Through the eye of the PLC

Abstract

Off-the-shelf intrusion detection systems prove an ill fit for protecting industrial control systems, as they do not take their process semantics into account. Specifically, current systems fail to detect recent process control attacks that manifest as unauthorized changes to the configuration of a plant's programmable logic controllers (PLCs). In this work we present a detector that continuously tracks updates to corresponding process variables to then derive variablespecific prediction models as the basis for assessing future activity. Taking a specification-agnostic approach, we passively monitor plant activity by extracting variable updates from the devices' network communication. We evaluate the capabilities of our detection approach with traffic recorded at two operational water treatment plants serving a total of about one million people in two urban areas. We show that the proposed approach can detect direct attacks on process control, and we further explore its potential to identify more sophisticated indirect attacks on field device measurements as well.

The Nuts and Bolts of Deploying Process-Level IDS in Industrial Control Systems

“…The data-driven methods proposed in the literature are based on various techniques including state-space model identification [20], auto-regression [8], singular spectrum analysis [2], machine learning [7,12], and data mining [13]. These methods have been evaluated through (i) simulation of, e.g., a chemical process (Tennessee-Eastman) [5], electric power flow (MATPOWER) [21], and water distribution piping systems (EPANET) [18]; (ii) physical testbeds, including water boilers [8] and the SWaT testbed [9]; and (iii) offline experiments on data extracted from real ICS, such as water purification plants [8], water distribution plants [2], and gas pipeline systems [7].…”

“…Simulation platforms (e.g., the Tennessee-Eastman process [5]) and physical testbeds (e.g., the SWaT testbed [9]) allow for crafting attacks and evaluating the detection capabilities of the proposed methods under various attack scenarios. Using datasets extracted from real systems (e.g., pipeline SCADA systems [12] and water treatment plants [8]) adds some degree of realism to the evaluation. However, in absence of documented live experiments in real environments, a complete and global understanding of the applicability and efficiency of process-level monitoring is still lacking.…”

Exploiting Bro for Intrusion Detection in a SCADA System

“…Hoyos et al [8] describe a message authentication attack on a network operating with the IEC-61850 standard and running the GOOSE protocol. Several examples of attacks feasible on Programmable Logic Controllers (PLCs) that run a Modbus protocol are described in the literature [7]. Moving on to smart grid infrastructures we see descriptions of potential attacks on smart grids and how the dynamics of such networks differ in terms of timing characteristics compared to traditional ones [15].…”

Towards a Distributed Runtime Monitor for ICS/SCADA Systems

“…In a SCADA environment the attacks are infrequent and likely to be unique to the specific environment under attack, therefore rule sets built from the analysis of one attack are unlikely to detect future attacks (Hadžiosmanović et al 2014). …”

“…There have been previous works on incorporating SCADA traffic monitoring into firewalls and IDS (Intrusion Detection Systems), such as the VIKING project by Giani et al (2009), which suggests using an application-level module in the IDS to detect data anomalies and suspicious traffic. Hadžiosmanović et al (2014) used a network tap to capture and inspect raw network packets at the PLC interface. Their approach inspects the content of messages and categorised them as (1) control, (2) reporting, (3) measurement and (4) program state.…”