Automatic Construction of Statechart-Based Anomaly Detection Models for Multi-Threaded Industrial Control Systems

摘要: Traffic of Industrial Control System (ICS) between the Human Machine Interface (HMI) and Programmable Logic Controller (PLC) is known to be highly periodic. However, it sometimes multiplexed, due asynchronous scheduling. Modeling network traffic patterns multiplexed ICS streams using Deterministic Finite Automata (DFA) for anomaly detection typically produces a very large DFA high false-alarm rate. In this article, we introduce new modeling approach that addresses gap. Our Statechart includes multiple DFAs, one per cyclic pattern, together with DFA-selector de-multiplexes incoming into sub-channels sends them their respective DFAs. We demonstrate how automatically construct statechart from captured stream. unsupervised learning algorithms first build Discrete-Time Markov Chain (DTMC) Next, split symbols sets, cycle, based on symbol frequencies node degrees in DTMC graph. Then, create sub-graph each cycle extract Euler cycles sub-graph. The final comprised cycle. allow non-unique symbols, which appear more than also once cycle.We evaluated our solution traces production Siemens S7-0x72 protocol. stress-tested collection synthetically-generated simulated varying levels uniqueness time overlap. were able sets 99.6% accuracy. resulting modeled median rate as low 0.483%. all but most extreme scenarios, model drastically reduced both learned size comparison naive single-DFA model.