Remotely inferring device manipulation of industrial control systems via network behavior

Proceedings - Conference on Local Computer Networks, LCN

Volumn 2015-December, Issue , 2015, Pages 603-610

  Lontorfos, Georgios ^a   Fairbanks, Kevin D ^b   Watkins, Lanier ^a   Robinson, William H ^c  

^a JOHNS HOPKINS UNIVERSITY   (United States)

^b UNITED STATES NAVAL ACADEMY   (United States)

^c VANDERBILT UNIVERSITY   (United States)

Author keywords

cyber physical systems; device fingerprinting; machine learning; network traffic analysis; processor workload; security; tampering

Indexed keywords

ARTIFICIAL INTELLIGENCE; CONTROL SYSTEMS; EMBEDDED SYSTEMS; INTELLIGENT CONTROL; LEARNING SYSTEMS;

CYBER PHYSICAL SYSTEMS (CPSS); DEVICE FINGERPRINTING; NETWORK TRAFFIC ANALYSIS; PROCESSOR WORKLOAD; SECURITY; TAMPERING;

COMPUTER NETWORKS;

EID: 84962184075     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/LCNW.2015.7365904     Document Type: Conference Paper

References (16)

1. L. Watkins, W. H. Robinson, and R. A. Beyah, "A passive solution to the CPU resource discovery problem in cluster grid networks," IEEE Transactions on Parallel and Distributed Systems, vol. 22, pp. 2000-2007, 2011.
2. L. Watkins, W. H. Robinson, and R. Beyah, "Using network traffic to infer hardware state: A kernel-level investigation," accepted to ACM Transactions on Embedded Computing Systems, 2015.
3. M. Behnam, T. Nolte, I. Shin, M. Åsberg, and R.J. Bril, "Towards hierarchical scheduling in VxWorks," In International Workshop on Operating Systems Platforms for Embedded Real-Time Applications (OSPERT), pp. 63-72, July 2008.
4. Vxworks. (2015). Available: http://www.cs.ru.nl/lab/vxworks/vxworksOS.html
5. WEKA. (2015). Available: http://www.cs.waikato.ac.nz/ml/weka/
6. K. Stouffer, J. Falco, and K. Scarfone, "Guide to Industrial Control Systems (ICS) Security" National Institute of Standards and Technology, SP 800-82, 2011.
7. K. Zetter. "A Cyberattack has caused confirmed physical damage for the second time ever," Wired, January 8th, 2015. Available: http://www.wired.com/2015/01/german-steel-mill-hackdestruction/
8. Brodersen. Available: http://brodersensystems.com/products/plcrtu-series/
9. B. Zhu and S. Sastry, "SCADA-specific intrusion detection/prevention systems: A survey and taxonomy," in 1st Workshop on Secure Control Systems (SCS), 2010.
10. S. Parthasarathy and D. Kundur, "Bloom filter based intrusion detection for smart grid SCADA," in 25th IEEE Canadian Conference on Electrical & Computer Engineering (CCECE), 2012.
11. M.-K. Yoon and G. F. Ciocarlie. "Communication pattern monitoring: Improving the utility of anomaly detection for industrial control systems," NDSS Workshop on Security of Emerging Networking Technologies (SENT), 2014.
12. I. Fovino, A. Carcano, M. T. De Lacheze, and A. Trombetta, "Modbus/DNP3 state-based intrusion detection system," in 24th IEEE International Conference Advanced Information Networking and Applications (AINA), Perth, WA, 2010.
13. WEKA 10-Fold Cross Validation. (2015). Available: http://www.cs.waikato.ac.nz/ml/weka/mooc/dataminingwithwek a/transcripts/Transcript2-5.txt
14. ABB. (2015). RTU500 Series Remote Terminal Unit: Function Description Release 11. Available: http://www.scribd.com/doc/243709820/E500-FD-Rel11-Part1-Overview#scribd
15. ABB. (2015). RTU560 Data Sheet DIN Rail RTU 560CID11. Available: http://www09.abb.com/global/scot/scot258.nsf/veritydisplay/1dc 5c9b5bb1ae98b83257a55002d6ab3/file/E560-CID11-DS.pdf
16. NIST. (2015). NIST Special Publication 800-82: Guide to Industrial Control Systems Security.Available: http://csrc.nist.gov/publications/drafts/800-82r2/sp800-82-r2-second-draft.pdf