Attacks against process control systems: Risk assessment, detection, and response

Alvaro A. Cárdenas, Saurabh Amin, Zong Syun Lin, Yu-Lun Huang, Chi Yen Huang, Shankar Sastry

Research output: Chapter in Book/Report/Conference proceedingConference contribution

401 Scopus citations

Abstract

In the last years there has been an increasing interest in the security of process control and SCADA systems. Furthermore, recent computer attacks such as the Stuxnet worm, have shown there are parties with the motivation and resources to effectively attack control systems. While previous work has proposed new security mechanisms for control systems, few of them have explored new and fundamentally different research problems for securing control systems when compared to securing traditional information technology (IT) systems. In particular, the sophistication of new malware attacking control systems-malware including zero-days attacks, rootkits created for control systems, and software signed by trusted certificate authorities-has shown that it is very difficult to prevent and detect these attacks based solely on IT system information. In this paper we show how, by incorporating knowledge of the physical system under control, we are able to detect computer attacks that change the behavior of the targeted control system. By using knowledge of the physical system we are able to focus on the final objective of the attack, and not on the particular mechanisms of how vulnerabilities are exploited, and how the attack is hidden. We analyze the security and safety of our mechanisms by exploring the effects of stealthy attacks, and by ensuring that automatic attack-response mechanisms will not drive the system to an unsafe state. A secondary goal of this paper is to initiate the discussion between control and security practitioners-two areas that have had little interaction in the past. We believe that control engineers can leverage security engineering to design-based on a combination of their best practices-control algorithms that go beyond safety and fault tolerance, and include considerations to survive targeted attacks.

Original languageEnglish
Title of host publicationProceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011
Pages355-366
Number of pages12
DOIs
StatePublished - 20 May 2011
Event6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011 - Hong Kong, China
Duration: 22 Mar 201124 Mar 2011

Publication series

NameProceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011

Conference

Conference6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011
CountryChina
CityHong Kong
Period22/03/1124/03/11

Keywords

  • Control systems
  • Critical infrastructure protection
  • Cyber-physical systems
  • Ids
  • Scada
  • Security

Fingerprint Dive into the research topics of 'Attacks against process control systems: Risk assessment, detection, and response'. Together they form a unique fingerprint.

  • Cite this

    Cárdenas, A. A., Amin, S., Lin, Z. S., Huang, Y-L., Huang, C. Y., & Sastry, S. (2011). Attacks against process control systems: Risk assessment, detection, and response. In Proceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011 (pp. 355-366). (Proceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011). https://doi.org/10.1145/1966913.1966959