Modelling Cost-Effectiveness of Defenses in Industrial Control Systems

Fielder, Andrew; Li, Tingting; Hankin, Chris

doi:10.1007/978-3-319-45477-1_15

Cited by 4 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Poli (2008) identified active applications of PSO, and also pointed out that very little work has undertaken by applying PSO to cyber security problems, with only 1.3% of the literature covering the whole security field, such as security predictions (Gao et al 2011), intrusion detection (Srinoy 2007) and authentication (Karnan and Akila 2010). A similar PSO-based simulation was also employed to investigate the impact of cost-efficiency of defence on deciding the optimal defence for ICS in our previous work (Fielder et al 2016) . Figure 2 depicts the development of optimal solutions by using our simulation.…”

Section: Related Worksupporting

confidence: 43%

Defense-in-depth vs. Critical Component Defense for Industrial Control Systems

Fielder

Hankin

2016

Electronic Workshops in Computing

Self Cite

View full text Add to dashboard Cite

Originally designed as self-contained and isolated networks, Industrial Control Systems (ICS) have evolved to become increasingly interconnected with IT systems and other wider networks and services, which enables cyber attacks to sabotage the normal operation of ICS. This paper proposes a simulation of attackers and defenders, who have limited resources that must be applied to either advancing the technology they have available to them or attempting to attack (defend) the system. The objective is to identify the appropriate deployment of specific defensive strategy, such as Defense-in-depth and Critical Component Defense. The problem is represented as a strategic competitive optimisation problem, which is solved using a coevolutionary Particle Swarm Optimisation problem. Through the development of optimal defense strategies, it is possible to identify when each specific defensive strategies is most appropriate; where the optimal defensive strategy depends on the kind of attacker the system is expecting and the structure of the network.

show abstract

Section: Related Worksupporting

confidence: 43%

Defense-in-depth vs. Critical Component Defense for Industrial Control Systems

Fielder

Hankin

2016

Electronic Workshops in Computing

Self Cite

View full text Add to dashboard Cite

show abstract

“…game theory, combinatorial optimisation and a hybrid of the two) to find effective defence for security managers. The work [5] provided a co-evolutionary agent-based simulation to find effective defences by considering the cost-efficiency of defence in various zones of ICS.…”

Section: Related Workmentioning

confidence: 44%

Effective Defence Against Zero-Day Exploits Using Bayesian Networks

Hankin

2017

Critical Information Infrastructures Security

Self Cite

View full text Add to dashboard Cite

Abstract. Industrial Control Systems (ICS) play a crucial role in controlling industrial processes. Unlike conventional IT systems or networks, cyber attacks against ICS can cause destructive physical damage. Zero-day exploits (i.e. unknown exploits) have demonstrated their essential contributions to causing such damage by Stuxnet. In this work, we investigate the possibility of improving the tolerance of a system against zero-day attacks by defending against known weaknesses of the system. We first propose a metric to measure the system tolerance against zero-day attacks, which is the minimum effort required by zero-day exploits to compromise a system. We then apply this metric to evaluate different defensive plans to decide the most effective one in maximising the system tolerance against zero-day attacks. A case study about ICS security management is demonstrated in this paper.

show abstract

“…programs that detect abnormal behaviors [12], [13], botnet detection [14] and detecting intrusions in Internet of Things [15]. Though conservative protective mechanisms may be reformed and usefully arrayed to guard ICS against cyber-outbreaks [16], [17], still there exist numerous complications that obstruct this course.…”

Section: Related Workmentioning

confidence: 99%

HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems

Khan

et al. 2019

IEEE Access

114

View full text Add to dashboard Cite

Critical infrastructures, e.g., electricity generation and dispersal networks, chemical processing plants, and gas distribution, are governed and monitored by supervisory control and data acquisition systems (SCADA). Detecting intrusion is a prevalent area of study for numerous years, and several intrusion detection systems have been suggested in the literature for cyber-physical systems and industrial control system (ICS). In recent years, the viruses seismic net, duqu, and flame against ICS attacks have caused tremendous damage to nuclear facilities and critical infrastructure in some countries. These intensified attacks have sounded the alarm for the security of the ICS in many countries. The challenge in constructing an intrusion detection framework is to deal with unbalanced intrusion datasets, i.e. when one class is signified by a lesser amount of instances (minority class). To this end, we outline an approach to deal with this issue and propose an anomaly detection method for the ICS. Our proposed approach uses a hybrid model that takes advantage of the anticipated and consistent nature of communication patterns that occur among ground devices in ICS setups. First, we applied some preprocessing techniques to standardize and scale the data. Second, the dimensionality reduction algorithms are applied to improve the process of anomaly detection. Third, we employed an edited nearest-neighbor rule algorithm to balance the dataset. Fourth, by using the Bloom filter, a signature database is created by noting the system for a specific period lacking the occurrence of abnormalities. Finally, to detect new attacks, we combined our package contents-level detection with another instance-based learner to make a hybrid method for anomaly detection. The experimental results with a real large-scale dataset generated from a gas pipeline SCADA system show that the proposed approach HML-IDS outperforms the benchmark models with an accuracy rate of 97%. INDEX TERMS Bloom filters, zero-day attacks, intrusion detection, SCADA, industrial control systems.

show abstract

Modelling Cost-Effectiveness of Defenses in Industrial Control Systems

Cited by 4 publications

References 19 publications

Defense-in-depth vs. Critical Component Defense for Industrial Control Systems

Defense-in-depth vs. Critical Component Defense for Industrial Control Systems

Effective Defence Against Zero-Day Exploits Using Bayesian Networks

HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems

Contact Info

Product

Resources

About