Emerging Techniques for Field Device Security

Schwartz, Moses; Mulder, John C.; Chavez, Adrian; Allan, Benjamin A.

doi:10.1109/msp.2014.114

Cited by 10 publications

(7 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traditionally, embedded control systems were not considered prominent attack targets due to their isolation from potential attack sources. However, the historical isolation has begun to break down as more and more embedded devices are connected to business networks and the Internet in the trend of IoT, making CPS control programs increasingly vulnerable [37].…”

Section: Cps Backgroundmentioning

confidence: 99%

“…Bare-metal CPS Devices: Our anomaly detection system works on the granularity of system calls and it leverages dynamic tracing facilities such as the strace tool, which requires the operating system support. An important reason behind our choice is that, the new generation of embedded control devices on the market are increasingly coming with operating systems [35], [37]. For example, Raspberry Pi devices with embedded Linux OS have been used as field devices in many CPS/IoT applications [62].…”

Section: Limitationmentioning

confidence: 99%

“…Embedded devices (a.k.a. field devices) in CPS are situated in the field, where their operating systems are typically embedded Linux/Windows variants [37] or PLC firmware [36]. Traditionally, embedded control systems were not considered prominent attack targets due to their isolation from potential attack sources.…”

Section: Cps Backgroundmentioning

confidence: 99%

See 2 more Smart Citations

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

Cheng

Tian

Yao

et al. 2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Securing cyber-physical systems (CPS) against malicious attacks is of paramount importance because these attacks may cause irreparable damages to physical systems. Recent studies have revealed that control programs running on CPS devices suffer from both control-oriented attacks (e.g., code-injection or code-reuse attacks) and data-oriented attacks (e.g., non-control data attacks). Unfortunately, existing detection mechanisms are insufficient to detect runtime data-oriented exploits, due to the lack of runtime execution semantics checking. In this work, we propose Orpheus, a new security methodology for defending against data-oriented attacks by enforcing cyber-physical execution semantics. We first present a general method for reasoning cyber-physical execution semantics of a control program (i.e., causal dependencies between the physical context/event and program control flows), including the event identification and dependence analysis. As an instantiation of Orpheus, we then present a new program behavior model, i.e., the event-aware finite-state automaton (eFSA). eFSA takes advantage of the event-driven nature of CPS control programs and incorporates event checking in anomaly detection. It detects data-oriented exploits if a specific physical event is missing along with the corresponding event dependent state transition. We evaluate our prototype's performance by conducting case studies under data-oriented attacks. Results show that eFSA can successfully detect different runtime attacks. Our prototype on Raspberry Pi incurs a low overhead, taking 0.0001s for each state transition integrity checking, and 0.063s∼0.211s for the cyber-physical contextual consistency checking.

show abstract

Section: Cps Backgroundmentioning

confidence: 99%

Section: Limitationmentioning

confidence: 99%

See 1 more Smart Citation

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

Cheng

Tian

Yao

et al. 2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…In fact, the main reasons for the vulnerabilities of networked control systems can be summarized in two aspects: from the perspective of their internal architectures, because the industrial-oriented communication protocols, real-time operating systems or embedded hardware/software platforms lack the applicable security mechanisms, the attackers can easily perform the destructive operations by exploiting the intrinsic system weaknesses [14], [15]; from the perspective of the external network environment, because the communication mechanism has developed into the IP-based communication pattern, the traditional IT threats can uncontrollably infiltrate into industrial control networks and cause significant damage [6], [16]. As a result, both academia and industry are now developing security solutions serving specially in networked control systems, and these solutions generally relate to threat prevention [17], [18], vulnerability evaluation [19], [20] and intrusion detection [13], [21]. As a bypass approach to detect misbehaviors without disrupting the availability and real-time performance of networked control systems, intrusion detection has been attracting great interests of researchers.…”

Section: Introductionmentioning

confidence: 99%

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

Wan

Shang

Zeng

2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Abstract-Due to the growing dependencies of information network technology, networked control systems are undergoing a severe blow of cyberattacks, and simply modeling cyberattacks is inadequate and impractical for the detection requirements, because of various vulnerabilities in these systems and the diversities of cyberattacks. Actually, a feasible viewpoint is to identify misbehaviors by constructing a normal model of industrial communication behaviors. However, one of the chief difficulties is how to completely and appropriately summarize industrial communication behaviors according to the specific communication characteristics. In view of process control and data acquisition, this paper associates industrial communication characteristics with the time sequence, and further extracts two distinct behaviors: function control behavior and process data behavior. Based on these double behavior characteristics, we introduce one-class classification to detect the corresponding anomalies, respectively. Besides, we also present the weighted mixed Kernel function and parameter optimization method to improve classification performance. Experimental results clearly demonstrate that the proposed approach has significant advantages of classification accuracy and detection efficiency.Index Terms-Function control behavior, process data behavior, one-class classification, networked control systems.

show abstract

“…For years, industrial control systems (ICS) were physically isolated from any external network or they are only connected to trusted hardware or communication link [1,2]. Hence, security was not in the picture of ICS world.…”

Section: Introductionmentioning

confidence: 99%

Intrusion Detection in PLC-Based Industrial Control Systems Using Formal Verification Approach in Conjunction with Graphs

Hailesellasie

Hasan

2017

J Hardw Syst Secur

View full text Add to dashboard Cite

Vulnerability in industrial control systems (ICS) has increased radically in the past few decades. This can be accounted to reasons including accessibility of ICS through Internet, development of sophisticated attack methods, and advancement in Internet of Things (IoT). The damage that can be caused by attackers on insecure ICS could cost hundreds of human lives and a huge state economy. Therefore, having such systems every where around us makes the concern for security nothing but a priority. Programmable logic controllers (PLCs) are the central devices of ICS and also a target to attacks which aim at gaining access and privilege to the control logic of the controller. A successful alteration or intrusion of the control logic by attackers can have a catastrophic effect on the plant. In this paper, control logic intrusion detection methodology for PLC-based control systems is proposed. The methodology implements the detection process by comparing a potentially intruded PLC program with a trusted version of the program. In order to achieve this goal, a scheme is proposed that operates in sequence of stages by first translating the PLC program to formal models (based on previous research work), then translating the formal models to graphs followed by performing a comparison between a trusted system model graph and a potentially intruded system graph. In the last stage of the methodology, graph discrepancy analysis is made in order to identify any intrusions. For demonstration purposes, a water level control system is presented as a case study, which is modeled using UPPAAL toolbox. We have verified our methodology by developing an in-house software. Our test results prove the concept that intrusions can be shown as discrepancies in the graphs generated from the UPPAAL-based formal modeling, which can be detected utilizing the proposed graph comparison approach. The premise of our study is that logic intrusions in PLC based ICS can be identified by the changes in the PLC code, and the methodology we proposed can successfully detect those changes by observing the code's graph model.

show abstract

Emerging Techniques for Field Device Security

Cited by 10 publications

References 8 publications

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

Intrusion Detection in PLC-Based Industrial Control Systems Using Formal Verification Approach in Conjunction with Graphs

Contact Info

Product

Resources

About