Automatic Construction of Statechart-Based Anomaly Detection Models for Multi-Threaded Industrial Control Systems

摘要

Traffic of Industrial Control System (ICS) between the Human MachineInterface (HMI) and the Programmable Logic Controller (PLC) is known to behighly periodic. However, it is sometimes multiplexed, due to asynchronousscheduling. Modeling the network traffic patterns of multiplexed ICS streamsusing Deterministic Finite Automata (DFA) for anomaly detection typicallyproduces a very large DFA, and a high false-alarm rate. We introduce a newmodeling approach that addresses this gap. Our Statechart DFA modeling includesmultiple DFAs, one per cyclic pattern, together with a DFA-selector thatde-multiplexes the incoming traffic into sub-channels and sends them to theirrespective DFAs. We demonstrate how to automatically construct the Statechartfrom a captured traffic stream. Our unsupervised learning algorithm builds aDiscrete-Time Markov Chain (DTMC) from the stream. Next it splits the symbolsinto sets, one per multiplexed cycle, based on symbol frequencies and nodedegrees in the DTMC graph. Then it creates a sub-graph for each cycle, andextracts Euler cycles for each sub-graph. The final Statechart is comprised ofone DFA per Euler cycle. The algorithms allow for non-unique symbols, thatappear in more than one cycle, and also for symbols that appear more than oncein a cycle. We evaluated our solution on traces from a production ICS using theSiemens S7-0x72 protocol. We also stress-tested our algorithms on a collectionof synthetically-generated traces that simulated multiplexed ICS traces withvarying levels of symbol uniqueness and time overlap. The algorithms were ableto split the symbols into sets with 99.6% accuracy. The resulting Statechartmodeled the traces with a low median false-alarm rate of 0.483%. In all but themost extreme scenarios the Statechart model drastically reduced both thefalse-alarm rate and the learned model size in compare to a naive single-DFAmodel