A System-level Behavioral Detection Framework for Compromised CPS Devices

Abstract

Cyber-Physical Systems (CPS) play a signi cant role in our critical infrastructure networks from power-distribution to utility networks. e emerging smart-grid concept is a compelling critical CPS infrastructure that relies on two-way communications between smart devices to increase e ciency, enhance reliability, and reduce costs. However, compromised devices in the smart grid poses several security challenges. Consequences of propagating fake data or stealing sensitive smart grid information via compromised devices are costly. Hence, early behavioral detection of compromised devices is critical for protecting the smart grid's components and data. To address these concerns, in this paper, we introduce a novel and con gurable system-level framework to identify compromised smart grid devices. e framework combines system and function call tracing techniques with signal processing and statistical analysis to detect compromised devices based on their behavioral characteristics. We measure the e cacy of our framework with a realistic smart grid substation testbed that includes both resource-limited and resource-rich devices. In total, using our framework, we analyze six di erent types of compromised device scenarios with di erent resources and a ack payloads. To the best of our knowledge, the proposed framework is the rst in detecting compromised CPS smart grid devices with system and function-level call tracing techniques. e experimental results reveal an excellent rate for the detection of compromised devices. Speci cally, performance metrics include accuracy values between 95% and 99% for the di erent a ack scenarios. Finally, the performance analysis demonstrates that the use of the proposed framework has minimal overhead on the smart grid devices' computing resources.

MINOS: A Lightweight Real-Time Cryptojacking Detection System

“…In order to see the effects of different amount of obfuscations, we firstly obfuscated 25% of the function names in the source and header files of Webminerpool. Then, we increased the number of function names to 50%, 75%, and finally, to 100% in which every function name was obfuscated, excluding C memory management functions (i.e., memset, memcpy, malloc and free) [38], [39], [40]. Figure 7 shows the gray-scale image representations of the resulting miner samples.…”

A Review of Smart Grid Anomaly Detection Approaches Pertaining to Artificial Intelligence

“…Data integrity attacks [13,21,25,29,40,41,48,49,53,55,[59][60][61][62]70,75,76] Unusual consumption behaviors and measurements [6,24,27,32,34,35,38,46,52,67,68,[71][72][73] Network intrusions [16,18,19,56,63,69] Network infrastructure anomalies [14,15,17,20,22,33,39,47,58,64] Electrical data anomalies [7,23,26,36,…”

Understanding Indicators of Compromise against Cyber-attacks in Industrial Control Systems: A Security Perspective

“…• Device Behaviour: Different types of industrial devices behave differently. Even similar devices can act differently, depending on their tasks [17]. Such vagueness can lead to mistakenly identifying benign devices as a compromise.…”

“…This is because attackers often use these components in the pages they alert or upload after an attack. Babunet al [17] designed a system-level framework capable of detecting compromised CPS smart grid devices using system and function-level call tracing techniques. The proposed framework combines function and system call analysis to provide detailed activity of a device from both kernel and application-level.…”