Improving OT Network and Host Baselines to Secure Critical Infrastructure
summary
Proposes building micro-baselines that match observable network and host artifacts to physical events by parsing PCAP payloads and protocol fields (DNP3, IEC 104) rather than just IP/port heuristics; demonstrates extracting features in Wireshark, using PI Historian event frames and SCL files for context, testing on Industroyer (caused TCP resets) and Trisis traces, runs experiments in Jupyter notebooks and ESX clusters with tens of terabytes, and evaluates detection with finite state machine inference and entropy-based feature selection.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:05Disclaimer
- 3:47Challenges of Network Baselining
- 6:13Historical Attacks Demonstrate the Need for System Baselining
- 8:13Microbaselinin'
- 10:52Outline: Microbaselining Pipeline
- 13:12Data Sources in OT Environments
- 15:24Data Collection and Curation in OT Environments
- 17:32Microbaselin' Pipeline
- 18:40Data Corpus
- 19:48Data Normalization
- 23:02Feature Selection
- 25:55Baselining and Finite State Machines
- 27:30System Behavior and Finite State Machines
- 29:10Applied OT Protocol State Machine Analysis
- 29:56Finite State Machine Inference
- 31:14Trace Construction
- 32:23Abstraction
- 33:19Passive FSM Inference
- 34:22"Apply" Slide
related talks
27mCollect All the Data; Protect All the Things
50mHarmonizing IT and OT Security in the Era of Convergence
27mSpecification Mining for Intrusion Detection in Networked Control Systems
17mExpansion of ICS Testbed for Security Validation based on MITRE ATT&CK Techniques
22mBadger - The Networked Security State Estimation Toolkit
32mThere and Back Again: Discovering OT Devices Across Protocol Gateways
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
43mBuilding a network security practice in your organization | Pannel Discussion