No description available.

No description available.

No description available.

No description available.

ICS security has been a topic of scrutiny and research for several years, and many security issues are well known. However, research efforts are impeded by a lack of an open virtual industrial control system testbed for security research. This thesis describes a virtual testbed framework using Python to create discrete testbed components (including virtual devices and process simulators). This testbed is designed such that the testbeds are interoperable with real ICS devices and that the virtual testbeds can provide comparable ICS network behavior to a laboratory testbed. Two testbeds based on laboratory testbeds have been developed and have been shown to be interoperable with real industrial control systemequipment and vulnerable to attacks in the samemanner as a real system. Additionally, these testbeds have been quantitatively shown to produce traffic close to laboratory systems (within 90% similarity on most metrics).

Automated software testing techniques have become increasingly popular in recent years, with fuzzing being one of the most prevalent approaches. However, fuzzing Finite State Machines (FSMs) poses a significant challenge due to state and input dependency, resulting in exponential exploration time required to unlock the Finite State Machine. To address this issue, we present a novel approach in this research paper by introducing FINITEFUZZ, a Grey Box Fuzzer explicitly designed to fuzz Finite State Machines. Unlike the Blackbox fuzzers, FINITEFUZZ employs a mutational technique that utilizes feedback to steer the fuzzing process. FINITEFUZZ takes a random set of states and compares them with the desired FSM and records the states that increase the coverage of the Finite State Machine. The next seed incorporates the feedback received from all the previous seed inputs. This avoids exploring the same path multiple times and results in linear performance for all the types of Finite State machines possible. Our findings reveal that the use of FINITEFUZZ significantly reduces the exploration time required to uncover each state of the machine, making it a promising solution for generating Finite State Machines. We tested our FINITEFUZZ on 4 different types of Finite State Machines with each scenario resulting in at least 5X performance improvement in FSM generation. The potential applications of FSMs are vast, and our research suggests that the proposed approach can be used to generate any type of Finite State Machine. / Master of Science / Fuzzing, also known as Fuzz testing is a technique used to test software for security vulner- abilities, errors, and unexpected behavior. It involves generating random or semi-random input to a software application such as an operating system, or network service to test how it responds. Once input is generated, it is sent to the target application, which may crash, hang or produce unexpected results in response to the input. The results are then analyzed to identify potential vulnerabilities such as buffer overflows, input validation errors, and re- source leaks. Fuzzing is also used to test software that is difficult to test through other means, such as closed-source software or embedded systems. We generated a Fuzzer,FINITEFUZZ for Finite State Machine that unlocks the FSM starting from the random input and exploring only those seeds that increases the test coverage

From factories to power grids, industrial systems are increasingly being digitally controlled and networked. While networking these systems together improves their efficiency and convenience, it also opens them up to attack by malicious actors. When these attacks occur, forensic investigators need to quickly be able to determine what was compromised and which corrective actions should be taken. In this thesis, a method is proposed for investigating attacks on industrial control systems by simulating the logged inputs of the system over time using a model constructed from the control programs that make up the system. When evaluated, this led to the detection of attacks which perturbed the normal operation of the system by comparing the simulated output to the actual output. It also allowed for dependency tracing between the inputs and outputs of the system, so that attacks could be traced from their unwanted effects to their source and vice-versa. This method can thus greatly aid investigators in recovering the complete attack story using only logs of inputs and outputs to an industrial control system.

<p>In industrial control systems PID-control remains the prevalent strategy, also for processes that would benefit from model based control. The purpose of this thesis is to evaluate whether model based control can be readily implemented in an industrial control system. To this end a simulated surge tank with a simulated industrial control system is studied. For evaluation two scenarios with specified objectives are selected.</p><p>Following a review of LQR and versions of MPC, Predictive Functional Control (PFC) is considered the most suitable for implementation. PFC is a form of MPC developed with industrial applications in mind and therefore has several advantages for implementation in an industrial control system. Controllers for the surge tank-system are developed and implemented in the control system.</p><p>Basic analysis of stability, sensitivity and robustness suggests that PFC has some advantages that might be important in a non-simulated implementation. Compared with PID-controllers adjusted for control performance, PFC does not show any notable improvements in performance.</p><p>In conclusion, it is possible to implement model based control in an industrial control system and with PFC the implementation is considered easy.</p>

In industrial control systems PID-control remains the prevalent strategy, also for processes that would benefit from model based control. The purpose of this thesis is to evaluate whether model based control can be readily implemented in an industrial control system. To this end a simulated surge tank with a simulated industrial control system is studied. For evaluation two scenarios with specified objectives are selected. Following a review of LQR and versions of MPC, Predictive Functional Control (PFC) is considered the most suitable for implementation. PFC is a form of MPC developed with industrial applications in mind and therefore has several advantages for implementation in an industrial control system. Controllers for the surge tank-system are developed and implemented in the control system. Basic analysis of stability, sensitivity and robustness suggests that PFC has some advantages that might be important in a non-simulated implementation. Compared with PID-controllers adjusted for control performance, PFC does not show any notable improvements in performance. In conclusion, it is possible to implement model based control in an industrial control system and with PFC the implementation is considered easy.

A lack of alarm management for industrial control rooms has led to frequent alarm floods that have the potential to overwhelm operators within minutes. One approach to managing alarm floods would be altering the salience of alarms that operators might already notice, thereby reducing the disruption on workflow and attention for managing uninformative alarms. This research investigated the central hypothesis that eye fixations could supply passive input to acknowledge alarms anticipated by the operators and thereby improve their overall task performance. A dual-task experiment recruiting 24 participants was conducted to compare three gaze-based alarm acknowledgement methods –Proximity, Prediction, and Entropy- against no acknowledgement across three types of scenarios – Near-threshold, Trending, and Fluctuation. The gaze-based acknowledgement methods reduced visual and auditory salience of alarms as a function of the number of fixations on parameters as well as characteristics of the parameter known to influence operator monitoring behaviors. The participants performed an alarm monitoring task while controlling a continuous parameter within an acceptable range. While participants showed a preference for all of three gaze-based acknowledgment methods, performance of the parameter control task did not improve with gaze-based acknowledgement. Scenario types, as defined by the behavior of the parameters, exhibited a significant effect on the performance of the parameter control task, suggesting a greater influence on participant attention than the reduced salience associated with the gaze-based acknowledgments. Additional analysis revealed that gaze-acknowledgements are higher in scenarios with the most suitable for the gaze-based acknowledgement methods, although the participants did not show any gaze-based acknowledgements and did not make a prediction of an alarm for a significant portion of the trials, suggesting a lack of resource allocation to the alarm monitoring task. This result suggests that the effectiveness of gaze-based acknowledgement may depend on the combination of on-going tasks. Taken together, the experimental results showed some utility of user gaze in managing alarms given how acknowledgement occurred more often when the acknowledgement methods and parameters matched; however, further design research is necessary to translate the utility into clear performance or productivity benefits. / Master of Science / Industrial control rooms are notorious for having too many alarms triggered within minutes and operators are hindered by responding to these alarms as opposed to the actual process faults. Existing alarm management research and applications have already reduced nuisance alarms by filtering out those correlated to one another according to historical data or plant models. However, existing approaches have not eliminated the process parameters that operators already expect to reach alarm thresholds. In other words, current alarm management has not adapted for operator awareness of impending alarms. This study explored how eye-tracking might be used to acknowledge alarms anticipated by operators, thereby reducing uninformative alarms and interruption to operator work. The participants performed an alarm monitoring task while trying to maintain a fluctuating parameter within an acceptable range. While participants liked the gaze-based acknowledgement methods, their performance on the parameter control task did not improve over conditions without any alarm acknowledgement. The alarm monitoring task may not have received sufficient attention to induce an observable benefit. The characteristics of the parameter seemed to have a larger effect on participants' attention than the muted alarm presentation associated with the gaze-based acknowledgment. Further research is necessary to refine the current design to induce the postulated attention and performance benefits with gaze-based acknowledgement.