Intrusion detection and identification using tree-based machine learning algorithms on the DCS network

다국어 초록 (Multilingual Abstract)

In the past, Industrial Control Systems (ICS) has been operated in a closed network separated physically from the Internet and the corporate network and has been used independent protocols for each manufacturer; thus, it has been operated relatively safely from cyberattacks. Recently, Critical Infrastructures (CI) such as energy, power, transportation, and communication have come to be increasingly dependent on advanced information and communication technology (ICT). With the advancement of the latest technologies such as Big Data and the Internet of Things (IoT), many companies are trying to utilize generated data from the ICS environment to improve production yield and minimize downtime of the process. This change has increased the connection between the Industrial Control System (ICS) supporting the CI and the Internet, resulting in an increase in security threats and allowing a malicious attacker to manipulate and control the ICS arbitrarily. However, compared to the increased cybersecurity risk, there is still a lack of research on ICS security and ICS operators are reluctant to install security systems for fear of negative effects on normal operations due to system changes. In this thesis,

• First of all, we analyze threats in detail using STRIDE threat analysis modeling for the Distributed Control Systems (DCS), one of the ICS, based on our experience as a cybersecurity specialist in the oil refinery. Furthermore, we verify that threats identified with STRIDE are valid through case studies for major ICS cybersecurity incidents. Finally, we present countermeasures and strategies to improve risk assessment for identified threats.
• Second of all, as ICS operated in isolated networks in the past that were connected to the Internet and corporate networks increased, layered network reference models were developed to more securely interconnect and protect the ICS operation environment. However, the people in charge of ICS lack knowledge of DCS systems and cybersecurity, making it difficult to determine the optimal installation location for DCS to operate safely. Therefore, we developed a methodology that can quickly determine the optimal system deployment location in the Purdue Enterprise Reference Architecture (PERA) model so that field operators in the process lacking expertise can select the system placement location and validate the methodology through case presentation. we derive new research is needed to quickly detect anomalies and identify attack types while ensuring the high availability of ICS.
• Third of all, availability is of paramount importance among the CIA Triad of cybersecurity in the ICS environment. This needs new research to quickly detect anomalies and identify attack types without affecting the availability of ICS. Therefore, we propose a host-based method to detect and identify abnormalities in an Oil Refinery’s Distributed Control System (DCS) network using DCS vendor-proprietary protocols using a proposed method based on the tree-based machine learning algorithm. The results demonstrate that the proposed method can effectively detect an abnormality with the eXtreme Gradient Boosting (XGB) classifier, with up to 99% accuracy. Taken together, the results of this study contribute to the exact detection of abnormal events and identification of attack types on the network without disrupting the normal operation of the DCS.

This thesis identifies practical security threats and derived field-applicable improvement measures based on DCS operational experience, and presents a methodology that allows field operators to easily select the optimal system placement location in the hierarchical security architecture developed to protect the DCS system. Finally, a tree-based machine learning algorithm that can detect and identify attacks with high accuracy without negative impact on the DCS operation is proposed. This thesis addresses overall DCS system security from threat modeling to intrusion identification on DCS networks, which will contribute significantly to future ICS security research.

목차 (Table of Contents)

• 1. Introduction 1
• 2. Background and Related Works 6
• 2.1 Background 6
• 2.1.1 DCS Network 7
• 2.1.2 Major Attack Vectors for DCS 8
• 2.1.3 Threat Modeling 10
• 2.1.4 Purdue Reference Architecture Model 11
• 2.2 Related Works 13
• 2.2.1 The History of Threat Modeling 14
• 2.2.2 Cybersecurity Researches for ICS 16
• 2.2.3 Intrusion Detection Methodology in the ICS Network 18
• 3. STRIDE-based Threat Modeling and DREAD evaluation for the DCS 21
• 3.1 Overview 21
• 3.2 Case Study 22
• 3.2.1 Stuxnet 22
• 3.2.2 BlackEnergy 3 23
• 3.2.3 Triton 23
• 3.3 STRIDE Methodology for DCS 24
• 3.3.1 STRIDE-based Threat Modeling Methodology 27
• 3.3.2 STRIDE Approach Method 28
• 3.4 System Description: DCS Operation 29
• 3.4.1 Identify Assets and Security Objectives 29
• 3.4.2 Create Architecture Overview 30
• 3.4.3 Decompose the System 32
• 3.4.4 Identify Threats using STRIDE 33
• 3.4.5 Document the Threats 40
• 3.4.6 Rate the Threats 43
• 3.4.7 Plan Mitigation Strategies 44
• 4. Purdue Enterprise Reference Architecture Based System Optimal Deployment Decision Methodology 48
• 4.1 Overview 48
• 4.2 Methodology for Determining System Optimal Deployment in ICS Environment 49
• 4.2.1 Validation of Decision Methodology 50
• 5. Intrusion Detection and Identification Using Tree-BasedMachine Learning Algorithms on the DCS Network 53
• 5.1 Overview 53
• 5.2 Preliminaries 54
• 5.2.1 Experimental Setup 54
• 5.2.2 Attack Scenarios 56
• 5.3 Proposed Scheme 57
• 5.3.1 Data Preprocessing 58
• 5.3.2 Detection Algorithm 61
• 5.4 Performance Evaluation 63
• 5.4.1 Performance Metrics 63
• 5.4.2 Experimental Results 65
• 6. Conclusion 76

참고문헌 (Reference)

• 1 B. Schneier, "Attack trees ,", vol . 24 , no . 12 , pp . 21 ? 29, 1999
• 2 L. Kohnfelder and P. Garg, "The threats to our products", vol . 33, 1999
• 3 R. M. Lee , M. J. Assante , and T. Conway ,, "German steel mill cyber attack ,", vol . 30 , p. 62 ,, 2014
• 4 A. Shostack, "Experiences threat modeling at microsoft.", vol . 2008, 2008
• 5 R. Langner, "Stuxnet : Dissecting a cyberwarfare weapon", vol . 9 , no . 3 , pp . 49 ? 51, 2011
• 6 G. Sindre and A. L. Opdahl, "Eliciting security requirements with misuse cases", vol . 10 , no . 1 , pp . 34 ? 44, 2005
• 7 R. Deraison , R. Gula , and T. Hayton ,, "Passive vulnerability scanning : Introduction to nevo", vol . 9 , no . 1-13 , p. 7 ,, 2003
• 8 K. K. Gon and K. S. Hoon, "Using threat modeling for risk analysis of smarthome ,", pp . 378 ? 379, 2015
• 9 D. U . Case, "Analysis of the cyber attack on the ukrainian power grid", vol . 388, 2016
• 10 P. A. Ralston , J. H. Graham , and J. L. Hieb, "Cyber security risk assessment for scada and dcs networks", vol . 46 , no . 4 , pp . 583 ? 594, 2007
• 11 A . Di Pinto , Y. Dragoni , and A. Carcano, "Triton : The first ics cyber attack on safety instrument systems", vol . 2018 , pp . 1 ? 26, 2018
• 12 Y. Cherdantseva , P. Burnap , A. Blyth , P. Eden , K. Jones , H. Soulsby , and K. Stoddart ,, "A review of cyber security risk assessment methods for scada systems", vol . 56 , pp . 1 ? 27, 2016
• 13 T. Alladi , V. Chamola , and S. Zeadally ,, "\Industrial control systems : Cyberattack trends and countermeasures", vol . 155 , pp . 1 ? 8 ,, 2020
• 14 K. Stouffer , J. Falco , and K. Scarfone ,, "Sp 800-82 rev . 2Guide to Industrial Control Systems ( ICS ) Security", vol . 2 , no . 3 , p. 5, 2015
• 15 S. V. B. Rakas , M. D . Stojanovi ? , and J. D . Markovi ? -Petrovi ?, "A review of research work on network-based scada intrusion detection systems", vol . 8 , pp . 93083 ? 93108 ,, 2020
• 16 B. Potteiger , G. Martins , and X. Koutsoukos, "Software and attack centric integrated threat modeling for quantitative risk assessment", pp . 99 ? 108, 2016
• 17 Y. Kwon , S. Lee , R. King , J. I. Lim , and H. K. Kim, "Behavior analysis and anomaly detection for a digital substation on cyberphysical system", vol . 8 , no . 3 , p. 326, 2019
• 18 A. Derhab , M. Guerroumi , A. Gumaei , L. Maglaras , M. A. Ferrag , M. Mukherjee , and F. A. Khan ,, "Blockchain and random subspace learning-based ids for sdn-enabled industrial iot security", vol . 19 , no . 14 , p. 3119, 2019
• 19 K. Kim , K. Cho , J. Lim , Y. H. Jung , M. S. Sung , S. B. Kim , and H. K. Kim, "What s your protocol : Vulnerabilities and security threats related to z-wave protocol ,", vol . 66 , p. 101211 ,, 2020
• 20 H. Lin , A. Slagell , Z. T. Kalbarczyk , P. W. Sauer , and R. K. Iyer ,, "Runtime semantic security analysis to detect and mitigate controlrelated attacks in power grids", vol . 9 , no . 1 , pp . 163 ? 178, 2016
• 21 D. Du , X. Li , W. Li , R. Chen , M. Fei , and L. Wu ,, "Admm-based distributed state estimation of smart grid under data deception and denial of service attacks", vol . 49 , no . 8 , pp . 1698 ? 1711, 2019
• 22 F. Zhang , H. A. D. E. Kodituwakku , J. W. Hines , and J. Coble ,, "Multilayer data-driven cyber-attack detection system for industrial control systems based on network , system , and process data", vol . 15 , no . 7 , pp . 4362 ? 4369, 2019