Identifying Near-Optimal Single-Shot Attacks on ICSs with Limited Process Knowledge

Abstract

Industrial Control Systems (ICSs) rely on insecure protocols and devices to monitor and operate critical infrastructure. Prior work has demonstrated that powerful attackers with detailed system knowledge can manipulate exchanged sensor data to deteriorate performance of the process, even leading to full shutdowns of plants. Identifying those attacks requires iterating over all possible sensor values, and running detailed system simulation or analysis to identify optimal attacks. That setup allows adversaries to identify attacks that are most impactful when applied on the system for the first time, before the system operators become aware of the manipulations. In this work, we investigate if constrained attackers without detailed system knowledge and simulators can identify comparable attacks. In particular, the attacker only requires abstract knowledge on general information flow in the plant, instead of precise algorithms, operating parameters, process models, or simulators. We propose an approach that allows single-shot attacks, i.e., near-optimal attacks that are reliably shutting down a system on the first try. The approach is applied and validated on two use cases, and demonstrated to achieve comparable results to prior work, which relied on detailed system information and simulations.

Towards automated identification and assessment of security weaknesses in smart buildings

“…Moreover, we show its applicability to the Industrial Control Systems domain. This chapter is based on the contents of two papers published at refereed conferences [3,5].…”

“…Their paper describes 20 disturbances commonly found in real chemical plants. For instance, sticky valves, changes in chemical reaction kinetics, and random variations in the composition of input streams, each of them with a unique numeric identifier in the range [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20]. Finally, there are process operating constraints (e.g., maximum reactor temperature, maximum reactor pressure, etc.)…”

“…By environmental conditions we refer to the disturbances enabled during the simulation. The disturbances considered are those in the range [1][2][3][4][5][6][7][8][9][10][11][12][13] and are executed one at a time. According to the original TEP paper, disturbances in the range [14][15][16][17][18][19][20] should be used in conjunction with other disturbances [41].…”

“…For the remaining 28 experiments, we use the minimum and maximum value attack strategies. This time we use all disturbances in the range [1][2][3][4][5][6][7][8][9][10][11][12][13] because this control strategy is able to handle all of them. Moreover, we execute experiments without any disturbances, which adds up to 14 different environmental conditions.…”