ARMET: Behavior-Based Secure and Resilient Industrial Control Systems

Abstract

diMiTrios serpanos, a nd howard shrobe cyber means alone was first demonstrated in the well-known Aurora experiment where a pure cyber attack successfully destroyed a diesel generator [2]; Stuxnet [3] and the recent Ukrainian smartgrid attack [4] as well as several additional less known incidents have demonstrated the potential of cyber attacks to inflict serious societal damage. Finally, ICSs may be compromised to serve as elements of a Botnet as the recent Mirai attack indicates [5]. To address reliability and security in ICSs, one needs to take into account the characteristics of OT technology that differentiates ICSs from typical IT systems, because this influences the security methods and solutions that are appropriate for ICSs. ICSs typically have real-time requirements, often hard ones, whose violation may have significant, or even catastrophic, results. It is important to note that func

Securing Industrial Cyber–Physical Systems: A Run-Time Multilayer Monitoring

“…Based on ARMET [16], we introduce our Multi-Layer Runtime Security Monitor (ML-RSM). The ML-RSM structure is given in Fig.…”

“…In contrast to the contemporary approaches, we handle the stealthy attacks based on a method that identifies the vulnerabilities in the system design [16], [36]. The method is iterative; the design will be refined until no vulnerabilities are identified, or the identified vulnerabilities are covered by the monitor.…”

“…They can raise alarms whenever the observed behaviour matches the bad reference behaviour or deviates from the good reference behaviour. To operate, these monitors either employ data-driven approaches [10], [11], [12] that are known to suffer from a high rate of false alarms or model-based approaches [13], [14], [15], [16] that are limited to protecting application computations only. Recently, more rigorous AI based security monitors [17], [18] have been developed, however, they require underlying AI models.…”

A Cognitive Protection System for the Internet of Things

“…This is similar to ARMET and the concept of a Runtime Security Monitor, which detect data anomalies stemming from physical or cyber faults or attacks. 5,7 The shift in security-related processing from the local device to a remote server affords constrained, embedded system the same protection as a powerful general-purpose system at the expense of latency. In this manner, substantial computing power may help develop a system adaptive to emerging threats that would be infeasible to operate within the constraints of a low-cost IoT device.…”

Optimizing Electricity Load and Cost for Demand Side Management in Smart Grid

“…Moreover, implementing security features in smart grid is out of the scope of this paper as already a lot of work is done in this domain. In future, smart meter and electricity consumption profile of each user can be secured using ARMET [29] technology.…”