NeTS: Small: Collaborative Research: Measurement and Modeling of Industrial Control Networks

工业控制系统的操作员具有有限的软件工具来获得他们的网络和过程的态势感知。该项目旨在表征各种工业控制网络的网络流量。 由于研究界无法访问来自操作控制系统的数据集（大部分是专有的），我们识别异常行为和保护弱点的能力是美国关键基础设施的一个问题。 研究团队已经获得了一系列网络数据集，这些数据集将使他们能够研究各种类型的工业控制系统的性能（和安全）属性，包括废水处理，电力和太阳能。通过研究这些数据集的相似性和差异性，该分析将产生关键基础设施控制系统流量的模型，这将有助于异常检测，并进一步加深我们对这些网络的理解。该项目将描述网络流的特征，并以协议和流程感知的方式执行深度数据包检测。 该项目将开发实现异常检测算法的开源工具，供研究人员和过程控制行业使用。由于异常检测工具是被动的，它们最终可以部署在工业合作伙伴的运营环境中，以帮助他们提高对控制网络的可见性和理解。这项工作将在美国-以色列两国科学基金会联合资助计划下与以色列的研究人员合作进行。

Operators of industrial control systems have limited software tools for obtaining situational awareness of their networks and processes. This project seeks to characterize network traffic for a rich variety of industrial control networks. Because the research community lacks access to (mostly proprietary) data sets from operating control systems, our ability to identify anomalous behavior and protect weaknesses is a concern for critical U.S. infrastructure. The research team has obtained a collection of network data sets that will allow them to study the performance (and security) properties of various types of industrial control systems, including wastewater treatment, power, and solar energy. By examining the similarities and differences of these data sets, this analysis will yield models of critical infrastructure control system traffic that will aid in anomaly detection and further our understanding of these networks in general.The project will characterize network flows, and perform deep-packet inspection in a protocol- and process-aware fashion. The project will develop open-source tools implementing anomaly detection algorithms to be used by researchers and the process control industry. Since the anomaly detection tools are passive, they can ultimately be deployed in the operational environments of industrial partners to help them improve the visibility and understanding of their control networks. This work will be performed in collaboration with researchers in Israel under the US-Israel Binational Science Foundation joint funding program.