PREEMPTIVE

Mar 1, 2014
SITE

Funded by: EU FP7-SECURITY. Grant agreement ID: 607093.

March 2014 – February 2017.

Total funding: 3.83M Euro.

In recent years, we have witnessed an increase in the number and impact of cyber attacks. A successful attack might affect, or even endanger, daily human activities. Multiple countermeasures have been put in place to prevent Advanced Persistent Threat (APT) attacks, but they failed, allowing the latest generation of APT. The goal of PREEMPTIVE is to provide an innovative solution for enhancing existing methods and conceiving tools to prevent against cyber attacks, that target utility networks.

PREEMPTIVE addresses the prevention of cyber attacks against hardware and software systems such as DCS, SCADA, PLC, networked electronic sensing, and monitoring and diagnostic systems used by the utilities networks. Moreover, the research aims to implement detection tools based on a dual approach comprising low direct detection and process misbehavior detection PREEMPTIVE proposes to:

  • Enhance existing methodological security and prevention frameworks with the aim of harmonizing Risk and Vulnerability Assessment methods, standard policies, procedures and applicable regulations or recommendations to prevent cyber attacks.
  • Design and develop prevention and detection tools complaint to the dual approach that takes into account both the industrial process misbehavior analysis (physical domain) and the communication & software anomalies (cyber domain):
    • Industrial process misbehavior detection tools.
    • Communication & software related threats prevention and detection tools.
  • Define a taxonomy for classifying the utilities networks taking into account:
    • The utility network type and communication technology used
    • The utility network exposure to Cyber threats
    • The impact to the citizens of services disruption caused by a cyber attack through the utility network.
  • Define guidelines for improving Critical Infrastructure (CI) surveillance.
  • Validate the PREEMPTIVE framework and innovative technologies in real scenarios with the support of the utility companies
Intrusion Detection Incident Response Industrial Control Systems
Emmanuele Zambon
Emmanuele Zambon
Assistant Professor

My research interests include Industrial Control System security and network intrusion detection.

Publications

Specification Mining for Intrusion Detection in Networked Control Systems
This paper discusses a novel approach to specification-based intrusion detection in the field of networked control systems. Our approach reduces the substantial human effort required to deploy a specification-based intrusion detection system by automating the development of its specification rules.
Marco Caselli, Emmanuele Zambon, Johanna Amann, Robin Sommer, Frank Kargl
PDF Cite Project DOI
Through the eye of the PLC: semantic security monitoring for industrial processes
Off-the-shelf intrusion detection systems prove an ill fit for protecting industrial control systems. Specifically, current systems fail to detect recent process control attacks. In this work we present a detector that continuously tracks updates to corresponding process variables to then derive variable-specific prediction models as the basis for assessing future activity.
Dina Hadžiosmanović, Robin Sommer, Emmanuele Zambon, Pieter H. Hartel
PDF Cite Project Project DOI