Exploit's Code Model for Cyber Security Analysis of Industrial Processes

Cyber security risk management is one of the essential aspects of the industrial processes control. Exploits are often used for cyber attacks for the exploitation of known and previously unseen vulnerabilities and can lead to serious consequences for industrial system security. Accurate forecasting and assessment of these consequences can enhance security risk management processes and, consequently, industrial processes control. For this goal, the paper proposes a new approach to automated exploits assessment and detection based on the exploit's compiled code model. The main idea consists, on the one hand, in revealing of the relations between the metrics of the vulnerability, used within the exploit, and system calls and their dependencies for further classification of the exploits of one type and severity. On the other hand, it consists in the revealing of such relations between system calls and their dependencies and sequences of the events detected in the system under analysis for further detection of parts of the events sequences to forecast exploitation of previously unseen vulnerabilities and assess appropriate exploits and cyberattacks. The authors introduce the methodology for cyberattack assessment based on the proposed approach, the new exploit's code model for the exploits classification and assessment considering related vulnerability metrics, as well as the general exploit's code model for further detection and assessment of previously unknown exploits and attacks.