A RIZONA S TATE U NIVERSITY CREDC Industrial Workshop 2017 Ants on the Grid: Biology–Inspired Monitoring for Incident and Vulnerability Detection Josephine Lamp , Carlos E. Rubio-Medrano, Ziming Zhao and Gail-Joon Ahn 6/27/2017 1
A RIZONA S TATE U NIVERSITY Motivation • Sophisticated attacks target entire Industrial Control Systems (ICSs): – Existing solutions focus on a small scale : separate pieces of the system, i.e., end devices – Difficult to detect large-scale attacks 2 6/27/2017
A RIZONA S TATE U NIVERSITY Our Proposal • A system-wide vulnerability and incident detection system that: – Places numerous small software/hardware sensors on the grid, aka ants 1 – Groups them together to link anomalies to vulnerabilities 1.) Fink, Glenn A., Jereme N. Haack, A. David McKinnon, and Errin W. Fulp. "Defense on the move: ant-based cyber defense." IEEE Security & Privacy 12, no. 2 (2014): 36-43. 3 6/27/2017
A RIZONA S TATE U NIVERSITY Ant Sensors and Architecture Control Center with control servers, data storage and workstations Main Control Server Internet Connection MTU Colony Ant Colony Health Level PLC IED 4 6/27/2017
A RIZONA S TATE U NIVERSITY Ant Sensors and Architecture Control Center with control servers, data storage and workstations Main Control Server Internet Connection Ant Control Servers MTU PLC IED Transformer 5 6/27/2017
A RIZONA S TATE U NIVERSITY Colony Health, Ant Fitness Control Center with control servers, data storage and workstations Colony Main Health Control Level Server 77% 65% 92% 100% 88% 85% MTU Ant PLC IED Control Servers 6 6/27/2017
A RIZONA S TATE U NIVERSITY Advantages of Using Ants • Ants may be unintelligent and lightweight, reusable and shareable • Correlate anomalous findings across disparate parts of the grid into a distributed, integrated, and customizable solution • Provide evidence of incidents and vulnerabilities • Aid for ICS operators and security officers 7 6/27/2017
A RIZONA S TATE U NIVERSITY Current Work • Placement and development of ants • Colony definitions and specializations • Coordination and correlation of ant finesses with colony health levels 8 6/27/2017
A RIZONA S TATE U NIVERSITY Questions and Contact Q A • Thank you for listening! • CDF Website: https://globalsecurity.asu.edu/cdf • Josephine Lamp: jalamp@asu.edu 9 6/27/2017
Recommend
More recommend
