Using timing-based side channels for anomaly detection in industrial control systems

Abstract

The critical infrastructure, which includes the electric power grid, railroads and water treatment facilities, is dependent on the proper operation of industrial control systems. However, malware such as Stuxnet has demonstrated the ability to alter industrial control system parameters to create physical effects. Of particular concern is malware that targets embedded devices that monitor and control system functionality, while masking the actions from plant operators and security analysts. Indeed, system security relies on guarantees that the assurance of these devices can be maintained throughout their lifetimes. This paper presents a novel approach that uses timing-based side channel analysis to establish a unique device fingerprint that helps detect unauthorized modifications of the device. The approach is applied to an Allen Bradley ControlLogix programmable logic controller where execution time measurements are collected and analyzed by a custom anomaly detection system to detect abnormal behavior. The anomaly detection system achieves true positive rates of 0.978–1.000 with false positive rates of 0.033–0.044. The test results demonstrate the feasibility of using timing-based side channel analysis to detect anomalous behavior in programmable logic controllers.

Introduction

During a siege in 590 BCE, Solon of Athens poisoned the water supply of the town of Cirrha using hellebore roots [20]. The contaminated water incapacitated the unsuspecting Cirrhaeans with uncontrollable diarrhea and the Athenians quickly overwhelmed the city [20]. In 2000, Vitek Boden leveraged unauthorized wireless access to a sewage treatment plant to release 800,000 l of raw sewage into public water supplies in Australia [22]. In this incident, one malicious actor without direct physical access was able to cause a significant environmental impact. Due to increasing network connectivity, critical infrastructure systems are more susceptible to malicious attacks than ever before.

Modern society relies on industrial control systems (ICSs) to automate the operation of the critical infrastructure. Historically, industrial control systems were considered to be secure due to their isolation from external networks. Recently, however, industrial control systems have become less isolated as they incorporate commodity information technologies to improve efficiency and decrease costs [25]. The trend to interconnect industrial control devices exposes them to external networks and potential threats. Common devices, such as programmable logic controllers (PLCs), often lack security mechanisms such as authentication and encryption [25]. Stuxnet [8] demonstrated that significant damage can occur if a programmable logic controller in an industrial facility is compromised. Stuxnet also demonstrated that network protection mechanisms such as intrusion detection and air gapping, while important and effective, are unable to protect sensitive systems from sophisticated attackers.

A programmable logic controller has three layers: (i) hardware layer; (ii) firmware layer; and (iii) programming layer [4]. Building and maintaining trust in a device requires validating all three layers against a known-good baseline. The hardware is the lowest layer that executes the firmware. The firmware handles functionality such as communications, programming layer execution and error handling. Compromising the firmware of a device enables an attacker to cause negative effects and hide them from operators. The programming layer, also called the application layer, is designed to perform high-level system tasks. The applications in this programmable logic controller layer are often implemented using ladder logic programs. Stuxnet [8] demonstrated that the application layer of a programmable logic controller can be modified to cause significant damage to the controlled physical systems.