Cybersecurity of critical infrastructure

Topic Description:

Critical infrastructure consists of systems and elements whose failure would have a serious impact on the provision of basic services to the public, such as water, electricity or gas distribution. Examples of critical infrastructure assets include power plants, substations, water facilities, gas distribution, traffic control, etc. These systems use industrial ICS control protocols such as Modbus, IEC 104, MMS for communication.

The research includes the analysis of cyber threats in industrial communications according to MITRE ATT&CK for ICS and the design of an anomaly detection system. Based on the analysis of normal traffic, attributes representing ICS communication must be automatically selected to build an anomaly detection model, which can be built using formal languages, statistical methods, machine learning methods, or neural networks. These models describe the expected behavior of the system and are used to detect anomalies. When an anomaly is detected, the proposed system evaluates its severity, determines its cause and method of resolution using the knowledge base.

References:

• HAVLENA Vojtěch, MATOUŠEK Petr, RYŠAVÝ Ondřej and HOLÍK Lukáš. Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication. IEEE Transactions on Smart Grid, vol. 2023, no. 14, pp. 2352-2366. ISSN 1949-3053.
• BURGETOVÁ Ivana, MATOUŠEK Petr and RYŠAVÝ Ondřej. Anomaly Detection of ICS Communication Using Statistical Models. In: Proceedings of the 17th International Conference on Network Service Management (CNSM 2021). Izmir: Institute of Electrical and Electronics Engineers, 2021, pp. 166-172. ISBN 978-3-903176-36-2.
• MATOUŠEK Petr, HAVLENA Vojtěch and HOLÍK Lukáš. Efficient Modelling of ICS Communication For Anomaly Detection Using Probabilistic Automata. In: Proceedings of IFIP/IEEE International Symposium on Integrated Network Management. Bordeaux: International Federation for Information Processing, 2021, pp. 81-89. ISBN 978-3-903176-32-4.