The Resource Usage Viewpoint of Industrial Control System Security: An Inference-Based Intrusion Detection System

Programmable Logic Controllers (PLC) are a part of a broader category of systems commonly known as Industrial Control Systems (ICS). These systems are primarily used to monitor and control various manufacturing and distribution processes, such as switches, pumps, or centrifuges. Since these devices perform relatively the same tasks throughout their lifetime, they likely have a fixed and predictable CPU load or usage for extended periods of time. Our work is primarily based on the premise that we are able to infer CPU load by remotely profiling the network traffic emitted by an ICS device and use that inference to detect potentially malicious modifications to the behavior of the ICS device. This is in stark contrast to traditional (e.g., signature and rule-based) and even other non-traditional (e.g., power fingerprinting and backplane traffic monitoring) intrusion detection mechanisms for ICS networks, since our approach does not require signature or rule updates, special access to ICS backplane devices, or additional software to be installed on the ICS device. In previous work, we have demonstrated that it is feasible to use network traffic and machine learning to remotely infer the typical task cycle periods (i.e., CPU load) for an ABB RTU560 (contains a built-in PLC), even on a lightly loaded network one hop away. We now extend this capability to inferring the presence of anomalous CPU load behavior by introducing a Stuxnet-type threat model (i.e., state-sponsored root-kit) to showcase our prototype’s detection ability (i.e., the ability to discern normal baseline states from those introduced by a threat). The main benefits of this approach are that: (1) it requires no additional software to be installed on the ICS devices to communicate with the monitor node, (2) the tool is low maintenance, since there are no software updates or signatures to be continuously installed on each ICS device, and (3) the risk of a centralized network-based monitor node being compromised is lower than if it were host-based software on each ICS device due to a reduced attack surface. Our overall prototype tool implements a graphical user interface (GUI) that can be used to monitor and alert on a small-sized to medium-sized ICS network of IP-based RTUs or PLCs similar to the ABB RTU560.