BAS) are technologies which automatically control building appliances based on specialized algorithms to achieve predefined goals, such as optimising user comfort or regulating energy consumption. Normally, they are configured during deployment as a one-time effort by technicians with expert knowledge and tools. However, the dynamic nature of the environment and the preferences of occupants calls for the need of frequent reconfigurations, which is often impractical and expensive to implement. As a solution, we propose a novel BAS design which considers user-based information such as user preferences and feedback in order to continuously reconfigure itself, as opposed to static configurations. This high-level information is then adopted by a software framework based on multi-agent systems (MAS) that applies the PROSA reference model [9] to dynamically control the building. Under this framework, every room in the building is automated by a dedicated agent, acting as a software mediator between the appliances and its occupants, with the aim of maximising the result of a utility function taking into account power optimisation, user comfort, and environment dynamics. The proposed approach has been implemented in a real office environment, and we discuss our design to improve user experience a BAS deployment.

No abstract