LOGistICS is a novel monitoring framework for investigating the security of industrial PLC systems. Diverse processing components and probes with different tasks are included in the architecture. Reconstructing the process of cyber-attacks against industrial devices in its entirety, and also identifying the actors, is the topic of this study. Our solution is suitable for research and production environments, allowing for more interaction with an attacker while remaining undetectable as we will see from the behaviour of the actors. To achieve this aim, we exposed LOGistICS to the Internet with a module that we developed to examine suspicious activities, sequencing the operations carried out by the same attacker over time and therefore identifying its pattern. We found that the Cyber Kill Chain model is not always respected. We discuss these anomalies and provide our insights.
On Identifying Repeated Patterns of OT Attacks with LOGistICS
Bistarelli S.;Bosimini E.;Santini F.
2022
Abstract
LOGistICS is a novel monitoring framework for investigating the security of industrial PLC systems. Diverse processing components and probes with different tasks are included in the architecture. Reconstructing the process of cyber-attacks against industrial devices in its entirety, and also identifying the actors, is the topic of this study. Our solution is suitable for research and production environments, allowing for more interaction with an attacker while remaining undetectable as we will see from the behaviour of the actors. To achieve this aim, we exposed LOGistICS to the Internet with a module that we developed to examine suspicious activities, sequencing the operations carried out by the same attacker over time and therefore identifying its pattern. We found that the Cyber Kill Chain model is not always respected. We discuss these anomalies and provide our insights.I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
