Specification Mining for Intrusion Detection in Networked Control Systems

TitleSpecification Mining for Intrusion Detection in Networked Control Systems
Publication TypeConference Paper
Year of Publication2016
AuthorsCaselli, M., Zambon E., Amann J., Sommer R., & Kargl F.
Published inProceedings of the 25th USENIX Security Symposium
Date Published08/2016
PublisherUSENIX Assoc.
ISBN Number 978 -1- 931971-32- 4

This paper discusses a novel approach to specificationbased intrusion detection in the field of networked control systems. Our approach reduces the substantial human effort required to deploy a specification-based intrusion detection system by automating the development of its specification rules. We observe that networked control systems often include comprehensive documentation used by operators to manage their infrastructures. Our approach leverages the same documentation to automatically derive the specification rules and continuously monitor network traffic. In this paper, we implement this approach for BACnet-based building automation systems and test its effectiveness against two real infrastructures deployed at the University of Twente and the LawrenceBerkeley National Laboratory (LBNL). Our implementation successfully identifies process control mistakes and potentially dangerous misconfigurations. This confirms the need for an improved monitoring of networked con- trol system infrastructures.

ICSI Research Group

Networking and Security