Attack Modeling and Threat Attribution Methodology for Industrial Control Systems
How to cite
Abstract
This article examines the issue of attribution of intruders that affect automated control systems from the point of view of information security. The central aspect of the work is the study of modern methods for identifying threat sources and their initial identification. Emphasis is placed on the use of a mathematical apparatus based on the Bayes theorem, which allows to significantly increase the accuracy and reliability of incident detection. The practical significance of this work lies in its importance for professionals working in the field of information security and cyber intelligence. The analysis proposed in the article can also serve as a basis for the development of new standards aimed at improving the mechanisms of cyber-attack attribution. The article emphasizes the need to integrate scientific methodologies into practical processes, which will allow not only to respond to current cyber threats, but also to develop strategies in advance to counter potentially new types of attacks. In addition, it is assumed that the implementation of the approaches described in the article will contribute to the creation of a more secure infrastructure, as well as to the improvement of national and international cybersecurity policies.
Keywords
References
Воронцов Е.А. Теория распознавания и обучения. М.: Высшая школа, 1989. 400 с.
Лукацкий А.В. Обнаружение атак. 2-е изд., перераб. и доп. СПб.: БХВ-Петербург, 2003. 608 с.
Марков А.С., Цирлов В.Л. Руководство по кибербезопасности: науч. изд. М.: АйТи, 2020. 197 с.
Шумский С.А. Математические основы теории обучения распознаванию образов: уч. пос. М.: Изд-во МФТИ, 2012. 248 с.
Актуальные киберугрозы: II квартал 2023 г.: аналит. отчет // Positive Technologies. 2023.
Серебрянский С.С. Кибербезопасность АСУ ТП: от концепции до решений // Автоматизация в промышленности. 2017. № 4. С. 4-7.
Alert (TA17-164A) // US-CERT. 2023. https://www.us-cert.gov/ncas/alerts/TA17-164A/ 8. Barber D. Bayesian Reasoning and Machine Learning. Cambridge: Cambridge University Press, 2012. 720 р.
Global baking industry automation report 2023 // International Baking Industry Association (IBIA). 2023. https://www.ibia.org/reports/automation-2023/
Langner R. Stuxnet: Dissecting a cyberwarfare weapon // IEEE Security & Privacy. 2011. Vol. 9. № 3. pp. 49-51.
Lazarus Group and the Evolutionary Malware Story behind the Sony Hack. Securelist // Kaspersky Lab. 2023. https://securelist.com/lazarus-group-and-the-evolutionary-malware/
MITRE ATT&CK® for Industrial Control Systems (ICS). 2023. https://attack.mitre.org/matrices/ics/
NIST Cybersecurity Framework. 2023. https://www.nist.gov/cyberframework/
Novetta threat research and intelligence // Novetta. 2023. https://www.novetta.com/
SANS Institute Information Security Reading Room. 2023. https://www.sans.org/reading-room/
Securelist by Kaspersky. 2023. https://securelist.com/
Stouffer K., Pillitteri V., Lightman S., Abrams M., Hahn A. Guide to Industrial Control Systems (ICS) security: Special publication 800-82 Revision 2. Gaithersburg: National Institute of Standards and Technology, 2015. 247 p.
Threat landscape for industrial automation systems. H2 2023 // Kaspersky. 2023. https://icscert.kaspersky.com/reports/2023/12/25/threat-landscape-for-industrial-automation-systems-h2-2023/
Zhu B.A., Joseph A., Sastry S. Survey of cyberattacks on Industrial Control Systems // Security and communication networks. 2019. Vol. 2019.