On the Feasibility of Device Fingerprinting in Industrial Control Systems

Abstract

As Industrial Control Systems (ICS) and standard IT networks are becoming one heterogeneous entity, there has been an increasing effort in adjusting common security tools and methodologies to fit the industrial environment. Fingerprinting of industrial devices is still an unexplored research field. In this paper we provide an overview of standard device fingerprinting techniques and an assessment on the application feasibility in ICS infrastructures. We identify challenges that fingerprinting has to face and mechanisms to be used to obtain reliable results. Finally, we provide guidelines for implementing reliable ICS fingerprinters.

Industrial Control System Fingerprinting and Anomaly Detection

“…With regard to fingerprinting information technology systems, Caselli et al [5] observe that the most widely adopted fingerprinting technique uses a 67-bit signature from TCP/IP protocol headers to identify an operating system on a machine in a standard network. Caselli and colleagues also describe the challenges involved in fingerprinting industrial control devices.…”

“…Caselli et al [5] have noted that industrial control system characteristics make device fingerprinting more challenging compared with conventional information technology networks due to device heterogeneity, proprietary protocols, device computational power and long-standing TCP sessions. On the other hand, from the system perspective, industrial control systems -unlike conventional information technology networks -tend to have stable and persistent control flow communications patterns, including characteristics such as long lifecycles, static topologies, periodic behavior and a limited number of applications and protocols [1,16].…”

Process matters: cyber security in industrial control systems

“…Guideword Deviation / Potential threat add a user adds a valve to the group Valve modify a user modifies the name of a valve (topology) 1 delete a user deletes a valve from the group add no Tanks modify a user modifies the capacity of tank (e.g., the presumed capacity of tank is increased by double) (operational parameters) 2 delete no add a user adds action type to the allowed actions (e.g., a user adds "inserting setpoint" and/or "changing pump status" to the list of allowed operator actions on a pump) Pumps modify no (access settings) 3 delete a user deletes action type from allowed actions (e.g., a user deletes "inserting setpoint" and/or "changing pump status" from operator actions on a pump) example, depending on the context (i.e., the specific software control implementation), some combinations of keywords and guidewords do not apply (e.g., acidity parameters cannot be deleted) or are not considered as severe (e.g., add tank). To this end, the focus group selected 35 user actions that represent a potential threat.…”

“…While both plants use equipment from the same (well-known) vendor, they deploy different software versions. 2 We have access to (i) 3 day long packet trace from plant A and (ii) 14 day long packet trace from plant B. Both traces contain the complete network traffic captured from the mirroring port of the switches that connect the different PLCs and the ICS servers.…”

“…Other efforts focus on analyzing security threats in ICS. For example, some authors analyze protocol vulnerabilities [11,21,122], explore the lack of compliance to protocol specifications in different PLCs [29,107] and the feasibility of device fingerprinting [2]. To address security threats some efforts exploit communication patterns for anomalydetection [109,67] However, the effects that one can find at the flow-level remain limited; detecting semantic process changes requires inspection of the application layer.…”