Modeling Message Sequences for Intrusion Detection in Industrial Control Systems

Abstract

Compared with standard information technology systems, industrial control systems show more consistent and regular communications patterns. This characteristic contributes to the stability of controlled processes in critical infrastructures such as power plants, electric grids and water treatment facilities. However, Stuxnet has demonstrated that skilled attackers can strike critical infrastructures by leveraging knowledge about these processes. Sequence attacks subvert infrastructure operations by sending misplaced industrial control system messages. This chapter discusses four main sequence attack scenarios against industrial control systems. Real Modbus, Manufacturing Message Specification and IEC 60870-5-104 traffic samples were used to test sequencing and modeling techniques for describing industrial control system communications. The models were then evaluated to verify the feasibility of identifying sequence attacks. The results create the foundation for developing "sequence-aware" intrusion detection systems.Keywords: Industrial control systems, sequence attacks, intrusion detection IntroductionCritical infrastructure assets such as power plants, electric grids and water treatment facilities have used control systems for many decades; however, until the turn of the century, they were primarily standalone systems. The Internet and network convergence have brought about many changes to critical infrastructure assets, the most important being their transformation from standalone systems to highly interconnected systems. This transformation has introduced advantages and disadvantages. On one hand, it facilitates the remote monitoring and management of industrial processes. On the other hand, traditional information technology attacks can be launched from afar, includ-50 CRITICAL INFRASTRUCTURE PROTECTION IX ing over the Internet, to compromise industrial control systems and the critical infrastructure assets they manage. This is the case of denial-of-service and distributed denial-of-service attacks. These attacks can target a specific device in an industrial control network and flood it with a massive number of packets until it is no longer able to operate normally. This can reduce or eliminate operator situational awareness and eventually impact the coordination and control of infrastructure assets, potentially affecting the larger infrastructure and connected infrastructures, leading to serious consequences to industry, government and society.Another example involves semantic attacks. Unlike standard cyber attacks, semantic attacks exploit knowledge of specific control systems and physical processes to maximize damage. Stuxnet [4,16] is probably the most wellknown attack of this type. Meanwhile, numerous reports from the U.S. ICS-CERT have described exploits on industrial devices, such as programmable logic controllers and SCADA servers, that are triggered by carefully-crafted messages (see, e.g., [9]). Sequence attacks are a type of semantic attack. Instead of using modified message headers or pa...

Intrusion Detection for Sequence-Based Attacks with Reduced Traffic Models

“…Sequence attacks are specific to industrial control systems and potentially harm a system by sending valid messages or commands, which are misplaced or outof-order [5]. To take control of the process, an attacker can either reprogram a PLC or directly control the process from the network, e.g., by taking control over the communication channel.…”

“…When controlling the process, an attacker sends commands in an order or timing not intended by the process. This potentially harmful sequence of commands is then called sequence attack [5].…”

“…Following the approach presented in [5] traffic is represented as a sequence of exchanges in terms of a Discrete Time Markov Chain (DTMC). In the following Algorithm 1: DTMC modeling of sequences as in [5] we use DTMC that can be defined as a tuple M = (S, T ), where S is a finite set of states and T is a transition relation, that assigns probabilities to states (s 1 , s 2 ) ∈ T , i.e.…”

“…In the following Algorithm 1: DTMC modeling of sequences as in [5] we use DTMC that can be defined as a tuple M = (S, T ), where S is a finite set of states and T is a transition relation, that assigns probabilities to states (s 1 , s 2 ) ∈ T , i.e. if there exists a transition between the states s 1 and s 2 .…”

“…Alg. 1 l. [1][2][3][4][5][6][7][8][9][10][11][12][13][14], processing its events. S2 extracts the attributes of an event and stores them in variable 'State DT M C ' (c.f.…”