No description available.

No description available.

Abstract Industrial control system (ICS) networks used to be isolated environments, typically separated by physical air gaps from the wider area networks. This situation has been changing and the change has brought with it new cybersecurity issues. The process has also exacerbated existing problems that were previously less exposed due to the systems’ relative isolation. This process of increasing connectivity between devices, systems and persons can be seen as part of a paradigm shift called the Internet of Things (IoT). This change is progressing and the industry actors need to take it into account when working to improve the cybersecurity of ICS environments and thus their reliability. Ensuring that proper security processes and mechanisms are being implemented and enforced on the ICS network level is an important part of the general security posture of any given industrial actor. Network security and the detection of intrusions and anomalies in the context of ICS networks are the main high-level research foci of this thesis. These issues are investigated through work on machine learning (ML) based anomaly detection (AD). Potentially suitable features, approaches and algorithms for implementing a network anomaly detection system for use in ICS environments are investigated. After investigating the challenges, different approaches and methods, a proof-ofconcept (PoC) was implemented. The PoC implementation is built on top of the Bro network security monitoring framework (Bro) for testing the selected approach and tools. In the PoC, a Self-Organizing Map (SOM) algorithm is implemented using Bro scripting language to demonstrate the feasibility of using Bro as a base system. The implemented approach also represents a minimal case of event-driven machine learning anomaly detection (EMLAD) concept conceived during the research. The contributions of this thesis are as follows: a set of potential features for use in machine learning anomaly detection, proof of the feasibility of the machine learning approach in ICS network setting, a concept for event-driven machine learning anomaly detection, a design and initial implementation of user configurable and extendable machine learning anomaly detection framework for ICS networks. / Tiivistelmä Kehittyneet yhteiskunnat käyttävät teollisuuslaitoksissaan ja infrastruktuuriensa operoinnissa monimuotoisia automaatiojärjestelmiä. Näiden automaatiojärjestelmien tieto- ja kyberturvallisuuden tila on hyvin vaihtelevaa. Laitokset ja niiden hyödyntämät järjestelmät voivat edustaa usean eri aikakauden tekniikkaa ja sisältää useiden eri aikakauden heikkouksia ja haavoittuvaisuuksia. Järjestelmät olivat aiemmin suhteellisen eristyksissä muista tietoverkoista kuin omista kommunikaatioväylistään. Tämä automaatiojärjestelmien eristyneisyyden heikkeneminen on luonut uuden joukon uhkia paljastamalla niiden kommunikaatiorajapintoja ympäröivälle maailmalle. Nämä verkkoympäristöt ovat kuitenkin edelleen verrattaen eristyneitä ja tätä ominaisuutta voidaan hyödyntää niiden valvonnassa. Tässä työssä esitetään tutkimustuloksia näiden verkkojen turvallisuuden valvomisesta erityisesti poikkeamien havainnoinnilla käyttäen hyväksi koneoppimismenetelmiä. Alkuvaiheen haasteiden ja erityispiirteiden tutkimuksen jälkeen työssä käytetään itsejärjestyvien karttojen (Self-Organizing Map, SOM) algoritmia esimerkkiratkaisun toteutuksessa uuden konseptin havainnollistamiseksi. Tämä uusi konsepti on tapahtumapohjainen koneoppiva poikkeamien havainnointi (Event-Driven Machine Learning Anomaly Detection, EMLAD). Työn kontribuutiot ovat seuraavat, kaikki teollisuusautomaatioverkkojen kontekstissa: ehdotus yhdeksi anomalioiden havainnoinnissa käytettävien ominaisuuksien ryhmäksi, koneoppivan poikkeamien havainnoinnin käyttökelpoisuuden toteaminen, laajennettava ja joustava esimerkkitoteutus uudesta EMLAD-konseptista toteutettuna Bro NSM työkalun ohjelmointikielellä.

In this thesis, an anomaly detection framework is assessed and fine-tuned to detect and explain anomalies in a power station, where EtherCAT, an Industrial Control System, is employed for monitoring. The chosen framework is based on a previously published Graph Neural Network (GNN) model, utilizing attention mechanisms to capture complex relationships between diverse measurements within the EtherCAT system. To address the challenges in graph learning and improve model performance and computational efficiency, the study introduces a novel similarity thresholding approach. This approach dynamically selects the number of neighbors for each node based on their similarity instead of adhering to a fixed 'k' value, thus making the learning process more adaptive and efficient. Further in the exploration, the study integrates Extreme Value Theory (EVT) into the framework to set the anomaly detection threshold and assess its effectiveness. The effect of temporal features on model performance is examined, and the role of seconds of the day as a temporal feature is notably highlighted. These various methodological innovations aim to refine the application of the attention based GNN framework to the EtherCAT system. The results obtained in this study illustrate that the similarity thresholding approach significantly improves the model's F1 score compared to the standard TopK approach. The inclusion of seconds of the day as a temporal feature led to modest improvements in model performance, and the application of EVT as a thresholding technique was explored, although it did not yield significant benefits in this context. Despite the limitations, including the utilization of a single-day dataset for training, the thesis provides valuable insights for the detection of anomalies in EtherCAT systems, contributing both to the literature and the practitioners in the field. It lays the groundwork for future research in this domain, highlighting key areas for further exploration such as larger datasets, alternative anomaly detection techniques, and the application of the framework in streaming data environments. / I denna avhandling utvärderas och finslipas ett ramverk för att detektera och förklara anomalier på ett kraftverk, där EtherCAT, ett industriellt styrsystem, används för övervakning. Det valda ramverket är baserat på en tidigare publicerad graf neurala nätverksmodell (GNN) som använder uppmärksamhetsmekanismer för att fånga komplexa samband mellan olika mätningar inom EtherCAT-systemet. För att hantera utmaningar inom grafiskt lärande och förbättra modellens prestanda och beräkningseffektivitet introducerar studien en ny metod för likhetsgränsdragning. Denna metod väljer dynamiskt antalet grannar för varje nod baserat på deras likhet istället för att hålla sig till ett fast 'k'-värde, vilket gör inlärningsprocessen mer anpassningsbar och effektiv. I en vidare undersökning integrerar studien extremvärdesteori (EVT) i ramverket för att sätta tröskeln för detektering av anomalier och utvärdera dess effektivitet. Effekten av tidsberoende egenskaper på modellens prestanda undersöks, och sekunder av dagen som en tidsberoende egenskap framhävs särskilt. Dessa olika metodologiska innovationer syftar till att förädla användningen av det uppmärksamhetsbaserade GNN-ramverket på EtherCAT-systemet. Resultaten som erhållits i denna studie illustrerar att likhetsgränsdragning väsentligt förbättrar modellens F1-poäng jämfört med den standardiserade TopK-metoden. Inkluderingen av sekunder av dagen som en tidsberoende egenskap ledde till blygsamma förbättringar i modellens prestanda, och användningen av EVT som en tröskelmetod undersöktes, även om den inte gav några betydande fördelar i detta sammanhang. Trots begränsningarna, inklusive användningen av ett dataset för endast en dag för träning, ger avhandlingen värdefulla insikter för detektering av anomalier i EtherCAT-system, och bidrar både till litteraturen och praktiker inom området. Den lägger grunden för framtida forskning inom detta område, och belyser nyckelområden för ytterligare utforskning såsom större dataset, alternativa tekniker för detektering av anomalier och tillämpningen av ramverket i strömmande data-miljöer.

Les systèmes de contrôle et d'automatisation industriels (IACS - Industrial Control and Automation Systems) reposent largement et de plus en plus sur les Technologies de l'Information et de la Communication. A l'origine, les IACS utilisaient des protocoles propriétaires sur des réseaux fermés, assurant ainsi une sécurité par obscurité et isolement. Mais les technologies et les usages ont évolué et cette sécurité intrinsèque n'existe plus désormais. Cette évolution concerne entre autre le domaine électrique : le réseau électrique devenant le "smart grid".Le standard IEC 61850 est un pilier pour le développement du smart grid. Il a pour objectif de rendre possible l'interopérabilité dans les "Systèmes et réseaux de communication pour l'automatisation des services de distribution d'énergie". Pour cela, la norme définit un modèle de données commun ainsi qu'une pile de protocoles répondant à divers besoins de communication.Le standard IEC 61850 n'aborde pas la question de la cyber sécurité malgré une prise de conscience générale qu'un risque cyber pèse sur les IACS.Ces travaux de recherche proposent de répondre à cette question de la cyber sécurité par de la détection d'intrusion dans les réseaux IEC 61850, et plus précisément dans les communications temps-réel GOOSE. L'idée est d'exploiter au maximum les sources d'informations que sont les spécifications du protocole et la configuration du système pour développer un système de détection d'intrusion réseau (NIDS - Network Intrusion Detection System) sur mesure. Cette approche comportementale déterministe est un gage de précision de détection.Ce manuscrit compte quatre chapitres. Les deux premiers consistent en un état de l'art détaillé sur les NIDS pour les IACS d'une part, et l'analyse du risque cyber d'autre part. Les deux autres chapitres présentent les contributions proprement dites de ces travaux de thèse. Le chapitre 3 explore tout d'abord le risque cyber pesant sur un poste électrique et pouvant compromettre la sûreté de fonctionnement du système. Dans un deuxième temps, est proposée une extension du modèle de données IEC 61850 dédiées à la détection d'intrusion dans les communication GOOSE. Le chapitre 4 commence avec la démonstration expérimentale de la faisabilité d'une attaque de type injection de données sur le protocole GOOSE, puis explique comment utiliser les fichiers de configuration du système pour spécifier les règles de détection. Un analyseur syntaxique pour le protocole GOOSE a été intégré à l'analyseur de trafic open source Bro, permettant l'implémentation d'un algorithme de détection. / Information and Communication Technologies have been pervading Industrial Automation and Control Systems (IACS) for a few decades now. Initially, IACS ran proprietary protocols on closed networks, thus ensuring some level of security through obscurity and isolation. Technologies and usages have evolved and today this intrinsic security does not exist any longer, though. This transition is in progress in the electricity domain, the power infrastructure turning into the "smart grid".The IEC 61850 standard is key to the smart grid development. It is aimed at making interoperability possible in ``Communication networks and systems for power utility automation''. It thus defines a common data object model and a stack of protocols answering different purposes.Although the cyber risk in IACS is now widely acknowledged, IEC 61850 does not address cyber security in any way whatsoever.This work tackles the question of cyber security through network intrusion detection in IEC 61850 networks, and more specifically in real-time GOOSE communications. The idea is to get the most out of the protocol specifications and system configuration while developing a tailored NIDS. This enables detection accuracy.

Over the last few decades, the complexity and variety of automation systems have increased dramatically. Commissioning has grown more and more critical for the entire industry. Conventional commissioning is time-consuming and expensive. It's always been a challenge in manufacturing to put new designs into production or implement new technologies, control codes, or tactics. In Virtual Commissioning (VC), control programs of the physical system's Digital Twin (DT) can be validated in Software-in-the-Loop (SIL) before the actual commissioning. The emergence of new VC tools and methods has become a tremendous advantage, bringing the values of shorter duration, flexibility, and lower risks to the commissioning process. In this thesis, advanced process control was developed using the software Matlab and Simulink in conjunction with the engineering tools S7-PLCSIM Advanced and STEP 7 TIA Portal to conduct VC. A VC approach with four key steps is taken to evaluate the possibility of validating advanced process control. The steps are modeling DT of a rolling mill, model-based control design, simulation model development in Simulink, communication between the simulation model and the PLC program using S-7 TIA Portal, and PLCSIM Advanced. Also, a simulated Human-Machine Interface was designed to operate and visualize the process. VC of the rolling mill process was verified and validated by Model-in-the-Loop (MIL) and SIL simulation. The simulation gives satisfactory results as both MIL and SIL show identical outputs of the process.

Integration testing in software refers to a type of tests where system components are tested as a group for the purpose of verifying their interfaces. It is an important phase in system testing which aims at verifying the compliance of the system with specified functional requirements and the elimination of errors in the interaction of system components. Often integration testing is performed on complex systems with additional requirements for the testing approaches wherein the hardware limitations and time delays need to be taken into account. The testing of such systems is commonly performed through hardware-in-the-loop (HIL) tests. Despite the advances in both integration testing and HIL testing, combining the two for complex systems is still a challenging issue requiring a new set of potential solutions. In this thesis work we propose a new solution approach for HIL integration testing of Supervisory Control and Data Acquisition (SCADA) systems which does not require any simulation of the system under test. The solution presented in this thesis is based on the utilization of probes which are deployed to select component interfaces and through which real-time, inter-component communication can be observed without interference. The feasibility of the proposed approach is evaluated by applying it to a proof-of-concept test of the SCADA control system for a wave-energy converter in development by the thesis host company CorPower Ocean. In the results chapter we further discuss the architectural solution of the probing-based approach and provide further implementation details. Our conclusion is that the proposed approach corresponds to a promising, light-weight, and modular testing solution that can be used to perform live software integration tests of a fully connected system with little to no interference on its operation. / Inom mjukvarubranschen är integrationstester en typ av testning där grupper av systemkomponenter testas tillsammans för att säkerställa funktionaliteten av deras gränssnitt. Det är en viktig fas inom systemtestning som försäkrar att systemet som helhet uppfyller designkraven samt som minimerar felrisken i interaktioner mellan delkomponenter. Integrationstester utförs ofta på komplexa system där testningen i sig har ytterligare krav som inskränker metodvalet, till exempel då hänsyn behöver tas till hårdvarubegränsningar eller timing. Ofta genomförs testningen av sådana system med så kallade hardware-in-the-loop-tester (HIL). Trots modern utveckling inom både integrations- och HIL-testning är det fortfarande mycket utmanande att kombinera båda metoderna för komplexa system och nya lösningar behöver utvecklas och utvärderas. I denna avhandling föreslås en ny sådan lösning för HIL-testning av Supervisory Control and Data Acquisition (SCADA) -kontrollsystem som inte kräver att någon del av systemet simuleras under testernas utförande. Lösningen är baseras på användandet av mjukvarusonder som sätts in vid utvalda komponentgränssnitt och som i realtid kan observera interkomponentkommunikation utan störningspåverkan på komponenterna i sig. Den beskrivna lösningen utvärderades genom att utföra en praktisk konceptvalidering mot SCADAkontrollsystemet för avhandlingens värdbolag CorPower Oceans vågenergigenerator. I avhandlingen beskrivs även den arkitekturella lösning som krävdes för att genomföra sonderingsbaserad testning på ett reellt system samt implementationsdetaljer för konceptvalideringen. Slutsatsen är att den föreslagna lösningen beskriver en lovande och modulär testningsmetodik som kan användas för att genomföra mjukvaruintegrationstester av komplexa, sammankopplade system i realtid, utan simuleringar och utan betydande störningspåverkan på systemets operation

<p>Modern reactors promise enhanced capabilities not previously possible including integration with the smart grid, remote monitoring, reduced operation and maintenance costs, and more efficient operation. . Modern reactors are designed for installation to remote areas and integration to the electric smart grid, which would require the need for secure undisturbed remote control and the implementation of two-way communications and advanced digital technologies. However, two-way communications between the reactor facility, the enterprise network and the grid would require continuous operation data transmission. This would necessitate a deep understanding of cybersecurity and the development of a robust cybersecurity management plan in all reactor communication networks. Currently, there is a limited number of testbeds, mostly virtual, to perform cybersecurity research and investigate and demonstrate cybersecurity implementations in a nuclear environment. To fill this gap, the goal of this thesis is the development of a real-time cyber-physical testbed with real operational and information technology data to allow for cybersecurity research in a representative nuclear environment. In this thesis, a prototypic cyber-physical testbed was designed, built, tested, and installed in PUR-1. The cyber-physical testbed consists of an Auxiliary Moderator Displacement Rod (AMDR) that experimentally simulates a regulating rod, several sensors, and digital controllers mirroring Purdue University Reactor One (PUR-1) operation. The cyber-physical testbed is monitored and controlled remotely from the Remote Monitoring and Simulation Station (RMSS), located in another building with no line of sight to the reactor room. The design, construction and testing of the cyber-physical testbed are presented along with its capabilities and limitations. The cyber-physical testbed network architecture enables the performance of simulated cyberattacks including false data injection and denial of service. Utilizing the RMSS setup, collected information from the cyber-physical testbed is compared with real-time operational PUR-1 data in order to evaluate system response under simulated cyber events. Furthermore, a physics-based model is developed and benchmarked to simulate physical phenomena in PUR-1 reactor pool and provide information about reactor parameters that cannot be collected from reactor instrumentation system.</p>