An approach based on behavioral models and critical states distance notion for improving cybersecurity of industrial control systems

Sicard, Franck; Zamaï, Éric; Flaus, Jean‐Marie

doi:10.1016/j.ress.2019.03.020

Cited by 13 publications

(5 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The latter is attack who send messages and commands in an illegal time. After that, Sicard et al [13] proposed four kinds of attack pattern, defined as follows.…”

Section: Related Work a Semantic Attackmentioning

confidence: 99%

“…The above classification did not express the actual scenarios perfectly, for instance, "Direct attacks" and "Over-soliciting attacks" referred to the attack effects, and did fail to explain any attack techniques. Meanwhile, "Sequential attacks" and "Temporal attacks" would lead to system to a critical state quickly, such as in the tank system [13], forcing "V3" open and "V5" closed as "Tank T5" is full, "Tank T5" would be overflow. Therefore, the pivotal research point of attack model focused on "attack patterns" or "attack effects" are not sufficient.…”

Section: Related Work a Semantic Attackmentioning

confidence: 99%

See 1 more Smart Citation

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

Wang

et al. 2022

IEEE Trans. Netw. Sci. Eng.

View full text Add to dashboard Cite

By violating semantic constraints that the control process impose, the semantic attack leads the Industry Control Systems (ICS) into an undesirable state or critical state. The spread of semantic attack has caused huge economic losses and casualties to critical infrastructure. Therefore, detecting semantic attack is referred to an urgent and critical task. However, few existing detecting techniques can achieve satisfactory effects in detecting semantic attack of ICS, due to the high requirements of complete critical state-based semantic behavior features description, joint detection on multivariate type state variables, and validity of field states datasets under semantic attacks. In an effort to deal with above challenges, We label device states databases with temporal characteristics and divide impacts on states of field devices under semantic attacks into three categories, including absent in states set, confused sequences, irregular frequency. On this basis, we establish a behavioral model based on secondary labeling of states-duration evolution graph (BMSLS), then implement an adaptive secure state-based semantic attack detection framework furtherly. Compared with the traditional Auto Regression (AR) algorithm, the newer time series correlation graph model, and other five deep learning algorithms, our proposed framework demonstrates the superior effect on the detection of semantic attack.

show abstract

“…The latter is attack who send messages and commands in an illegal time. After that, Sicard et al [13] proposed four kinds of attack pattern, defined as follows.…”

Section: Related Work a Semantic Attackmentioning

confidence: 99%

Section: Related Work a Semantic Attackmentioning

confidence: 99%

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

Wang

et al. 2022

IEEE Trans. Netw. Sci. Eng.

View full text Add to dashboard Cite

show abstract

“…: IS Interactions (X) between factory perimeters They have been used since the second half of the 20 th century [13]. Inside this category, can be mentioned PLC (Programmable Logic Controllers), RTU (Remote Terminal Units) [14], IED (Intelligent Electronic Devices).…”

Section: Presence Of Is Interactionsmentioning

confidence: 99%

“…An innovative methodology was proposed by [13], and is based on the concept of "automation knowledge". This is a deepening of [40] from the same author.…”

Section: ) Behavioral Models and Critical State Distance Notion To Protect Industrial Control Systems A: Purposementioning

confidence: 99%

A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0

2021

View full text Add to dashboard Cite

Industry 4.0 is a revolution in manufacturing by introducing disruptive technologies such as Internet of Things (IoT) and cloud-computing into the heart of the factory. The resulting increased automation and the improved production synergy between stocks, supply chains and customer demands, come along with the threats and attacks from the Internet. Despite extensive literature on the cybersecurity topic, many actors in manufacturing factories are just realizing the impact of cybersecurity in the preservation of their business. This paper introduces step-by-step the concepts and practical aspects of an Industry 4.0 manufacturing factory that are related to cybersecurity. Based on a subdivision of a typical factory into several generic perimeters, we present the vulnerabilities and threats regarding the network and devices usually found in each perimeter. Therefore, it is more efficient to present the recent proposals of the literature regarding cybersecurity guidelines and solutions in Industry 4.0. Instead of spreading a lot of references regarding every aspect of cybersecurity, we focused on a limited number of papers among the recent references. However, for each paper, we provide the details about the purpose of the proposal, the methodology adopted, the technical solution developed and its evaluation by the authors. These solutions range from classical cybersecurity countermeasures to innovative ones, such as those based on honeypots and digital twins. In order to deliver a review also useful to non scientists, we present our guidelines along with those of some organizations involved in cybersecurity harmonization and standardization in the world.

show abstract

“…Cyber‐attacks have become a major threat to many modern systems and networks. For example, industrial control systems have been targeted by cyber‐attacks based on vulnerabilities in these systems and their environments or based on the equipment degradation . It is a challenging task to address dependence in cybersecurity models …”

Section: Introductionmentioning

confidence: 99%

Probabilistic modeling and analysis of sequential cyber‐attacks

Liu

Xing

Zhou

2019

Engineering Reports

View full text Add to dashboard Cite

Security is one of the major challenges for promoting the computer industry. Existing models for assessing security have mostly assumed that different hazards causing the security breach are independent of each other. Dependencies however can exist among different hazardous actions and they may affect the system security attribute greatly. This paper advances the state of the art in quantitative security risk assessment by modeling one such dependency, where multiple sequence‐dependent hazardous actions are performed to launch a successful security cyber‐attack. Continuous‐time Markov chain and semi‐Markov process–based methods are proposed to estimate the occurrence probability of a security risk for systems undergoing the sequential cyber‐attacks. While the CTMC method is limited to the exponential state transition time, the proposed semi‐Markov process–based approach is applicable to analyzing attacks with any arbitrary types of transition time distributions. Both methods are illustrated using case studies where Trojan attacks in the banking application are modeled and analyzed.

show abstract

An approach based on behavioral models and critical states distance notion for improving cybersecurity of industrial control systems

Cited by 13 publications

References 30 publications

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0

Probabilistic modeling and analysis of sequential cyber‐attacks

Contact Info

Product

Resources

About