Systems and methods for identifiying compromised devices within industrial control systems

Abstract

The disclosed computer-implemented method for identifying compromised devices within industrial control systems may include monitoring (302) network traffic within a network that facilitates communication for an industrial control system that includes an industrial device, creating (304), based at least in part on the network traffic, a message protocol profile for the industrial device that describes a network protocol used to communicate with the industrial device and normal communication patterns of the industrial device, detecting (306) at least one message that involves the industrial device and at least one other computing device included in the industrial control system, determining (308), by comparing the message with the message protocol profile, that the message represents an anomaly, and then determining (310), based at least in part on the message representing the anomaly, that the other computing device has likely been compromised. Various other methods, systems, and computer-readable media are also disclosed.

Description

Background technique [0001] Industrial control systems are often used to control the functions of equipment and / or machines that perform manufacturing and / or production operations in an industrial environment. For example, nuclear power plants may implement and / or rely on industrial control systems to regulate the production and / or distribution of electrical power. The industrial control system may include a collection of sensors, actuators, controllers, control valves, motors, robotics, and / or computing devices. In this example, a nuclear power plant may represent a prime target for terrorist attacks due to severe damage in the event of a system failure and / or malfunction. [0002] Unfortunately, due to the high security requirements of some industrial control systems, the network protocols with which these industrial control systems communicate are poorly documented and / or available to the public. As a result, traditional security techniques may not be able to meaningfully...

AI Technical Summary

Problems solved by technology

As a result, traditional security techniques may not be able to meaningfully monitor network traffic within industrial control systems and / or detect suspicious behavior that suggests a particular device may have been compromised

As such, traditional security techniques may be somewhat ineffective at identifying compromised devices within industrial control systems, which may leave such systems vulnerable to attack

Images