Work

Specification Mining for Intrusion Detection in Networked Control Systems

Year: 2016

Type: conference-paper

Abstract: This paper discusses a novel approach to specification-based intrusion detection in the field of networked control systems. Our approach reduces the substantial human effort required to deploy a specification-based intrusion detection system by automating the development of its specification rules. We observe that networked control systems often include comprehensive documentation used by operators to manage their infrastructures. Our approach leverages the same documentation to automatically derive the specification rules and continuously monitor network traffic. In this paper, we implement this approach for BACnet-based building automation systems and test its effectiveness against two real infrastructures deployed at the University of Twente and the Lawrence Berkeley National Laboratory (LBNL). Our implementation successfully identifies process control mistakes and potentially dangerous misconfigurations. This confirms the need for an improved monitoring of networked control system infrastructures.

Source: University of Twente Research Information

Authors: Marco Caselli, Emmanuele Zambon, Johanna Amann, Robin Sommer, Frank Kargl

Institutions: University of Twente, International Computer Science Institute, Lawrence Berkeley National Laboratory, Universität Ulm

Language: English

Topic: Smart Grid Security and Resilience

Subfield: Control and Systems Engineering

Field: Engineering

Domain: Physical Sciences

SDG: Industry, innovation and infrastructure

Open Access status: green

Funder: National Science Foundation

Award: TWC: Option: Medium: Collaborative: Semantic Security Monitoring for Industrial Control Systems