ALGORITHM FOR CONTEXTUAL VALIDATION OF INDICATORS OF BEHAVIOR (IOB) FOR DETECTING STEALTHY ATTACKS IN ICS
Abstract
This article addresses the pressing issue of ensuring the information security of critical information infrastructure (CII) amidst the qualitative evolution of cyber threats and the massive shift of threat actors toward stealthy "Living-off-the-Land" (LotL) attacks. Because such attacks are executed using legitimate administration tools, classical indicators of compromise (IOCs) lose their effectiveness, and traditional monitoring systems generate an excessive number of false alarms, thereby provoking "alert fatigue". To solve this problem, the paper proposes a methodology for the contextual validation of indicators of behavior (IOB) in Industrial Control Systems (ICS) networks. The primary scientific result is the developed "reverse enrichment" algorithm, which utilizes the deterministic nature of the technological process as a strict a priori filter. The algorithm verifies every control action by predicting the next state of the system using a state-space mathematical model and checking its membership in a formalized set of safe values, $\Omega_{safe}$. Additionally, the organizational context, $S_{org}$, including shift schedules and maintenance windows, is taken into account. Unlike probabilistic machine learning approaches, this method provides a strict binary criterion for command admissibility. The effectiveness of the proposed approach is confirmed by simulation results based on the verified dataset of the SWaT (Secure Water Treatment) academic testbed. The implementation of physical and organizational filters achieved a 97.7% False Positive Reduction Rate (FPRR) and successfully detected 1,021 out of 1,035 injected stealthy destructive impacts. The average computational latency of the algorithm was 1.4 ms, which fully satisfies the stringent requirements of real-time systems. The proposed method does not require the instrumentation of legacy field equipment and ensures the precise attribution of cyber incidents based on the physical laws of the production cycle.
References
1. Ongun T., Stokes J., Bar Or J. Living-Off-The-Land Command Detection Using Active Learning, RAID, 2021, pp. 442-455. DOI: 10.48550/arXiv.2111.15039.
2. Ning R., Bu W., Yang J., Duan S. A Survey of Detection Methods Research on Living-Off-The-Land Techniques, 2023 IEEE International Conference on Sensors, Electronics and Computer Engineering (ICSECE), 2023, pp. 159-164. DOI: 10.1109/ICSECE58870.2023.10263445.
3. Kelley K. Indicators of Compromise (IoCs) and Their Role in Attack Defence (RFC 9424), Internet Engineering Task Force, 2023. DOI: 10.17487/RFC9424.
4. Asiri M., Saxena N., Burnap P. Investigating Usable Indicators against Cyber-Attacks in Industrial Con-trol Systems, USENIX Symposium on Usable Privacy and Security (SOUPS), 2021.
5. Alahmadi B.A., Axon L., Martinovic I. 99% False Positives: A Qualitative Study of SOC Analysts’ Per-spectives on Security Alarms, 31st USENIX Security Symposium, 2022, pp. 2783-2800.
6. Asiri M., Arunasalam A., Saxena N., Celik Z.B. Frontline responders: Rethinking indicators of compro-mise for industrial control system security, Computers & Security, 2025, Vol. 154, pp. 104421. DOI: 10.1016/j.cose.2025.104421.
7. Atarskaya E.A., Vul'fin A.M., Uzbekova L.Ya. Sistema obnaruzheniya anomaliy sostoyaniya kiberfizi-cheskikh ob"ektov v zadache obespecheniya informatsionnoy bezopasnosti [System for detecting anomalies in the state of cyber-physical objects in the task of ensuring information security], Vestnik UGATU [Vestnik USATU], 2023, Vol. 27, No. 2, pp. 98-107.
8. Lyu S., Wang K., Zhang L., Wang B. Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition, Pattern Recognition, 2023, Vol. 141, Article 109661. DOI: 10.1016/j.patcog.2023.109661.
9. Erba A., Taormina R., Galelli S. et al. No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems, ACM ACSAC, 2020. DOI: 10.1145/3427228.3427261.
10. Müller N., Ziras C., Heussen K. Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems, IEEE International Conference on Communications, Control, and Com-puting Technologies for Smart Grids (SmartGridComm), 2022. DOI: 10.1109/SmartGridComm52983.2022.9961010.
11. Yahya M., Sharaf N., Rrushi J. et al. Physics Reasoning for Intrusion Detection in Industrial Networks, 2nd IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applica-tions (TPS-ISA), 2020. DOI: 10.1109/TPS-ISA50397.2020.00043.
12. Aftabi N., Li D., Ramanan P. A Variational Autoencoder Framework for Robust, Physics-Informed Cyberattack Recognition in Industrial Cyber-Physical Systems, arXiv:2310.06948, 2023. DOI: 10.48550/arXiv.2310.06948.
13. Ike M., Phan K., Sadoski K. et al. SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical, Proc. IEEE Symposium on Security and Privacy (SP), 2023, pp. 362-379. DOI: 10.1109/SP46215.2023.00067.
14. Basan E., Basan A., Nekrasov A., Fidge C., Ishchukova E., Basyuk A., Lesnikov A. Trusted Operation of Cyber-Physical Processes Based on Assessment of the System’s State and Operating Mode, Sensors, 2023, Vol. 23, No. 4, pp. 1996. DOI: 10.3390/s23041996.
15. Ahmed I., Obermeier S., Naedele M. et al. SCADA systems: Challenges for forensic investigators, Computer, 2012, Vol. 45, No. 12, pp. 44-51. DOI: 10.1109/MC.2012.325.
16. Kabasele Ndonda G., Sadre R. Exploiting the Temporal Behavior of State Transitions for Intrusion De-tection in ICS/SCADA, IEEE Access, 2022, Vol. 10, pp. 41535-41554. DOI: 10.1109/ACCESS.2022.3168864.
17. Asiri M., Saxena N., Gjomemo R., Burnap P. Understanding Indicators of Compromise against Cyber-attacks in Industrial Control Systems: A Security Perspective, ACM Transactions on Cyber-Physical Systems, 2023, Vol. 7, No. 2. DOI: 10.1145/3565972.
18. Abramov E.S., Belov N.E. Klassifikatsiya i otsenka kachestva istochnikov indikatorov komprometatsii [Classification and quality assessment of sources of indicators of compromise], Sistemnyy sintez i pri-kladnaya sinergetika: Sb. nauchnykh trudov XII Vseros. nauch. konf. [System Synthesis and Applied Synergetics: Proceedings of the XII All-Russian Scientific Conference]. Rostov-on-Don; Taganrog: YuFU, 2024, pp. 392-395.
19. Tumanov D.A., Abramov E.S. Poisk i skoring istochnikov indikatorov komprometatsii po industriyam [Search and scoring of sources of indicators of compromise by industry], Inzhenernyy vestnik Dona [Engineering Journal of Don], 2024, No. 8 (116).
20. Azzam M., Pasquale L., Provan G. et al. Forensic readiness of industrial control systems under stealthy attacks, Computers & Security, 2023, Vol. 125, pp. 103010. DOI: 10.1016/j.cose.2022.103010.
21. Radvanovsky R., Brodsky J. SCADA/Control Systems Security. Boca Raton: CRC Press, 2013, 330 p. – DOI: 10.1201/b19545.
22. Kotenko I.V., Khmyrov S.S. Model' komprometatsii ob"ektov kriticheskoy informatsionnoy infra-struktury [Model of compromise of critical information infrastructure objects], Aktual'nye problemy in-fotelekommunikatsiy v nauke i obrazovanii (APINO 2022) [Actual Problems of Infotelecommunications in Science and Education (APINO 2022)]. Saint Petersburg., 2022, Vol. 1, pp. 614-619.
23. Knowles W., Prince D., Hutchison D. et al. A survey of cyber security management in industrial control systems, International Journal of Critical Infrastructure Protection, 2015, Vol. 9, pp. 52-80. DOI: 10.1016/j.ijcip.2015.02.002.
24. Mathur A.P. SWaT: a water treatment testbed for research and training on ICS security, 2016 Interna-tional Workshop on Cyber-physical Systems for Smart Water Networks (CySWater). IEEE, 2016,
pp. 31-36. DOI: 10.1109/CySWater.2016.7469060.
25. Goh J. A dataset to support research in the design of secure water treatment systems, Critical Infor-mation Infrastructures Security: 11th International Conference, CRITIS 2016. Springer, 2017, pp. 88-99. DOI: 10.1007/978-3-319-71368-7_8.
