Abstract:Industrial control systems (ICS) of critical infrastructure are increasingly connected to the Internet for remote site management at scale. However, cyber attacks against ICS - especially at the communication channels between humanmachine interface (HMIs) and programmable logic controllers (PLCs) - are increasing at a rate which outstrips the rate of mitigation. In this paper, we introduce a vendor-agnostic analytics framework which allows security researchers to analyse attacks against ICS systems, even if the researchers have zero control automation domain knowledge or are faced with a myriad of heterogenous ICS systems. Unlike existing works that require expertise in domain knowledge and specialised tool usage, our analytics framework does not require prior knowledge about ICS communication protocols, PLCs, and expertise of any network penetration testing tool. Using `digital twin' scenarios comprising industry-representative HMIs, PLCs and firewalls in our test lab, our framework's steps were demonstrated to successfully implement a stealthy deception attack based on false data injection attacks (FDIA). Furthermore, our framework also demonstrated the relative ease of attack dataset collection, and the ability to leverage well-known penetration testing tools. We also introduce the concept of `heuristic inference attacks', a new family of attack types on ICS which is agnostic to PLC and HMI brands/models commonly deployed in ICS. Our experiments were also validated on a separate ICS dataset collected from a cyber-physical scenario of water utilities. Finally, we utilized time complexity theory to estimate the difficulty for the attacker to conduct the proposed packet analyses, and recommended countermeasures based on our findings.

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

Real-time data fusion for intrusion detection in industrial control systems based on cloud computing and big data techniques

A New Perspective Towards the Development of Robust Data-Driven Intrusion Detection for Industrial Control Systems

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

ICS-IDS: Application of Big Data Analysis in AI-based Intrusion Detection Systems to Identify Cyberattacks in ICS Networks

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

DEIDS: a Novel Intrusion Detection System for Industrial Control Systems

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

An Ensemble Deep Learning-based Cyber-Attack Detection in Industrial Control System

Intrusion Detection System for Industrial Control Systems Based on Imbalanced Data

Survey on Intrusion Detection Systems Based on Machine Learning Techniques for the Protection of Critical Infrastructure

A Risk-Based Dynamic Decision-Making Approach for Cybersecurity Protection in Industrial Control Systems

A Game-Based Framework Towards Cyber-Attacks on State Estimation in ICSs.

A Real-time Intrusion Detection Method for Industrial Control Network Based on Heterogeneous Feature Extractor

Development of Intrusion Detection in Industrial Control Systems Based On Deep Learning

Intrusion sensor data fusion in an intelligent intrusion detection system architecture

An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Deployment Challenges of Industrial Intrusion Detection Systems

Multi-agent Intrusion Detection System Using Feature Selection Approach

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks