Detecting Anomalies in Programmable Logic Controllers Using Unsupervised Machine Learning

Abstract

Supervisory control and data acquisition systems have been employed for decades to communicate with and coordinate industrial processes. These systems incorporate numerous programmable logic controllers that manage the operations of industrial equipment based on sensor information. Due to the important roles that programmable logic controllers play in industrial facilities, these microprocessor-based systems are exposed to serious cyber threats.This chapter describes an innovative methodology that leverages unsupervised machine learning to monitor the states of programmable logic controllers to uncover latent defects and anomalies. The methodology, which employs a one-class support vector machine, is able to detect anomalies without being bound to specific scenarios or requiring detailed knowledge about the control logic. A case study involving a traffic light simulation demonstrates that anomalies are detected with high accuracy, enabling the prompt mitigation of the underlying problems.

PLCPrint: Fingerprinting Memory Attacks in Programmable Logic Controllers

“…Both PLCs show high performance reaching F1 scores of 0.97 and 0.92 for the S7-300 and AB CLX PLCs, respectively, demonstrating the generalisability of PLCPrint at detecting anomalous PLC behaviour. Moreover, the achieved F1 scores are competitive with existing PLC anomaly detection approaches [9], [11], [15]. PLCPrint anomaly detection performs best when the PLCs were subject to static attacks, possibly as static attacks typically comprise lower entropy regarding how PLC registers are manipulated.…”

“…The majority of existing fingerprinting approaches for ICS provide functionality for anomaly detection [5]- [7], [9]- [11], [14]- [16], [18]- [20]. There is an insubstantial number of studies that have explored the crossover between anomaly detection and forensic response, with only one study being identified to have limited forensic applications through timestamps associated with state changes [14].…”

“…As ICS network traffic is primarily deterministic, models of normal system behaviour are able to be accurately generated in comparison to generic IT systems, where there would typically be a greater amount of noise in the network data [23]. Other studies used the dynamic states of device input/output (I/O) registers to fingerprint ICS processes [9], [11], [14]. None of the studies in Table I have looked to use PLC application code as an artefact for device fingerprinting.…”

Detecção de anomalias em poços produtores de petróleo usando aprendizado de máquina

“…Os algoritmos Cluster Based Local Outlier Factor e Floresta de Isolamento foram utilizados para detectar alterações de qualidade nas medições realizadas, tendo sido utilizado um conjuntos de dados semi-sintéticos. Chan et al (2019) realizaram detecção de anomalias em controladores lógicos programáveis (CLPs) que compõem sistemas de controle de supervisão e aquisição de dados (SCADA). Esses equipamentos gerenciam operações de equipamentos industriais baseados em sensores e estão expostos a ameaças cibernéticas.…”

An Evaluation Model of Autonomy Levels in Manufacturing and its Features

“…separate hardware (see Figure 18). Either approach allows the system can 534 secure itself from most attacks [86]. An Evaluation Model of Autonomy Levels in Manufacturing and its Features 541 Some of the capabilities that increase the level of maturity of a system 542 are listed in Table 7 as important functionalities of self-x systems, in order 543 of maturity.…”