NeTS: Small: Collaborative Research: Measurement and Modeling of Industrial Control Networks

工业控制系统的操作人员用于获取其网络和过程的态势感知的软件工具有限。该项目旨在描述各种工业控制网络的网络流量特征。由于研究界缺乏对操作控制系统的数据集的访问（主要是专有的），我们识别异常行为和保护弱点的能力是美国关键基础设施的一个关注点。研究小组已经获得了一系列网络数据集，这将使他们能够研究各种类型的工业控制系统的性能（和安全）特性，包括废水处理、电力和太阳能。通过检查这些数据集的异同，这种分析将产生关键基础设施控制系统流量的模型，这将有助于异常检测，并进一步加深我们对这些网络的总体理解。该项目将描述网络流，并以协议和进程感知的方式执行深度数据包检测。该项目将开发实现异常检测算法的开源工具，供研究人员和过程控制行业使用。由于异常检测工具是被动的，因此它们最终可以部署在工业合作伙伴的操作环境中，以帮助他们提高控制网络的可见性和理解。这项工作将在美国-以色列两国科学基金会的联合资助计划下与以色列的研究人员合作进行。

Operators of industrial control systems have limited software tools for obtaining situational awareness of their networks and processes. This project seeks to characterize network traffic for a rich variety of industrial control networks. Because the research community lacks access to (mostly proprietary) data sets from operating control systems, our ability to identify anomalous behavior and protect weaknesses is a concern for critical U.S. infrastructure. The research team has obtained a collection of network data sets that will allow them to study the performance (and security) properties of various types of industrial control systems, including wastewater treatment, power, and solar energy. By examining the similarities and differences of these data sets, this analysis will yield models of critical infrastructure control system traffic that will aid in anomaly detection and further our understanding of these networks in general.The project will characterize network flows, and perform deep-packet inspection in a protocol- and process-aware fashion. The project will develop open-source tools implementing anomaly detection algorithms to be used by researchers and the process control industry. Since the anomaly detection tools are passive, they can ultimately be deployed in the operational environments of industrial partners to help them improve the visibility and understanding of their control networks. This work will be performed in collaboration with researchers in Israel under the US-Israel Binational Science Foundation joint funding program.