Enhancing the Security and Forensic Capabilities of Programmable Logic Controllers

Abstract

Industrial control systems are used to monitor and operate critical infrastructures. For decades, the security of industrial control systems was preserved by their use of proprietary hardware and software, and their physical separation from other networks. However, to reduce costs and enhance interconnectivity, modern industrial control systems increasingly use commodity hardware and software, and are connected to vendor and corporate networks, and even the Internet. These trends expose industrial control systems to risks that they were not designed to handle.This chapter describes a novel approach for enhancing industrial control system security and forensics by adding monitoring and logging mechanisms to programmable logic controllers, key components of industrial control systems. A proof-of-concept implementation is presented using a popular Siemens programmable logic controller. Experiments were conducted to compare the accuracy and performance impact of the proposed method versus the conventional programmable logic controller polling method. The experimental results demonstrate that the new method yields increased anomaly detection coverage and accuracy with only a small performance impact. Additionally, the new method increases the speed of anomaly detection and reduces network overhead, enabling forensic investigations of programmable logic controllers to be conducted more efficiently and effectively.

Detecting Anomalies in Programmable Logic Controllers Using Unsupervised Machine Learning

“…Another approach is to actively poll memory address values using an external program [19]. Yet another approach is to use a security block to transmit internal programmable logic controller data [1] to a historian.…”

“…To overcome these challenges, Chan et al [1] proposed the incorporation of a security block module to support programmable logic controller logging and attack detection capabilities. Specifically, they installed a security block (i.e., programmable logic controller code) on the device to capture selected memory content and other internal device information for monitoring purposes.…”

“…The most common inadvertent threats are posed by control program implementation bugs. Malicious threats include memory read/write logic attacks [20,21], malware worms [5,6,16], time bombs [1,7], and stop and start attacks [22]. These threats make it imperative to develop security solutions for monitoring the states of programmable logic controllers to uncover latent defects and anomalies.…”

“…The methodology, which employs a one-class support vector machine, can detect anomalies without being bound to specific scenarios or requiring detailed knowledge about the control logic. In addition to conventional data capture methods, the methodology leverages an additional security block in a programmable logic controller to detect anomalies [1]. The historian is also employed to store timestamped programmable logic controller state information (i.e., key memory address values) for anomaly/attack analyses and forensic investigations.…”

Forensic readiness of industrial control systems under stealthy attacks

“…Other work has proposed techniques to perform live forensics, i.e., investigate potential attacks while the system is running ( Al-Sharif et al, 2018;Taveras, 2013 ). In addition, several approaches have focused on analysing and acquiring evidence from specific ICS devices, namely PLC's ( Chan et al, 2018;Qasim et al, 2020;Yau et al, 2018 ) and engineering workstations ( Hadz ȋosmanovi ć et al, 2012;Myers et al, 2017 ).…”