Defending malicious attacks in Cyber Physical Systems

Abstract

An increasing number of security incidents on industrial control systems drew a lot of concerns lately. Many attacks involved multiple attack vectors similar to internet attacks. However, CPS are more vulnerable to attacks. To evade detection, a hacker may apply multiple attack stages to gain the access to a control system. For example, he first employs a group of zombies (compromised machines) to identify the vulnerabilities of the target system and the findings would send back to the hacker through a communication channel. Once the correct access information is found by the zombies, the hacker could gain unauthorized access without violating any detection rules. The control system may be compromised by such multi-stage attacks and an appropriate defense mechanism is desired.In order to detect the sequence of such attack, this study correlates network information and system logs to find the stages of the attack. Finite state model, hidden Markov chain, is adopted to identify the multi-stage attacks and to prevent real damage. The results show that the proposed system can identify the multi-stage attacks in the early stage efficiently to prevent further damage in the networks. Index Terms-cloud computing, Hidden Markov Model, intrusion detectionA 13 978-1-4799-0798-4/13/$31.00 ©2013 IEEE

Temporal Phase Shifts in SCADA Networks

“…Different kinds of anomaly-based IDS models have been suggested for SCADA systems [36], [2], [9], [37], [17], [15], [11]. Model-based anomaly detection for the Modbus/TCP industrial network protocol was first studied by Cheung et al [10].…”

Accurate Modeling of the Siemens S7 SCADA Protocol for Intrusion Detection and Digital Forensics

“…Several recent studies (such as (Atassi, Elhajj, Chehab, & Kayssi, 2014) & (Chen, Hsiao, Yang, & Ou, 2013)) suggest anomaly-based detection for SCADA systems that is based on Markov chains. However, (Ye, Zhang, & Borror, 2004) showed that although the detection accuracy of this technique is high, the number of 'false positive' values is also high, as it is sensitive to noise.…”

Stealthy Deception Attacks Against SCADA Systems

“…Anomaly-based intrusion detection approaches are based on "the belief that an intruder's behavior will be noticeably different from that of a legitimate user" [34]. The main types of anomaly detection approaches that are applied to SCADA systems [3,4,11] are: Network-aware detection in which the anomaly detection models only consider network and OS-level events; Protocol-aware detection in which modeling the normal traffic relies on deep-packet-inspection and considers the SCADA control protocol's meta-data (message sizes, timing, argument addresses, command sequence); and Process-aware approaches which are based on process invariants, mathematical relationships among physical properties of the process controlled by the PLCs.…”

“…Surveys of techniques related to learning and detection of anomalies in critical control systems can be found in [3,4,11]. While most of the current commercial network intrusion detection systems (NIDS) are signature-based, i.e., they recognize an attack when it matches a previously defined signature, anomaly-based NIDS "are based on the belief that an intruder's behavior will be noticeably different from that of a legitimate user" [34].…”