PaperlayerView exact revision on arXiv

Source-linked AI summary

Cybersecurity for Industrial Control Systems: A Survey

Deval Bhamare, Maede Zolanvari, Aiman Erbad, Raj Jain, Khaled Khan, Nader Meskin

arXiv:2002.04124v1cs.CRcs.NIeess.SY

TL;DR

ICS cloudification creates new cybersecurity exposure for industrial systems that were historically isolated from the Internet. This paper surveys cloud-based ICS security, machine-learning approaches, datasets, and case studies, reporting both promising detection results and substantial robustness challenges. It concludes that broader testbeds and evaluation across diversified operating conditions are needed.

  • Problem

    Cloud-connected ICSs face advanced cyber-attacks, while existing surveys and datasets provide limited cloud-specific and cross-environment coverage for machine-learning security evaluation.

  • Method

    The paper surveys cloud-based ICS security research and machine-learning approaches, and examines case studies and simulation-based data collection for intrusion detection.

  • Results

    Case studies report that NNge and random forest achieve the highest precision and recall for data injection attacks, while command-injection models perform almost consistently.

  • Takeaways & Limitations

    Effective ICS machine-learning security requires shared datasets, broader robustness testing, and testbeds representing diversified operating conditions.

  • Takeaways & Limitations

    ICS machine-learning models may degrade across datasets because real-time unbiased data are difficult to obtain and simulated datasets may lack comprehensiveness.

Abstract

from arXiv · show

Industrial Control System (ICS) is a general term that includes supervisory control & data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC). ICSs are often found in the industrial sectors and critical infrastructures, such as nuclear and thermal plants, water treatment facilities, power generation, heavy industries, and distribution systems. Though ICSs were kept isolated from the Internet for so long, significant achievable business benefits are driving a convergence between ICSs and the Internet as well as information technology (IT) environments, such as cloud computing. As a result, ICSs have been exposed to the attack vectors used in the majority of cyber-attacks. However, ICS devices are inherently much less secure against such advanced attack scenarios. A compromise to ICS can lead to enormous physical damage and danger to human lives. In this work, we have a close look at the shift of the ICS from stand-alone systems to cloud-based environments. Then we discuss the major works, from industry and academia towards the development of the secure ICSs, especially applicability of the machine learning techniques for the ICS cyber-security. The work may help to address the challenges of securing industrial processes, particularly while migrating them to the cloud environments.

I. INTRODUCTION

ICSs integrate control, communication, and monitoring components across critical industrial sectors. Their migration from isolated systems to cloud-connected environments brings operational benefits but increases exposure to cyber-attacks and security weaknesses.

  • I. INTRODUCTION: ICSs encompass SCADA, DCS, PLCs, and other control configurations used across industrial sectors and critical infrastructures.Examples include nuclear and thermal plants, water treatment, power generation, heavy industry, and distribution systems.
  • I. INTRODUCTION: Typical ICSs combine control loops, human-machine interfaces, remote diagnostics, maintenance tools, and network protocols.
  • I. INTRODUCTION: Cloud services can reduce hardware and infrastructure costs while enabling remote connectivity, but Internet connections expose ICSs to broader cyber-attack scenarios.
  • I. INTRODUCTION: Cloud migration introduces threats including advanced persistent threats, network compromise spillover, denial-of-service attacks, and supply-chain compromise.
  • I. INTRODUCTION: The paper surveys cloudification and security research, emphasizes machine learning for anomaly and intrusion detection, and proposes a simulation testbed for collecting ICS operation traces.

II. AVAILABLE SURVEYS

Existing ICS security surveys address safety, risk management, cloud integration, control, software-defined networking, and intrusion detection, but leave important cloud-specific machine-learning gaps.

  • II. AVAILABLE SURVEYS: Earlier surveys covered ICS safety and security, risk management, standards, and cloud-based SCADA security challenges.
  • II. AVAILABLE SURVEYS: Existing work lacked an in-depth survey of cloud-based approaches and machine-learning techniques for ICS security.
  • II. AVAILABLE SURVEYS: Surveys of distributed filtering, control, software-defined networking, and ICS intrusion detection did not provide cloud-specific coverage for multi-cloud scenarios.

III. RELATED WORK

Related work examines cloud-based ICS benefits, security threats, simulation, and machine-learning applications. These studies establish cloud feasibility while motivating broader security analysis and testbed development.

  • III. RELATED WORK: Cloud-based ICS approaches can reduce costs, increase throughput, improve reliability and functionality, and connect remote components for remote use.
  • III. RELATED WORK: Research documents attacks against Internet-facing ICS technologies, including SCADA brute-force attacks and attacks on energy and water infrastructure.
  • III. RELATED WORK: Security breaches can cause sensitive-data loss, revenue and financial losses, environmental impacts, production losses, and human injury.
  • III. RELATED WORK: Simulation studies demonstrate security assessment potential but identify flexibility and extensibility limitations in existing environments.
  • III. RELATED WORK: Proposed security work includes fuzzy Petri networks, smart-grid security models, threat categorization, and cloud-based big-data analytics for smart grids.
  • III. RELATED WORK: Cloud-based SCADA studies include secure water-supply monitoring, cloud implementation for lower real-time infrastructure costs, risk assessment, and web-based substation control.
  • III. RELATED WORK: Machine learning is identified as a key trend for cloud-based industrial cybersecurity and anomaly detection.

IV. MACHINE LEARNING APPROACHES FOR ICS

Machine-learning approaches exploit regular ICS communication patterns for anomaly and intrusion detection, but their evaluation is constrained by limited and incomplete datasets. The section surveys algorithms, datasets, industry tools, and case studies.

  • IV. MACHINE LEARNING APPROACHES FOR ICS: Machine-learning studies apply anomaly detection to SCADA communication, power disturbances, water distribution, and electrical substations.
  • IV. MACHINE LEARNING APPROACHES FOR ICS: Regular SCADA command-and-response loops provide behavioral patterns that can support machine-learning-based anomaly detection.The example uses repeated Modbus write and read commands followed by responses.
  • IV. MACHINE LEARNING APPROACHES FOR ICS: ICS intrusion detection uses machine-learning pattern recognition, signature matching, or combinations of both to identify anomalous or known threats.
  • IV. MACHINE LEARNING APPROACHES FOR ICS: Researchers lack standard, comprehensive datasets containing all attack types, making robust model development and IDS performance assessment difficult.
  • IV. MACHINE LEARNING APPROACHES FOR ICS: Reviewed approaches include neural networks, hidden Markov models, support vector machines, one-class SVMs, semi-supervised learning, and data mining.
  • IV. MACHINE LEARNING APPROACHES FOR ICS: Industry efforts include a Linux-based firewall capable of filtering Modbus packets, while other work classifies malicious behavior from network-traffic features.

V. CASE STUDY EXAMPLES

The case studies examine machine-learning-based ICS security, cloud-based attack mitigation, SCADA machine-learning detection, and practical cloud deployment. Together, they show both measurable detection gains and deployment constraints that shape secure cloud migration.

  • Cyber risk assessment: Machine learning is useful for detecting manipulated ICS traffic, but imbalanced datasets can cause false negatives and may limit detection of confidentiality attacks.Attack samples are often rare relative to normal traffic, and eavesdropping may not produce detectable traffic manipulation.
  • Cloud-based attack mitigation: An integrated fog-and-cloud framework improved average DDoS detection rate by 8.98% across two simulated attacks.The testbed simulated ICS field devices, fog and cloud environments, TCP SYN flooding, and forged Modbus command data.
  • SCADA machine-learning detection: For data injection attacks, NNge and random forest achieved the highest scores on both evaluated metrics, whereas command-injection performance was nearly identical across models.The study used labeled gas-pipeline RTU telemetry and simulated command- and data-injection attacks.
  • SCADA cloud deployment: The SCADA cloud-deployment study evaluated monitored-field size, component location, processing time, communication time, and network delays.These experimental settings supported recommendations for real-world migration to an IaaS cloud environment.
  • SCADA cloud deployment: Centralizing all SCADA functionality is not useful, while event-driven communication and protocol conversion near field devices can reduce network load.The recommendations arise from testing different deployment and communication configurations in the cloud setting.

VI. RESEARCH CHALLENGES

The paper identifies dataset diversity and realistic testbeds as central challenges for evaluating machine-learning-based ICS intrusion detection. It proposes hybrid data and simulation environments to improve robustness across operating conditions and cloud-based scenarios.

  • Research Challenges: Real-time and unbiased ICS security datasets are difficult to obtain because industrial network data may be confidential, private, or statistically incomplete.Simulated or closed environments may lack comprehensiveness, creating a semantic gap between model results and application.
  • Research Challenges: Supervised models that perform well on UNSW may show much-degraded performance on the different ISOT dataset.This comparison motivates testing model robustness across datasets generated under different simulation or experimental conditions.
  • Research Challenges: Machine-learning research for ICS cybersecurity lacks sufficient evidence of effectiveness across multiple datasets and diversified operating environments.The paper links this gap to the need for robustness evaluation in cloud-based control-system scenarios.
  • Research Challenges: The proposed future work combines publicly available datasets with testbed and industry-campus traces to create hybrid datasets.Common features extracted from raw TCP dumps are intended to support robustness in multi-cloud scenarios, while real-time traces can augment existing data.
  • Research Challenges: The Tennessee Eastman process is presented as a nonlinear, unstable benchmark for analyzing cyberattack effects and validating future machine-learning algorithms.The paper notes that intrusion detection has not been thoroughly investigated for this benchmark.
  • Research Challenges: An ICS security testbed can model real ICSs, support attack and defense experiments, and evaluate their effects on control systems.The proposed testbed is intended to provide a cost-effective and realistic environment for cybersecurity research.

VII. CONCLUDING REMARKS

Cloud-based ICS security remains an open issue as sophisticated malware makes component-level attack prevention and detection difficult. The paper surveys cloudification, machine-learning-based security research, and testbed-based approaches for addressing process-control security challenges.

  • Cloud-based ICS security remains an open issue despite the popularity of big data analytics and cloud computing.
  • Sophisticated malware, including zero-day attacks and rootkits, complicates prevention and detection at the ICS component level.
  • The paper reviews the shift from stand-alone ICSs to cloud environments and major industry and academic work using machine learning for security.
  • A testbed may provide process-management insights and clarify security requirements for industrial processes using cloud platforms.
Loading 2002.04124v1…