Command Disaggregation Attack and Mitigation in Industrial Internet of Things

Xun, Peng; Zhu, Peidong; Hu, Yifan; Cui, Pengshuai; Zhang, Yan

doi:10.3390/s17102408

Cited by 12 publications

(4 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MQTT may also employ TLS for encryption via port 8883. More information on the security of industrial IoT systems can be found in [53][54][55], on intrusion detection in [56][57][58], on encryption in [59], and on black-hole detection in [60].…”

Section: Discussionmentioning

confidence: 99%

Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study

Jaloudi

2019

Future Internet

100

View full text Add to dashboard Cite

Most industrial and SCADA-like (supervisory control and data acquisition) systems use proprietary communication protocols, and hence interoperability is not fulfilled. However, the MODBUS TCP is an open de facto standard, and is used for some automation and telecontrol systems. It is based on a polling mechanism and follows the synchronous request–response pattern, as opposed to the asynchronous publish–subscribe pattern. In this study, polling-based and event-based protocols are investigated to realize an open and interoperable Industrial Internet of Things (IIoT) environment. Many Internet of Things (IoT) protocols are introduced and compared, and the message queuing telemetry transport (MQTT) is chosen as the event-based, publish–subscribe protocol. The study shows that MODBUS defines an optimized message structure in the application layer, which is dedicated to industrial applications. In addition, it shows that an event-oriented IoT protocol complements the MODBUS TCP but cannot replace it. Therefore, two scenarios are proposed to build the IIoT environment. The first scenario is to consider the MODBUS TCP as an IoT protocol, and build the environment using the MODBUS TCP on a standalone basis. The second scenario is to use MQTT in conjunction with the MODBUS TCP. The first scenario is efficient and complies with most industrial applications where the request–response pattern is needed only. If the publish–subscribe pattern is needed, the MQTT in the second scenario complements the MODBUS TCP and eliminates the need for a gateway; however, MQTT lacks interoperability. To maintain a homogeneous message structure for the entire environment, industrial data are organized using the structure of MODBUS messages, formatted in the UTF-8, and then transferred in the payload of an MQTT publish message. The open and interoperable environment can be used for Internet SCADA, Internet-based monitoring, and industrial control systems.

show abstract

Section: Discussionmentioning

confidence: 99%

Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study

Jaloudi

2019

Future Internet

100

View full text Add to dashboard Cite

show abstract

“…The system data security is the guarantee of the safe and reliable operation of industrial manipulators [20]. During a system data transmission process, attackers modified the state of the exchange between the master and slave manipulators by introducing a static malicious content modification attack, which made the joint speed of the manipulator unstable and realized the content modification attack of the bilateral teleoperation system [21].…”

Section: B System Datamentioning

confidence: 99%

“…Then, we destroy the data logic of B s in red line, and the values in blue line are the attacked system data in Equation (20).…”

Section: B Cosimulation Model 1) the Data Logic Attack Simulationmentioning

confidence: 99%

Data Logic Attack on Heavy-Duty Industrial Manipulators

Xie

Hao

et al. 2020

IEEE Access

View full text Add to dashboard Cite

The anticipated widespread use of the heavy-duty industrial manipulator (HDIM) makes it an important role in the field of modern industrial automation. Research on the attack of cyber-physical systems based on industrial manipulator vulnerabilities is booming, while there are few studies on the data logic and attack impact for HDIMs. This paper proposes a new cyber-physical attack mechanism named data logic attack mechanism on HDIMs, including network protocol data logic attack, system data integrity logic attack, and process logic attack. Meanwhile, data logic attack models for HDIMs and an attack impact analysis model are established. Besides, for the proposed data logic attack mechanism, a hardware-in-theloop cosimulation based on Simulink and Adams is carried out to demonstrate the impact of data logic attacks on the system integrity, availability, accuracy, and integrity. A test platform has also been established to test the attack mechanism's effectiveness. The results of cosimulation and test show the attack impact ranking and effectiveness of the attack mechanism. INDEX TERMS Industrial manipulator, data logic attack, impact analysis model, cosimulation.

show abstract

“…A tank system [7,31] is simulated by using Matlab/Simulink, and its structure is shown in Figure 8. The controller of the tank system receives requests from users to produce liquid C, E, F, and G by the neutralization process of ingredient A, ingredient B, and ingredient D. Liquid C is produced when the ratio of ingredient A to ingredient B is 1.…”

Section: Scenariomentioning

confidence: 99%

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

Deng

Yang²,

Xun

et al. 2019

Electronics

Self Cite

View full text Add to dashboard Cite

False data injection (FDI) attack is a hot topic in cyber-physical systems (CPSs). Attackers inject bad data into sensors or return false data to the controller to cause the inaccurate state estimation. Although there exists many detection approaches, such as bad data detector (BDD), sequence pattern mining, and machine learning methods, a smart attacker still can inject perfectly false data to go undetected. In this paper, we focus on the advanced false data injection (AFDI) attack and its detection method. An AFDI attack refers to the attack where a malicious entity accurately and successively changes sensory data, making the normal system state continuously evaluated as other legal system states, causing wrong outflow of controllers. The attack can lead to an automatic and long-term system failure/performance degradation. We first depict the AFDI attack model and analyze limitations of existing detectors for detecting AFDI. Second, we develop an approach based on machine learning, which utilizes the k-Nearest Neighbor (KNN) technique and heterogeneous data including sensory data and system commands to implement a classifier for detecting AFDI attacks. Finally, simulation experiments are given to demonstrate AFDI attack impact and the effectiveness of the proposed method for detecting AFDI attacks.

show abstract

Command Disaggregation Attack and Mitigation in Industrial Internet of Things

Cited by 12 publications

References 34 publications

Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study

Communication Protocols of an Industrial Internet of Things Environment: A Comparative Study

Data Logic Attack on Heavy-Duty Industrial Manipulators

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

Contact Info

Product

Resources

About