Detecting Safety and Security Faults in PLC Systems with Data Provenance

TL;DR

This paper introduces PLC-PROV, a system that tracks inputs and outputs in PLC systems to detect safety and security violations, enhancing security in critical industrial infrastructures.

Contribution

The paper presents PLC-PROV, a novel provenance-based system for detecting safety and security faults in PLC systems by monitoring input-output consistency.

Findings

PLC-PROV effectively detects safety violations in smart building scenarios.

The system can identify security breaches like unauthorized input manipulation.

Application demonstrates improved fault detection in industrial control systems.

Abstract

Programmable Logic Controllers are an integral component for managing many different industrial processes (e.g., smart building management, power generation, water and wastewater management, and traffic control systems), and manufacturing and control industries (e.g., oil and natural gas, chemical, pharmaceutical, pulp and paper, food and beverage, automotive, and aerospace). Despite being used widely in many critical infrastructures, PLCs use protocols which make these control systems vulnerable to many common attacks, including man-in-the-middle attacks, denial of service attacks, and memory corruption attacks (e.g., array, stack, and heap overflows, integer overflows, and pointer corruption). In this paper, we propose PLC-PROV, a system for tracking the inputs and outputs of the control system to detect violations in the safety and security policies of the system. We consider a smart building as an example of a PLC-based system and show how PLC-PROV can be applied to ensure that the inputs and outputs are consistent with the intended safety and security policies.