Railway Defender Kill Chain to Predict and Detect Cyber-Attacks

Abstract

Most organizations focus on intrusion prevention technologies, with less emphasis on prediction and detection. This research looks at prediction and detection in the railway industry. It uses an extended cyber kill chain (CKC) model and an industrial control system (ICS) cyber kill chain for detection and proposes predictive technologies that will help railway organizations predict and recover from cyber-attacks. The extended CKC model consists of both internal and external cyber kill chain; breaking the chain at an early stage will help the defender stop the adversary’s malicious actions. This research incorporates an OSA (open system architecture) for railways with the railway cybersecurity OSA-CBM (open system architecture for condition-based maintenance) architecture. The railway cybersecurity OSACBM architecture consists of eight layers; cybersecurity information moves from the initial level of data acquisition to data processing, data analysis, incident detection, incident assessment, incident prognostics, decision support, and visualization. The main objective of the research is to predict, prevent, detect, and respond to cyber-attacks early in the CKC by using defensive controls called the Railway Defender Kill Chain (RDKC). The contributions of the research are as follows. First, it adapts and modifies the railway cybersecurity OSA-CBM architecture for railways. Second, it adapts the cyber kill chain model for the railway. Third, it introduces the Railway Defender Kill Chain. Fourth, it presents examples of cyber-attack scenarios in the railway system.

A review on cybersecurity in railways

“…135 Other. Other papers are qualitative (3 conceptual, 1 comparative study, and 1 case study) and consist of generalised security technologies, 136,137 cybersecurity issues and challenges, 15 cybersecurity maturity levels 138 and other security guidance within railways. 139 From the critical review process, it has been noticed that some of the authors have used CKC models to predict and detect cyberattacks which is an interesting model to explore more into.…”

A Review and Case Study on Android Malware: Threat Model, Attacks, Techniques and Tools

“…The malware detection approaches have evolved over the years. While most research studies discuss the detection mechanisms, in [27], the use of prediction technologies using the cyber kill chain and industrial control system to reduce cyber-based attacks has been explained. This article discusses the detection approaches for Android malware analysis.…”

Towards an Approach to Contextual Detection of Multi-Stage Cyber Attacks in Smart Grids

“…Alternatively, the Kill-Chain modeling concept provides an approach for structuring multistage attacks aimed at disrupting or destroying vital processes or devices. Steps within the structure include gaining access to and information about the target system, developing and testing new capabilities on the compromised targets, exploiting vulnerabilities and moving laterally in the network, building Command and Control (C2) infrastructure, and acting on the objection (e.g., disrupting grid operations) [23].…”