Forensic readiness of industrial control systems under stealthy attacks

Azzam, M.; Pasquale, Liliana; Provan, Gregory; Nuseibeh, Bashar

doi:10.1016/j.cose.2022.103010

Cited by 9 publications

(3 citation statements)

References 37 publications

(90 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The automated industry relies on the Industrial Control System (ICS). The ICS consists of various types of controllers that are used to control the industrial plants and monitor their performance to guarantee their accurate operations [4,5]. There are various types of ICSs, such as distributed control systems (DCS), programmable logic controllers (PLC), supervisory control, and data acquisition systems (SCADA).…”

Section: Introductionmentioning

confidence: 99%

Intrusion Detection Framework for Industrial Internet of Things Using Software Defined Network

et al. 2023

View full text Add to dashboard Cite

The Industrial Internet of Things (IIoT) refers to the employment of the Internet of Things in industrial management, where a substantial number of machines and devices are linked and synchronized with the help of software programs and third platforms to improve the overall productivity. The acquisition of the industrial IoT provides benefits that range from automation and optimization to eliminating manual processes and improving overall efficiencies, but security remains to be forethought. The absence of reliable security mechanisms and the magnitude of security features are significant obstacles to enhancing IIoT security. Over the last few years, alarming attacks have been witnessed utilizing the vulnerabilities of the IIoT network devices. Moreover, the attackers can also sink deep into the network by using the relationships amidst the vulnerabilities. Such network security threats cause industries and businesses to suffer financial losses, reputational damage, and theft of important information. This paper proposes an SDN-based framework using machine learning techniques for intrusion detection in an industrial IoT environment. SDN is an approach that enables the network to be centrally and intelligently controlled through software applications. In our framework, the SDN controller employs a machine-learning algorithm to monitor the behavior of industrial IoT devices and networks by analyzing traffic flow data and ultimately determining the flow rules for SDN switches. We use SVM and Decision Tree classification models to analyze our framework’s network intrusion and attack detection performance. The results indicate that the proposed framework can detect attacks in industrial IoT networks and devices with an accuracy of 99.7%.

show abstract

Section: Introductionmentioning

confidence: 99%

Intrusion Detection Framework for Industrial Internet of Things Using Software Defined Network

et al. 2023

View full text Add to dashboard Cite

show abstract

“…We used advanced machine learning and data analysis techniques to identify anomalous patterns and suspicious behavior that indicate intrusion attempts or malicious activity. These AI systems operate under conditions that require high precision and speed to be effective, such as real-time detection and continuous monitoring, enabling a rapid, automated response that minimizes potential damage and improves infrastructure resilience [22].…”

Section: Definition Of the Problemmentioning

confidence: 99%

Transforming Cybersecurity into Critical Energy Infrastructure: A Study on the Effectiveness of Artificial Intelligence

Govea,

Gaibor-Naranjo,

Villegas-Ch

2024

Systems

View full text Add to dashboard Cite

This work explores the integration and effectiveness of artificial intelligence in improving the security of critical energy infrastructure, highlighting its potential to transform cybersecurity practices in the sector. The ability of artificial intelligence solutions to detect and respond to cyber threats in critical energy infrastructure environments was evaluated through a methodology that combines empirical analysis and artificial intelligence modeling. The results indicate a significant increase in the threat detection rate, reaching 98%, and a reduction in incident response time by more than 70%, demonstrating the effectiveness of artificial intelligence in identifying and mitigating cyber risks quickly and accurately. In addition, implementing machine learning algorithms has allowed for the early prediction of failures and cyber-attacks, significantly improving proactivity and security management in energy infrastructure. This study highlights the importance of integrating artificial intelligence into energy infrastructure security strategies, proposing a paradigmatic change in cybersecurity management that increases operational efficiency and strengthens the resilience and sustainability of the energy sector against cyber threats.

show abstract

“…At the same time, for investigators, advanced data collection would help speed up the investigation process www.ijacsa.thesai.org because the data is already available. This proactive approach is essential in digital investigation, especially in environments like social networks where editing and deleting messages are common for users to remove their unwanted traces; also, in critical systems such as Industrial Control Systems where realtime analysis may enable rapid triaging and response to attack [16], [17]. Meanwhile, the live data collection approach can be conducted by recording data from the running activities.…”

Section: Related Workmentioning

confidence: 99%

Proactive Acquisition using Bot on Discord

Cahyani¹,

Pratama²,

Rahman³

2023

IJACSA

View full text Add to dashboard Cite

Data deletion increases challenges in cybercrime investigation. To address the problem, proactive forensics for evidentiary collection is acknowledged to help investigators to acquire the potentially needed digital evidence. This study proposes a bot machine to record data from the Discord server in advance, hashing and saving it in proper storage for further forensic analysis. The recording process can be managed to collect activities and their related data (intact, modified, deleted), including text, pictures, videos, and audio. The Discord bot is designed by utilizing the main features of the Discord Social Networks Application Programming Interface (API). This paper examines how this approach is applicable by embedding the bot in a Discord server. Observation showed that the bot records the real-time data as it is always alive on the server, including the deleted or modified messages and their timestamps. All the recorded data is saved locally on the server's storage in easy-toread formats, CSV and JSON. The results showed that the bot could conduct the data acquisition for 37 concurrent users with a 2.3% error rate and 97.7% accuracy.

show abstract

Forensic readiness of industrial control systems under stealthy attacks

Cited by 9 publications

References 37 publications

Intrusion Detection Framework for Industrial Internet of Things Using Software Defined Network

Intrusion Detection Framework for Industrial Internet of Things Using Software Defined Network

Transforming Cybersecurity into Critical Energy Infrastructure: A Study on the Effectiveness of Artificial Intelligence

Proactive Acquisition using Bot on Discord

Contact Info

Product

Resources

About