ICS Policy Engine for Stateful Cyber Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial Control Systems (ICS) lack effective cyber security measures, particularly in detecting and preventing malicious network traffic and data injection attacks, as they rely on implicit trust and have limited protection against cyber threats, which can disrupt critical operations.
Innovation Solution
A dynamic policy engine is introduced that works in conjunction with a firewall to perform deep packet inspection and enforce stateful policy enforcement, using XML models to define and enforce security rules, detect unauthorized operations, and react to state transitions, thereby providing adaptive protection against cyber threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep packet inspection and stateful policy enforcement are implemented, then cyber security detection capability is improved, but device complexity increases
Solution Approach 1:
A policy engine is introduced as an intermediary component between the network traffic and the control system. The policy engine receives network packets, performs deep packet inspection, evaluates them against stored security policies, and determines whether to allow or block traffic. This intermediary architecture improves security detection capability while managing system complexity by centralizing the inspection logic in a dedicated component rather than distributing it throughout the entire control system.
Solution Approach 2:
The security system is segmented into distinct functional modules: a policy storage module that holds security rules, a policy engine that performs inspection and evaluation, and a decision module that allows or blocks traffic. This segmentation allows each component to be optimized independently and simplifies the overall system architecture by dividing the complex security function into manageable, specialized units.
2Adaptability or versatility
If real-time policy updates are implemented, then adaptability to new threats is improved, but processing time increases
Solution Approach 1:
Security policies are pre-loaded into the policy engine before runtime operations begin. When new security rules or threat signatures need to be applied, the system performs preliminary actions by updating the policy storage and triggering a policy reload operation. This allows the system to adapt to new threats while maintaining efficient real-time processing, as the updated policies are prepared in advance and then quickly activated without disrupting ongoing traffic inspection.
Solution Approach 2:
The policy engine implements dynamic policy management that allows security rules to be updated during system operation. The policy storage is designed to accept new policies at runtime, and the policy engine can reload and apply updated rules without requiring system restart. This dynamic capability enables the system to adapt to emerging threats in real-time while maintaining continuous traffic inspection with minimal processing delays.
3Measurement precision
If state tracking is implemented, then detection precision is improved, but memory usage increases
Solution Approach 1:
The policy engine implements state tracking with selective detail, maintaining comprehensive state information only for protocol fields that are critical to security detection. Rather than tracking all possible packet attributes, the system focuses on storing and evaluating only the specific state variables relevant to the security policies being enforced. This local quality approach improves detection precision for critical security parameters while limiting memory usage by avoiding unnecessary state tracking of non-essential fields.
Data Source
AI summary
An industrial control system (ICS) communicates via ICS protocols. A model is deployed in an information technology (IT) and operation technology (OT) network. Security policies are dynamically updated as the particular IT and OT network are used, patched, and modified. A deep packet inspection is used to enforce ICS constraints and ICS behaviors defined by the initial model. A state of the deep packet inspection is reported for situational awareness and debugging purposes. An alert is transmitted when anomalies are detected when ICS protocol traffic traverses ICS firewall network paths that execute ICS policies.