Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

Vollmer, Todd; Manic, Milos

doi:10.1109/TII.2014.2304633

Title: Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

Abstract

A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% ofmore » the monitored emulated devices.« less

Authors:

Vollmer, Todd ^[1]; Manic, Milos ^[1]

Idaho National Lab. (INL), Idaho Falls, ID (United States)

Publication Date:: Thu May 01 00:00:00 EDT 2014

Research Org.:: Idaho National Laboratory (INL), Idaho Falls, ID (United States)

Sponsoring Org.:: USDOE

OSTI Identifier:: 1136315

Report Number(s):: INL/JOU-14-32392
Journal ID: ISSN 1551-3203; TRN: US1500453

Grant/Contract Number:: AC07-05ID14517

Resource Type:: Accepted Manuscript

Journal Name:: IEEE Transactions on Industrial Informatics

Additional Journal Information:: Journal Volume: 10; Journal Issue: 2; Journal ID: ISSN 1551-3203

Publisher:: IEEE

Country of Publication:: United States

Language:: English

Subject:: 97 MATHEMATICS AND COMPUTING; INDUSTRIAL CONTROL NETWORKS; VIRTUAL HOSTS

Citation Formats


                    Vollmer, Todd, and Manic, Milos. Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks.  United States: N. p., 2014. 
Web.  doi:10.1109/TII.2014.2304633.

Copy to clipboard


                    Vollmer, Todd, & Manic, Milos. Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks.  United States.  https://doi.org/10.1109/TII.2014.2304633

Copy to clipboard


                    Vollmer, Todd, and Manic, Milos. Thu .  
"Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks".  United States.  https://doi.org/10.1109/TII.2014.2304633.  https://www.osti.gov/servlets/purl/1136315.

Copy to clipboard


                    
@article{osti_1136315,

  title        = {Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks},

  author       = {Vollmer, Todd and Manic, Milos},

  abstractNote = {A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% of the monitored emulated devices.},

  doi          = {10.1109/TII.2014.2304633},

  journal      = {IEEE Transactions on Industrial Informatics},

  number       = 2,

  volume       = 10,

  place        = {United States},

  year         = {Thu May 01 00:00:00 EDT 2014},

  month        = {Thu May 01 00:00:00 EDT 2014}

}

Copy to clipboard

Journal Article:

Free Publicly Available Full Text

Accepted Manuscript (DOE)

Publisher's Version of Record

https://doi.org/10.1109/TII.2014.2304633

Other availability

Search WorldCat to find libraries that may hold this journal

Citation Metrics:

Cited by: 41 works

Citation information provided by
Web of Science

Save / Share:

Export Metadata

Save to My Library

Works referencing / citing this record:

Security Attacks in Wireless Sensor Networks: A Survey
book, January 2018

Dewal, Prachi; Narula, Gagandeep Singh; Jain, Vishal
Advances in Intelligent Systems and Computing
DOI: 10.1007/978-981-10-8536-9_6

Research on information security system of waste terminal disposal process
journal, May 2017

Zhou, Chao; Wang, Ziying; Guo, Jing
IOP Conference Series: Earth and Environmental Science, Vol. 64
DOI: 10.1088/1755-1315/64/1/012074

Cyber Physical System (CPS)-Based Industry 4.0: A Survey
journal, September 2017

Lu, Yang
Journal of Industrial Integration and Management, Vol. 02, Issue 03
DOI: 10.1142/s2424862217500142

Similar Records in DOE PAGES and OSTI.GOV collections:

Virtual machine-based simulation platform for mobile ad-hoc network-based cyber infrastructure

Journal Article Yoginath, Srikanth B. ; Perumalla, Kayla S. ; Henz, Brian J. - Journal of Defense Modeling and Simulation

In modeling and simulating complex systems such as mobile ad-hoc networks (MANETs) in de-fense communications, it is a major challenge to reconcile multiple important considerations: the rapidity of unavoidable changes to the software (network layers and applications), the difficulty of modeling the critical, implementation-dependent behavioral effects, the need to sustain larger scale scenarios, and the desire for faster simulations. Here we present our approach in success-fully reconciling them using a virtual time-synchronized virtual machine(VM)-based parallel ex-ecution framework that accurately lifts both the devices as well as the network communications to a virtual time plane while retaining full fidelity. At themore »« less
https://doi.org/10.1177/1548512915591050

Full Text Available
PMU Data Integrity Evaluation through Analytics on a Virtual Test-Bed

Conference Olama, Mohammed M. ; Shankar, Mallikarjun

Power systems are rapidly becoming populated by phasor measurement units (PMUs) in ever increasing numbers. PMUs are critical components of today s energy management systems, designed to enable near real-time wide area monitoring and control of the electric power system. They are able to measure highly accurate bus voltage phasors as well as branch current phasors incident to the buses at which PMUs are equipped. Synchrophasor data is used for applications varying from state estimation, islanding control, identifying outages, voltage stability detection and correction, disturbance recording, and others. However, PMU-measured readings may suffer from errors due to meter biases ormore »« less
Ten million and one penguins, or, lessons learned from booting millions of virtual machines on HPC systems.

Conference Minnich, Ronald G ; Rudish, Donald W

In this paper we describe Megatux, a set of tools we are developing for rapid provisioning of millions of virtual machines and controlling and monitoring them, as well as what we've learned from booting one million Linux virtual machines on the Thunderbird (4660 nodes) and 550,000 Linux virtual machines on the Hyperion (1024 nodes) clusters. As might be expected, our tools use hierarchical structures. In contrast to existing HPC systems, our tools do not require perfect hardware; that all systems be booted at the same time; and static configuration files that define the role of each node. While we believemore »« less
Development and Demonstration of a Security Core Component

Technical Report Turke, Andy

In recent years, the convergence of a number of trends has resulted in Cyber Security becoming a much greater concern for electric utilities. A short list of these trends includes: · Industrial Control Systems (ICSs) have evolved from depending on proprietary hardware and operating software toward using standard off-the-shelf hardware and operating software. This has meant that these ICSs can no longer depend on “security through obscurity. · Similarly, these same systems have evolved toward using standard communications protocols, further reducing their ability to rely upon obscurity. · The rise of the Internet and the accompanying demand for more datamore »« less
https://doi.org/10.2172/1162156

Full Text Available
Scalable Fault Detection and Localization of Network Issues

Technical Report Zeng, Hui ; Cheng, Yi ; Chen, Peter ; ...

In this report, we describe the progress we have made towards developing the NetFault-SONAR: a modular, cloud-based, scalable and extensible advanced network and cyber analysis tool to address the above needs. Towards this goal, our Phase I effort has been mainly focused on the feasibility study and preliminary system implementation, and an initial evaluation to demonstrate the feasibility of a cloud-based network and cyber anomaly detection and analysis system. Our accomplishments in Phase I are summarized as follows; Investigated the network faults and symptoms and the relationship between faults and symptoms. We identified a preliminary list of faults and symptomsmore »« less

Similar Records

Title: Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

Abstract

Citation Formats

Security Attacks in Wireless Sensor Networks: A Survey book, January 2018

Research on information security system of waste terminal disposal process journal, May 2017

Cyber Physical System (CPS)-Based Industry 4.0: A Survey journal, September 2017

Security Attacks in Wireless Sensor Networks: A Survey
book, January 2018

Research on information security system of waste terminal disposal process
journal, May 2017

Cyber Physical System (CPS)-Based Industry 4.0: A Survey
journal, September 2017