Extracting Vulnerabilities in Industrial Control Systems using a Knowledge-Based System

Abstract

Industrial Control Systems (ICS) are used for monitoring and controlling critical infrastructures such as power stations, waste water treatment facilities, traffic lights, and many more. Lately, these systems have become a popular target for cyber attacks. Both during their design and while operational, security is often an afterthought, leaving them vulnerable to all sorts of attacks. This paper presents a formal approach for analysing the security of Industrial Control Systems. A knowledge-based system, namely IDP, is used to analyse a model of the control system and extract system vulnerabilities. In this paper we present the input model of the methodology and the inferences and queries that allow the system to extract vulnerabilities. This methodology has been added to an existing framework where the user can model his system in the modeling language SysML. This SysML model then gets parsed into suitable IDP input. A fully working prototype has been developed and the approach has been validated on a real case study.

CPS Security Assessment using Automatically Generated Attack Trees

“…Our approach extends FAST-CPS (Lemaire et al 2014(Lemaire et al , 2015, which focuses on analyzing the security impact of known vulnerabilities on the security of 2 cyber-physical systems. It enables the user to model the system architecture in SysML, a modelling language derived from UML used for model-based systems engineering (Friedenthal et al 2014) and translates it to a logic-based model.…”

“…The attack trees are generated based on a model of the ICS, which must be provided by the assessor. This paper does not focus on the modelling of the CPS itself but uses an existing modelling framework, namely FAST-CPS (Lemaire et al 2015). This framework was selected because it allows the assessor to model the system using a graphical formalism based on SysML and automatically links known vulnerabilities extracted from vulnerability databases on the Internet (e.g.…”

A logic-based framework for the security analysis of Industrial Control Systems

“…This list is added to our logic theory in order to identify these vulnerabilities if the associated components are used in the control system. More details about how this is done can be found at [12] [13].…”

“…It is able to identify complex vulnerabilities which could escape the human eye, as shown in [13]. It also draws from vast vulnerability databases to quickly identify component vulnerabilities, which means the user does not have to search through the databases himself.…”

Ontology and life cycle of knowledge for ICS security assessments

“…In the ICS domain, some papers already address the ICS security knowledge. However many of them do not cover the full scope of ICS security assessments (Oates et al, 2013;Schneider, Obermeier and Schlegl, 2015;Lemaire et al, 2015;Lemaire et al, 2014), and others focus on special applications of ICS like smart grids and critical infrastructures (Choraś et al, 2010a; Jarmakiewicz, Maslanka and Parobczak, 2015; Barnett and Crapo, 2011;Koster et al, 2009). Additionally some general papers, dealing with ICS, do not embrace (all) ICS requirements (Bouet and Israel, 2011;Choraś et al, 2010b).…”