|
|
Identification of industrial devices
Šotola, Bohuslav ; Blažek, Petr (referee) ; Pospíšil, Ondřej (advisor)
This thesis, titled Identification of Industrial Devices, deals with the use of machine learning for the passive identification of exclusively programmable logic controllers (PLCs) from Siemens, communicating via network traffic. The identification is performed to obtain information about vulnerabilities in the devices currently in use. The motivation for introducing identification in the industry is to minimize the likelihood of attacks and thus reduce losses in production. Datasets in the field of Industrial Control Systems (ICS) are created for targeted device identification within 5 minutes of capturing network traffic. These datasets are statistically processed to find input parameters showing independence from topology and time. The statistically processed parameters are then subjected to machine learning models. If they are found to be sufficiently independent, the idea is verified on independent data not related to previous ones. In identification, there is also an attempt to utilize network transmission parameters that are independent of the PLC device manufacturer. Identification of PLC devices is possible, with the ideal use of the older version of the proprietary S7 protocol, as it allows identification within 5 minutes of capturing traffic. Identification based on the older version of the protocol is also relevant because it is used in practice. An obstacle to capturing traffic for identification is the fact that potential users often need appropriate permissions. Firmware updates must be taken into account, providing new data security features.
|
guest ::
