Programmable Logic Controller Block Monitoring System for Memory Attack Defense in Industrial Control Systems

Cyberattacks targeting industrial control systems(ICS)are becoming more sophisticated and advanced than in the past.A programmable logic controller(PLC),a core component of ICS,controls and monitors sensors and actuators in the field.However,PLC has memory attack threats such as program injection and manipulation,which has long been a major target for attackers,and it is important to detect these attacks for ICS security.To detect PLC memory attacks,a security system is required to acquire and monitor PLC memory directly.In addition,the performance impact of the security system on the PLC makes it difficult to apply to the ICS.To address these challenges,this paper proposes a system to detect PLC memory attacks by continuously acquiring and monitoring PLC memory.The proposed system detects PLC memory attacks by acquiring the program blocks and block information directly from the same layer as the PLC and then comparing them in bytes with previous data.Experiments with Siemens S7-300 and S7-400 PLC were conducted to evaluate the PLC memory detection performance and performance impact on PLC.The experimental results demonstrate that the proposed system detects all malicious organization block(OB)injection and data block(DB)manipulation,and the increment of PLC cycle time,the impact on PLC performance,was less than 1 ms.The proposed system detects PLC memory attacks with a simpler detection method than earlier studies.Furthermore,the proposed system can be applied to ICS with a small performance impact on PLC.

The Effect of Key Nodes on theMalware Dynamics in the Industrial Control Network

As industrialization and informatization becomemore deeply intertwined,industrial control networks have entered an era of intelligence.The connection between industrial control networks and the external internet is becoming increasingly close,which leads to frequent security accidents.This paper proposes a model for the industrial control network.It includes a malware containment strategy that integrates intrusion detection,quarantine,and monitoring.Basedonthismodel,the role of keynodes in the spreadofmalware is studied,a comparisonexperiment is conducted to validate the impact of the containment strategy.In addition,the dynamic behavior of the model is analyzed,the basic reproduction number is computed,and the disease-free and endemic equilibrium of the model is also obtained by the basic reproduction number.Moreover,through simulation experiments,the effectiveness of the containment strategy is validated,the influence of the relevant parameters is analyzed,and the containment strategy is optimized.In otherwords,selective immunity to key nodes can effectively suppress the spread ofmalware andmaintain the stability of industrial control systems.The earlier the immunization of key nodes,the better.Once the time exceeds the threshold,immunizing key nodes is almost ineffective.The analysis provides a better way to contain the malware in the industrial control network.

Fuzzy Online Auto-Tuning for an Industrial PID Controller

This paper presents a fuzzy tuning system for real-time industrial PID （proportional-integral-derivative） controllers. The algorithm set the proportional gain, integral time and derivative time of a classical PID structure according to the set point, error and error derivative of the process, respectively. The tuning of the PID controller is based on a fuzzy inference machine. The set of rules of the fuzzy inference machine was obtained by experts engineering. The system is tested in an austempering process but can be applied in any industrial plant. Besides, an analysis between the response of the process with a PID controller and the system of fuzzy auto-tuning for P1D proposed was made.

Critical Relation Path Aggregation-Based Industrial Control Component Exploitable Vulnerability Reasoning

With the growing discovery of exposed vulnerabilities in the Industrial Control Components(ICCs),identification of the exploitable ones is urgent for Industrial Control System(ICS)administrators to proactively forecast potential threats.However,it is not a trivial task due to the complexity of the multi-source heterogeneous data and the lack of automatic analysis methods.To address these challenges,we propose an exploitability reasoning method based on the ICC-Vulnerability Knowledge Graph(KG)in which relation paths contain abundant potential evidence to support the reasoning.The reasoning task in this work refers to determining whether a specific relation is valid between an attacker entity and a possible exploitable vulnerability entity with the help of a collective of the critical paths.The proposed method consists of three primary building blocks:KG construction,relation path representation,and query relation reasoning.A security-oriented ontology combines exploit modeling,which provides a guideline for the integration of the scattered knowledge while constructing the KG.We emphasize the role of the aggregation of the attention mechanism in representation learning and ultimate reasoning.In order to acquire a high-quality representation,the entity and relation embeddings take advantage of their local structure and related semantics.Some critical paths are assigned corresponding attentive weights and then they are aggregated for the determination of the query relation validity.In particular,similarity calculation is introduced into a critical path selection algorithm,which improves search and reasoning performance.Meanwhile,the proposed algorithm avoids redundant paths between the given pairs of entities.Experimental results show that the proposed method outperforms the state-of-the-art ones in the aspects of embedding quality and query relation reasoning accuracy.

Anomaly Detection for Industrial Internet of Things Cyberattacks

The evolution of the Internet of Things(IoT)has empowered modern industries with the capability to implement large-scale IoT ecosystems,such as the Industrial Internet of Things(IIoT).The IIoT is vulnerable to a diverse range of cyberattacks that can be exploited by intruders and cause substantial reputational andfinancial harm to organizations.To preserve the confidentiality,integrity,and availability of IIoT networks,an anomaly-based intrusion detection system(IDS)can be used to provide secure,reliable,and efficient IIoT ecosystems.In this paper,we propose an anomaly-based IDS for IIoT networks as an effective security solution to efficiently and effectively overcome several IIoT cyberattacks.The proposed anomaly-based IDS is divided into three phases:pre-processing,feature selection,and classification.In the pre-processing phase,data cleaning and nor-malization are performed.In the feature selection phase,the candidates’feature vectors are computed using two feature reduction techniques,minimum redun-dancy maximum relevance and neighborhood components analysis.For thefinal step,the modeling phase,the following classifiers are used to perform the classi-fication:support vector machine,decision tree,k-nearest neighbors,and linear discriminant analysis.The proposed work uses a new data-driven IIoT data set called X-IIoTID.The experimental evaluation demonstrates our proposed model achieved a high accuracy rate of 99.58%,a sensitivity rate of 99.59%,a specificity rate of 99.58%,and a low false positive rate of 0.4%.

Identifying Industrial Control Equipment Based on Rule Matching and Machine Learning

To identify industrial control equipment is often a key step in network mapping,categorizing network resources,and attack defense.For example,if vulnerable equipment or devices can be discovered in advance and the attack path canbe cut off,security threats canbe effectively avoided and the stable operationof the Internet canbe ensured.The existing rule-matching method for equipment identification has limitations such as relying on experience and low scalability.This paper proposes an industrial control device identification method based on PCA-Adaboost,which integrates rule matching and machine learning.We first build a rule base from network data collection and then use single andmulti-protocol rule-matchingmethods to identify the type of industrial control devices.Finally,we utilize PCA-Adaboost to identify unlabeled data.The experimental results show that the recognition rate of this method is better than that of the traditional Nmap device recognitionmethod and the device recognition accuracy rate reaches 99%.The evaluation effect of the test data set is significantly enhanced.

Information Security Evaluation of Industrial Control Systems Using Probabilistic Linguistic MCDM Method

Industrial control systems(ICSs)are widely used in various fields,and the information security problems of ICSs are increasingly serious.The existing evaluation methods fail to describe the uncertain evaluation information and group evaluation information of experts.Thus,this paper introduces the probabilistic linguistic term sets(PLTSs)to model the evaluation information of experts.Meanwhile,we propose a probabilistic linguistic multi-criteria decision-making(PL-MCDM)method to solve the information security assessment problem of ICSs.Firstly,we propose a novel subscript equivalence distance measure of PLTSs to improve the existing methods.Secondly,we use the Best Worst Method(BWM)method and Criteria Importance Through Inter-criteria Correlation(CRITIC)method to obtain the subjective weights and objective weights,which are used to derive the combined weights.Thirdly,we use the subscript equivalence distance measure method and the combined weight method to improve the probabilistic linguistic Visekriterijumska Optimizacija I Kompromisno Resenje(PL-VIKOR)method.Finally,we apply the proposed method to solve the information security assessment problem of ICSs.When comparing with the existing methods such as the probabilistic linguistic Tomada deDecisão Iterativa Multicritério(PL-TODIM)method and probabilistic linguistic Technique for Order Preference by Similarity to Ideal Solution(PL-TOPSIS)method,the case example shows that the proposed method can provide more reasonable ranking results.By evaluating and ranking the information security level of different ICSs,managers can identify problems in time and guide their work better.

GRU-based Buzzer Ensemble for Abnormal Detection in Industrial Control Systems

Recently,Industrial Control Systems(ICSs)have been changing from a closed environment to an open environment because of the expansion of digital transformation,smart factories,and Industrial Internet of Things(IIoT).Since security accidents that occur in ICSs can cause national confusion and human casualties,research on detecting abnormalities by using normal operation data learning is being actively conducted.The single technique proposed by existing studies does not detect abnormalities well or provide satisfactory results.In this paper,we propose a GRU-based Buzzer Ensemble for AbnormalDetection(GBE-AD)model for detecting anomalies in industrial control systems to ensure rapid response and process availability.The newly proposed ensemble model of the buzzer method resolves False Negatives(FNs)by complementing the limited range that can be detected in a single model because of the internal models composing GBE-AD.Because the internal models remain suppressed for False Positives(FPs),GBE-AD provides better generalization.In addition,we generated mean prediction error data in GBE-AD and inferred abnormal processes using soft and hard clustering.We confirmed that the detection model’s Time-series Aware Precision(TaP)suppressed FPs at 97.67%.The final performance was 94.04%in an experiment using anHIL-basedAugmented ICS(HAI)Security Dataset(ver.21.03)among public datasets.

An Intelligent Approach for Intrusion Detection in Industrial Control System

Supervisory control and data acquisition(SCADA)systems are computer systems that gather and analyze real-time data,distributed control systems are specially designed automated control system that consists of geographically distributed control elements,and other smaller control systems such as programmable logic controllers are industrial solid-state computers that monitor inputs and outputs and make logic-based decisions.In recent years,there has been a lot of focus on the security of industrial control systems.Due to the advancement in information technologies,the risk of cyberattacks on industrial control system has been drastically increased.Because they are so inextricably tied to human life,any damage to them might have devastating consequences.To provide an efficient solution to such problems,this paper proposes a new approach to intrusion detection.First,the important features in the dataset are determined by the difference between the distribution of unlabeled and positive data which is deployed for the learning process.Then,a prior estimation of the class is proposed based on a support vector machine.Simulation results show that the proposed approach has better anomaly detection performance than existing algorithms.

Deep Learning Based Intelligent Industrial Fault Diagnosis Model

In the present industrial revolution era,the industrial mechanical system becomes incessantly highly intelligent and composite.So,it is necessary to develop data-driven and monitoring approaches for achieving quick,trustable,and high-quality analysis in an automated way.Fault diagnosis is an essential process to verify the safety and reliability operations of rotating machinery.The advent of deep learning(DL)methods employed to diagnose faults in rotating machinery by extracting a set of feature vectors from the vibration signals.This paper presents an Intelligent Industrial Fault Diagnosis using Sailfish Optimized Inception with Residual Network(IIFD-SOIR)Model.The proposed model operates on three major processes namely signal representation,feature extraction,and classification.The proposed model uses a Continuous Wavelet Transform(CWT)is for preprocessed representation of the original vibration signal.In addition,Inception with ResNet v2 based feature extraction model is applied to generate high-level features.Besides,the parameter tuning of Inception with the ResNet v2 model is carried out using a sailfish optimizer.Finally,a multilayer perceptron(MLP)is applied as a classification technique to diagnose the faults proficiently.Extensive experimentation takes place to ensure the outcome of the presented model on the gearbox dataset and a motor bearing dataset.The experimental outcome indicated that the IIFD-SOIR model has reached a higher average accuracy of 99.6%and 99.64%on the applied gearbox dataset and bearing dataset.The simulation outcome ensured that the proposed model has attained maximum performance over the compared methods.

Impact of environmental regulations on the efficient control of industrial pollution in China

The continuous progress of industrialization is a fundamental cause of China’s increasingly severe environmental pollution problem.Improving the efficiency of industrial pollution control is an inevitable choice to effectively decrease pollution emissions,thus winning the battle of pollution prevention and control.In this paper,we used the stochastic frontier analysis(SFA)model to measure the provincial efficiency of industrial pollution control based on the input and output data of industrial pollution control of 29 administrative provinces in China from 2000 to 2017.On this basis,a spatial econometric model was used to explore the influence of environmental regulation intensity on the efficiency of industrial pollution control.In addition,the spatial spillover effect of pollution reduction was thoroughly examined.The results show that:(1)The efficiency of industrial pollution control in China has improved year by year,but the overall efficiency is still low,with the average value increasing from 0.165 in 2000 to 0.309 in 2017.Furthermore,there is significant regional heterogeneity with the highest efficiency level in the east and lowest efficiency level in the west.(2)By increasing the financial and material input,the efficiency of industrial pollution control has increased.However,the increase of human input has not been so helpful.(3)The global Moran’s I index is significantly greater than zero,indicating a strong spatial correlation and agglomeration in the efficiency of industrial pollution control,which is reflected in high-high agglomeration in the eastern region and low-low agglomeration in the western region.(4)Stringent environmental regulation has a positive effect on improving the efficiency of industrial pollution control.It also imposes a positive spatial spillover effect,indicating a strategic interaction and coordination of regional pollution control.In line with this,related proposals have been made to optimize the investment structure for environmental pollution control,establish a flow mechanism for the factor market,and strengthen the environmental responsibility awareness of state-owned enterprises.On this basis,we expect to provide a policy for improving the efficiency of industrial pollution control and promoting regional joint pollution control in China.

Review of PLC Security Issues in Industrial Control System

Programmable Logic Controllers(PLC),core of industrial control systems,is widely used in industrial control systems.The security of PLC is the key to the security of industrial control systems.Nowadays,a large number of industrial control systems are connected to the Internet which exposes the PLC equipment to the Internet,and thus raising security concerns.First of all,we introduce the basic principle of PLC in this paper.Then we analyze the PLC code security,firmware security,network security,virus vulnerability and Modbus communication protocol by reviewing the previous related work.Finally,we make a summary of the current security protection methods.

Rough set based multi-agent system cooperation for industrial supervisory interface system

In this paper, rough set theory is introduced into the interface multi-agent system （MAS） for industrial supervisory system. Taking advantages of rough set in data mining, a cooperation model for MAS is built. Rules for avoiding cooperation conflict are deduced. An optimization algorithm is used to enhance security and real time attributes of the system. An application based on the proposed algorithm and rules are given.

Improving Method of Anomaly Detection Performance for Industrial IoT Environment

Industrial Control System(ICS),which is based on Industrial IoT(IIoT),has an intelligent mobile environment that supports various mobility,but there is a limit to relying only on the physical security of the ICS environment.Due to various threat factors that can disrupt the workflow of the IIoT,machine learning-based anomaly detection technologies are being presented;it is also essential to study for increasing detection performance to minimize model errors for promoting stable ICS operation.In this paper,we established the requirements for improving the anomaly detection performance in the IIoT-based ICS environment by analyzing the related cases.After that,we presented an improving method of the performance of a machine learning model specialized for IIoT-based ICS,which increases the detection rate by applying correlation coefficients and clustering;it provides a mechanism to predict thresholds on a per-sequence.Likewise,we adopted the HAI dataset environment that actively reflected the characteristics of IIoT-based ICS and demonstrated that performance could be improved through comparative experiments with the traditional method and our proposed method.The presented method can further improve the performance of commonly applied error-based detection techniques and includes a primary method that can be enhanced over existing detection techniques by analyzing correlation coefficients between features to consider feedback between ICS components.Those can contribute to improving the performance of several detection models applied in ICS and other areas.

Intelligent Forensic Investigation Using Optimal Stacked Autoencoder for Critical Industrial Infrastructures

Industrial Control Systems(ICS)can be employed on the industrial processes in order to reduce the manual labor and handle the complicated industrial system processes as well as communicate effectively.Internet of Things(IoT)integrates numerous sets of sensors and devices via a data network enabling independent processes.The incorporation of the IoT in the industrial sector leads to the design of Industrial Internet of Things(IIoT),which find use in water distribution system,power plants,etc.Since the IIoT is susceptible to different kinds of attacks due to the utilization of Internet connection,an effective forensic investigation process becomes essential.This study offers the design of an intelligent forensic investigation using optimal stacked autoencoder for critical industrial infrastructures.The proposed strategy involves the design of manta ray foraging optimization(MRFO)based feature selection with optimal stacked autoencoder(OSAE)model,named MFROFS-OSAE approach.The primary objective of the MFROFS-OSAE technique is to determine the presence of abnormal events in critical industrial infrastructures.TheMFROFS-OSAE approach involves several subprocesses namely data gathering,data handling,feature selection,classification,and parameter tuning.Besides,the MRFO based feature selection approach is designed for the optimal selection of feature subsets.Moreover,the OSAE based classifier is derived to detect abnormal events and the parameter tuning process is carried out via the coyote optimization algorithm(COA).The performance validation of the MFROFS-OSAE technique takes place using the benchmark dataset and the experimental results reported the betterment of the MFROFS-OSAE technique over the recent approaches interms of different measures.

Anomaly Detection Framework in Fog-to-Things Communication for Industrial Internet of Things

The rapid development of the Internet of Things(IoT)in the industrial domain has led to the new term the Industrial Internet of Things(IIoT).The IIoT includes several devices,applications,and services that connect the physical and virtual space in order to provide smart,cost-effective,and scalable systems.Although the IIoT has been deployed and integrated into a wide range of industrial control systems,preserving security and privacy of such a technology remains a big challenge.An anomaly-based Intrusion Detection System(IDS)can be an effective security solution for maintaining the confidentiality,integrity,and availability of data transmitted in IIoT environments.In this paper,we propose an intelligent anomalybased IDS framework in the context of fog-to-things communications to decentralize the cloud-based security solution into a distributed architecture(fog nodes)near the edge of the data source.The anomaly detection system utilizes minimum redundancy maximum relevance and principal component analysis as the featured engineering methods to select the most important features,reduce the data dimensionality,and improve detection performance.In the classification stage,anomaly-based ensemble learning techniques such as bagging,LPBoost,RUSBoost,and Adaboost models are implemented to determine whether a given flow of traffic is normal or malicious.To validate the effectiveness and robustness of our proposed model,we evaluate our anomaly detection approach on a new driven IIoT dataset called XIIoTID,which includes new IIoT protocols,various cyberattack scenarios,and different attack protocols.The experimental results demonstrated that our proposed anomaly detection method achieved a higher accuracy rate of 99.91%and a reduced false alarm rate of 0.1%compared to other recently proposed techniques.

An Anomaly Detection Method of Industrial Data Based on Stacking Integration

With the development of Internet technology,the computing power of data has increased,and the development of machine learning has become faster and faster.In the industrial production of industrial control systems,quality inspection and safety production of process products have always been our concern.Aiming at the low accuracy of anomaly detection in process data in industrial control system,this paper proposes an anomaly detection method based on stacking integration using the machine learning algorithm.Data are collected from the industrial site and processed by feature engineering.Principal component analysis(PCA)and integrated rule tree method are adopted to reduce the dimension of the process data,which can restore the original feature information of the data to the maximum extent.Random forest(RF),Adaboost,XGboost,SVM were selected as the first layer of basic learners.Logistic regression(LR)was used as the secondary learner to build the exception detection model based on stacking integrated method.TE data was used to train the base learner model and the integrated model.By comparing and analyzing the experimental results of between integrated model and each basic learning model.By comparing and analyzing the experimental results of the constructed anomaly detection model and the basic learning model,the accuracy of process data anomaly detection is effectively improved,and the false alarm rate of process data anomaly detection is effectively reduced.

A New Intrusion Detection Algorithm AE-3WD for Industrial Control Network

In this paper,we propose a intrusion detection algorithm based on auto-encoder and three-way decisions(AE-3WD)for industrial control networks,aiming at the security problem of industrial control network.The ideology of deep learning is similar to the idea of intrusion detection.Deep learning is a kind of intelligent algorithm and has the ability of automatically learning.It uses self-learning to enhance the experience and dynamic classification capabilities.We use deep learning to improve the intrusion detection rate and reduce the false alarm rate through learning,a denoising AutoEncoder and three-way decisions intrusion detection method AE-3WD is proposed to improve intrusion detection accuracy.In the processing,deep learning AutoEncoder is used to extract the features of high-dimensional data by combining the coefficient penalty and reconstruction loss function of the encode layer during the training mode.A multi-feature space can be constructed by multiple feature extractions from AutoEncoder,and then a decision for intrusion behavior or normal behavior is made by three-way decisions.NSL-KDD data sets are used to the experiments.The experiment results prove that our proposed method can extract meaningful features and effectively improve the performance of intrusion detection.

RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

Nowadays,industrial control system(ICS)has begun to integrate with the Internet.While the Internet has brought convenience to ICS,it has also brought severe security concerns.Traditional ICS network traffic anomaly detection methods rely on statistical features manually extracted using the experience of network security experts.They are not aimed at the original network data,nor can they capture the potential characteristics of network packets.Therefore,the following improvements were made in this study:(1)A dataset that can be used to evaluate anomaly detection algorithms is produced,which provides raw network data.(2)A request response-based convolutional neural network named RRCNN is proposed,which can be used for anomaly detection of ICS network traffic.Instead of using statistical features manually extracted by security experts,this method uses the byte sequences of the original network packets directly,which can extract potential features of the network packets in greater depth.It regards the request packet and response packet in a session as a Request-Response Pair(RRP).The feature of RRP is extracted using a one-dimensional convolutional neural network,and then the RRP is judged to be normal or abnormal based on the extracted feature.Experimental results demonstrate that this model is better than several other machine learning and neural network models,with F1,accuracy,precision,and recall above 99%.

Real-Time Memory Data Optimization Mechanism of Edge IoT Agent

With the full development of disk-resident databases(DRDB)in recent years,it is widely used in business and transactional applications.In long-term use,some problems of disk databases are gradually exposed.For applications with high real-time requirements,the performance of using disk database is not satisfactory.In the context of the booming development of the Internet of things,domestic real-time databases have also gradually developed.Still,most of them only support the storage,processing,and analysis of data values with fewer data types,which can not fully meet the current industrial process control system data types,complex sources,fast update speed,and other needs.Facing the business needs of efficient data collection and storage of the Internet of things,this paper optimizes the transaction processing efficiency and data storage performance of the memory database,constructs a lightweight real-time memory database transaction processing and data storage model,realizes a lightweight real-time memory database transaction processing and data storage model,and improves the reliability and efficiency of the database.Through simulation,we proved that the cache hit rate of the cache replacement algorithm proposed in this paper is higher than the traditional LRU(Least Recently Used)algorithm.Using the cache replacement algorithm proposed in this paper can improve the performance of the system cache.