International Journal of Critical Infrastructure Protection最新文献

Securing Industrial Control Systems (ICS) against cyber threats is crucial for maintaining operational reliability and safety in critical infrastructure. Traditional Machine Learning (ML) approaches in ICS development require substantial domain expertise, posing challenges for non-experts. To address this gap, we propose and evaluate ICS-defender, a defense mechanism to enhance ICS security through Automated Machine Learning (AutoML) techniques. Our approach leverages sophisticated feature engineering and AutoML to automate model selection, training, aggregation, and optimization, thereby reducing the dependency on specialized knowledge. We evaluate ICS-defender against state-of-the-art AutoML frameworks using diverse datasets from power systems and electric vehicle chargers. Experimental results consistently demonstrate that ICS-defender outperforms existing frameworks in terms of accuracy and robustness, achieving average accuracies of 93.75%, 94.34%, and 87.12% for power systems attacks datasets and 94.23% for the electric vehicle charging station attacks dataset, surpassing baseline algorithms. This research contributes to advancing secure and resilient ICS, offering significant implications for broader applications and future enhancements in industrial cybersecurity.

Recently released scan data on Shodan reveals that thousands of Industrial Control Systems (ICSs) worldwide are directly accessible via the Internet and, thus, exposed to cyber-attacks aiming at financial gain, espionage, or disruption and/or sabotage. Executing sophisticated cyber–physical attacks aiming to manipulate industrial functionalities requires a deep understanding of the underlying physical process at the core of the target ICS, for instance, through unauthorized access to memory registers of Programmable Logic Controllers (PLCs). However, to date, countermeasures aiming at hindering the comprehension of physical processes remain largely unexplored.

In this work, we investigate the use of obfuscation strategies to complicate process comprehension of ICSs while preserving their runtime evolution. To this end, we propose a framework to design and evaluate obfuscation strategies for PLCs, involving PLC memory registers, PLC code (user program), and the introduction of extra (spurious) physical processes. Our framework categorizes obfuscation strategies based on two dimensions: the type of (spurious) registers employed in the obfuscation strategy and the dependence on the (genuine) physical process. To evaluate the efficacy of proposed obfuscation strategies, we introduce evaluation metrics to assess their potency and resilience, in terms of system invariants the attacker can derive, and their cost in terms of computational overhead due to runtime modifications of spurious PLC registers. We developed a prototype tool to automatize the devised obfuscation strategies and applied them to a non-trivial use case in the field of water tank systems. Our results show that code obfuscation can be effectively used to counter malicious process comprehension of ICSs achieved via scanning of PLC memory registers. To our knowledge, this is the first work using obfuscation as a technique to protect ICSs from such threats. The efficacy of the proposed obfuscation strategies predominantly depends on the intrinsic complexity of the interplay introduced between genuine and spurious registers.