Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems

Destructive Cyber Operations and Machine Learning

“…* A group of researchers demonstrated that these models may be vulnerable to manipulation through adversarial attacks, just as other machine learning systems are. 36 An adversarial attack uses information about the target model-which can be learned by probing the target with inputs and recording the responses-to create an input (like ICS data) that causes the target to fail at its job. 37 The researchers trained an ML model using adversarial learning techniques to generate false sensor data which could deceive the defensive systems and help enable an attack.…”

“…The fake data created by the adversarial attack acted as a camouflage for the real attack being carried out simultaneously. 42 If human operators were to examine the screens of the HMIs at the plant, nothing would seem abnormal. The proof-of-concept provides clear evidence of the vulnerabilities inherent to intrusion detection systems based in machine learning.…”

Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems

“…Recent work in [28] generated adversarial attacks for ICS when attacking an autoencoder IDS. Their attacker substitutes the original data for readings within normal sensor range.…”

“…Additional work in [23] investigated adversarial attacks targeting an autoencoder IDS. Unlike [28], the work in [23] modelled their attacker as not having control of the communications to the IDS independently of the programmable logic controller (PLC). Therefore, the adversarial data had to fool the IDS and fulfill the original cyber-physical attack.…”

“…Having an accurate model of the physical system is a significant requirement, however it is an accepted assumption in this area. Related work provided the attacker with knowledge of all of the data, free of any noise [23], or considered defences which evaluate datapoints independently, and enable attackers to compromise a target without knowledge of the physical system [28]. In comparison our model is more challenging for the attacker.…”