PFI:AIR - TT: Passive Techniques for Monitoring Industrial Control Systems

此PFI：AIR技术转换项目侧重于转换工业控制系统(ICS)安全技术，以满足对保护国家最关键基础设施(例如电网、关键制造厂、水处理厂等)的方法的需求。工业控制系统的安全技术非常重要，因为这些ICS网络的安全可能会导致生命损失、大范围停电、环境灾难和经济损失。该项目将产生一个ICS安全和监测系统的原型。该ICS安全和监控系统具有以下独特功能：1)检测恶意网络流量的能力，检测运行在嵌入式控制器上的恶意程序的能力，以及3)备份通过网络传输的程序的能力。这些功能提供了以下优势：1)防御国家级别的攻击者，2)检测嵌入式控制器上的恶意软件的微创技术，以及3)与该市场领域的标准入侵检测系统和硬件附加设备等领先的竞争方法相比，被动的程序备份。该项目解决了从研究发现转化为商业应用的以下技术差距：入侵检测、访问控制、网络管理和工业控制系统的恶意软件检测。具体地说，本项目提出了新的ICS特定指纹识别技术，可用于补充入侵检测、访问控制或网络管理的传统技术。此外，将开发一种使用标准可编程逻辑控制器(PLC)诊断信息来检测可编程逻辑控制器的代码修改(由Stuxnet完成)的健壮技术。此外，还将开发一种被动的方法，拦截和存档从工程工作站传输的二进制PLC程序。此外，参与该项目的人员，研究生，将通过需求和规范讨论、原型开发、单元/系统/集成测试、原型部署和上市战略开发，获得创新、创业和技术转换经验。

This PFI: AIR Technology Translation project focuses on translating industrial control system (ICS) security techniques to fill the need for methods to secure the Nation's most critical infrastructure (e.g., the electric power grid, critical manufacturing plants, water treatment plants, etc.). The industrial control system security techniques are important because the compromise of these ICS networks can lead to loss of life, widespread blackouts, environmental disasters, and financial loss. The project will result in a prototype of an ICS security and monitoring system. This ICS security and monitoring system has the following unique features: 1) the ability to detect malicious network traffic, the ability to detect malicious programs running on embedded controllers, and 3) the ability to backup programs transmitted over the network. These features provide the following advantages: 1) defense against Nation State level attackers, 2) minimally-invasive techniques to detect malware on embedded controllers, and 3) passive program backups when compared to the leading competing approaches such as standard intrusion detection systems and hardware add-ons in this market space. This project addresses the following technology gaps as it translates from research discovery toward commercial application: intrusion detection, access control, network management, and malware detection for industrial control systems. Specifically, this project presents new ICS specific fingerprinting techniques that can be used to supplement traditional techniques for intrusion detection, access control, or network management. Further, a robust technique for detecting code modification of programmable logic controllers (which was done by Stuxnet), using standard programmable logic controller (PLC) diagnostic information will be developed. Also, a passive method that intercepts and archives binary PLC programs transmitted from the engineering workstation will be developed. In addition, personnel involved in this project, graduate students, will receive innovation, entrepreneurship, and technology translation experiences through requirements and specifications discussions, prototype development, unit/system/integration testing, prototype deployment, and go-to-market strategy development.