Abstract:Industrial control systems (ICS) of critical infrastructure are increasingly connected to the Internet for remote site management at scale. However, cyber attacks against ICS - especially at the communication channels between humanmachine interface (HMIs) and programmable logic controllers (PLCs) - are increasing at a rate which outstrips the rate of mitigation. In this paper, we introduce a vendor-agnostic analytics framework which allows security researchers to analyse attacks against ICS systems, even if the researchers have zero control automation domain knowledge or are faced with a myriad of heterogenous ICS systems. Unlike existing works that require expertise in domain knowledge and specialised tool usage, our analytics framework does not require prior knowledge about ICS communication protocols, PLCs, and expertise of any network penetration testing tool. Using `digital twin' scenarios comprising industry-representative HMIs, PLCs and firewalls in our test lab, our framework's steps were demonstrated to successfully implement a stealthy deception attack based on false data injection attacks (FDIA). Furthermore, our framework also demonstrated the relative ease of attack dataset collection, and the ability to leverage well-known penetration testing tools. We also introduce the concept of `heuristic inference attacks', a new family of attack types on ICS which is agnostic to PLC and HMI brands/models commonly deployed in ICS. Our experiments were also validated on a separate ICS dataset collected from a cyber-physical scenario of water utilities. Finally, we utilized time complexity theory to estimate the difficulty for the attacker to conduct the proposed packet analyses, and recommended countermeasures based on our findings.

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

An Anomaly Detection and Scenario Classification Scheme Based on Fuzzy C-means Clustering

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Vulnerability Analysis of CSP Based on Stochastic Game Theory

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Risk-Based Scheduling of Security Tasks in Industrial Control Systems With Consideration of Safety

A cyber-physical model for SCADA system and its intrusion detection

Mismatched Control and Monitoring Frequencies: Vulnerability, Attack, and Mitigation

Cybersafety: A System-theoretic Approach to Identify Cyber-vulnerabilities & Mitigation Requirements in Industrial Control Systems

Assessing the Use of Insecure ICS Protocols via IXP Network Traffic Analysis

A Security Posture Assessment of Industrial Control Systems Based on Evidential Reasoning and Belief Rule Base

An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems

A Novel Framework for Industrial Control System Malicious Code Analysis

Anomaly detection using isomorphic analysis for false data injection attacks in industrial control systems

From Exposed to Exploited: Drawing the Picture of Industrial Control Systems Security Status in the Internet Age.

Research on Attack Mechanism of Network Intrusion in Industrial Control System

A risk assessment model for similar attack scenarios in industrial control system