Internet-scale Probing of CPS: Inference, Characterization and Orchestration Analysis

Abstract

Although the security of Cyber-Physical Systems (CPS) has been recently receiving significant attention from the research community, undoubtedly, there still exists a substantial lack of a comprehensive and a holistic understanding of attackers' malicious strategies, aims and intentions. To this end, this paper uniquely exploits passive monitoring and analysis of a newly deployed network telescope IP address space in a first attempt ever to build broad notions of real CPS maliciousness. Specifically, we approach this problem by inferring, investigating, characterizing and reporting large-scale probing activities that specifically target more than 20 diverse, heavily employed CPS protocols. To permit such analysis, we initially devise and evaluate a novel probabilistic model that aims at filtering noise that is embedded in network telescope traffic. Subsequently, we generate amalgamated statistics, inferences and insights characterizing such inferred scanning activities in terms of their probe types, the distribution of their sources and their packets' headers, among numerous others, in addition to examining and visualizing the co-occurrence patterns of such events. Further, we propose and empirically evaluate an innovative hybrid approach rooted in time-series analysis and context triggered piecewise hashing to infer, characterize and cluster orchestrated and well-coordinated probing activities targeting CPS protocols, which are generated from Internet-scale unsolicited sources. Our analysis and evaluations, which draw upon extensive network telescope data observed over a recent one month period, demonstrate a staggering 33 thousand probes towards ample of CPS protocols, the lack of interest in UDP-based CPS services, and the prevalence of probes towards the ICCP and Modbus protocols. Additionally, we infer a considerable 74% of CPS probes that were persistent throughout the entire analyzed period targeting prominent protocols such as DNP3 and BACnet. Further, we uncover close to 9 thousand large-scale, stealthy, previously undocumented orchestrated probing events targeting a number of such CPS protocols. We validate the various outcomes through cross-validations against publicly available threat repositories. We concur that the devised approaches, techniques, and methods provide a solid first step towards better comprehending real CPS unsolicited objectives and intents. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Easing the Conscience with OPC UA

“…Devices using these legacy and insecure industrial protocols are often subject to scanning activities [4,17,35]. While standard scanning tools, e.g., zmap [16], not necessarily influence normal operations of industrial devices [8], malicious activities can compromise such unprotected devices.…”

Security of controlled manufacturing systems in the connected factory: the case of industrial robots

“…More in general, projects such as Shodan's ICS radar 3 provide insights on the non-trivial amount of industrial control systems and PLCs directly exposed to the Internet. As shown by [15], a significant amount of probing activities targeted at cyberphysical systems is happening in the wild, both for research and for nefarious purposes.…”

Deep mining port scans from darknet

“…For instance, in Rossow, the author evaluated UDP‐based network protocols if they are vulnerable to amplification attacks and proposed a method based on darknet monitoring to detect them. In Fachkha et al, the authors proposed a formal probabilistic model that aims at analyzing activities targeting Cyber‐Physical System (CPS) protocols. In Bou‐Harb et al, the authors passively monitored close to 16.5 million darknet IP addresses from a /8 and a /13 network telescopes.…”