Abstract:With the advent of Industry 4.0, industrial facilities and critical infrastructures are transforming into an ecosystem of heterogeneous physical and cyber components, such as programmable logic controllers, increasingly interconnected and therefore exposed to cyber-physical attacks, i.e., security breaches in cyberspace that may adversely affect the physical processes underlying industrial control systems. In this paper, we propose a formal approach based on runtime enforcement to ensure specification compliance in networks of controllers, possibly compromised by colluding malware that may tamper with actuator commands, sensor readings, and inter-controller communications. Our approach relies on an ad-hoc sub-class of Ligatti et al.'s edit automata to enforce controllers represented in Hennessy and Regan's Timed Process Language. We define a synthesis algorithm that, given an alphabet $P$ of observable actions and a timed correctness property $e$, returns a monitor that enforces the property $e$ during the execution of any (potentially corrupted) controller with alphabet $P$, and complying with the property $e$. Our monitors correct and suppress incorrect actions coming from corrupted controllers and emit actions in full autonomy when the controller under scrutiny is not able to do so in a correct manner. Besides classical requirements, such as transparency and soundness, the proposed enforcement enjoys deadlock- and diverge-freedom of monitored controllers, together with scalability when dealing with networks of controllers. Finally, we test the proposed enforcement mechanism on a non-trivial case study, taken from the context of industrial water treatment systems, in which the controllers are injected with different malware with different malicious goals.

Programmable Logic Controllers Past Linear Temporal Logic for Monitoring Applications in Industrial Control Systems

Synthesis of logical controllers and discrete-event systems supervisory control theory

Towards Comprehensively Understanding the Run-time Security of Programmable Logic Controllers: A 3-year Empirical Study

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses

A Binary Level Verification Framework for Real-Time Performance of PLC Program in Backhaul/Fronthaul Networks

Anomoly Detection for PLC Based on Magnetic Side Channel

Binary-Level Formal Verification Based Automatic Security Ensurement for PLC in Industrial IoT

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Runtime Enforcement of Programmable Logic Controllers

A Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics

Designing Actively Secure, Highly Available Industrial Automation Applications

HyPLC: Hybrid Programmable Logic Controller Program Translation for Verification

Symbolic Analysis of Programmable Logic Controllers

Formal Modeling and Synthesis of Programmable Logic Controllers

DNAttest: Digital-twin-based Non-intrusive Attestation under Transient Uncertainty.

Detecting PLC Intrusions Using Control Invariants

Formal Verification of Safety PLC Based Control Software

Detecting Safety and Security Faults in PLC Systems with Data Provenance

SoK: Security of Programmable Logic Controllers

Dynamically Detecting Invariants for Automatic Testing PLC Programs (S).