In recent years, Advanced Persistent Threats (APTs) have become a major issue for critical infrastructures that are increasingly integrating modern IT technologies. This requires the development of advanced cyber-security services that can holistically detect and trace these attacks, beyond traditional solutions. In this sense, Opinion Dynamics has been proven as an effective solution, as they can locate the most affected areas within the industrial network. With this information, it is possible to put in place accurate response techniques to limit the impact of attacks on the infrastructure. In this paper, we analyze the applicability of Opinion Dynamics to trace an APT throughout its entire life cycle, by correlating different anomalies over time and accounting for the persistence of threats and the criticality of resources. Moreover, we run various experiments with this novel technique over a testbed that models a real control system, thereby assessing its effectiveness in an actual industrial scenario.
C.Alcaraz, G.Bernieri, F.Pascucci, J.Lopez and R.Setola, Covert channels-based stealth attacks in Industry 4.0, IEEE Systems Journal(in press).
2.
Beazley, 2018 Breach Briefing Whitepaper (2018), https://www.beazley.com/documents/Whitepapers/201802-beazley-breach-briefing.pdf, last retrieved in February 2019.
3.
L.Cazorla, C.Alcaraz and J.Lopez, Cyber stealth attacks in critical information infrastructures, IEEE Systems Journal12(2) (2018), 1778–1792. doi:10.1109/JSYST.2015.2487684.
4.
P.Chen, L.Desmet and C.Huygens, A study on advanced persistent threats, in: IFIP International Conference on Communications and Multimedia Security, Springer, 2014, pp. 63–72.
5.
A.Cherepanov, TeleBots are back – supply-chain attacks against Ukraine, 2017, https://www.welivesecurity.com, last retrieved in April 2018.
6.
A.Cherepanov, GreyEnergy White Paper: A successor to BlackEnergy, 2018, https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf, last retrieved in February 2019.
7.
N.Falliere, L.O.Murchu and E.Chien, W32.Stuxnet Dossier, version 1.4 (February 2011), 2011, https://www.symantec.com, last retrieved in April 2018.
8.
T.W.Haynes, S.M.Hedetniemi, S.T.Hedetniemi and M.A.Henning, Domination in graphs applied to electric power networks, SIAM Journal on Discrete Mathematics15(4) (2002), 519–529. doi:10.1137/S0895480100375831.
9.
R.Hegselmann, U.Krauseet al., Opinion dynamics and bounded confidence models, analysis, and simulation, Journal of Artificial Societies and Social Simulation5(3) (2002).
10.
E.M.Hutchins, M.J.Cloppert and R.M.Amin, Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains, Leading Issues in Information Warfare & Security Research1(1) (2011).
11.
International Society of Automation, ISA-95 standard, 2017, https://www.isa.org/isa95/, last retrieved in December 2017.
12.
J.Kneis, D.Mölle, S.Richter and P.Rossmanith, Parameterized power domination complexity, Information Processing Letters98(4) (2006), 145–149. doi:10.1016/j.ipl.2006.01.007.
13.
A.Lemay, J.Calvet, F.Menet and J.M.Fernandez, Survey of publicly available reports on advanced persistent threat actors, Computers & Security72 (2018), 26–59. doi:10.1016/j.cose.2017.08.005.
14.
A.Lemay, J.M.Fernandez and S.Knight, A modbus command and control channel, in: 2016 Annual IEEE Systems Conference (SysCon), IEEE, 2016, pp. 1–6.
15.
C.Leonardo and D.Johnson, MODBUS covert channel, in: Proceedings of the International Conference on Security and Management (SAM), The Steering Committee of The World Congress in Computer Science, Computer…, 2014, p. 1.
J.Lopez, J.E.Rubio and C.Alcaraz, A resilient architecture for the smart grid, IEEE Transactions on Industrial Informatics14 (2018), 3745–3753. doi:10.1109/TII.2018.2826226.
18.
MITRE Corporation, MITRE ATT&CK, 2018, https://attack.mitre.org, last retrieved in April 2018.
19.
OpenWeatherMap, Malaga weather, 2019, https://openweathermap.org/, last retrieved in February 2019.
20.
G.A.Pagani and M.Aiello, The power grid as a complex network: A survey, Physica A: Statistical Mechanics and Its Applications392(11) (2013), 2688–2700. doi:10.1016/j.physa.2013.01.023.
21.
J.E.Rubio, C.Alcaraz and J.Lopez, Preventing advanced persistent threats in complex control networks, in: European Symposium on Research in Computer Security, Vol. 10493, 2017, pp. 402–418.
22.
J.E.Rubio, C.Alcaraz, R.Roman and J.Lopez, Analysis of intrusion detection systems in industrial ecosystems, in: 14th International Conference on Security and Cryptography, 2017, pp. 116–128.
23.
S2Grupo, Emas SOM – monitoring system for industrial environments, 2018, https://s2grupo.es/es/emas-ics/, last retrieved in April 2018.
24.
SANS Industrial Control Systems, Analysis of the cyber attack on the Ukrainian power grid, 2016, https://ics.sans.org, last retrieved in April 2018.
25.
Symantec Security Response Attack Investigation Team, Dragonfly: Western energy sector targeted by sophisticated attack group, 2017, https://www.symantec.com, last retrieved in April 2018.
26.
D.J.Watts and S.H.Strogatz, Collective dynamics of ‘small-world’ networks, Nature393(6684) (1998), 440. doi:10.1038/30918.
