Attack pattern mining to discover hidden threats to industrial control systems

Abstract This work focuses on the validation of attack pattern mining in the context of Industrial Control System (ICS) security. A comprehensive security assessment of an ICS requires the generation of a variety of attack patterns. For this purpose, we have proposed a data-driven technique to generate attack patterns for an ICS. The proposed technique has been used to generate 117,960 attack patterns from data from a water treatment plant. These attack patterns were used to launch attacks on the operational testbed that typically lasted 2 to 4 minutes. Interestingly, some 2-minute attacks impacted the plant, while some attacks of 3 or 4 minutes duration had no observable effect. This suggests that even short-lived attacks can significantly impact operational plants. The proposed technique and the effectiveness of the patterns generated in moving the plant to an anomalous state are valuable when assessing the quality of Intrusion Detection Systems for physical plants. In this work, we present a detailed case study to validate the attack patterns.