Detecting ICS Attacks Through Process Variable Analysis

Описание: Great ICS attack detection session at the 2017 S4xEurope by Jean-Christophe Testud of Sentryo. His research attempted to use the process variables, e.g. temperature, pressure, speed, rotation, pedal position, etc., to determine when the attacker was injecting false data into the ICS.

S4 has seen many sessions on detecting attacks, especially related to attacks on electric substations. Past research has focused on modeling the current state thoroughly and required a great deal of knowledge and work to set up. Jean-Christophe uses a classic machine learning approach to identify correlations between variables and create equations.

Quite simply, when the predicted value, based on the machine learning equation, of a process varies significantly from the reported value, then an attack or other anomaly is identified.

The sample system used in this project is an automobile and the mile-per-hour (MPH) value. This makes the approach easy to understand without the mathematics.

4:30 A refresher on CAN protocol basics

7:45 Example of an attacker targeting park assist

9:50 Dissecting CANbus packets

14:00 Anomaly detection prototype using a MPH predictor

20:25 Shows it is hard to fool the MPH predictor because it relies on many variables

21:50 Creating an attack predictor with no knowledge of the protocol or variables