Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System

Abstract

Cyber-physical systems (CPS) consist of sensors, actuators, and controllers all communicating over a network; if any subset becomes compromised, an attacker could cause significant damage. With access to data logs and a model of the CPS, the physical effects of an attack could potentially be detected before any damage is done. Manually building a model that is accurate enough in practice, however, is extremely difficult. In this paper, we propose a novel approach for constructing models of CPS automatically, by applying supervised machine learning to data traces obtained after systematically seeding their software components with faults ("mutants"). We demonstrate the efficacy of this approach on the simulator of a real-world water purification plant, presenting a framework that automatically generates mutants, collects data traces, and learns an SVM-based model. Using cross-validation and statistical model checking, we show that the learnt model characterises an invariant physical property of the system. Furthermore, we demonstrate the usefulness of the invariant by subjecting the system to 55 network and codemodification attacks, and showing that it can detect 85% of them from the data logs generated at runtime.

A Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems

“…For example, Momtazpour et al [49] conduct anomaly detection by using an ARX (Auto Regression with eXogenous input) model with pre-discovered latent variables to find invariants between wireless sensor data within multiple time steps at Intel Berkeley Research lab. Chen et al [50] use code mutation programs to generate abnormal data traces, and then use a SVM classifier and statistical model checking to find invariants between sensor data in the SWaT testbed. Nevertheless, the invariant rules generated in our work are more comprehensive than [49], [50] as actuator states which are an important part of the control dynamics in ICS are also included.…”

“…Chen et al [50] use code mutation programs to generate abnormal data traces, and then use a SVM classifier and statistical model checking to find invariants between sensor data in the SWaT testbed. Nevertheless, the invariant rules generated in our work are more comprehensive than [49], [50] as actuator states which are an important part of the control dynamics in ICS are also included.…”

Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks

“…Other researches focused on the detection of anomalies with physical properties [14]. By using the specification or control logic, the monitoring system rarely emits false alarms [3,15]. However, it is relatively expensive to obtain and specify the specification or control logic.…”

A System-level Behavioral Detection Framework for Compromised CPS Devices

“…In this work, however, they utilize stimulant-response mechanisms to detect compromised devices based on their speci c reaction to controlled inputs, which can also be impractical for the smart grid and results can depend on several undesired networks' and physical channels' dynamics. Other relevant works propose similar a estation approaches [14,55] to detect a acks in CPS. However, these works focus on building models of the entire CPS network instead of focusing on individual devices, which impacts the overhead and the general performance of the proposed solutions.…”