Machine learning-based defense against process-aware attacks on Industrial Control Systems

Keliris, Anastasis; Salehghaffari, Hossein; Cairl, Brian; Krishnamurthy, P.; Maniatakos, Michail; Khorrami, Farshad

doi:10.1109/test.2016.7805855

Cited by 67 publications

(40 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a hot research topic, many researchers are focusing on the two stage intrusion detection approaches. A classical chemical process and went over all the attack vectors were studied in [18]. A data driven approach to detect anomalies was designed for early indicators of malicious activity.…”

Section: Related Workmentioning

confidence: 99%

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Wang

Song

2019

Electronics

View full text Add to dashboard Cite

Standard Ethernet (IEEE 802.3 and the TCP/IP protocol suite) is gradually applied in industrial control system (ICS) with the development of information technology. It breaks the natural isolation of ICS, but contains no security mechanisms. An improved intrusion detection system (IDS), which is strongly correlated to specific industrial scenarios, is necessary for modern ICS. On one hand, this paper outlines three kinds of attack models, including infiltration attacks, creative forging attacks, and false data injection attacks. On the other hand, a two stage IDS is proposed, which contains a traffic prediction model and an anomaly detection model. The traffic prediction model, which is based on the autoregressive integrated moving average (ARIMA), can forecast the traffic of the ICS network in the short term and detect infiltration attacks precisely according to the abnormal changes in traffic patterns. Furthermore, the anomaly detection model, using a one class support vector machine (OCSVM), is able to detect malicious control instructions by analyzing the key field in Ethernet/IP packets. The confusion matrix is selected to testify to the effectiveness of the proposed method, and two other innovative IDSs are used for comparison. The experiment results show that the proposed two stage IDS in this paper has an outstanding performance in detecting infiltration attacks, forging attacks, and false data injection attacks compared with other IDSs.

show abstract

Section: Related Workmentioning

confidence: 99%

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Wang

Song

2019

Electronics

View full text Add to dashboard Cite

show abstract

“…Simulinks serial interface functionality is used to communicate with the SIBs. Packets containing values corresponding to the power generation set-point of the generator are sent from PLC to the SIB over a custom built USB-Serial connection [29]. Also, the relay open/closed commands are sent from/to PC through the SIB over a USB-Serial connection.…”

Section: Experimental Hitl Testbedmentioning

confidence: 99%

Hardware-In-The-Loop Vulnerability Analysis of a Single-Machine Infinite-Bus Power System

Salehghaffari

Khodaparastan

2019

2019 IEEE Power &Amp; Energy Society General Meeting (PESGM)

Self Cite

View full text Add to dashboard Cite

The dynamic performance of the generators is a critical factor for the safe operation of the power grid. To this extent, the stability of the frequency of generators is the target of cyber attacks since its instability may lead to sizable cascade failures in the whole network. In this paper, we perform the vulnerability analysis in a developed power grid Hardware-In-The-Loop (HITL) testbed with a Wago 750-881 PLC sending control commands to the generators and a 750 Feeder Management Relay connected to a local load. A process-aware coordinated attack is demonstrated by spoofing control commands sent by the PLC and the relay to the simulated power system which is modeled as a single-machine infinite-bus (SMIB). Based on the reachability analysis, the attacker can find the optimal attack signal to drive the system state out of their safe set of values. Thereafter, it is experimentally demonstrated that the attacker does not need to send attack signal continuously if he implements a carefully designed coordinated attack on the PLC and the relay. The presented assessments provide information about the best time to launch an attack in order to destabilize the power system.

show abstract

“…In [10], Keliris et al develop a process-aware supervised learning defense strategy that considers the operational behavior of an ICS to detect attacks in real-time. They use a benchmark chemical process and consider several categories of attack vectors on their hardware controllers.…”

Section: Related Workmentioning

confidence: 99%

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

et al. 2018

View full text Add to dashboard Cite

This paper presents the development of a SCADA system testbed used for cybersecurity research. The testbed consists of a water storage tank's control system, which is a stage in the process of water treatment and distribution. Sophisticated cyber-attacks are conducted against the testbed. During the attacks, the network traffic is captured, and features are extracted from the traffic to build a dataset for training and testing different machine learning algorithms. Five traditional machine learning algorithms are trained to detect the attacks: Random Forest, Decision Tree, Logistic Regression, Naïve Bayes and KNN. After that, the trained machine learning models are built and deployed in the network, where new tests are made using online network traffic. The performance obtained during the training and test of the machine learning models is compared to the performance obtained during the online deployment of these models in the network. The results show the efficiency of the machine learning models in detecting the attacks in real time. The testbed provides a good understanding of the effects and consequences of attacks on real SCADA environments.

show abstract

Machine learning-based defense against process-aware attacks on Industrial Control Systems

Cited by 67 publications

References 12 publications

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Hardware-In-The-Loop Vulnerability Analysis of a Single-Machine Infinite-Bus Power System

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

Contact Info

Product

Resources

About