Detecting Anomalies in Process Control Networks

Abstract

This paper presents the estimation-inspection algorithm, a statistical algorithm for anomaly detection in process control networks. The algorithm determines if the payload of a network packet that is about to be processed by a control system is normal or abnormal based on the effect that the packet will have on a variable stored in control system memory. The estimation part of the algorithm uses logistic regression integrated with maximum likelihood estimation in an inductive machine learning process to estimate a series of statistical parameters; these parameters are used in conjunction with logistic regression formulas to form a probability mass function for each variable stored in control system memory. The inspection part of the algorithm uses the probability mass functions to estimate the normalcy probability of a specific value that a network packet writes to a variable. Experimental results demonstrate that the algorithm is very effective at detecting anomalies in process control networks.

Towards Learning Normality for Anomaly Detection in Industrial Control Networks

“…The presented algorithm in [15] uses deep packet inspection and estimates if a network packet has anomal effect on a memory variable of an ICS device. This approach, however, requires both detailed understanding of the used ICS network protocol and extensive knowledge about variables stored in the RAM variable memory of all monitored PLCs of the ICS.…”

Intrusion Detection in SCADA Networks

“…Packets are considered normal or abnormal based on the effect they have in the control system. Another approach, described in [9], is based on the observation that the contents of random access memory (RAM) of PLCs follow specific flows that persist over time. Packets are classified as normal or abnormal, by considering the effects they have in the contents of a PLC's RAM.…”

Anomaly detection in SCADA systems : a network based approach

“…The system is validated using 2 weeks of data from a real water treatment facility. The data was captured in the context of the Hermes, [20] network anomaly testbed aware Carcano et al [28,29,59] network anomaly simulation aware Cárdenas et al [31] network anomaly simulation aware Cheung et al [37] network anomaly testbed unaware D'Antonio et al [45] network anomaly none unaware Di Santo et al [49] network anomaly simulation aware Düssel et al [51] network anomaly measurement unaware Goldenberg and Wool [62] network anomaly measurement unaware Gonzalez and Papa [64] network anomaly testbed unaware Hadeli et al [69] network anomaly testbed unaware Hadiosmanovic et al [70] host anomaly measurement unaware Hoeve [76] network anomaly testbed unaware Linda et al [99] network anomaly testbed unaware McEvoy and Wolthusen [105] network anomaly simulation aware Oman and Phillips [116] network anomaly none unaware Premaratne et al [122] network signature testbed unaware Rrushi et al [125,126] network anomaly none aware Valdes and Cheung [145] network anomaly testbed unaware Xiao et al [151] network anomaly none aware Yang et al [152] host anomaly testbed unaware Table 4.2: Overview of surveyed IDS approaches Castor and Midas projects 4 , which also supported the work described in this thesis.…”

“…Process-aware approaches have also been proposed for nuclear power plants [125] (later tested in a simulated advanced boiling water reactor [126] [31]. An interesting aspect of [31] is the evaluation of the impact of different realistic attack scenarios and the discussion of responses to these attacks.…”

“…In fact, many publications on SCADA networks do not rely on empirical data, as obtained from real-world measurement (e.g., [37,145,126,140]). We argue that a comprehensive analysis of real-world measurements is necessary to fully understand SCADA networks.…”