Unveiling Physical Semantics of PLC Variables Using Control Invariants

The security risk of semantic attacks to Industrial Control Systems (ICSs) is increasing. Semantic attacks manipulate targeted system modules by identifying the physical semantics of variables in Programmable Logic Controllers (PLCs) programs, i.e., the sensing/actuating modules represented by the variables, which is usually and inefficiently achieved via manual examination of system documents and long-term observation of system behavior. In this paper, we design
ARES
, a method that
A
utomatically
R
everse
E
ngineers the
S
emantics of variables in PLC programs without requiring any domain knowledge.
ARES
is built on the fact that the Supervisory Control And Data Acquisition (SCADA) system monitors the behavior of PLC using a fixed mapping between the variables of program code and data log, and the data log variables are marked with physical semantics. By identifying the mapping between PLC code and SCADA data (i.e., the code-data mapping),
ARES
reverse engineers the physical semantics of program variables.
ARES
also sheds light on the preferred defense strategies in implementing control rules that improve the resistance of PLC programs to semantic attacks, as well as in detecting and responding to semantics attacks in real time. We have experimentally evaluated
ARES
and the recommended defending practices on two ICS platforms.