Analysing and Detecting Advanced Multi-stage Attacks against ICS (ADAMA)

Industrial Control Systems (ICS) are used in sectors such as energy, manufacturing, transport, etc., and consequently play a fundamental role in the operation of many critical national infrastructures. In the last few decades ICS have evolved to incorporate new capabilities and connectivity, provided by integrating modern information and communications technology (ICT). However, a significant problem that has emerged due to this new set of technologies and high degree of interconnectivity is that ICS have become exposed to the myriad security problems that beset traditional ICT systems.

Of great concern is the trend towards advanced multi-stage attacks against ICS, which continue to emerge. These can involve remote exploitation and lateral movements (pivots) across multiple systems. Recent attacks suggest that traditional crimeware type malware is being adapted explicitly for ICS; e.g. BlackEnergy and Havex exhibit malware modules that appear to have been developed to target ICS features and vulnerabilities. New threats against ICS supporting national infrastructures continue to emerge, and criminal and state entities are known to be targeting such systems. Consequently it is of great importance that we analyse and understand how advanced attacks against ICS behave and can be better detected.

Common initial attack vectors include highly targeted spear-phishing against executives or engineers with valuable credentials, or opportunistic watering hole attacks against websites of specific interest to ICS personnel. Following the initial infiltration of an ICS network, the malware will likely try to execute actions including escalating its privileges on the host system, attempting to connect to a command and control server, downloading further payload packages, enumerating the network, pivoting and propagate further, exfiltrating data, and so on. A highly targeted, or "weaponised", payload is likely to enumerate ICS devices on the network or attempt to sniff and identify particular ICS related network traffic.

Detecting advanced multi-stage attacks is difficult in IT systems, but approaches towards detection and response for ICS are comparatively less mature. Moreover, attacks discovered in the wild continue to evolve in sophistication. Stopping such attacks demands continual monitoring of the infrastructure and it is difficult to provide operators with targeted security status information in the face of advanced multi-stage ICS threats.

This research aims to develop and test an approach that enhances real-time cyber-security monitoring capabilities for networked ICS environments. The objective is to present information to an operator that is more closely correlated to advanced multi-stage threats, rather than individual alerts, thereby improving the ability of the operator to gauge the current security status of the system.

A threat measurement based approach will be used to investigate how the real-time cyber-security status of an ICS network environment can be measured in terms of an observable threat presence. It is hypothesised that such a status can be appraised by using suitable metrics, which may be derived by analysing, decomposing and modelling known advanced multistage threats. The analysis will target the development of threat models based on a combination of reported ICS attacks and an investigation of future potential advanced threats based on emerging trends in crimeware. A proposed solution will be implemented and tested in a test-bed environment based on a realistic factory automation environment.

This research will have an impact on the industrial partners who have supported this project. The anticipated outcomes to improve attack detection will be tested in a factory automation environment where the design is specified with input and advice from Airbus. The intention is to make the impact of this research as directly transferable as possible to the real factory environments managed by the Airbus Cyber Security Team. The intended impact is to support the Airbus team in enhancing and understanding advanced ICS attack detection approaches, enabling the research to be directly applied to production environments.

Intended academic beneficiaries particularly include projects and colleagues at the RITICS institute, which also comprises industry and government board members. The results in analysing and modeming attacks, and developing metrics from a detection perspective is intended to impact and inform the research in risk within RITICS, by contributing additional knowledge to those projects. The threat modelling and metrics identified will also enhance the impact the research undertaken in the QUB project CAPRICA, which is part of RITICS, by allowing additional practical analyses to be carried out in the context of the CAPRICA synchrophasor test environment, .

Academic and industry partners in FP7 SPARKS, which focuses on smart grid security, will benefit from the threat analysis carried out by ADAMA and will also provide input in terms of data and knowledge about real ICS environments. The intended results from will complement and the outcomes of SPARKS, and the ability to disseminate the findings of ADAMA via the established dissemination channels of SPARKS, for example through regular workshops. The effect will be to leverage greater dissemination and to provide impact across Europe-wide ICS stakeholders, in terms of shared expertise in state-of-the art attacks and threat models, in particular for electrical distribution operators.

The research outcomes are also expected to contribute towards commercialisation and industrial engagement opportunities undertaken at the Centre for Secure Information Technologies (CSIT). CSIT has a strong history of commercial licensing, knowledge transfer partnerships and spin out ventures initiated from research activities.

Another important expected impact is to enhance the training, knowledge and career opportunities for the Research Assistant to be appointed in the project. Due to the nature and size of the project, it is expected that the RA may be a recent PhD graduate, thus the expected impact will be to provide an excellent career starting opportunity in this important field of research.