Detecting industrial control malware using automated PLC code analytics

IEEE Security and Privacy

Volumn 12, Issue 6, 2014, Pages 40-47

  Zonouz, Saman ^a   Rrushi, Julian ^b   McLaughlin, Stephen ^c  

^a RUTGERS UNIVERSITY   (United States)

^b WESTERN WASHINGTON UNIVERSITY   (United States)

^c Narus ^*  (United States)

Author keywords

formal models; industrial control malware; model checking; PLC code analytics; process control systems; reverse engineering; safety critical code; security

Indexed keywords

ACCIDENT PREVENTION; CODES (SYMBOLS); COMPUTER CRIME; CONTROL THEORY; DYNAMICAL SYSTEMS; MALWARE; MODEL CHECKING; PROCESS CONTROL; REVERSE ENGINEERING;

CRITICAL CODES; ENGINEERING AND MATHEMATICS; FORMAL MODEL; INDUSTRIAL CONTROLS; PROGRAMMABLE LOGIC CONTROLLERS (PLC); SAFETY PROPERTY; SECURITY;

SAFETY ENGINEERING;

EID: 84921416016     PISSN: 15407993     EISSN: None     Source Type: Journal    
DOI: 10.1109/MSP.2014.113     Document Type: Article

References (11)

1. S. Zonouz et al., "RRE: A Game-Theoretic Intrusion Response and Recovery Engine," IEEE/IFIP Int'l Conf. Dependable Systems and Networks (DSN 09), 2009, pp. 439-448.
2. S. McLaughlin et al., "A Trusted Safety Verifier for Process Controller Code," Proc. Networks and Distributed Systems Security Symposium (NDSS 14), 2014.
3. R. Alur et al., "Automatic Symbolic Verification of Embedded Systems," IEEE Trans. Software Engineering, vol. 22, no. 3, 1996, pp. 181-201.
4. A. Coen-Porisini et al., "Using Symbolic Execution for Verifying Safety-Critical Systems," ACM SIGSOFT Software Engineering Notes, vol. 26, no. 5, 2001, pp. 142-151.
5. IEC, International Standard IEC61131, Part 3: Programming Languages; http://webstore.iec.ch/webstore/webstore.nsf/Artnum-PK/47556.
6. D. Song et al., "BitBlaze: A New Approach to Computer Security via Binary Analysis," Proc. 4th Int'l Conf. Information Systems Security (ICISS 08), 2008, pp. 1-25.
7. S. McLaughlin and P. McDaniel, "SABOT: Specification-Based Payload Generation for Programmable Logic Controllers," Proc. ACM Conf. Computer and Communications Security (CCS 12), 2012, pp. 439-449.
8. J. Larsen, "Breakage," Black Hat Federal, 2008; www.blackhat.com/presentations/bh-dc-08/Larsen/Presentation/bh-dc-08-larsen.pdf.
9. W.L. Brogan, Modern Control Theory, 3rd ed., Prentice Hall, 1990.
10. J. Rrushi, "Anomaly Detection via Statistical Learning in Industrial Communication Networks," Int'l J. Information and Computer Security, vol. 4, no. 4, 2011, pp. 295-315.
11. Á. Cárdenas et al., "Secure Control: Towards Survivable Cyber-Physical Systems," Proc. 28th Int'l Conf. Distributed Computing Systems Workshops (ICDCS 08), 2008, pp. 495-500.