Artificial intelligence, cyber-threats and Industry 4.0: challenges and opportunities

Abstract

This survey paper discusses opportunities and threats of using artificial intelligence (AI) technology in the manufacturing sector with consideration for offensive and defensive uses of such technology. It starts with an introduction of Industry 4.0 concept and an understanding of AI use in this context. Then provides elements of security principles and detection techniques applied to operational technology (OT) which forms the main attack surface of manufacturing systems. As some intrusion detection systems (IDS) already involve some AI-based techniques, we focus on existing machine-learning and data-mining based techniques in use for intrusion detection. This article presents the major strengths and weaknesses of the main techniques in use. We also discuss an assessment of their relevance for application to OT, from the manufacturer point of view. Another part of the paper introduces the essential drivers and principles of Industry 4.0, providing insights on the advent of AI in manufacturing systems as well as an understanding of the new set of challenges it implies. AI-based techniques for production monitoring, optimisation and control are proposed with insights on several application cases. The related technical, operational and security challenges are discussed and an understanding of the impact of such transition on current security practices is then provided in more details. The final part of the report further develops a vision of security challenges for Industry 4.0. It addresses aspects of orchestration of distributed detection techniques, introduces an approach to adversarial/robust AI development and concludes with human–machine behaviour monitoring requirements.

Appendices

Appendix A: Nature, types and sources of data for ML-based IDS

1.1 Appendix A.1: Data types for ML/DM applied to IDS

As we highlighted the importance of data quality and quantity to DM/ML techniques, it is important to highlight the diverse nature of data which can be used for intrusion detection. A first distinction is between Packet level data and Netflow data. Packet level data: the packets transmitted through network infrastructures can be captured by a specific Application Programming Interface (API) called pcap. IDS and other network security equipment use Libpcap and WinPCap as packet capture libraries of Unix and Windows respectively. The Ethernet frame contains an Ethernet header such as media access control [MAC] address, and up to 1500 bytes [maximum transmission unit (MTU)] of payload which contains the IP packet made of IP header and IP payload where the data content lies. The features captured from pcap interface vary depending on the protocols carried in the packet. IP addresses are captured in the IP header.

NetFlow Data: NetFlow was originally a router feature by Cisco, enabling to collect IP Network traffic as it enters or leaves the network equipment. In its version 5, NetFlow is defined as a unidirectional sequence of packets that share the exact same seven packet attributes: ingress interface, source IP address, destination IP address, IP protocol, source port, destination port, and IP type of service. NetFlow data include a compressed and preprocessed version of the actual network packets.

Kernel level data: the kernel is the core of a computer’s operating system. It handles requests from applications, sends instructions to central processing unit, allocates computing resource, and man-ages memory and peripherals. Kernel level data can be analyzed to provide evidence of attacks on the endpoint. The analysis would be specific to the type of operating system monitored. Kernel behavior analysis can be performed based on expert rules, statistical approaches or DM/ML techniques. It could rely on endpoint detection and response (EDR) agents or Host IDS (HIDS). An interesting field of investigation is the correlation is the correlation of alerts raised by network level and kernel level IDS.

1.2 Appendix A.2: Public data sets for IDS training and testing

ML/DM methods require vast amounts of data, in most cases labeled, in any case representative from real network traffic and free of use. Data collection is a painful step. Network data are usually subject to confidentiality and privacy issues. This is particularly the case of OT networks which usual-ly bear company or utility confidential data. A comparison of performance in intrusion detection between two projects is only valid if they use the same data set. For those reasons, public data sets have been collected and shared across the research community.

• DARPA 1998 (Lippmann et al. 2000): this data set was created by the Lincoln Laboratory from Massachusetts Institute of Technology in 1998 to support an offline evaluation of IDS on network traffic and audit logs collect-ed on a simulation network.

• DARPA 1999 (Lippmann et al. 2000): also created by the Lincoln Laboratory, this data set contained three weeks of training data among which only the second week contained a selected subset of attacks from the 1998 evaluation in addition to several new attacks. In 1999, intrusion detection systems were tested as part of an off-line evaluation, a real time evaluation or both.

• KDD 1999 (Stolfo 1999): the NSL-KDD corrects a number of discrepancies found in KDD 1999. It has been used for The Third International Knowledge Discovery and Data Mining Tools Competition, which was held in conjunction with KDD-99.

• CICIDS2017 (Sharafaldin et al. 2018): probably the most up to date public data set for NIDS training and testing. It contains benign and the most up-to-date common attacks. It also includes the results of the network traffic analysis using a network traffic flow generator with labeled flows based on the time stamp, source and destination IPs, source and destination ports, protocols and attack. The implemented attacks include Brute Force FTP, Brute Force SSH, DoS, Heartbleed , Web Attack, Infiltration, Botnet and DDoS within 5 days of traffic.

• ADFA data sets (2013–2014): the ADFA data sets provide kernel level data for HIDS training and testing. The ADFA Linux Dataset (ADFA-LD) (Creech and Hu 2014, 2013) provides a contemporary Linux dataset while ADFA Windows Dataset (ADFA-WD) (Creech 2014) provides representative windows kernel data. A Stealth Attacks Ad-dendum (ADFA-WD:SAA) (Creech 2014) contains stealth attack traces for evaluation in conjunction with the AD-FA-WD (Creech 2014).

• MODBUS data sets (2014) (Morris and Gao 2014): 4 data sets were developed by Thomas Morris and Wei Gao in a project entitled “Industrial Control System Traffic Data Sets for Intrusion Detection Research”. They include network traffic, process control and process measurement features from two laboratory-scale SCADA systems. They were generated from network flow records captured with a serial port data logger in a laboratory environment. They contain transactions from a gas pipeline system and a water storage tank system. A set of 28 attacks were grouped into four categories: reconnaissance, response injection, command injection and denial-of-service attacks. Although MODBUS is a particular SCADA protocol, the authors claim their data sets are relevant to a wide variety of SCADA systems and would apply to other than pipeline or water storage ICS.

The DARPA, KDD and CICIDS2017 data sets contain network level and kernel level data representative of IT networks and appropriate for training and testing of generic NIDS. They may contain useful data for OT IDS but would not to address the very specificities of such environments. They are how-ever useful to assess IDS performance as they are widely used and thus form a potential reference for comparison of performances. The ADFA data set is dedicated to HIDS training and testing. It is useful to work on detection of industrial endpoint

• The CIDDS-001 (Coburg Intrusion Detection Data Set), disclosed by Markus Ring et al. in [8], contains about four weeks of network traffic from two different environments, an emulated small business environment (OpenStack) and an External Server that captured real and up-to-date traffic from the internet. The OpenStack environment includes several clients and typical servers like an E-Mail server or a Web server. The dataset contains labeled flow-based data that can be used to evaluate anomaly-based network intrusion detection systems considering normal activity as well as DoS, Brute Force, Ping Scans and Port Scan attacks. The collection of data provided by the CIDDS-001 dataset is represented in an Netflow format. Netflow is a feature of CISCO routers that allows the collection of IP network traffic as it enters or exits an interface.

Appendix B: Open source OT IDS solutions

There are three major open source NIDS currently available for ICS/SCADA: Snort Suricata and Bro.

• Snort is the oldest and most famous NIDS. It is a signature-based NIDS owned by SourceFire. It is widely used by any type of organizations (large companies, SMEs, research labs, governmental organ-izations). In addition, this solution is supported by a huge community of users and developers. When the interest to ICS/SCADA appeared, Snort was an obvious choice for attempting to adapt an IT-related IDS to ICS/SCADA needs. It remains the most studied NIDS, including in the ICS/SCADA domain and Snort comes with a large set of SCADA-oriented rules.

  The work performed by Digital Bond since 2009 on SCADA IDS is probably the most cited. It deals with ready-to-use rules for Snort and Suricata. Thus, if one wants to create his/her own solution, it is quite simple to build a system able to detect malicious packets.

• Suricata Developed by the OISF (Open Information Security Foundation), Suricata is a signature-based IDS, competitor of Snort. The main advantage of Suricata is the easy integration of Snort rules. Suricata is multi-threaded, Snort is not. It is not necessarily an advantage. Suricata is more scalable but may require more resources even if a study states that Suricata does its job, at least, as good as Snort. However, the level of maturity is lower and the Suricata community is less important than the Snort ones. Suricata is trickier to use than Snort as well. It is worth mentioning that the French national cyber security agency (ANSSI) officially supports Suricata as an IDS adapted to critical infra-structures. The Suricata project is quite dynamic: a version is released every 2 or 3 months.

• Bro Presented in 1999 by V. Parxson, Bro is not restricted to any particular detection approach and does not rely on traditional signatures. Then Bro’s detection principle is completely different from Snort. As a consequence, it may be more efficient than Snort on some types of intrusion. Addition-ally, it embeds a capacity of network flow analysis (including performance measurements). Howev-er, Bro is less used than Snort, probably because it does not have any graphical user interface and has to be fully configured in command line mode. Furthermore, it only runs on Linux, FreeBSD and Mac OS X operating systems. Despite these limitations, it remains widely used by academics.

1.1 Appendix B.1: Synthesis on Open source IDS solutions

Snort benefits from a large support by the community. It is integrated with many other systems (e.g., rule providers, SIEM) and add-ons make it adaptable to many usages (IT and OT). Suricata—the Snort challenger—is scalable but requires extensive computing resources. Bro is an IDS mostly used by academics and would require a lot of effort to make it usable in an operational environment.

Appendix C: Vendor OT IDS solutions

Many commercial solutions use one or several frameworks coming from the above mentioned open source tools. Still the effectiveness of IDS solutions highly relies on the capacity of a company to write relevant rules, and to analyze customer architecture and needs. The analysis of vendor solu-tions below results from an assessment carried out by Airbus Defence and Space Cybersecurity based on an analysis of product documentation and vendor questionnaires.

1.1 Appendix C.1: Signature-based IDS

Most signature-based IDS are originally designed for IT security. The following three products have been short listed for their applicability to ICS/SCADA environments. Many other IDS exist on the market which however do not equally match the specific requirements of OT environments.

• Cisco IPS, Firepower, is a signature-based and agent-less solution that embeds SCADA-related rulesets. The IPS uses deep packet inspection (DPI) to detect attacks. The detection process starts by normalizing received packets and goes on parallel inspection at various levels (e.g., IP headers, TCP payloads). Signatures are built from vulnerability bulletins, provided an exploit is known. More than 35,000 vulnerability-focused rules are available. As an IPS, Firepower manages a prevention policy and especially one dedicated to industrial protocols (e.g., Modbus, ICCP).

• Fortinet propose an IPS solution embedded in their firewall offer, FortiGate. There is a specific range adapted to industrial environments, meaning appliances are designed to resist to tempera-ture constraints (very low, very high, variations), vibrations, etc. Additionally Fortinet propose a range of security solutions such as switches, web analyzers and central managers for industry-focused cyber security. FortiGate IPS is a signature-based IPS. It supports BACnet, DLMS/COSEM, DNP3, EtherCAT, ICCP, IEC-60870.5.104, Modbus/TCP, OPC, PROFINET. A combination of Fortinet and Nozomi solutions extends this list and provides anomaly detection capacity.

• Leidos Industrial Defender ASM is a US solution, owned by Leidos. It is a cyber security solution that in-cludes asset discovery and management, compliance monitoring, reporting and security event mon-itoring. The solution relies on a three-tier architecture with a manager (ASM), local appliances (ASA) and a signature-based NIDS. In terms of protocols, the NIDS supports Modbus, TCP, DNP3, Profibus, ODVA Ethernet/IP, and ICCP, and generate alarms that are sent to the ASM for logging and diagnosis. The amount of available rules makes it very likely that the NIDS is an overlay of an existing NIDS (such as Snort). However, Leidos mentions that they create specific rules from the ICS typical at-tacks. Even if the solution is very promising with its exhaustive approach, it is very linked with the US government which may be a reason to be rejected for monitoring of critical infrastructures in Europe.

1.2 Appendix C.2: Anomaly-based IDS

Because state of the art ICS are so predictable in their behavior and employ specific and simple protocols, most existing OT IDS rely on anomaly detection. The following are examples selected among the most well-known anomaly-based industrial security products.

• Claroty is an Israeli company founded in 2016, with a headquarter based in the US and a research and development staff based on Israel. The Claroty company proposes a set of components fully dedi-cated to cyber security of industrial networks. Among their OT security platform, the Enterprise Management component collects events from the monitoring virtual appliance to build dashboards and send alert data to external systems such as SIEMs, log managers and ticket request systems. The network anomaly-based detection (deterministic and behavioural models) is performed in a passive mode with DPI, using a span port (no agents) or connecting to sensors on serial networks. Both seri-al and Ethernet networks can be monitored. Raised events are linked to assets (e.g., PLCs, HMIs) modelled in the Claroty’s knowledge base. Along with the network intrusion detection, Claroty provides a change monitoring from commands observed from the network. A large range of IT and OT protocols are supported. Focusing on industrial protocols: Modbus, Siemens S7/S7-Plus, Siemens P2, EtherNet/IP + CIP, PCCC/CPSv4, GE SRTP, VNet/IP, Emerson Ovation DCS protocols, Emerson Del-taV DCS protocols, Melsec/Melsoft, FTE, ABB 800xA DCS protocols, MMS (including ABB extension), Sattbus, OPC DA/AE/UA, IEC104, DNP3, Profinet-DCP, and Bacnet.

• Indegy Founded in 2014, Indegy is an Israeli company. Indegy provides an ICS Cyber Security Platform that detects changes to controller logic, configuration, firmware and state. The anomaly-based Indegy IDS includes a DPI (Deep Packet Inspection) engine that focuses on control-layer events. All supported protocols are not publicly available: Modbus and DNP3 are mentioned only. Even if not detailed, the approach is based on the technical asset discovery (devices, configuration and state) and addresses multi-site contexts. Sensors are deployed on sites, and the analysis is made on a sin-gle point by a centralized analyzer.

• SecurityMatters is a Dutch company founded in 2009 that develops the SilentDefense solution, a hybrid IDS. This solution provides automatic asset and network flows discovery. This information is used by the anomaly-based engine. The SilentDefense DPI engine comes with more than 800 rules. It detects cyber attacks and network misconfiguration. The solution supports many ICS and IT proto-cols. Focusing on industrial protocols (excluding proprietary protocols): BACnet, DNP3, EtherNet/IP + CIP, Foundation Fieldbus HSE, IEC 60870-5-101/104, ICCP TASE.2, IEC 61850 (MMS, GOOSE, SV), IEEE C37.118 (Synchrophasor), Modbus/TCP, OPC-DA, OPC-AE, PROFINET (RPC, RTC, RTA, DCP and PTCP). The SilentDefense architecture is based on sensors connected to the SPAN/mirroring port of network switches, and a Command Center that performs a central analysis, provides visualizations and connects to external systems such as a SIEM.

• Sentryo is a French company founded in 2014. ICS CyberVision is the solution developed by Sentryo. It includes asset inventory and network analysis through a DPI engine. Sentryo CyberVision supports a wide range of industrial protocols and the main IT protocols. Focusing on industrial pro-tocols: Modbus, OPC-DA/UA, IEC 61850, EtherNet/IP + CIP, PROFINET and Siemens S7. Sentryo per-formed a PoC on a railway infrastructure use case with a railway-related manufacturer, specifically on signalling and control-command. They added support on specific protocols from this manufactur-er and implemented some threat scenarios (no details provided on these scenarios).

1.3 Appendix C.3: Hybrid IDS

The following IDS products typically mix signature-based and anomaly-based approach in an attempt to gather the advantages of both detection techniques.

Cyberbit Founded in 2015, Cyberbit is an Israeli company, editor of the SCADAShield and EDR solutions. The offering is very close to the one from Claroty: intrusion detection, change monitoring, asset discovery and SIEM interface. Detection capabilities include deep packet inspection (DPI) which results are used in the investigation phase. The EDR detection engine is not very well detailed. Cyberbit mentions an automated blacklisting and white-listing capability to detect abnormal situations.

Cypres This French solution comes from a research project funded by the EU, led by FPC Ingénierie and with Netceler, two SMEs specialized in industrial automation, software development and cyber security. This non-intrusive solution is dedicated to ICS/SCADA networks. Intrusions are detected by rule-based IDS probes. Cypres probes can also detect non legitimate machines and protocols. Rules are contextualized, meaning they take the system state and ongoing operations into consideration. Contexts are acquired through a learning process. Another type of rules is based on a heuristic engine that checks anomalies of processes, depending on the replicability of the process controls. The project is still ongoing. Since this solution has been deployed in the frame of proof of concept (PoC) only, it probably lacks of maturity. However, no PoC has been performed on the rail-way domain so far.

Nozomi Nozomi is a Swiss company founded in 2013, with headquarters in the USA. Nozomi is the editor of the SCADAGuardian solution. This solution includes a network IDS, a process anomaly detection system and a cyber risk evaluation system. The IDS relies on a signature-based DPI engine. The solution is design to address multi-site security monitoring and includes a Central Management Console (CMC) to aggregate from multiple sites and centralize the cyber security awareness. The solution supports many ICS and IT protocols. Focusing on industrial protocols: Aspentech Cim/IO, BAC-Net, Beckhoff ADS, BSAP IP, CEI 79-5/2-3, COT P, DNP3, Enron Modbus, EtherCAT, EtherNet/IP - CIP, Foundation Fieldbus, Generic MMS, GOOSE, Honeywell, IEC 60870-5-7 (IEC 62351-3 + IEC 62351-5), IEC 60870-5-104, IEC-61850 (MMS, GOOSE, SV), IEC DLMS/COSEM, ICCP, Modbus/TCP, MQTT, OPC, PI-Connect, Profinet/DCP, Profinet/I-O CM, Profinet/ RT, Sercos III, Siemens S7, Vnet/IP. Nozomi provides a SDK that enables a customer to extend support for new protocols. SCADAShield comes in more than 10 appliance versions (physical or virtual). It is worth mentioning that the technical documentation publicly available on SCADAShield is very detailed and clear, which is usually not the case for its competitors.

Radiflow Radiflow is an Israeli company founded in 2009. The solution developed by Radiflow for SCADA networks is iSID. The iSID solution embeds an anomaly-based detection engine. The change monitoring process relies on the knowledge of the existing assets along with used protocols and sessions. To get this knowledge, an asset topology discovery capacity has been implemented. The learning process makes the iSID solution able to detect any change in the network topology such as new sessions. A DPI system relying on a set of rules analyses the network traffic to detect any policy violations. The list of supported protocols is not publicly available. Some papers and datasheets mention: Modbus, DNP3, IEC-104 and 61850. The iSID solution also manages vulnerabilities by both active and passive scans. Then their signature-based Cyber Attack module uses this information to detect any vulnerability exploitation by an attacker. Incident response is managed through an inter-face with the Radiflow security gateway: iSID is able to push policy modifications into the Radiflow security gateway.

1.4 Appendix C.4: Synthesis

The table below summarizes the characteristics of IDS solutions described in the previous sections. No solutions have been evaluated in a testbed. That is why there is no information about their performance and reliability. The performance metrics provided by the vendors are not considered relevant for an objective comparison. Detection rates and false positive rates highly depend on the data sets used for evaluation and the training method (in the case of ML-based detection) or the human experts involved in rule edition (in the case of misuse detection). To date there is not any agreed international standard for assessment of detection performance. Existing certification frameworks for IDS focus on assessing the protective functions. While such as technical assessment would surely be of interest, it would require significant resources and the cooperation of product vendors.