A Software-Defined Security Approach for Securing Field Zones in Industrial Control Systems

Abstract

Industrial control systems (ICSs) are facing increasingly severe security threats. Zone isolation, a commonly adopted idea for stopping attack propagation in general information systems, has been investigated for ICS security protection. It is usually implemented through perimeter security techniques. However, anomaly states of the physical processes in a compromised field zone may spread into other zones through the inter-zone information interaction. Due to the coupling of the physical processes between different zones, it is difficult to prevent the propagation of attack impact in ICSs. In this paper, a softwaredefined security (SDSec) approach is presented to address this problem. It consists of a hybrid anomaly detection module and a multi-level security response module, both of which work together to secure the ICS field zones. The hybrid anomaly detection module inspects anomaly behaviors from the perspectives of network communications and physical process states. The multi-level security response module helps prevent unapproved packets from communications, thus isolating any compromised zone. It also generates attack mitigation strategies to secure physical processes. Hardware-in-the-loop simulations are conducted to demonstrate the effectiveness of the presented approach.

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

“…No security perimeter defined: Without a clearly defined security perimeter for the ICS, it becomes challenging to guarantee the proper deployment and configuration of essential security measures [56]. This situation can result in unauthorized access to systems and data, along with other potential issues.…”

Reduction of the Delays Within an Intrusion Detection System (IDS) Based on Software Defined Networking (SDN)

“…[14] proposes an attack detection and localisation algorithm and designs an intervention strategy in the networked robot control field. A software-defined approach to secure field zones in an ICS is shown in [15]. The implementation of IDS within SDN controllers is proposed in [16], [17], [18], and [19] that provides a survey on SDN based network intrusion detection systems based on machine learning approaches.…”

Advancements and Research Trends in Microgrids Cybersecurity

“…Reference [27] proposes an attack detection and localization algorithm and designs an intervention strategy in the networked robot control field. A software-defined security approach to secure field zones in ICS is shown in Reference [28]: it consists of a hybrid anomaly detection module that inspects anomaly behaviors in network communications and physical process states. It proposes a multi-level security response module that allows isolating any compromised zone.…”