Towards Industrial Intrusion Prevention Systems: A Concept and Implementation for Reactive Protection
Source abstract
Abstract
System intrusions violate the security of a system. In order to maintain it, it is necessary to decrease the chances of intrusions occurring or by detecting them as soon as they ensue in order to respond to them in a timely manner. These responses are divided in two types: passive or reactive responses. Passive responses are limited to only notification and alerting; whereas, reactive responses influence the intrusion by undoing or diminishing its consequences. Unfortunately, some reactive responses may influence the underlying system where the intrusion has occurred. This is especially a concern in the field of Industrial Automation Systems, as these systems are critical and have a well-defined set of operational requirements that must be maintained. Hence, automatic reactive responses are often not considered or are limited to human intervention. This paper addresses this issue by introducing a concept for reactive protection that integrates the automatic execution of active responses that do not influence the operation of the underlying Industrial Automation System. This concept takes into consideration architectural and security trends, as well as security and operational policies of Industrial Automation Systems. It also proposes a set of reactive actions that can be taken in the presence of intrusions in order to counteract them or diminish their effects. The feasibility and applicability of the presented concept for Industrial Automation Systems is supported by the implementation and evaluation of a prototypical Reactive Protection System.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Institute of Automation and Information Systems, Technical University of Munich, 85748 Munich, Germany
Bosch Rexroth AG, 97816 Lohr am Main, Germany
References (63)
Show source-provided references
1. Towards Industry 4.0—Standardization as the crucial challenge for highly modular, multi-vendor production systems10.1016/j.ifacol.2015.06.143 ↗
2. Koutepas, G., Giannopoulos, G., and Mitsiara, A. (2018, September 22). Cyber Security Trends and Their Implications in ICS: Mid-Year Report 2016. Available online: http://publications.jrc.ec.europa.eu/repository/bitstream/JRC103512/lbna28187enn.pdf.
3. Kaspersky Lab ICS CERT (2018, October 01). Threat Landscape for Industrial Automation Systems: H1 2018. Available online: https://ics-cert.kaspersky.com/media/H1_2018_ICS_REPORT_ENG.pdf.
4. (2018, October 01). Security Requirements for Cryptographic Modules: FIPS PUB 140-2: Federal Information Processing Standards Publication, Available online: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf.
5. Enforceable security policies10.1145/353323.353382 ↗
6. Kissel, R. (2011). Glossary of Key Information Security Terms: NISTIR 7298, Diane Publishing.10.6028/NIST.IR.7298r1 ↗
7. Stavroulakis, P., and Stamp, M. (2010). Intrusion Detection and Prevention Systems. Handbook of Information and Communication Security, Springer Berlin Heidelberg.10.1007/978-3-642-04117-4 ↗
8. Colombo, A.W., Bangemann, T., Karnouskos, S., Delsing, J., Stluka, P., Harrison, R., Jammes, F., and Lastra, J.L. (2014). Trends and Challenges for Cloud-Based Industrial Cyber-Physical Systems. Industrial Cloud-Based Cyber-Physical Systems: The IMC-AESOP Approach, Springer International Publishing.10.1007/978-3-319-05624-1 ↗
9. Jazdi, N. (2014, January 22–24). Cyber physical systems in the context of Industry 4.0. Proceedings of the 2014 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR), Cluj-Napoca, Romania.10.1109/AQTR.2014.6857843 ↗
10. Karnouskos, S. (2011, January 7–10). Stuxnet Worm Impact on Industrial Cyber-Physical System Security. Proceedings of the IECON 2011—37th Annual Conference of IEEE Industrial Electronics, Melbourne, Australia.10.1109/IECON.2011.6120048 ↗
11. Nasser, M., Ahmad, R., Yassin, W., Hassan, A., Zainal, Z., Salih, N., and Hameed, K. (2018). Cyber-Security Incidents: A Review Cases in Cyber-Physical Systems. Int. J. Adv. Comput. Sci. Appl., 9.10.14569/IJACSA.2018.090169 ↗
12. Multiattribute SCADA-Specific Intrusion Detection System for Power Networks10.1109/TPWRD.2014.2300099 ↗
13. Kim, B.K., Kang, D.H., Na, J.C., and Chung, T.M. (February, January 31). Abnormal traffic filtering mechanism for protecting ICS networks. Proceedings of the 2016 18th International Conference on Advanced Communication Technology (ICACT), Pyeongchang, Korea.10.1109/ICACT.2016.7423422 ↗
14. Ossowski, S. (2016, January 4–8). Reading Between the Fields: Practical, Effective Intrusion Detection for Industrial Control Systems. Proceedings of the 31st Annual ACM Symposium on Appliec Computing, Pisa, Italy.
15. ICS CERT (2018, November 12). Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies, Available online: https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf.
16. The Evolution of Factory and Building Automation10.1109/MIE.2011.942175 ↗
17. Scholten, B. (2007). The Road to Integration: A Guide to Applying the ISA-95 Standard in Manufacturing, ISA.
18. A survey of information security incident handling in the cloud10.1016/j.cose.2014.11.006 ↗
19. Schneider Electric (2018, November 29). Industrial Defender: Security, Compliance, and Change Management Solution. Available online: https://www.schneider-electric.com/en/product-range-download/61675-industrial-defender/.
20. Stouffer, K., Falco, J., and Scarfone, K. (2011). Guide to Industrial Control Systems (ICS) Security: Supervisory Control and Data Acquisition (SCADA) Systems, Distributed Control Systems (DCS), and Other Control System Configurations Such as Programmable Logic Controllers (PLC): Recommendations of the National Institute of Standards and Technology, Computer Security, National Institute of Standards and Technology.10.6028/NIST.SP.800-82 ↗
21. Stouffer, K.K., and Falco, J. (2016). Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies, Department of Homeland Security, Control systems security Program, National Cyber Security Division.
22. Qian, Y. (2008). Intrusion Response Systems: A Survey. Information Assurance, Morgan Kaufmann.
23. Piggin, R. (2013, January 4–5). Development of industrial cyber security standards: IEC 62443 for SCADA and Industrial Control System security. Proceedings of the IET Conference on Control and Automation 2013: Uniting Problems and Solutions, Birmingham, UK.10.1049/cp.2013.0001 ↗
24. Ray, I., Thomas, R., and Cardenas, A.A. (2015, January 16). Assurance Techniques for Industrial Control Systems (ICS). Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or Privacy, Denver, CO, USA.
25. Corchado, E., Snasel, V., Sedano, J., Hassanien, A.E., Calvo, J.L., and Slezak, D. (2011). A Review of SCADA Anomaly Detection Systems. Soft Computing Models in Industrial and Environmental Applications, 6th International Conference SOCO 2011, Springer.10.1007/978-3-642-19644-7 ↗
26. Zhu, B., and Sastry, S. (2010, January 12). SCADA-specific Intrusion Detection/Prevention Systems: A Survey and Taxonomy. Proceedings of the 1st Workshop on Secure Control Systems (SCS), Stockholm, Sweden.
27. Albach, H., Meffert, H., Pinkwart, A., and Reichwald, R. (2015). Change Through Digitization—Value Creation in the Age of Industry 4.0. Management of Permanent Change, Springer Fachmedien.10.1007/978-3-658-05014-6 ↗
28. Colbert, E.J.M., and Kott, A. (2016). In Conclusion: The Future Internet of Things and Security of Its Control Systems. Cyber-security of SCADA and Other Industrial Control Systems, Springer International Publishing.10.1007/978-3-319-32125-7 ↗
29. A Survey of Intrusion Detection Techniques for Cyber-Physical Systems10.1145/2542049 ↗
30. Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems10.1016/j.ijcip.2013.05.001 ↗
31. Integrated OCSVM mechanism for intrusion detection in SCADA systems10.1049/el.2014.2897 ↗
32. Maglaras, L.A., and Jiang, J. (2014, January 27–29). Intrusion detection in SCADA systems using Machine Learning Techniques. Proceedings of the 2014 Science and Information Conference (SAI), London, UK.10.1109/SAI.2014.6918252 ↗
33. Industrial Control System Network Intrusion Detection by Telemetry Analysis10.1109/TDSC.2015.2443793 ↗
34. Nizam, F., Chaki, S., Al Mamun, S., and Kaiser, M.S. (2016, January 7–9). Attack detection and prevention in the Cyber Physical System. Proceedings of the 2016 International Conference on Computer Communication and Informatics, Coimbatore, India.
35. Security Matters (2018, October 01). Phoenix Contact’s mGuard Integration with Silent Defense. Available online: https://www.secmatters.com/hubfs/Security_Matters-March2017/PDF/Solution-Brief-SecurityMatters-and-Phoenix-Contact.pdf.
36. Tsang, C.H., and Kwong, S. (2005, January 14–17). Multi-Agent Intrusion Detection System in Industrial Network using Ant Colony Clustering Approach and Unsupervised Feature Extraction. Proceedings of the 2005 IEEE International Conference on Industrial Technology (ICIT), Hong Kong, China.
37. Morris, T., Vaughn, R., and Dandass, Y. (2012, January 4–7). A Retrofit Network Intrusion Detection System for MODBUS RTU and ASCII Industrial Control Systems. Proceedings of the 2012 45th Hawaii International Conference on System Sciences (HICSS), Maui, HI, USA.10.1109/HICSS.2012.78 ↗
38. Roesch, M. (1999, January 7–12). Snort: Lightweight intrusion detection for networks. Proceedings of the Lisa ’99: 13th Systems Administration Conference, Seattle, WA, USA. Available online: http://static.usenix.org/publications/library/proceedings/lisa99/full_papers/roesch/roesch.pdf.
39. Chen, Q., and Abdelwahed, S. (2014, January 17). A Model-based Approach to Self-Protection in SCADA Systems. Proceedings of the 9th International Workshop on Feedback Computing, Philadelphia, PA, USA. Available online: https://www.usenix.org/conference/feedbackcomputing14/workshop-program/presentation/chen.
40. Abercrombie, R.K., and McDonald, J.T. (2014, January 8–10). Cyber-Security Analysis of Smart Grid SCADA Systems with Game Models. Proceedings of the 9th Annual Cyber and Information Security Research Conference, Oak Ridge, TN, USA.
41. Cyber-physical System Security for Networked Industrial Processes10.1007/s11633-015-0923-9 ↗
42. CockpitCI (2018, October 01). Cybersecurity on SCADA: Risk Prediction, Analysis and Reaction Tools for Critical Infrastructures. Available online: https://cordis.europa.eu/docs/results/285/285647/final1-final-report-publishable-summary.pdf.
43. Hurd, C.M., and McCarty, M.V. (2018, October 01). A Survey of Security Tools for the Industrial Control System Environment, Available online: https://www.osti.gov/servlets/purl/1376870.10.2172/1376870 ↗
44. Security Event Correlation Approach for Cloud Computing10.1504/IJHPCN.2013.056525 ↗
45. Intrusion response systems: Foundations, design, and challenges10.1016/j.jnca.2015.12.006 ↗
46. SCADA security in the light of Cyber-Warfare10.1016/j.cose.2012.02.009 ↗
47. Candell, R., Stouffe, K., and Anand, D. (2018, October 20). A Cybersecurity Testbed for Industrial Control System, Available online: https://www.nist.gov/publications/cybersecurity-testbed-industrial-control-systems.
48. A survey on policy languages in network and security management10.1016/j.comnet.2011.09.014 ↗
49. Diver, S. (2018, October 25). Information Security Policy: A Development Guide for Large and Small Companies. Available online: https://www.sans.org/reading-room/whitepapers/policyissues/information-security-policy-development-guide-large-small-companies-1331.
50. Gerhards, R. (2009). The Syslog Protocol: RFC 5424, IETF Trust.10.17487/rfc5424 ↗
51. Toward better horizontal integration among IoT services10.1109/MCOM.2015.7263375 ↗
52. Datta, S.K., Bonnet, C., and Nikaein, N. (2014, January 6–8). An IoT Gateway Centric Architecture to Provide Novel M2M Services. Proceedings of the 2014 IEEE World Forum on Internet of Things (WF-IoT), Seoul, Korea.10.1109/WF-IoT.2014.6803221 ↗
53. Industry IoT Gateway for Cloud Connectivity
54. Sinha, S.R., and Park, Y. (2017). Creating Smart Gateway. Building an Effective IoT Ecosystem for Your Business, Springer International Publishing.10.1007/978-3-319-57391-5 ↗
55. Maintainability and evolvability of control software in machine and plant manufacturing—An industrial survey10.1016/j.conengprac.2018.08.007 ↗
56. Colbert, E.J.M., and Kott, A. (2016). Experimental Methods for Control System Security Research. Cyber-Security of SCADA and Other Industrial Control Systems, Springer International Publishing.10.1007/978-3-319-32125-7 ↗
57. ArcSight Inc. (2006). Common Event Format: Event Interoperability Standard, ArcSight Inc.
58. Zhu, B., Joseph, A., and Sastry, S. (2011, January 19–22). A Taxonomy of Cyber Attacks on SCADA Systems. Proceedings of the 4th IEEE International Conference on Cyber, Physical and Social Computing (CPSCom), Dalian, China.10.1109/iThings/CPSCom.2011.34 ↗
59. Bosch Rexroth AG (2018, October 01). IoT Gateway: Get ready for Industry 4.0!. Available online: https://www.boschrexroth.com/en/xc/products/product-groups/electric-drives-and-controls/industrial-iot.
60. A gentle introduction to OSGi10.1145/1402521.1402526 ↗
61. The OSGi Alliance (2018, October 25). OSGi Core. Available online: https://osgi.org/download/r6/osgi.core-6.0.0.pdf.
62. ArcSight Inc. (2018, October 25). Common Event Format. Available online: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/78000/KB78712/en_US/CEF_White_Paper_20100722.pdf.
63. Inside the slammer worm10.1109/MSECP.2003.1219056 ↗