Cybersecurity algorithms and tools for supervisory control and data acquisition and industrial control systems

Abstract

A hybrid approach involving the mix of communication patterns and passive fingerprinting is used to identify unknown device types, manufacturers, and models of devices of digital control systems. ANDVI implementation maps the identified devices to their known vulnerabilities. According to one example, to identify how interdependence among existing atomic vulnerabilities may be exploited by an adversary to stitch together an attack that can compromise the system, model-checking based A2G2V is employed. According to another example, an A2G2V algorithm uses existing model-checking tools, an architecture description tool, and code to generate an attack-graph that enumerates the set of all possible sequences in which atomic-level vulnerabilities can be exploited to compromise system security. In yet another example, identification of label-cuts within an attack-graph automatically identifies a set of critical-attacks that, when blocked, renders the system secure. A linear complexity approximation utilizing SCCs helps identify the minimum label-cut representing a critical-attacks set.