Autonomous Attack Mitigation for Industrial Control Systems

Mern, John; Hatch, Kyle; Silva, Ryan; Hickert, Cameron; Sookoor, Tamim; Kochenderfer, Mykel J.

doi:10.1109/dsn-w54100.2022.00015

Cited by 8 publications

(7 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The literature covered starts with challenges identified (Cinque, et al, 2018) to the latest review on the state of SIEM (Velasquez et al, 2023). The industries and domains covered are Air Traffic Control (ATC) (Cinque, et al, 2018), Intrusion Detection Systems (IDS) (Muhammed, et al, 2023), Industrial Control Systems (ICS) and critical infrastructures (Mern, et al, 2022; Gonzalez-Granadillo, Gonzalez-Zarsosa and Diaz, 2021), and Wind Energy Systems (Johnson, et al, 2023). This gives a good sweep of systems that are not just IT, but also includes critical infrastructures outside of IT.…”

Section: Integrating Siem/xsoar/xdrmentioning

confidence: 99%

On the Benefits of Vulnerability Data Consolidation in Application Security

Kasturi,

Li,

et al. 2024

iccws

View full text Add to dashboard Cite

This research aims to build upon a conceptual idea of consolidating all application security vulnerability data from monitoring, detection, and discovery tools into a physical system that allows for convergence of observation and response to an event that is a threat. Multiple application security testing and monitoring tools are deployed at different layers of an application architecture and capture activities that occur at that layer. This multi-layer data capture is disconnected without any analysis of data lineage from the externally exposed web attack surface to deep down into the application and data layers. It is only through this data consolidation can one provide a reliable statistical analysis of correlating multiple vulnerability information and synthesize an attack pattern and predict possible events accurately. The benefits of such a system are discussed in this paper that includes how one can organize the data, identifying temporal and spatial correlation of events, focusing on specific web requests that point to a specific vulnerability, and formulating a fast response to such events. Advantages of integrating with Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR/XSOAR), Extended Detection Response (XDR) are briefly discussed. The analysis can be further used to develop a predictive system using deep learning (DL) techniques using correlation of application security vulnerability information.

show abstract

Section: Integrating Siem/xsoar/xdrmentioning

confidence: 99%

On the Benefits of Vulnerability Data Consolidation in Application Security

Kasturi,

Li,

et al. 2024

iccws

View full text Add to dashboard Cite

show abstract

“…Variable σ x (j) Unit s (1) : Production 22.89 x (17) 0.11 m 3 /hour s (2) : Stripper Level 50.00 x (15) 1.03 % s (3) : Separator Level 50.00 x (12) 1.00 % s (4) : Reactor Level 65.00…”

Section: Setpoint S(i)mentioning

confidence: 99%

“…2) Noise Insertion and Data Collection: Noises are randomly generated and inserted into s (4) , as described in Section IV-C3. Parameters γ = 1 and T = 1 are chosen to accommodate the noise and the time scale of the system dynamics.…”

Section: B Reactor Level Attacksmentioning

confidence: 99%

“…Recent research has proposed many ICS-specific Intrusion Detection Systems (IDSs) [2], [3]. Once an intrusion is identified, manual or automated intervention [4] follows to prevent or, in the worst cases, mitigate process disruptions and physical damage. Based on its interactivity with the industrial process controlled by the ICS, an IDS can be classified as either passive or active.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Revealing Ongoing Sensor Attacks in Industrial Control System Via Setpoint Modification

Dai,

He,

Yang

et al. 2023

2023 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf

View full text Add to dashboard Cite

A variety of Intrusion Detection Systems (IDSs) for Industrial Control Systems have been proposed to detect attacks and alert operators. Passive and active detection schemes are characterised by whether or not they interact with the process under control, though both categories of approach have limitations relating to either known correlations in the process data or the use of explicit system modelling. We propose setpoint modification as a strategy to address those limitations. The approach superimposes Gaussian noises on setpoint values, which aids in revealing latent correlations between setpoints and measurements, thereby allowing machine learning-based IDSs to learn them during training and verify during inference. We show that by applying the approach to a linear system with PID control, statistical tests can be configured such that the distortion power of sensor attacks is nullified. Building on this foundation, we further adapt passive IDSs for active discovery of sensor attacks in a processagnostic fashion. The proposed strategy is evaluated using a nonlinear and simulated industrial benchmark, affirming that the approach enhances intrusion detection performance when the specific sensor under consideration is targeted whilst incurring marginal cost. Finally, we explore changing setpoints concurrently when the attacker could manipulate an arbitrary sensor, which also boosts detection performance and motivates the exploration of setpoint selection.

show abstract

“…The literature cited starts with challenges identified in SIEM technologies and then covers the latest review on the state of SIEM [1,2]. The industries and domains covered are Air Traffic Control (ATC) [1], Intrusion Detection Systems (IDS) [3], Industrial Control Systems (ICS) and critical infrastructures [4,5], and Wind Energy Systems [6]. This literature study gives a good sweep of systems that are not just IT, but also includes application of SIEM technology outside of IT.…”

Section: Introductionmentioning

confidence: 99%

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

Kasturi,

Li,

et al. 2024

AJNC

View full text Add to dashboard Cite

This paper has proposed a method to develop an attack tree, from application vulnerability data discovered through tests and scans and correlation analysis using incoming transaction requests monitored by a Web Application Firewall (WAF) tool. The attack tree shows multiple pathways for an attack to shape through vulnerability linkages and a deeper analysis of the Common Weakness Enumeration (CWE) and Common Vulnerability Exposure (CVE) mapping to individual vulnerabilities. By further relating to a parent, peer, or child CWE (including CWEs that follow another CWE and in some cases precede other CWEs) will provide more insight into the attack patterns. These patterns will reveal a multi-vulnerability, multi-application attack pattern which will be hard to visualize without data consolidation and correlation analysis. The correlation analysis tied to the test and scan data supports a vulnerability lineage starting from incoming requests to individual vulnerabilities found in the code that traces a possible attack path. This solution, if automated, can provide threat alerts and immediate focus on vulnerabilities that need to be remedied as a priority. SOAR (Security Orchestration, Automation, and Response), XSOAR (Extended Security Orchestration, Automation, and Response), SIEM (Security Information and Event Management), and XDR (Extended Detection and Response) are more constructed to suit networks, infrastructure and devices, and sensors; not meant for application security vulnerability information as collected. So, this paper makes a special case that must be made for integration of application security information as part of threat intelligence, and threat and incident response systems.

show abstract

Autonomous Attack Mitigation for Industrial Control Systems

Cited by 8 publications

References 12 publications

On the Benefits of Vulnerability Data Consolidation in Application Security

On the Benefits of Vulnerability Data Consolidation in Application Security

Revealing Ongoing Sensor Attacks in Industrial Control System Via Setpoint Modification

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

Contact Info

Product

Resources

About