Work

Reconfiguration of Firewall Filter Rules as a Response to Industrial Control System Intrusion

Year: 2025

Type: conference-paper

Abstract: In recent years, industrial control systems (ICS) have become a target of choice for cybercriminals. In turn, developing new defense mechanisms against intrusions in ICS has become a necessity. In a previous work, we created a reaction framework, able to reconfigure a system under attack by migrating applications away from compromised host devices. Since communication within an ICS should be heavily filtered to prevent anomalous commands, we need to redefine these filters to match our new configurations. In this paper, from a formal description of the IEC 62443 compliant ICS under study, we aim to automate the creation of all necessary filter rules, and the adaptation to application migration and device isolation. This approach is tested on a small scale installation supervising a physical process with industrial hardware.

Source: IEEE Conference on Communications and Network Security

DOI: 10.1109/cns66487.2025.11195004

Authors: Jolahn Vaudey, Stéphane Mocanu, Gwenaël Delaval, Eric Rutten

Institutions: Institut polytechnique de Grenoble, Centre National de la Recherche Scientifique, Institut national de recherche en sciences et technologies du numérique, Laboratoire d'Informatique de Grenoble

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

SDG: Industry, innovation and infrastructure

Open Access status: green

Funder: Agence Nationale de la Recherche