English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Cyber-physical systems (CPSs) are widespread in critical domains, andsignificant damage can be caused if an attacker is able to modify the code oftheir programmable logic controllers (PLCs). Unfortunately, traditionaltechniques for attesting code integrity (i.e. verifying that it has not beenmodified) rely on firmware access or roots-of-trust, neither of whichproprietary or legacy PLCs are likely to provide. In this paper, we propose apractical code integrity checking solution based on privacy-preserving blackbox models that instead attest the input/output behaviour of PLC programs.Using faithful offline copies of the PLC programs, we identify their mostimportant inputs through an information flow analysis, execute them on multiplecombinations to collect data, then train neural networks able to predict PLCoutputs (i.e. actuator commands) from their inputs. By exploiting the black boxnature of the model, our solution maintains the privacy of the original PLCcode and does not assume that attackers are unaware of its presence. The trustinstead comes from the fact that it is extremely hard to attack the PLC codeand neural networks at the same time and with consistent outcomes. We evaluatedour approach on a modern six-stage water treatment plant testbed, finding thatit could predict actuator states from PLC inputs with near-100% accuracy, andthus could detect all 120 effective code mutations that we subjected the PLCsto. Finally, we found that it is not practically possible to simultaneouslymodify the PLC code and apply discreet adversarial noise to our attesters in away that leads to consistent (mis-)predictions.

Code Integrity Attestation for PLCs using Black Box Neural Network Predictions