检索结果-内蒙古大学图书馆

作者： Mantere, M. (Matti) University of Oulu

学位级别：doctor

Abstractindustrial control system (ICS) networks used to be isolated environments, typically separated by physical air gaps from the wider area networks. This situation has been changing and the change has brought with it new cybersecurity issues. The process has also exacerbated existing problems that were previously less exposed due to the systems’ relative isolation. This process of increasing connectivity between devices, systems and persons can be seen as part of a paradigm shift called the Internet of Things (IoT). This change is progressing and the industry actors need to take it into account when working to improve the cybersecurity of ICS environments and thus their reliability. Ensuring that proper security processes and mechanisms are being implemented and enforced on the ICS network level is an important part of the general security posture of any given industrial *** security and the detection of intrusions and anomalies in the context of ICS networks are the main high-level research foci of this thesis. These issues are investigated through work on machine learning (ML) based anomaly detection (AD). Potentially suitable features, approaches and algorithms for implementing a network anomaly detection system for use in ICS environments are *** investigating the challenges, different approaches and methods, a proof-ofconcept (PoC) was implemented. The PoC implementation is built on top of the Bro network security monitoring framework (Bro) for testing the selected approach and tools. In the PoC, a Self-Organizing Map (SOM) algorithm is implemented using Bro scripting language to demonstrate the feasibility of using Bro as a base system. The implemented approach also represents a minimal case of event-driven machine learning anomaly detection (EMLAD) concept conceived during the *** contributions of this thesis are as follows: a set of potential features for use in machine learning anomaly detection, proof of the feasibili

关键词： anomaly detection cybersecurity industrial control system security information security intrusion detection machine learning network security automaatioj?rjestelmien turvallisuus koneoppiminen kyberturvallisuus poikkeamien havainnointi tietoturva tunkeutumisen havainnointi

来源：评论

学校读者我要写书评

暂无评论

security evaluation of coal mine industrial control systems based on CVSS v4.0

引用

RESULTS IN ENGINEERING 2025年 26卷

作者： Zhang, Jianzhen Wen, Jing Qi, Yanjun Shanxi Inst Mech & Elect Engn Dept Informat Engn Changzhi 046011 Peoples R China Shanxi Univ Coll Comp & Informat Technol Taiyuan 030006 Peoples R China Shanxi Informat Technol Co Ltd Dept Tech Changzhi 046000 Peoples R China

This paper proposes a security evaluation model for coal mine industrial control systems (ICS) based on the CVSSv4.0 framework, incorporating four core dimensions: asset value, attack difficulty, attack consequences, and safety protection measures. The asset value dimension of ICS considers factors such as equipment type, functional importance, and data sensitivity. The attack difficulty dimension considers the technical knowledge, resources required by the attacker, and the complexity of the attack. The attack consequences dimension takes into account factors such as loss of function, data leakage, and impact on reputation. Safety protection measures dimension considers management measures, technical measures, and operational maintenance measures. The evaluation of an ICS in a coal mine located in Changzhi City, Shanxi Province, demonstrates that this model can accurately reflect the risk level of coal mine ICS. It provides a scientific basis for protective strategies within the industry. For instance, the final CVSS score of the evaluated system was 8.67, indicating a high-risk level, with 127 industrial control devices and 16 known vulnerabilities (15 low-risk and 1 medium-risk).This model effectively assesses the security risks of coal mine ICS and provides a quantitative method and a unified standard for coal mining enterprises to formulate reasonable ICS security policies. Additionally, it offers an innovative model and reference case for security assessments in other industrial control environments, with significant practical implications and theoretical value.

关键词： Coal mine industrial control systems CVSS industrial control system security Risk assessment Vulnerability model

来源：评论

学校读者我要写书评

暂无评论

A dynamic games approach to proactive defense strategies against Advanced Persistent Threats in cyber-physical systems

引用

COMPUTERS & security 2020年 89卷

作者： Huang, Linan Zhu, Quanyan NYU Dept Elect & Comp Engn Brooklyn NY 11201 USA

Advanced Persistent Threats (APTs) have recently emerged as a significant security challenge for a cyber-physical system due to their stealthy, dynamic and adaptive nature. Proactive dynamic defenses provide a strategic and holistic security mechanism to increase the costs of attacks and mitigate the risks. This work proposes a dynamic game framework to model a long-term interaction between a stealthy attacker and a proactive defender. The stealthy and deceptive behaviors are captured by the multi-stage game of incomplete information, where each player has his own private information unknown to the other. Both players act strategically according to their beliefs which are formed by the multi-stage observation and learning. The perfect Bayesian Nash equilibrium provides a useful prediction of both players' policies because no players benefit from unilateral deviations from the equilibrium. We propose an iterative algorithm to compute the perfect Bayesian Nash equilibrium and use the Tennessee Eastman process as a benchmark case study. Our numerical experiment corroborates the analytical results and provides further insights into the design of proactive defense-in-depth strategies. (C) 2019 Elsevier Ltd. All rights reserved.

关键词： Advanced persistent threats Defense in depth Proactive defense industrial control system security Cyber deception Multi-stage Bayesian game Perfect Bayesian Nash equilibrium Tennessee Eastman process

来源：评论

学校读者我要写书评

暂无评论

Securing wastewater facilities from accidental and intentional harm: A cost-benefit analysis

引用

INTERNATIONAL JOURNAL OF CRITICAL INFRASTRUCTURE PROTECTION 2013年第2期6卷 96-106页

作者： Papa, Stephen Casper, William Moore, Tyler So Methodist Univ Dept Comp Sci & Engn Bobby Lyle Sch Engn Dallas TX 75275 USA Lockheed Martin Aeronaut Ft Worth TX 76101 USA

It has been widely reported that industrial control systems underpinning critical infrastructures ranging from power plants to oil refineries are vulnerable to cyber attacks. A slew of countermeasures have been proposed to secure these systems, but their adoption has been disappointingly slow according to many experts. Operators have been reluctant to spend large sums of money to protect against threats that have only rarely materialized as attacks. But many security countermeasures are dual-use, in that they help protect against service failures caused by hackers and by accidents. In many critical infrastructure sectors, accidents caused by equipment failures and nature occur regularly, and investments for detecting and possibly preventing accidents and attacks could be more easily justified than investments for detecting and preventing attacks alone. This paper presents a cost-benefit analysis for adopting security countermeasures that reduce the incidence of sewer overflows in wastewater facilities. The paper estimates the expected annual losses at wastewater facilities due to large overflows exceeding 10,000 gallons using publicly-available data on overflows, cleanup costs, property damage and regulatory fines. Also, it estimates the costs of adopting security countermeasures in wastewater facilities in eight large U.S. cities. The results of the analysis indicate that, in many cases, even a modest 20% reduction in large overflows can render the adoption of countermeasures cost-effective. (C) 2013 Elsevier B.V. All rights reserved.

关键词： industrial control system security Wastewater facilities security economics Cost-benefit analysis

来源：评论

学校读者我要写书评

暂无评论

Evaluation of Visual Notations as a Basis for ICS security Design Decisions

引用

IEEE ACCESS 2023年 11卷 9967-9994页

作者： Fluchs, Sarah Drath, Rainer Fay, Alexander Admeritia GmbH D-40764 Langenfeld Germany Pforzheim Univ Sch Engn D-75175 Pforzheim Germany Helmut Schmidt Univ Dept Automat D-22043 Hamburg Germany

For making informed security decisions during the design of industrial control systems (ICS), engineers need to process large amounts of security-relevant information outside their area of expertise. This problem moves the presentation of the security-relevant information into focus: security-relevant engineering information must be presented to security decision-makers in a way that enables them to decide upon security measures to build a defensible system. Visual representations have the potential to effectively convey suchlike information, thus saving the engineers' brain capacity for the security decision-making. However, research shows that this potential is only realized if the visualizations are carefully constructed for cognitive effectiveness. As a prerequisite for constructing a visual language for security engineering in the future, this paper explores two scientific questions: 1) what are the requirements for visualizing security-relevant engineering information in a way that enables engineers to make security decisions during ICS design? and 2) which existing visual languages meet (parts of) these requirements? The evaluation of existing visualizations reveals that there is a need for an improved, specialized visual language for security engineering that builds upon established engineering visualizations like piping and instrumentation diagrams and network maps, represents all security-relevant information as icons to achieve semantic transparency, and includes filtering mechanisms to reduce the complexity of each single diagram. The paper finishes with defining the main pillars of a future visual language that should allow ICS engineers to quickly capture security-relevant information and guide them through the process of selecting the right security measures to design a defensible ICS.

关键词： security Decision making Visualization Integrated circuits Automation Monitoring Knowledge engineering industrial control Automation engineering industrial control system security security by design visual language

来源：评论

学校读者我要写书评

暂无评论

A Flexible Architecture for industrial control system Honeypots 12

A Flexible Architecture for Industrial Control System Honeyp...

引用

12th International Joint Conference on E-Business and Telecommunications (ICETE)

作者： Serbanescu, Alexandru Vlad Obermeier, Sebastian Yu, Der-Yeuan KPMG AG Zurich Switzerland ABB Corp Res Baden Switzerland ETH Dept Comp Sci Zurich Switzerland

ISBN: (纸本)9789897581403

While frequent reports on targeted attacks for industrial control systems hit the news, the amount of untargeted attacks using standardized industrial protocols is still unclear, especially if devices are mistakenly or even knowingly connected to the Internet. To lay the foundation for a deeper insight into the interest of potential attackers, a large scale honeynet system that captures all interactions using industrial protocols is proposed. Special for the honeynet system architecture is the automated deployment on a cloud infrastructure and its modularisation of the industrial protocols. The centralized-but-redundant data collection allows correlating attacks that happen on multiple devices. A real-world experiment confirms the feasibility of the approach, and results of the observed interactions with the honeynet are presented.

关键词： industrial control system security Honeypots SCADA security

来源：评论

学校读者我要写书评

暂无评论

A Framework for Incident Response in industrial control systems 12

A Framework for Incident Response in Industrial Control Syst...

引用

12th International Joint Conference on E-Business and Telecommunications (ICETE)

作者： Schlegel, Roman Hristova, Ana Obermeier, Sebastian ABB Switzerland Ltd Corp Res Baden Switzerland

ISBN: (纸本)9789897581403

industrial control systems are used to control and supervise plants and critical infrastructures. They are crucial for operation of many industries and even society at large. However, despite efforts to secure such systems, there are frequent reports of incidents that lead to problems because of human error (e.g., installing unauthorized software on a mission-critical machine) or even cyber attacks. While such incidents should be prevented in the first place, it is not feasible to achieve 100% security;therefore, operators should be prepared to deal with incidents promptly and efficiently if they occur. In this paper, we present a general methodology and framework for investigating incidents in industrial control systems. The methodology is supported by a tool to automate an investigation, especially to efficiently determine the state of files on a device after an incident. This enables faster recovery from incidents by being able to identify suspicious files and focus on the files that have been modified compared to the initially installed files, or a previously taken baseline. An evaluation confirms the applicability of the methodology for an embedded industrial controller and for an industrial control system.

关键词： industrial control system security Forensics Incident Response

来源：评论

学校读者我要写书评

暂无评论

Method for authentication of sensors connected on Modbus TCP 4

Method for authentication of sensors connected on Modbus TCP

引用

4th International Conference on control, Decision and Information Technologies (CoDIT)

作者： Pricop, Emil Fattahi, Jaouhar Parashiv, Nicolae Zamfir, Florin Ghayoula, Elies Petr Gas Univ Ploiesti Automat Control Comp & Elect Dept Ploiesti Romania Univ Laval Dept Comp Sci & Software Engn Quebec City PQ Canada El Manar Univ Natl Engn Sch Tunis ENIT SysCom Lab Tunis Tunisia

ISBN: (纸本)9781509064656

The paper focuses on the conceptual development of an innovative method for authenticating sensors connected using Modbus TCP. Modbus TCP is a highly used industrial networking protocol that has very good performances but lacks security. In the first section of the paper, the authors try to highlight the importance of security of industrial control systems. The second section is dedicated to presenting the authentication process and the state-of-the-art regarding Modbus devices authentication. The third section focuses on presenting the characteristics of Modbus TCP protocol. The last section discusses the proposed conceptual solution showing a possible method of implementation.

关键词： authentication Modbus TCP security sensor authentication industrial control system security

来源：评论

学校读者我要写书评

暂无评论

Application-level Autonomic Hardware to Predict and Preempt Software Attacks on industrial control systems 44

Application-level Autonomic Hardware to Predict and Preempt ...

引用

44th Annual IEEE/IFIP International Conference on Dependable systems and Networks (DSN)

作者： Lerner, Lee W. Franklin, Zane R. Baumann, William T. Patterson, Cameron D. Virginia Tech Bradley Dept Elect & Comp Engn Blacksburg VA 24061 USA

ISBN: (纸本)9781479922338

We mitigate malicious software threats to industrial control systems, not by bolstering perimeter security, but rather by using application-specific configurable hardware to monitor and possibly override software operations in real time at the lowest (I/O pin) level of a system-on-chip platform containing a microcontroller augmented with configurable logic. The process specifications, stability-preserving backup controller, and switchover logic are specified and formally verified as C code commonly used in control systems, but synthesized into hardware to resist software reconfiguration attacks. In addition, a copy of the production controller task is optionally implemented in an on-chip, isolated soft processor, connected to a model of the physical process, and accelerated to preview what the controller will attempt to do in the near future. This prediction provides greater assurance that the backup controller can be invoked before the physical process becomes unstable. Adding trusted, application-tailored, software-invisible, autonomic hardware is well-supported in a commercial system-on-chip platform.

关键词： industrial control system security software threats hardware root-of-trust formal analysis

来源：评论

学校读者我要写书评

暂无评论

SePanner: Analyzing Semantics of controller Variables in industrial control systems based on Network Traffic 23

SePanner: Analyzing Semantics of Controller Variables in Ind...

引用

39th Annual Computer security Applications Conference (ACSAC)

作者： Meng, Jie Yang, Zeyu Zhang, Zhenyong Geng, Yangyang Deng, Ruilong Cheng, Peng Chen, Jiming Zhou, Jianying Zhejiang Univ State Key Lab Ind Control Technol Hangzhou Peoples R China Zhejiang Univ Coll Control Sci & Engn Hangzhou Peoples R China Guizhou Univ State Key Lab Publ Big Data Guiyang Peoples R China Guizhou Univ Coll Comp Sci & Technol Guiyang Peoples R China Zhengzhou Univ Informat Engn Zhengzhou Peoples R China Singapore Univ Technol & Design Singapore Singapore

ISBN: (纸本)9798400708862

Programmable logic controllers (PLCs), the essential components of critical infrastructure, play a crucial role in various industrial manufacturing processes. Recent attack events show that attackers have a strong interest in tampering with the controller variables, such as the device status and internal program logic. A typical attack strategy is that the attackers just send malicious network traffic of industrial control protocols (ICPs) to change the controller variables of PLCs. To defend against this attack, a lot of countermeasures have been proposed to detect anomalies in network traffic based on the semantic analysis. However, the proprietary nature of ICPs poses a challenge to extracting the required semantics for evaluating the controller variables. In this paper, we propose a novel framework named SePanner to extract the semantics of controller variables from proprietary ICPs based on network traffic. Specifically, SePanner conducts the multi-state comparison to locate the semantic fields directly, then removes the interfering fields by the single-state comparison and filtering criteria. Our experiments demonstrate that SePanner can precisely extract the semantics of controller variables from proprietary ICPs, providing protection for PLCs while remaining compatible with various proprietary binary protocols.

关键词： industrial control system security Programmable Logic controller Semantics of controller variables Network traffic

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：