A Forensic I/O Recorder for Industrial Control Systems Using PLCs and OPC UA

Abstract

The increasing network connectivity of automation or industrial control systems (ICS) through Industrie 4.0 has led to higher risks of attacks, where remote attackers can compromise industrial devices or networks to maliciously change or inject data, as well as send malicious commands that can damage machines or impair production efficiency. However, evidence gathering for such attacks can be challenging due to the lack of forensic compliant logging capabilities, as well as the high heterogeneity of these devices that makes it difficult to find generalized approaches for collecting evidence or artifacts from an ICS system. Furthermore industrial devices have limited hardware and CPU resources making established IT forensics not applicable to these devices. To address this challenge, we use an industrial device, specifically a Programmable Logic Controller (PLC), as a non intrusive I/O recorder to log I/O changes in a forensically compliant manner. In addition, we use OPC UA to securely transmit the data as well as to allow deployment of the approach to a broader range of devices by establishing a forensic information model or OPC UA server interface.