Optimization of Process-Aware Attack Detection for Industrial Control Systems Security
Résumé
Industrial Control Systems (ICS) are present in many fields, sometimes critical infrastructures, and perform complex functions to carry out their missions. However, since the beginning of the century, they have been the target of increasingly specific attacks whose consequences can be catastrophic. Thus, new security approaches at the border between IT security and safety have emerged to detect malicious activities in ICS. S.A.F.E. (Security Approach based on Filter Execution) is one of them as it enables the order analysis issued by the Programmable Logic Controller (PLC) based on behavioral models. Indicators are used to trigger automation-oriented detection mechanisms. One of these indicators, the distance, measures the minimal number of orders from the PLC to apply from the current state before reaching a prohibited state. This computation is based on the Dijkstra algorithm which is time consuming and complex. This paper presents a comparative study of different algorithms for optimizing distance computation in a cybersecurity context.