國立虎尾科技大學 |

Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems.

Record Type:	Language materials, manuscript : Monograph/item
Title/Author:	Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems./
Author:	Rajput, Prashant Hari Narayan.
Description:	1 online resource (176 pages)
Notes:	Source: Dissertations Abstracts International, Volume: 84-11, Section: B.
Contained By:	Dissertations Abstracts International84-11B.
Subject:	Computer science. -
Online resource:	click for full text (PQDT)
ISBN:	9798379544614

Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems.
Rajput, Prashant Hari Narayan.

Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems. - 1 online resource (176 pages)

Source: Dissertations Abstracts International, Volume: 84-11, Section: B.

Thesis (Ph.D.)--New York University Tandon School of Engineering, 2023.

Includes bibliographical references

Traditionally, Industrial Control System (ICS) devices remained isolated from the Information Technology (IT) systems of the enterprise network, creating a boundary often referred to as the "air gap". Over the years, organizations have steadily integrated Industrial Internet of Things (IIoT) devices in the Operational Technology (OT) network to realize the technological benefits of Industry 4.0, such as automation to enable supply chain optimizations, predictive maintenance, and more. However, the poor cybersecurity posture of such IIoT devices makes the OT sector a prolific target for exploitation, resulting in increased cyberattacks on critical infrastructure in recent years. Therefore, ICS devices also require security controls similar to the ones available for the IT domain. Nevertheless, available approaches do not directly apply due to the unique ICS constraints, such as low computational power, legacy Operating System (OS), and maintaining hard real-time requirements.To address the shortcoming of traditional security controls in the ICS domain, this thesis commences by analyzing the impact of process-aware cyberattacks on critical infrastructure to systematically understand and expose weaknesses in these systems, allowing for building appropriate defenses. A process-aware cyberattack assumes that the adversary has prior knowledge about the physical processes of the plant, allowing them to maximize impact. The cyberattack is evaluated against a thermal desalination plant to study financial losses due to decreased distillate output and mechanical damages on the pipes due to a water hammer attack, revealing the attack vectors. Such attacks can infect various layers of an ICS device, including the kernel or the firmware of the device, user space that executes maintenance processes, and the control logic level that monitors and controls the physical process of critical infrastructure, requiring security controls at each of these layers.On the kernel level, this thesis proposes an injection prevention mechanism for kernel-level rootkits that hook to the syscall table by detecting modifications to critical static data structures using hardware watchpoints. On the other hand, it uses outlier detection with static file analysis features to detect user-level rootkits before preloading by establishing a chain of trust rooted in hardware. Preventing the injection of rootkits is critical because they are notoriously difficult to remove after injection, especially on the lower levels. Typically, malware detection in the user space employs static file analysis or behavioral analysis features. This thesis explores both approaches in the context of ICS. The static file analysis-based approach collects the suitable static features directly from the text section of the currently executing processes (avoiding the obfuscation issue) to detect the presence of malware using a Support Vector Machine (SVM) model. The behavioral analysisbased approach utilizes kernel (semantic) and microarchitectural event counts to detect abnormal system behavior, identifying the execution of malware using an SVM model. Using semantic and microarchitectural event counts provide a holistic system view, making it difficult for malware to mask its activities.Finally, control applications executing on Programmable Logic Controllers (PLCs) regulate the physical industrial processes in critical infrastructures, requiring similar security controls. Vulnerabilities in the control logic can impact the runtime software and even compromise the complete PLC. To this end, this thesis implements a framework capable of simulating the execution of a memory snapshot of a control application for automatically detecting vulnerabilities such as outof-bounds read/write, Operating System (OS) command injection, and improper input validation using predefined vulnerability rules. During the simulation, it also constructs a data dependence graph to track data flow, allowing for automated vulnerability localization and determining a suitable patch location. Finally, it can also automatically patch vulnerabilities by populating skeleton patches and using a trampoline function for redirection without hindering the execution of the control logic. Since ICS devices operate undisturbed for long periods, control critical physical processes, and provide low computational power, all the proposed security controls are non-intrusive and out-of-the-device using assistance from the hardware.

Electronic reproduction.
Ann Arbor, Mich. :
ProQuest,
2024

Mode of access: World Wide Web

ISBN: 9798379544614Subjects--Topical Terms:

573171
Computer science.
Subjects--Index Terms:

Embedded systems securityIndex Terms--Genre/Form:

554714
Electronic books.

Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems.
LDR:06070ntm a22004337 4500 001 1143783
005 20240517104951.5
006 m o d
007 cr mn ---uuuuu
008 250605s2023 xx obm 000 0 eng d
020 $a 9798379544614
035 $a (MiAaPQ)AAI30490808
035 $a AAI30490808
040 $a MiAaPQ $b eng $c MiAaPQ $d NTU
100 1 $a Rajput, Prashant Hari Narayan. $3 1468575
245 1 0 $a Hardware-Assisted Non-Intrusive Security Controls for Modern Industrial Control Systems.
264 0 $c 2023
300 $a 1 online resource (176 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 84-11, Section: B.
500 $a Advisor: Maniatakos, Michail.
502 $a Thesis (Ph.D.)--New York University Tandon School of Engineering, 2023.
504 $a Includes bibliographical references
520 $a Traditionally, Industrial Control System (ICS) devices remained isolated from the Information Technology (IT) systems of the enterprise network, creating a boundary often referred to as the "air gap". Over the years, organizations have steadily integrated Industrial Internet of Things (IIoT) devices in the Operational Technology (OT) network to realize the technological benefits of Industry 4.0, such as automation to enable supply chain optimizations, predictive maintenance, and more. However, the poor cybersecurity posture of such IIoT devices makes the OT sector a prolific target for exploitation, resulting in increased cyberattacks on critical infrastructure in recent years. Therefore, ICS devices also require security controls similar to the ones available for the IT domain. Nevertheless, available approaches do not directly apply due to the unique ICS constraints, such as low computational power, legacy Operating System (OS), and maintaining hard real-time requirements.To address the shortcoming of traditional security controls in the ICS domain, this thesis commences by analyzing the impact of process-aware cyberattacks on critical infrastructure to systematically understand and expose weaknesses in these systems, allowing for building appropriate defenses. A process-aware cyberattack assumes that the adversary has prior knowledge about the physical processes of the plant, allowing them to maximize impact. The cyberattack is evaluated against a thermal desalination plant to study financial losses due to decreased distillate output and mechanical damages on the pipes due to a water hammer attack, revealing the attack vectors. Such attacks can infect various layers of an ICS device, including the kernel or the firmware of the device, user space that executes maintenance processes, and the control logic level that monitors and controls the physical process of critical infrastructure, requiring security controls at each of these layers.On the kernel level, this thesis proposes an injection prevention mechanism for kernel-level rootkits that hook to the syscall table by detecting modifications to critical static data structures using hardware watchpoints. On the other hand, it uses outlier detection with static file analysis features to detect user-level rootkits before preloading by establishing a chain of trust rooted in hardware. Preventing the injection of rootkits is critical because they are notoriously difficult to remove after injection, especially on the lower levels. Typically, malware detection in the user space employs static file analysis or behavioral analysis features. This thesis explores both approaches in the context of ICS. The static file analysis-based approach collects the suitable static features directly from the text section of the currently executing processes (avoiding the obfuscation issue) to detect the presence of malware using a Support Vector Machine (SVM) model. The behavioral analysisbased approach utilizes kernel (semantic) and microarchitectural event counts to detect abnormal system behavior, identifying the execution of malware using an SVM model. Using semantic and microarchitectural event counts provide a holistic system view, making it difficult for malware to mask its activities.Finally, control applications executing on Programmable Logic Controllers (PLCs) regulate the physical industrial processes in critical infrastructures, requiring similar security controls. Vulnerabilities in the control logic can impact the runtime software and even compromise the complete PLC. To this end, this thesis implements a framework capable of simulating the execution of a memory snapshot of a control application for automatically detecting vulnerabilities such as outof-bounds read/write, Operating System (OS) command injection, and improper input validation using predefined vulnerability rules. During the simulation, it also constructs a data dependence graph to track data flow, allowing for automated vulnerability localization and determining a suitable patch location. Finally, it can also automatically patch vulnerabilities by populating skeleton patches and using a trampoline function for redirection without hindering the execution of the control logic. Since ICS devices operate undisturbed for long periods, control critical physical processes, and provide low computational power, all the proposed security controls are non-intrusive and out-of-the-device using assistance from the hardware.
533 $a Electronic reproduction. $b Ann Arbor, Mich. : $c ProQuest, $d 2024
538 $a Mode of access: World Wide Web
650 4 $a Computer science. $3 573171
650 4 $a Computer engineering. $3 569006
650 4 $a Information technology. $3 559429
653 $a Embedded systems security
653 $a Hot patching
653 $a Industrial control systems security
653 $a OT security
653 $a Process-aware cyberattacks
653 $a Programmable logic controllers
653 $a Industrial Internet of Things
653 $a ICS devices
655 7 $a Electronic books. $2 local $3 554714
690 $a 0984
690 $a 0489
690 $a 0464
710 2 $a ProQuest Information and Learning Co. $3 1178819
710 2 $a New York University Tandon School of Engineering. $b Computer Science & Engineering. $3 1464956
773 0 $t Dissertations Abstracts International $g 84-11B.
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=30490808 $z click for full text (PQDT)