Autonomic Passive IT-OT Device Classification in ICS/SCADA Networks

Industrial Control Systems (ICS) manage physical processes through Programmable Logic Controllers (PLCs) and are widely used in critical infrastructure (CI). Because of their wide use in CI, PLCs are a target for cyberattacks to disrupt CI. On CI and other networks, there is often a mix of Information Technology (IT) and Operational Technology (OT) systems. Detecting and classifying OT and IT assets on a network can help in providing targeted security measures for OT systems. Actively scanning for assets in ICS networks can lead to unexpected errors on PLCs. PLCs operate with limited resources and are notorious for producing errors or faults when presented with unexpected network packets. Special care must be taken when sending unsolicited network packets to these devices to avoid physical process interruption, catastrophic failures, even potential human injury. In this paper, we explore a collection of prevalent Machine Learning (ML) algorithms: k-Nearest-Neighbors (KNN), Support-Vector-Machines (SVM), Random Forest and AdaBoost in order to differentiate ICS network assets from IT machines solely from passive monitoring of network traffic flows. Furthermore, we integrate the proposed classification method into an autonomic architecture for continuous monitoring and identification of ICS assets in a SCADA network environment, both for offensive and defensive purposes.