On the Edge Realtime Intrusion Prevention System for DoS Attack

Abstract

Industrial control systems manage critical infrastructures that are immensely diverse and complicated. These highly linked critical infrastructures are made up of networks of industrial control system (ICS) each responsible for controlling critical processes. During its nascent stages the controllers in the ICS were built for robust operation in extreme industrial conditions, but little to no emphasis was placed on safeguarding the system against potential cyberthreats. The industrial networks having legacy controllers are air gapped from the enterprise network hence a centrally deployed NIDS in the same network of the trusted nodes is often used as the last line of defence against intrusions such as malicious activity or policy violation. Most cyber incidents in industrial control systems have witnessed the breach of the air gap and compromised trusted nodes. Hence this paper proposes an on-the-edge Intrusion Prevention System (IPS) that can detect and prevent Denial of Service (DoS) attack on the Programmable Logic Controllers (PLCs) from trusted nodes at real time. A novel attribute of our proposed framework is that it is generic in nature and can be used on any PLC irrespective of the critical infrastructure being controlled by it. A wide range of experimentation has been performed to validate the performance of our proposed IPS.

A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

“…Recognizing that proprietary and heterogenous communication protocols are a barrier to effective anomaly detection as well as the effective development of industry best practices for CPS security postures, the O-PAS (Open Process Automation Standard) [260] is an industry consortium that is attempting to standardize the wide range of proprietary CPS into a set of open and collaborative standards around communication protocols and security postures, with the goal of increasing efficiency through multivendor interoperability. By achieving broad consensus within the open industry consortium, a particular CPS can be designed to meet the O-PAS standard, which allows for standardized methods of threat detection, health monitoring, and the use of standardized security methods.…”

“…With the throughput of data communication networks and microprocessor speeds increasing exponentially over the past decades, it has become attractive to move certain functions to the network edge [255][256][257][258][259][260][261][262][263][264][265][266][267][268][269][270][271][272][273][274]. In decades past, early CPS were constrained [255] by the state of the art of microprocessor technology and network bandwidth, resulting in low-frequency, low-resolution data sampling from the sensors of the CPS.…”

“…Das et al [260] focus on real-time intrusion prevention of edge devices, starting with the rationale that the sensors and actuators in a CPS were designed to operate in harsh environmental conditions but have limited emphasis on resilience in the face of cyberattack. Das et al propose a generic framework for detection and prevention of Denial of Service (DoS) attacks on Programmable Logic Controllers (PLC) through the use of a novel IPS running at the network edge between the resource-constrained PLC devices and potentially malicious traffic.…”