Detecting Process-Aware Attacks in Sequential Control Systems

Cross-domain alert correlation methodology for industrial control systems

“…Process-aware IDSs [45,46,47,48,49,50] cover the physical domain of the ICS. Given a model of the correct behavior of the physical process, a processaware IDS monitors the communications between sensors/actuators and Programmable Logic Controllers (PLCs) while reporting anomalous deviations in the evolution of process variables.…”

“…While such an assumption can be valid for small systems, manually determining critical states for large systems can be daunting, with the risk of missing some critical states. As a result, some approaches explored more expressive formalisms, such as temporal logics [48,47] or state-aware models [51].…”

“…For example, Koucham et al infer temporal safety properties over the states of sensors and actuators from legitimate traces [47]. Then, their IDS detects any violation of such process specifications.…”

“…Our correlation approach receives inputs from separate IDSs, each one specific to a domain, and the resulting meta-alerts summarize the information from both domains. Our experimental evaluation used the following IDSs found among the literature concerning intrusion detection: network flow IDS [1,56], payload-based IDS [2,4], and process-aware IDS [47].…”

“…[64]. However, we could not have directly exploited those datasets for our work because we would have needed access to the control logic and the initial state of the logic in the captures to perform the activity tracking required by the process-aware IDS [47].…”