Content-based deep communication control for networked control system

Abstract

In smart cities, the networked control system plays a significant role in transportation systems, power stations or other critical infrastructures, and it is facing many security issues. From this point, this paper proposes a content-based deep communication control approach to guarantee its security. Based on the layer architecture, this approach analyzes the interactive content in depth according to different industrial communication protocols, and implements the access control between two distinct enclaves. For OPC Classic, we acquire the dynamic port provided by OPC server, and open a new connection belonging to this port; for Modbus/TCP, we not only analyze the ordinary function codes and addresses, but also check the register or coil values by using the multi-bit Trie-tree matching algorithm. Besides, the white-listing strategy is introduced to satisfy the special requirements of industrial communication. Our experiment results show that, on the one hand the proposed approach pro- vides OPC and Modbus/TCP defenses in depth; on the other hand it has less than 1 ms forwarding latency and 0 packet loss rate when the rule number reaches 200, and all these meet the availability requirements in the networked control system. In particular, this approach has been successfully applied in several real-world petrochemical control systems.

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

“…Furthermore, we use Libpcap mechanism to capture the packets, and parse all Modbus/TCP packets in depth by using our own Linux C program. In this program, we perform the packet analysis layer by layer to obtain function codes, addresses and values according to Modbus/TCP protocol specification [17]. In particular, the whole capture time is about one hour 40 minutes, and the number of captured Modbus/TCP packets is 46,485.…”

“…In fact, the main reasons for the vulnerabilities of networked control systems can be summarized in two aspects: from the perspective of their internal architectures, because the industrial-oriented communication protocols, real-time operating systems or embedded hardware/software platforms lack the applicable security mechanisms, the attackers can easily perform the destructive operations by exploiting the intrinsic system weaknesses [14], [15]; from the perspective of the external network environment, because the communication mechanism has developed into the IP-based communication pattern, the traditional IT threats can uncontrollably infiltrate into industrial control networks and cause significant damage [6], [16]. As a result, both academia and industry are now developing security solutions serving specially in networked control systems, and these solutions generally relate to threat prevention [17], [18], vulnerability evaluation [19], [20] and intrusion detection [13], [21]. As a bypass approach to detect misbehaviors without disrupting the availability and real-time performance of networked control systems, intrusion detection has been attracting great interests of researchers.…”

Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication

“…In the device-oriented cases, trusted computing for industrial embedded devices [16] is a burgeoning security technology to provide system integrity check and data confidentiality protection. In the network-oriented cases, industrial firewall [11,17] and intrusion detection [15,18,19] are the typical applications in industrial control networks to improve the communication security. However, because we have not understood the boundary conditions between the availability and security of industrial control systems, the cases on trusted computing and industrial firewall may result in the processing delay or transmission delay in industrial process automation.…”

“…Moreover, we suppose that these malicious Modus/TCP packets cannot contain other function codes which are different with the four categories of function codes used in the simulation control system, and these packets only change the function control process. The major reason of such assumption is that the malicious packets containing other function codes can be easily filtered by the applied industrial firewall [11,32]. Besides, we generate 60 malicious function code sequences in each experiment.…”

“…According to the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) statistics [7], the ICS-CERT incident response team generalized and analyzed 290 industrial security incidents in 2016, and more and more sophisticated attacks against industrial control systems are developed by the adversaries. Actually, three comprehensible causes in such a situation can be recognized as follows: (1) multifarious vulnerabilities of industrial control systems have been exposed gradually in recent years, for example, system architecture vulnerability [8,9], embedded control device vulnerability [9][10][11], and industrial communication vulnerability [11,12]; (2) the types of cyberattacks are distinctive and diversified, and targeted attacks and APTs (Advanced Persistent Threats) have permeated to face reality [13]; (3) industrial-oriented defense technologies are in an underway and exploring stage, and the regular Internet security methods are unable to satisfy the special industrial control requirements [14].…”