Systems and methods for identifying compromised devices within an industrial control system

Abstract

Disclosed is a computer-implemented method for identifying compromised equipment within an industrial control system that may include monitoring (302) network traffic within a network that facilitates industrial controlling communication of a system; creating a message protocol configuration file for said industrial device based at least in part on said network traffic (304), said message protocol configuration file describing a network protocol for communicating with said industrial device and said normal communication mode of the industrial device; detecting (306) at least one message involving the industrial device and at least one other computing device included in the industrial control system; by matching the message with the message protocol configuration file comparing to determine ( 308 ) that the message indicates an anomaly; and then determining ( 310 ) that the other computing device may have been compromised based at least in part on the message indicating the anomaly. Various other methods, systems, and computer-readable media are also disclosed herein.

Description

technical field [0001] The present disclosure relates to systems and methods for identifying compromised devices within an industrial control system. Background technique [0002] Industrial control systems are often used to control the functions of equipment and / or machines that perform manufacturing and / or production operations in an industrial environment. For example, nuclear power plants may implement and / or rely on industrial control systems to regulate the production and / or distribution of electrical power. The industrial control system may include a collection of sensors, actuators, controllers, control valves, motors, robotics, and / or computing devices. In this example, a nuclear power plant may represent a prime target for terrorist attacks due to severe damage in the event of a system failure and / or malfunction. [0003] Unfortunately, due to the high security requirements of some industrial control systems, the network protocols with which these industrial cont...

AI Technical Summary

Problems solved by technology

As a result, traditional security techniques may not be able to meaningfully monitor network traffic within industrial control systems and / or detect suspicious behavior that suggests a particular device may have been compromised

As such, traditional security techniques may be somewhat ineffective at identifying compromised devices within industrial control systems, which may leave such systems vulnerable to attack

Images