Target Discovery Differentials for 0-Knowledge Detection of ICS Malware

In this paper we present an unconventional anti ICS-malware approach. We leverage a factor that appears to be overlooked as of this writing, namely that ICS malware often infect machines which do not run any functions related to industrial process control. These may be, for example, business machines in the enterprise networks of power utility companies, or even random machines on the Internet. Because ICS environments use special-purpose communication protocols, it is highly unlikely that any application code on those machines will send or receive network traffic through an ICS communication protocol. On the other hand, ICS malware discover their targets via searches that initiate ICS communication protocol traffic. Our approach uses a kernel filter driver to analyze the network traffic that flows through a real NIC. The kernel filter driver works with a module that uses in-kernel ICS protocol signatures to recognize ICS protocol traffic embedded within the network traffic in question. Our approach can detect 0-day malware on machines that are unrelated to industrial process control, without any prior knowledge of their internal code and data. We performed extensive testing against malware samples involved in recent cyber attack campaigns, as well as safety and efficiency tests, and thus discuss the findings in the paper.