Research Article
POET: A Self-learning Framework for PROFINET Industrial Operations Behaviour
@INPROCEEDINGS{10.1007/978-3-031-33458-0_1, author={Ankush Meshram and Markus Karch and Christian Haas and J\'{y}rgen Beyerer}, title={POET: A Self-learning Framework for PROFINET Industrial Operations Behaviour}, proceedings={Tools for Design, Implementation and Verification of Emerging Information Technologies. 17th EAI International Conference, TridentCom 2022, Melbourne, Australia, November 23-25, 2022, Proceedings}, proceedings_a={TRIDENTCOM}, year={2023}, month={6}, keywords={Network Security Cyber-Physical System Intrusion Detection}, doi={10.1007/978-3-031-33458-0_1} }- Ankush Meshram
Markus Karch
Christian Haas
Jürgen Beyerer
Year: 2023
POET: A Self-learning Framework for PROFINET Industrial Operations Behaviour
TRIDENTCOM
Springer
DOI: 10.1007/978-3-031-33458-0_1
Abstract
Since 2010, multiple cyber incidents on industrial infrastructure, such asStuxnetandCrashOverride, have exposed the vulnerability of Industrial Control Systems (ICS) to cyber threats. The industrial systems are commissioned for longer duration amounting to decades, often resulting in non-compliance to technological advancements in industrial cybersecurity mechanisms. The unavailability of network infrastructure information makes designing the security policies or configuring the cybersecurity countermeasures such as Network Intrusion Detection Systems (NIDS) challenging. An empirical solution is to self-learn the network infrastructure information of an industrial system from its monitored network traffic to make the network transparent for downstream analyses tasks such as anomaly detection. In this work, aPython-based industrial communication paradigm-aware framework, namedPROFINETOperations Enumeration and Tracking (POET), that enumerates different industrial operations executed in a deterministic order of aPROFINET-based industrial system is reported. The operation-driving industrial network protocol frames are dissected for enumeration of the operations. For the requirements of capturing the transitions between industrial operations triggered by the communication events, the Finite State Machines (FSM) are modelled to enumerate thePROFINEToperations of the device, connection and system. POET extracts the network information from network traffic to instantiate appropriate FSM models (Device, Connection or System) and track the industrial operations. It successfully detects and reports the anomalies triggered by a network attack in a miniaturizedPROFINET-based industrial system, executed through valid network protocol exchanges and resulting in invalidPROFINEToperation transition for the device.
