Industrial Control System Network Intrusion Detection by Telemetry Analysis

Abstract

Until recently, Industrial Control Systems (ICSs) used "air-gap" security measures, where every node of the ICS network was isolated from other networks, including the Internet, by a physical disconnect. Attaching ICS networks to the Internet benefits companies and engineers who use them. However, as these systems were designed for use in the air-gapped security environment, protocols used by ICSs contain little to no security features and are vulnerable to various attacks. This paper proposes an approach to detect the intrusions into network attached ICSs by measuring and verifying data that is transmitted through the network but is not inherently the data used by the transmission protocol -network telemetry. Using simulated PLC units, the developed IDS was able to achieve 94.3% accuracy when differentiating between machines of an attacker and engineer on the same network, and 99.5% accuracy when differentiating between attacker and engineer on the Internet. Stanislav Ponomarev is a Ph.D. candidate of engineering at Louisiana Tech University with concentration in cyber security. His research topics of interest include image enhancement, hard drive forensics, malicious application detection, network intrusion detection, and windows executable memory attacks.Travis Atkison received the B.

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

“…A summary of the related work is listed in Table 1. There are reviews addressing the chal- Scientific Work Reviews [19,27] Graph-based methods [2,12,13,36,37,41,42] Graph-based and time-sensitive methods [1,45] Machine learning-based [6,14,32] Statistical processes [33,44,48,50] Wavelet analysis [25,31,35] Industrial Intrusion Detection [3,15,18,20,23,28,34,38,39,46] lenge of anomaly detection for intrusion detection. García-Teodoro et al address the challenges of this field of work while presenting techniques and systems [19].…”

“…Regis Barbosa and Pras present a novel flow-based intrusion and anomaly detection method [39]. Air gapped Industrial Control Systems (ICSs) and attacks on such Figure 1: Relation of Sub-Processes systems are evaluated by Ponomarev and Atkison [38]. Ghaeini and Tippenhauer present a hierarchical model for industrial intrusion detection to combine information from the physical, as well as the Programmable Logic Controller (PLC) layer [20].…”

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

“…Kwon et al [26] present a behavior-based IDS for IEC 61850 protocol using both statistical analysis of traditional network features and specification-based metrics to secure smart grid network. Ponomarev and Atkison [27] give a network telemetry-based intrusion detection system to secure the communication of network attached ICSs, and network telemetry include temporal data of packet arrival, packet sizes, session times and sizes, amount of dropped packets and more. Although the statisticalbased approaches may identify some unknown attacks in some degree, the main drawbacks are that it is a difficult task to set the different metrics or parameters of traffic profile, and the deep industrial communication behaviors cannot be simply modeled by a statistical distribution.…”

UAV telemetry communications using ZigBee protocol

“…Constraints on these measurements can be overcome by remote measurement method (telemetry) using UAV (Unmanned Aerial Vehicle) [3,4]. The telemetry process is the measurement of the parameters of an object (objects, space, natural conditions) whose measurement results will be sent elsewhere either via cable or wireless [5,6]. The telemetry communications UAV is carried out wirelessly.…”