From ICS Attacks' Analysis to the S.A.F.E. Approach: Implementation of Filters Based on Behavioral Models and Critical State Distance for ICS Cybersecurity

Since the beginning of this century, Industrial Control Systems (ICSs) are the target of hackers which use vulnerabilities to perform attacks affecting the physical system. These cyberattacks can cause tremendous damages on its system, environment, product quality or equipment of production. Most approaches proposed in the literature are derived from Information Technology cybersecurity field. Unfortunately, most of them fail to fully secure the ICSs. In fact, either they do not consider their specificities or are not adequate as analyzing the industrial network. This paper provides two major contributions: (i) analyses of the main attacks against ICSs with an automation point of view and, (ii) the implementation of the S.A.F.E. (Security Approach based on Filter Execution) approach on a platform. The detection strategy analyzes the normal behavior model of ICSs with its current behavior by analyzing exchanges between control and operative parts through filters. To conclude this paper, the authors discuss about the main contributions, limitations and future research avenues from the proposed approach.