Command Disaggregation Attack and Mitigation in Industrial Internet of Things.

Area of Science:

• Cyber-physical systems security
• Industrial Internet of Things (IIoT) security

Background:

• Cyber-physical attacks in IIoT pose significant risks to physical systems.
• Command disaggregation attacks, which manipulate disaggregated commands via controllers, are a specific threat.
• Existing detection methods are insufficient against sophisticated attack models.

Purpose of the Study:

• To investigate command disaggregation attacks in IIoT.
• To analyze the impact of these attacks on physical processes.
• To develop an effective detection mechanism for command disaggregation attacks.

Main Methods:

• Depicting two command disaggregation attack modes: disordered sequences and misallocated sub-commands.
• Describing three novel attack models designed to evade current detection.
• Proposing a detection framework utilizing correlations between central controller outputs and actuator inputs.

Main Results:

• Demonstrated the effectiveness of the proposed framework in detecting command disaggregation attacks.
• Validated the framework's performance through two case studies with varying attack models.
• Showcased the framework's ability to detect attacks before physical process disruptions occur.

Conclusions:

• The developed framework effectively detects command disaggregation attacks in IIoT.
• Analyzing correlations in two-tier command sequences is crucial for robust security.
• Further enhancements to the detection framework are discussed for improved resilience.