Abstract
Cybersecurity threats against the Industrial Control Systems (ICS) threaten to devastate cyber and physical processes and cause a breakdown of industrial services, costing billions of dollars. In each evolution of cyber and physical threats, additional layers of the ICS were compromised, and in recent ICS attacks even the software of the “air-gapped” (i.e., in an isolated network) Programmable Logic Controllers (PLC) was tampered by the Advanced Persistent Threats (APTs) designed to control the ICS systems. Modern cryptography solutions often cannot be implemented in existing ICS for legacy compliance and performance reasons. In addition, the attacker might compromise a PLC directly and perform a replay attack while she is changing the physical state of the ICS. In this thesis, we address new threats and countermeasures to the ICS. We present the attacker and system model of the work, and we implement such a threat in realistic ICS test-beds. We peruse these threats, and we present “defense-in-depth” techniques that utilize three classes of the cyber and physical countermeasures against these threats, including: 1. cyber intrusion detection, 2. process anomaly detection and remote attestation. Our first contribution is a cyber “defense-in-depth” technique that uses deep packet inspection to detect intrusions inside the ICS network. This Intrusion Detection System (IDS) is customized for ICS, and its detection performance was evaluated by in-lab experiments and a gamified hack/defense event. As the second contribution, we offer a process-based anomaly detection technique that is designed to parse the ICS network packets securely and estimates the system state directly from ICS cyberspace. The change point detectors such as Cumulative SUM (CUSUM) widely used in industrial applications to detect the process anomalies in system state estimation. Machine learning techniques provide an automatic setting to use change point detectors as a feature, in addition to general ICS features, to improve the performance of anomaly detection systems. As the third contribution, we present a machine learning technique for online cyber intrusion and process anomaly detection in ICS. As the fourth contribution, we present a process-based software attestation with control process validation. Our obtained result of the works presented in this thesis shows that we can detect well-known cyber intrusions, physical state manipulation, and replay attacks. As the fifth contribution, we offer a cybersecurity technique that can detect software tampering and network packet manipulation against the industrial control systems by a novel remote attestation technique and a message authentication technique utilizing a low-cost crypto-processor to be attached to the PLCs.