Automated detection-in-depth in industrial control systems

Abstract

Legacy industrial control systems (ICSs) are not designed to be exposed to the Internet and linking them to corporate networks has introduced a large number of cyber security vulnerabilities. Due to the distributed nature of ICS devices, a detection-in-depth strategy is required to simultaneously monitor the behaviour of multiple sources of ICS data. While a detection-in-depth method leads to detecting attacks, like flooding attacks in earlier phases before the attacker can reach the end target, most research papers have focused on anomaly detection based on a single source of ICS data. Here, we present a detection-in-depth method for an ICS network. The new method is called automated flooding attack detection (AFAD) which consists of three stages: data acquisition, pre-processing, and a flooding anomaly detector. Data acquisition includes data collection from different sources like programmable logic controller (PLC) logs and network traffic. We then generate NetFlow data to provide light-weight anomaly detection in ICS networks. NetFlow-based analysis has been used as a scalable method for anomaly detection in high-speed networks. It only analyses packet headers, and it is an efficient method for detecting flooding attacks like denial of service attacks, and its performance is not affected by encrypted data. However, it has not been sufficiently studied in industrial control systems. Besides NetFlow data, ICS device logs are a rich source of information that can be used to detect abnormal behaviour. Both NetFlow traffic and log data are processed in our pre-processing stage. The third stage of AFAD is anomaly detection which consists of two parallel machine learning analysis methods, which respectively analyse the behaviours of device logs and NetFlow records. Due to the lack of enough labelled training datasets in most environments, an unsupervised predictor and an unsupervised clustering method are respectively used in the anomaly detection stage. We validated our approach using traffic captured in a factory automation dataset, Modbus dataset, and SWAT dataset. These datasets contain physical and network level normal and abnormal data. The performance of AFAD was compared with single-layer anomaly detection and with other studies. Results showed the high precision of AFAD in detecting flooding attacks.

Operational Status Monitoring and Fault Diagnosis System of Transformer Equipment

“…In formulas (3) and ( 4), X, Y ∈ fA, B, Cg, X ≠ Y, I R * ABC,X , and I R * ABC,Y are the averages of vectors I R * ABC,X and I R * ABC,Y , respectively. If none of the column vectors I A , I B , and I C has the same value, the value of I R * ABC will be an integer [9]. Equation ( 4) can be simplified as…”

“…In equations ( 9) and (10), n is the degree of freedom of the t distribution. The t distribution probability density function is used to determine the thresholds for hypothesis testing of the t statistics shown in Figure 2; i.e., t α ðN − 2Þ is the threshold with significance level equal to α and degrees of freedom equal to N − 2, which can be derived from equation (9). ð +∞…”

Anomaly Detection for a Water Treatment System Based on One-Class Neural Network

“…Jadidi et al [29] proposed a multi-layer anomaly detector known as AFAD. The system was made up of two main parts: a lightweight network-based anomaly detector using hierarchical cluster analysis on Netflow data and a physical anomaly detector using an Autoregressive Integrated Moving Average (ARIMA)/Generalized AutoRegressive Conditional Heteroskedasticity (GARCH) predictor for time-series forecasting of sensor readings.…”

Design and Development of Automated Threat Hunting in Industrial Control Systems

“…Other automated solutions have utilised the MITRE framework to perform threat hunting and detect APTs. For instance, [2] and [24] employed MITRE ATT&CK for Enterprise to detect threats. Proposal [24] further used statistical analysis based on MITRE ATT&CK to learn APT TTPs to predict the future techniques that the adversary may perform.…”

“…An ICS adversary often practices different actions to exploit these vulnerabilities, pass the border between Information Technology (IT) and Operational Technology (OT) networks and launch a targeted attack against ICS networks. Many organisations use cyber threat hunting to detect hidden intrusions before they cause a significant breach proactively [2]. Hunting aims to detect threat actors early in the cyber kill chain by searching for signs of an intrusion and then providing hunting strategies for future use [3].…”