PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection

Mislav Findrik; Paul Smith; Kevin Quill; Kieran McLaughlin

doi:10.14236/ewic/ICS2018.12

PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection

Mislav Findrik, Paul Smith, Kevin Quill, Kieran McLaughlin

School of Electronics, Electrical Engineering and Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

8402 Downloads (Pure)

Abstract

The threat landscape for industrial control systems is ever-expanding and these systems have proven to be attractive targets for cyber attackers. Programmable Logic Controllers are major components in ICSs and hence need to be well-protected and monitored. By examining the existing research in this field we found that there is a void in comprehensive analysis of data logging and extraction features on industrial devices. However, analysis of these features and evaluation of their applicability for cyber intrusion detection would significantly facilitate their adoption by intrusion detection tools. In order to close the gap, we analyzed the logging and extraction capabilities of the Siemens S7-1200 PLC and HMI panel. We implemented a PLC logic for data logging called PLCBlockMon. In this paper, we provide guidelines for its usage and demonstrate its applicability for cyber intrusion detection in selected scenarios.

Original language	English
Title of host publication	5th International Symposium for ICS & SCADA Cyber Security Research 2018: Proceedings
Publisher	Electronic Workshops in Computing (eWic)
Pages	102-111
Number of pages	10
DOIs	https://doi.org/10.14236/ewic/ICS2018.12
Publication status	Published - Aug 2018
Event	5th International Symposium for ICS & SCADA Cyber Security Research 2018 - Hamburg, Germany Duration: 28 Aug 2018 → 30 Aug 2018

Publication series

Name	The eWiC Series
Publisher	BCS
ISSN (Print)	1477-9358

Conference

Conference	5th International Symposium for ICS & SCADA Cyber Security Research 2018
Country/Territory	Germany
City	Hamburg
Period	28/08/2018 → 30/08/2018

Access to Document

10.14236/ewic/ICS2018.12Licence: Unspecified

PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection
© 2018 The Authors. Published by BCS Learning and Development Ltd. This work is made available online in accordance with the publisher’s policies. Please refer to any applicable terms of use of the publisher.
Final published version, 835 KBLicence: Unspecified

2 Finished

R1594ECI: Analysing and Detecting Advanced Multistage Attacks Against ICS
McLaughlin, K. (PI)
13/01/2016 → 30/09/2018
Project: Research
R6440ECI: Smart Grid Protection Against Cyber Attacks
Sezer, S. (PI) & McLaughlin, K. (CoI)
15/04/2014 → 30/06/2017
Project: Research

1 Article

Vulnerability Analysis of S7 PLCs: Manipulating the Security Mechanism
Hui, H., McLaughlin, K. & Sezer, S., Dec 2021, In: International Journal of Critical Infrastructure Protection. 35, 100470.
Research output: Contribution to journal › Article › peer-review

Open Access
File
20 Citations (Scopus)

1006 Downloads (Pure)

Cite this

@inproceedings{bd45ff33e9f145af9c70734158b87f7f,

title = "PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection",

abstract = "The threat landscape for industrial control systems is ever-expanding and these systems have proven to be attractive targets for cyber attackers. Programmable Logic Controllers are major components in ICSs and hence need to be well-protected and monitored. By examining the existing research in this field we found that there is a void in comprehensive analysis of data logging and extraction features on industrial devices. However, analysis of these features and evaluation of their applicability for cyber intrusion detection would significantly facilitate their adoption by intrusion detection tools. In order to close the gap, we analyzed the logging and extraction capabilities of the Siemens S7-1200 PLC and HMI panel. We implemented a PLC logic for data logging called PLCBlockMon. In this paper, we provide guidelines for its usage and demonstrate its applicability for cyber intrusion detection in selected scenarios.",

author = "Mislav Findrik and Paul Smith and Kevin Quill and Kieran McLaughlin",

year = "2018",

month = aug,

doi = "10.14236/ewic/ICS2018.12",

language = "English",

series = "The eWiC Series",

publisher = "Electronic Workshops in Computing (eWic)",

pages = "102--111",

booktitle = "5th International Symposium for ICS & SCADA Cyber Security Research 2018: Proceedings",

note = "5th International Symposium for ICS & SCADA Cyber Security Research 2018 ; Conference date: 28-08-2018 Through 30-08-2018",

}

Findrik, M, Smith, P, Quill, K & McLaughlin, K 2018, PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection. in 5th International Symposium for ICS & SCADA Cyber Security Research 2018: Proceedings. The eWiC Series, Electronic Workshops in Computing (eWic), pp. 102-111, 5th International Symposium for ICS & SCADA Cyber Security Research 2018, Hamburg, Germany, 28/08/2018. https://doi.org/10.14236/ewic/ICS2018.12

PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection. / Findrik, Mislav; Smith, Paul; Quill, Kevin et al.
5th International Symposium for ICS & SCADA Cyber Security Research 2018: Proceedings. Electronic Workshops in Computing (eWic), 2018. p. 102-111 (The eWiC Series).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection

AU - Findrik, Mislav

AU - Smith, Paul

AU - Quill, Kevin

AU - McLaughlin, Kieran

PY - 2018/8

Y1 - 2018/8

N2 - The threat landscape for industrial control systems is ever-expanding and these systems have proven to be attractive targets for cyber attackers. Programmable Logic Controllers are major components in ICSs and hence need to be well-protected and monitored. By examining the existing research in this field we found that there is a void in comprehensive analysis of data logging and extraction features on industrial devices. However, analysis of these features and evaluation of their applicability for cyber intrusion detection would significantly facilitate their adoption by intrusion detection tools. In order to close the gap, we analyzed the logging and extraction capabilities of the Siemens S7-1200 PLC and HMI panel. We implemented a PLC logic for data logging called PLCBlockMon. In this paper, we provide guidelines for its usage and demonstrate its applicability for cyber intrusion detection in selected scenarios.

AB - The threat landscape for industrial control systems is ever-expanding and these systems have proven to be attractive targets for cyber attackers. Programmable Logic Controllers are major components in ICSs and hence need to be well-protected and monitored. By examining the existing research in this field we found that there is a void in comprehensive analysis of data logging and extraction features on industrial devices. However, analysis of these features and evaluation of their applicability for cyber intrusion detection would significantly facilitate their adoption by intrusion detection tools. In order to close the gap, we analyzed the logging and extraction capabilities of the Siemens S7-1200 PLC and HMI panel. We implemented a PLC logic for data logging called PLCBlockMon. In this paper, we provide guidelines for its usage and demonstrate its applicability for cyber intrusion detection in selected scenarios.

U2 - 10.14236/ewic/ICS2018.12

DO - 10.14236/ewic/ICS2018.12

M3 - Conference contribution

T3 - The eWiC Series

SP - 102

EP - 111

BT - 5th International Symposium for ICS & SCADA Cyber Security Research 2018: Proceedings

PB - Electronic Workshops in Computing (eWic)

T2 - 5th International Symposium for ICS & SCADA Cyber Security Research 2018

Y2 - 28 August 2018 through 30 August 2018

ER -

PLCBlockMon: Data Logging and Extraction on PLCs for Cyber Intrusion Detection

Abstract

Publication series

Conference

Access to Document

Fingerprint

Projects

R1594ECI: Analysing and Detecting Advanced Multistage Attacks Against ICS

R6440ECI: Smart Grid Protection Against Cyber Attacks

Research output

Vulnerability Analysis of S7 PLCs: Manipulating the Security Mechanism

Cite this