A Plant-Wide Industrial Process Control Security Problem

Abstract

Industrial control systems are a vital part of the critical infrastructure.The potentially large impact of a failure makes them attractive targets for adversaries. Unfortunately, simplistic approaches to intrusion detection using protocol analysis or naïve statistical estimation techniques are inadequate in the face of skilled adversaries who can hide their presence with the appearance of legitimate actions. This paper describes an approach for identifying malicious activity that involves the use of a path authentication mechanism in combination with state estimation for anomaly detection. The approach provides the ability to reason conjointly over computational structures, and operations and physical states. The well-known Tennessee Eastman reference problem is used to illustrate the efficacy of the approach.

Defeating Node Based Attacks on SCADA Systems Using Probabilistic Packet Observation

“…Detective strategies based on protocol analysis, or statistical signal analysis by themselves can be shown to have weaknesses in uncovering such attacks [7], particularly in the face of an adversary with the ability to subvert network nodes in the system [3]. Hence conjoint reasoning over both communication and control functionality, making use of advanced state estimation techniques, is necessary to detect such attacks [2] [8]. This can be split into the analysis of the integrity of network nodes on the one hand and the analysis of the integrity of process control units on the other.…”

“…Techniques related to IP traceback [9,10,11,12,13,14] have been proposed to help solve this kind of problem in the context of denial of service attacks and such techniques are easily adaptable to this problem, particularly for probabilistic cases [15]. In [2], this requires demonstrating the existence of independent routes and then considering their consistency in terms of the model to determine route integrity. However, this approach relies on the knowledge of routes and system operations in a highly stable topology.…”

“…This elimination can take place along multiple routes simultaneously depending on edge-disjointedness of the network graph. In the remainder of the paper we rely on an algebraic formulation of the protocol [2] [17] as this offers a means of designing and proving protocol behaviour abstracted from specific SCADA environments.…”

“…This enables us to detect efficiently whether or not network nodes are forging or manipulating packages. If no such activity is discovered, in the presence of anomalous plant conditions, we may assume that the control unit is subject to adversary subversion 2 . We subsequently prevent subverted nodes from participating further in system communications, while repair and recovery procedures are carried out.…”

“…Attack aims are not confined to creating short-lived, albeit disastrous, effects, but based on medium-to long-term strategies to disrupt plant operation, and necessarily make use of advanced concealment techniques, which require the concomitant development of detection methods to uncover and remove them. The concept of utilising network protocols to aid intrusion recovery on SCADA systems has been proposed previously [2]. A detection event is assumed 1 [3], indicating a process under attack.…”