Visible to the public Network Security Situation Awareness for Industrial Control System Under Integrity Attacks

TitleNetwork Security Situation Awareness for Industrial Control System Under Integrity Attacks
Publication TypeConference Paper
Year of Publication2018
AuthorsLu, G., Feng, D.
Conference Name2018 21st International Conference on Information Fusion (FUSION)
KeywordsCommunication networks, computer network security, control systems, hazard situation detection, industrial control, industrial control system, industrial control system network, industrial control systems, integrated circuits, integrity attacks, local estimator, malicious attacks, network security situation awareness, nonlinear systems, novel security situation awareness framework, particle filtering, particle filtering (numerical methods), Prediction algorithms, process control, pubcrawl, resilience, Resiliency, Scalability, scalable, Sensor systems, situation awareness, situation prediction algorithm, state estimation, system state estimation, telecommunication security
AbstractDue to the wide implementation of communication networks, industrial control systems are vulnerable to malicious attacks, which could cause potentially devastating results. Adversaries launch integrity attacks by injecting false data into systems to create fake events or cover up the plan of damaging the systems. In addition, the complexity and nonlinearity of control systems make it more difficult to detect attacks and defense it. Therefore, a novel security situation awareness framework based on particle filtering, which has good ability in estimating state for nonlinear systems, is proposed to provide an accuracy understanding of system situation. First, a system state estimation based on particle filtering is presented to estimate nodes state. Then, a voting scheme is introduced into hazard situation detection to identify the malicious nodes and a local estimator is constructed to estimate the actual system state by removing the identified malicious nodes. Finally, based on the estimated actual state, the actual measurements of the compromised nodes are predicted by using the situation prediction algorithm. At the end of this paper, a simulation of a continuous stirred tank is conducted to verify the efficiency of the proposed framework and algorithms.
Citation Keylu_network_2018