Cyber attack and defense on industry control systems

Abstract

Industry control systems (ICSs) are widely used in various critical infrastructure production facilities of the oil, water, and electricity industries. In the past, most of these ICSs lacked both authentication and encryption mechanisms, leaving them vulnerable to attack by hackers. By establishing an industry control system test bed, this paper examines two operational cases, viz. water level control and air pollution control, and develops for them a Modbus/TCP network attack program, and an associated intrusion detection system (IDS). Through in-depth analysis of the Modbus ICS protocol, an automatic-learning based method of malicious intrusion detection is proposed, with which a variety of tests are conducted on the developed testbed. The results show that this method can effectively detect various kinds of network attacks.