Visible to the public Network-Based Machine Learning Detection of Covert Channel Attacks on Cyber-Physical Systems

TitleNetwork-Based Machine Learning Detection of Covert Channel Attacks on Cyber-Physical Systems
Publication TypeConference Paper
Year of Publication2022
AuthorsLi, Hongwei, Chasaki, Danai
Conference Name2022 IEEE 20th International Conference on Industrial Informatics (INDIN)
Date Publishedjul
Keywordsattack detection, command injection attacks, composability, Cyber-physical systems, datasets, Detectors, electrical grid, Entropy, feature extraction, industrial control systems, machine learning, Metrics, Pipelines, pubcrawl, resilience, Resiliency, Throughput, Voltage measurement
AbstractMost of the recent high-profile attacks targeting cyber-physical systems (CPS) started with lengthy reconnaissance periods that enabled attackers to gain in-depth understanding of the victim's environment. To simulate these stealthy attacks, several covert channel tools have been published and proven effective in their ability to blend into existing CPS communication streams and have the capability for data exfiltration and command injection.In this paper, we report a novel machine learning feature engineering and data processing pipeline for the detection of covert channel attacks on CPS systems with real-time detection throughput. The system also operates at the network layer without requiring physical system domain-specific state modeling, such as voltage levels in a power generation system. We not only demonstrate the effectiveness of using TCP payload entropy as engineered features and the technique of grouping information into network flows, but also pitch the proposed detector against scenarios employing advanced evasion tactics, and still achieve above 99% detection performance.
DOI10.1109/INDIN51773.2022.9976152
Citation Keyli_network-based_2022