Detecting Vulnerabilities in Critical Infrastructures by Classifying Exposed Industrial Control Systems Using Deep Learning

Abstract

Industrial control systems depend heavily on security and monitoring protocols. Several tools are available for this purpose, which scout vulnerabilities and take screenshots of various control panels for later analysis. However, they do not adequately classify images into specific control groups, which is crucial for security-based tasks performed by manual operators. To solve this problem, we propose a pipeline based on deep learning to classify snapshots of industrial control panels into three categories: internet technologies, operation technologies, and others. More specifically, we compare the use of transfer learning and fine-tuning in convolutional neural networks (CNNs) pre-trained on ImageNet to select the best CNN architecture for classifying the screenshots of industrial control systems. We propose the critical infrastructure dataset (CRINF-300), which is the first publicly available information technology (IT)/operational technology (OT) snapshot dataset, with 337 manually labeled images. We used the CRINF-300 to train and evaluate eighteen different pipelines, registering their performance under CPU and GPU environments. We found out that the Inception-ResNet-V2 and VGG16 architectures obtained the best results on transfer learning and fine-tuning, with F1-scores of 0.9832 and 0.9373, respectively. In systems where time is critical and the GPU is available, we recommend using the MobileNet-V1 architecture, with an average time of 0.03 s to process an image and with an F1-score of 0.9758.

A preliminary SWOT evaluation for the applications of ML to Cyber Risk Analysis in the Construction Industry

“…Ebrahimi et al [17] proposed a Transductive Support Vector Machines (TSVM) algorithm and a deep bidirectional Long Short-Term Memory (LSTM) algorithm for semi-supervised threat identification and labeling. Medina et al [18] employed Inception-ResNet-V2 architecture and VGG16 architecture on transfer learning and finetuning to detect vulnerabilities in industrial control systems. Of course, these are not an exhaustive list but give insights into how ML techniques could be used in the construction industry in risk identification, such as identifying an attack by detecting abnormal data flow in computers, identifying a phishing email received by contractors by analyzing the text, identifying an intentional data-stealing of building plans by detecting the excessive attempts of log-in, etc.…”

A survey on methods, datasets and implementations for scene text spotting

“…It is also possible to extract artificially added text to an image, such as subtitles or watermarks [2]. Applications of Text Spotting can be found in the Industrial field, such as assembly lines [3,4], video indexing [1], document analysis [5], robot navigation [6,7], automatic classification of Information / Operational Technology (IT/OT) snapshots in Industrial Control Systems [8], or identification of port containers [9]. In CyberSecurity, it can be applied to retrieve text found in images from Tor (The Onion Router) darknet, which can be linked to the sale of weapons, document falsification [10] from suspicious domains [11] or from child sexual abuse (CSA) images.…”

Análisis de técnicas de aumento de datos y entrenamiento en YOLOv3 para detección de objetos en imágenes RGB y TIR del UMA-SAR Dataset

“…Un problema para la adopción de CNNs en nuevas aplicaciones es la escasez de imágenes convenientemente etiquetadas para casos de aplicación o modalidades específicas [2]. En este sentido, las técnicas de transferencia de conocimiento han demostrado eficacia en distintas aplicaciones [7] y se pueden combinar con operaciones de aumento de datos para conseguir buenos resultados a partir de conjuntos de datos reducidos [8].…”