Detection of False Command and Response Injection Attacks for Cyber Physical Systems Security and Resilience

Abstract

The operational cyber-physical system (CPS) state, safety and resource availability is impacted by the safety and security measures in place. This paper focused on i) command injection (CI) attack that alters the system behaviour through injection of false control and configuration commands into a control system and ii) response injection (RI) attacks that modifies the response from server to client, thereby providing false information about system state. In this project, we implemented deep learning (DL) multi-layered security model approach for securing industrial control system (ICS) against malicious CI and RI attacks. We validated this approach with two case studies: i) network transactions between a Remote Terminal Unit (RTU) and a Master Control Unit (MTU) in-house SCADA gas pipeline control system and ii) a case study of command and response injection attacks. Based on this project result, we show that the proposed approach achieved a significant attacks detection capability of 96.50%. Also, demonstrated that performance of attack detection techniques applied can be influences by the nature of network transactions with respect to the domain of application. Hence, robustness and resilience of operational CPS state and performance are influenced by the safety and security measures in place which is specific to the CPS device in question. CCS CONCEPTS • Security and privacy → Distributed systems security.

Command Injection Attacks in Smart Grids: A Survey

“…Natural language processing and speech recognition frequently employ RNNs [74]. [75] uses deep ensemble RNNs-CNN to identify response injection and command injection threats in SCADA systems. A DL-based hybrid technique was presented by the authors in [76] to identify command injection attacks that cause remote tripping on relay systems inside a smart grid.…”

Advanced Persistent Threats Detection based on Deep Learning Approach

“…The architectural design of the proposed model for APT intrusion detection system (IDS) is built to run through three stages. This involves implementing a multi-step security detection approach based on DL, that takes into consideration the distributed and multi-level nature of the ICS architecture and reflect on the APT lifecycle for the four main SCADA cyber-attacks as suggested in [35]. Thus, APT detection system…”

“…This data contains network transaction captured over serial line that contains network information, payload information and label. In [35], the focus was on command injection (CI) attack (alters the system behaviour through injection of false control and configuration commands into a control system) and response injection (RI) attacks (attack that modifies the response from server to client, thereby providing false information about system state). A multi-stage approach based on DL techniques was implemented, where this approach is validated with two case scenarios; a network transactions between a RTU & MTU in-house SCADA gas pipeline control system and a case study of CI and RI attacks detection.…”