Decomposition and sequential-AND analysis of known cyber-attacks on critical infrastructure control systems

Research output: Contribution to journalArticlepeer-review

55 Downloads (Pure)

Abstract

We perform a detailed survey and analysis of the most significant attacks, which have targeted industrial control systems over the past decade, based on detailed incident reports from scientific and non-traditional resources. This work is the first that considers together a comprehensive set of real-world cyber-attacks with the purpose of deriving a set of common features focusing particularly on the process control network. Each attack is decomposed to provide a comprehensive overview followed by a discussion of the commonalities identified across attacks. To achieve this, each attack is modelled using Attack Trees with Sequential AND, and mapped to the industrial control system Cyber Kill Chain. We focus on the methods of intrusion rather than the identification of actors. This article can be read in two parts: first, an analysis of each attack, and secondly a discussion of the derived commonalities. The resulting commonalities can be used to develop improved detection strategies to detect modern adversarial techniques and tactics.
Original languageEnglish
JournalJournal of Cybersecurity
Volume6
Issue number1
Early online date15 Dec 2020
DOIs
Publication statusEarly online date - 15 Dec 2020

Fingerprint Dive into the research topics of 'Decomposition and sequential-AND analysis of known cyber-attacks on critical infrastructure control systems'. Together they form a unique fingerprint.

Cite this