Passive inference of attacks on CPS communication protocols

摘要: Abstract The security of Cyber-Physical Systems (CPS) has been recently receiving significant attention from the research community. While majority such originates control theory domain, few approaches have addressed problem practical perspective. In this work, we do not claim that propose a particular solution to specific related CPS security, but rather present first look into what can help shape these solutions in future. Indeed, our vision and ultimate goal is attempt merge or at least diminish gap between highly theoretical derived insightful empirical experimentation, for securing CPS. Motivated by scarcity malicious data be captured, inferred analyzed within operational settings, paper adopts unique approach derive notions maliciousness based on passive measurements analysis. scrutinizing unsolicited real traffic targeting routable, allocated unused Internet Protocol (IP) addresses (i.e., darknet traffic), shed light attackers’ intentions actual attacks ample communication protocols. To permit analysis, initially devise evaluate novel probabilistic model aims filtering noise misconfiguration traffic) embedded traffic. Subsequently, near real-time inference algorithm designed implemented detect probing denial service activities. end, characterize misdemeanors terms their types, frequency, target protocols possible orchestration behavior. outcome demonstrate staggering 16 thousand scanning attempts close 8 various Further, results uncover stealthy activities proprietary clusters coordinated We concur devised approaches, techniques, methods provide solid step towards better comprehending objectives intents. As such, hope motivates literature design secure tailored models leverage tangible vulnerabilities measurements, achieve truly reliable