Whos In Control of Your Control System? Device Fingerprin<ng for - - PowerPoint PPT Presentation
Whos In Control of Your Control System? Device Fingerprin<ng for Cyber-Physical Systems David Formby 1 , Preethi Srinivasan 1 , Andrew Leonard 2 , Jonathan Rogers 2 , Raheem Beyah 1 Communica<ons Assurance and Performance (CAP) Group
Who’s In Control of Your Control System? Device Fingerprin<ng for Cyber-Physical Systems
David Formby1, Preethi Srinivasan1, Andrew Leonard2, Jonathan Rogers2, Raheem Beyah1 Communica<ons Assurance and Performance (CAP) Group School of Electrical and Computer Engineering1 School of Mechanical Engineering2 Georgia Ins<tute of Technology
@GTCAPGROUP
Who’s In Control of Your Control System?
Personal Computers Mobile Phones Embedded Devices
Motors, pumps, Generators, Valves, Relays…
CPS
2
Who’s In Control of Your Control System?
– Power grid, water/sewage, oil/gas, manufacturing, supervisory control and data acquisi<on (SCADA)
– Ligh<ng, locks, thermostat, security system
Vulnerabilities can lead to physical harm ICS filled with vulnerable, legacy devices
3
ICSA-15-041-02 ICSA-15-006-01 ICSA-15-169-01B https://ics-cert.us-cert.gov/advisories
Who’s In Control of Your Control System?
data injec<on and false command responses
– Can push system into unsafe state, cause physical harm – Previous fingerprin<ng work not suited for ICS – False data detec<on and IDS have limita<ons
4
Illustration of simple false data injection
Who’s In Control of Your Control System?
– Compromised PLC
– Physical access
– Inject false data and command responses while masquerading as a different device
5
Who’s In Control of Your Control System?
– Cross Layer Response Time (CLRT) – Es<mate device processing <me – Black Box Model fingerprints
– Physical fingerprin<ng – Es<mate physical
– Black Box Model fingerprints – New class of fingerprin<ng - White Box Modeling
6
Who’s In Control of Your Control System?
from data acquisi<on traffic
processing <me
– Time between TCP ACK and SCADA response – Fast links (100Mbps) with slow devices, slow and regular traffic
7
Adversary cannot simply respond faster to beat IED, must match the CLRT fingerprint
Who’s In Control of Your Control System?
Same hardware, different software
8
Who’s In Control of Your Control System?
9
– 100Mbps fiber links – Path distance ranged from 1 switch at 10 yards, to roughly 30 switches around 10 miles away
Who’s In Control of Your Control System?
10
Detection time – Time to gather samples before making a decision Precision
𝑈𝑄/𝑈𝑄+𝐺𝑄
Recall
𝑈𝑄/𝑈𝑄+𝐺𝑂
Accuracy
𝑈𝑄+𝑈𝑂/𝑈𝑄+𝑈𝑂+𝐺𝑄+𝐺𝑂
Who’s In Control of Your Control System?
Training Data – Original dataset Testing Data – Upgraded network Training Data – Original dataset Testing Data – Different substation
11
Who’s In Control of Your Control System?
from control traffic
– Time between command packet and event <mestamp
Box Methods
12
Adversary must guess what event timestamp to respond with
Who’s In Control of Your Control System?
13
with a lower voltage signal. Common device in ICS and analogous to large scale circuit breakers
Relays used in testbed, nearly identical specifications Testbed setup
Who’s In Control of Your Control System?
14
No obvious differences between Open operations due to nearly identical ratings. Clear differences in Close
fingerprinting.
Who’s In Control of Your Control System?
15
Who’s In Control of Your Control System?
some<mes infeasible
– Operate infrequently, no physical access
model and es<mate parameters
16
Who’s In Control of Your Control System?
17
Current in coil Magnetic field Permanent magnet force Equation of motion Coil Force Armature displacement Armature angular velocity
Who’s In Control of Your Control System?
18
Reduced accuracy, but could be refined as true samples become available
Who’s In Control of Your Control System?
– TCP Quick ACKs for CLRT and <mestamps for physical
– Not high enough for stand-alone IDS, but can complement tradi<onal IDS
– Reduced accuracy and requires some exper<se, combine with “gray box” modeling to overcome
– Skilled adversary would evade detec<on, countermeasures could randomize requests, send extra
19
Who’s In Control of Your Control System?
– Data acquisi<on and control – 99% and 92% classifica<on accuracy – Inventory and complemen<ng tradi<onal IDS – Resistant to simple mimicry a\acks
– Internet of Things, developing white box methods
20
Who’s In Control of Your Control System?
21
Who’s In Control of Your Control System?
22
Who’s In Control of Your Control System?
23
Who’s In Control of Your Control System?
– Simulate compromised PLC – BeagleBone Black at 300MHz, 512MB RAM
– Simulate on-site a\acker – Desktop with 3.4 GHz quad-core i7, 16GB RAM
– Given the target distribu<ons, masquerade as target device while responding to read requests
24
Who’s In Control of Your Control System?
25