PaperlayerView exact revision on arXiv

Source-linked AI summary

MiniCPS: A toolkit for security research on CPS Networks

Daniele Antonioli, Nils Ole Tippenhauer

arXiv:1507.04860v1cs.NIcs.CR

TL;DR

Real-world CPS are often inaccessible to security researchers, and CPS research must account for physical-layer interactions as well as network communication. MiniCPS extends Mininet with CPS components and a physical-layer API; two example scenarios demonstrate its use in developing attacks and defenses applicable to real systems.

  • Problem

    Real-world CPS are often not open to security researchers, and research environments must account for physical-layer interactions alongside network communications.

    Source: §1 · p. 1

  • Method

    MiniCPS builds on Mininet for real-time network emulation, adds simulation tools for CPS components, and provides an API for physical-layer interaction simulation.

    Source: §7 · p. 8

  • Results

    MiniCPS was demonstrated in two example scenarios and used to develop attacks and defenses described as directly applicable to real systems.

    Source: §7 · p. 8

  • Takeaways & Limitations

    MiniCPS provides a framework for researchers, network engineers, and security experts to build or investigate ICS networks and test exploits and countermeasures in virtualized environments.

    Source: §7 · p. 8

    MiniCPS is not intended for performance simulation or optimization, and currently places little emphasis on GUI or visualization.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

In recent years, tremendous effort has been spent to modernizing communication infrastructure in Cyber-Physical Systems (CPS) such as Industrial Control Systems (ICS) and related Supervisory Control and Data Acquisition (SCADA) systems. While a great amount of research has been conducted on network security of office and home networks, recently the security of CPS and related systems has gained a lot of attention. Unfortunately, real-world CPS are often not open to security researchers, and as a result very few reference systems and topologies are available. In this work, we present MiniCPS, a CPS simulation toolbox intended to alleviate this problem. The goal of MiniCPS is to create an extensible, reproducible research environment targeted to communications and physical-layer interactions in CPS. MiniCPS builds on Mininet to provide lightweight real-time network emulation, and extends Mininet with tools to simulate typical CPS components such as programmable logic controllers, which use industrial protocols (Ethernet/IP, Modbus/TCP). In addition, MiniCPS defines a simple API to enable physical-layer interaction simulation. In this work, we demonstrate applications of MiniCPS in two example scenarios, and show how MiniCPS can be used to develop attacks and defenses that are directly applicable to real systems.

1. INTRODUCTION

As CPS networks adopt more connected communications, their security has attracted attention, but real-world systems are often inaccessible and physical-layer interactions complicate research. MiniCPS addresses this gap with a reproducible CPS emulation environment and example attack and defense applications.

1. INTRODUCTION

  • Real-world CPS are often closed to security researchers, while physical-layer interactions must be considered alongside network communications.Growing connectivity also introduces security threats, particularly when systems communicate over public networks.Source: §1 · p. 1
  • MiniCPS is built on Mininet to emulate ICS networks and components such as PLCs, while providing an API for physical-layer interactions.The framework is intended as an extensible, reproducible research environment for CPS.Source: §1 · p. 1
  • MiniCPS supports sharing system setups and extending them with Linux tools, and its Mininet foundation suits ICS Software-Defined Networking research.The paper proposes SDN for detecting and preventing the attack described in its application case.Source: §1 · p. 1
  • The paper identifies missing CPS network simulation environments that support physical interactions, detailed communication links, and industrial protocols.It also describes an application in which an attack was refined in MiniCPS and later validated on a real testbed.Source: §1 · p. 1

2. CPS NETWORKS AND MININET

The section outlines typical ICS components, network protocols, and topology, then describes Mininet's emulation approach and extensibility. Together, these provide context for MiniCPS's network-emulation foundation.

2.1 ICS networks

  • ICS can include PLCs, sensors, actuators, supervisory components, and gateways; the paper focuses on single-site systems with local connections.Industrial networks are transitioning to Ethernet/IP, while retaining additions such as Ethernet rings, multicasting, and custom protocols; ENIP transports CIP messages for tag operations.Source: §2.1 · p. 2
  • ICS topology spans L0, where sensors and actuators connect to PLCs, and L1, which links PLCs with local supervisory devices.The section presents a generic ICS network topology in Figure 1; some industrial devices are kept in the same IP-layer subnetwork.Source: §2.1 · p. 2, Figure 1 · p. 2

2.2 Mininet

  • Mininet emulates hosts, switches, routers, middleboxes, and links with high fidelity, using lightweight Linux containers rather than full system virtualization.Virtual hosts use network namespaces and virtual Ethernet links; the approach runs on one kernel with lower computational overhead than full virtualization.Source: §2.2 · pp. 2–3
  • Mininet supports realistic network setups that can be adapted over time, extended through Python APIs, and interacted with through a command-line interface.The section also describes Mininet as open-source and actively maintained, with support for developing OpenFlow architectures.Source: §2.2 · p. 3

3. MINICPS

MiniCPS extends Mininet into a real-time CPS network emulation toolkit for building and sharing ICS setups, with component logic and physical-layer interactions. Its design supports industrial protocols and configurable network links, while its implementation emphasizes modularity and testing.

3. MINICPS

  • MiniCPS provides Python tools for real-time CPS network emulation, enabling researchers, network engineers, and security experts to build, investigate, share, and test ICS setups.The toolkit is intended for realistic virtualized environments.Source: §3 · p. 3

3.1 Goals of MiniCPS

  • Its design goals include cost-effectiveness, hardware compatibility, realistic industrial traffic, usability, reproducibility, open-source licensing, and readiness for SDN.Sharing scripts can help others reproduce specialized ICS setups.Source: §3.1 · p. 3

3.2 Design overview

  • MiniCPS separates network messaging, component logic, and physical-layer properties, which simulation scripts update in real time.Figure 2 depicts the framework's component logic, network emulation, and physical-layer simulation layers.Source: §3.2 · p. 3, Figure 2 · p. 3

3.3 Network Communication

  • Mininet supports configurable link delay, loss, and capacity, while Linux networking and industrial-protocol libraries enable varied topologies and ENIP or Modbus/TCP traffic.The framework also supports standard protocols and configurable link settings.Source: §3.3 · pp. 3–4

3.4 Physical Layer Interactions

  • PHY-SIM exposes real-time physical properties as JSON file resources that components and external tools can read or update.The API is independent of a particular library or programming language, and could connect to a physical process when suitable interfaces exist.Source: §3.4 · p. 4

3.5 Implementation

  • The implementation organizes shared helpers, configurable CPS/ICS topologies, and control applications into core modules, with corresponding tests and automated test and logging tools.A first prototype was implemented and was still being tested and extended.Source: §3.5 · p. 4

4. EXAMPLE APPLICATION: MITM TRAFFIC MANIPULATIONS

MiniCPS models a water-treatment testbed to examine HMI–PLC traffic manipulation. The extended attack rewrites both valve commands and reported fill-state measurements, and was transferred to the physical testbed with minor modifications.

4. EXAMPLE APPLICATION: MITM TRAFFIC MANIPULATIONS

  • The water-treatment testbed model supports experiments on HMI–PLC command and sensor-value manipulation, as well as SDN-based ARP-spoofing detection and mitigation.The first application manipulates ENIP/CIP traffic; the second concerns SDN controller-based defenses.Source: §4 · p. 4

4.1 Basic Attack scenario

  • An attacker on the ICS link-layer network can redirect HMI–PLC traffic to alter a valve command and overfill a tank without detection.The HMI controls the valve based on the tank fill level reported by a sensor.Source: §4.1 · p. 4

4.2 Basic Attack

  • Ettercap filter rules changed the HMI's repeated valve-close commands to open, allowing arbitrary valve-tag values without competing with the HMI's control traffic.The attack was deployed successfully in MiniCPS.Source: §4.2 · p. 5, §4.1 · p. 5

4.3 Simulating physical layer

  • The extended attack rewrote both valve commands and reported fill-state measurements, was demonstrated in MiniCPS, and transferred to the physical testbed with minor modifications.The modifications were needed because the exact CIP messages in the testbed and MiniCPS were not yet fully identical.Source: §4.3 · p. 5, Figure 5 · p. 5

5. EXAMPLE APPLICATION: SDN

The SDN example uses a custom controller to detect and prevent ARP spoofing in CPS networks. MiniCPS supports this work by modeling industrial network conditions and physical interactions.

5. EXAMPLE APPLICATION: SDN

  • The example investigates a customized SDN controller as a way to detect and prevent the previously described ARP-spoofing attack in a testbed.The authors selected POX for their prototype because it targets research use and integrates with their tools.Source: §5 · pp. 5–6, §5.2 · p. 6

5.1 Background on SDN/OpenFlow

  • SDN separates network policy from forwarding: a Network Operating System exposes an annotated network view, and controllers respond to switch-reported flows with forwarding rules.OpenFlow is described as the interface between SDN control logic and network devices.Source: §5.1 · p. 6

5.2 Leveraging SDN in CPS Networks

  • Industrial networks often have static topologies and regular traffic patterns, which the SDN approach extracts and enforces to detect and prevent ARP spoofing.For example, tag values may be queried every 100 ms and control commands sent every second; Figure 6 extends a generic ICS network with an OpenFlow switch and SDN controller.Source: §5.2 · p. 6, Figure 6 · p. 6

5.3 Preventing MitM attacks with a custom SDN controller

  • It checks ARP requests and replies against per-switch IP-to-MAC and MAC-to-port maps, then tells switches to block suspicious attacker traffic.Suspicious ARP requests are logged; suspicious replies can trigger blocking by attacker port and MAC address.Source: §5.3 · pp. 6–7
  • The controller detects internal and external ARP spoofing attempts and prevents both passive and active ARP man-in-the-middle attacks.Under normal ARP request/reply conditions, it dynamically updates its network map.Source: §5.3 · p. 7
  • More elaborate ARP-cache restoration and static MAC/IP mapping techniques are still under development; a dynamic policy checker and distributed controllers are proposed extensions.The planned distributed design uses synchronized controllers to tolerate a single point of failure in the control plane.Source: §5.3 · p. 7

6. RELATED WORK

The related-work discussion distinguishes MiniCPS by its focus on reproducible ICS topologies, PLC tools, and physical-layer interactions. It also contrasts network-emulation and simulation choices in prior CPS testbeds.

Related work

  • MiniCPS differs from Dong et al.'s testbed through its focus on reproducible ICS topologies, PLC tools that interact with network traffic, and a generic physical-layer API.The work instead proposes PowerWorld for power-grid simulation and uses DNP3 rather than MiniCPS's ENIP; the authors note that its testbed did not appear fully implemented.Source: §6 · p. 7
  • The framework in simulates network communication as abstract messages rather than the full TCP/IP and industrial-protocol stack, limiting detailed simulation of attacks such as CIP/ENIP manipulation.Unlike MiniCPS's real-time orientation, permits simulation at other timescales.Source: §6 · p. 7
  • SANE is cited as an early practical SDN-based secure-network design featuring centralized control, high-level policy design, and network scalability.The authors also point to other SDN and OpenFlow papers and.Source: §6 · p. 7

7. CONCLUSION

MiniCPS combines Mininet network emulation with component simulation tools and a physical-layer API. The authors demonstrated example applications and state that the framework's physical-layer simulation remains simplistic.

Conclusion

  • MiniCPS combines Mininet with a physical-layer API and component simulation tools to provide a lightweight, versatile CPS-network simulation system.The authors envision researchers using it to build, investigate, and exchange ICS networks, and security experts using it to test exploits and countermeasures in virtualized environments.Source: §7 · pp. 7–8
  • The framework's physical-layer simulation is currently very simplistic, although its API is intended to accommodate different kinds of physical-process simulations.Examples named include water flow, mechanical levers, and temperature transfer.Source: §7 · p. 8
  • MiniCPS uses Mininet for lightweight real-time network emulation, simulates PLCs using industrial protocols such as Ethernet/IP and Modbus/TCP, and was demonstrated in two scenarios involving attacks and defenses applicable to real systems.Source: §7 · p. 8
Loading 1507.04860v1…