ICSML: Industrial Control Systems ML Framework for native inference using IEC 61131-3 code

TL;DR

This paper introduces ICSML, a framework enabling native machine learning inference directly on PLCs using IEC 61131-3 code, enhancing security and efficiency in industrial control systems by eliminating reliance on external hardware.

Contribution

The paper presents a novel ML inference framework for PLCs that operates natively in IEC 61131-3, with optimizations and benchmarks demonstrating its effectiveness and broad compatibility.

Findings

ICSML runs efficiently on various PLCs without vendor support

Benchmark results show competitive performance with TFLite

Domain-specific optimizations improve inference efficiency

Abstract

Industrial Control Systems (ICS) have played a catalytic role in enabling the 4th Industrial Revolution. ICS devices like Programmable Logic Controllers (PLCs), automate, monitor, and control critical processes in industrial, energy, and commercial environments. The convergence of traditional Operational Technology (OT) with Information Technology (IT) has opened a new and unique threat landscape. This has inspired defense research that focuses heavily on Machine Learning (ML) based anomaly detection methods that run on external IT hardware, which means an increase in costs and the further expansion of the threat landscape. To remove this requirement, we introduce the ICS machine learning inference framework (ICSML) which enables executing ML model inference natively on the PLC. ICSML is implemented in IEC 61131-3 code and provides several optimizations to bypass the limitations imposed by the domain-specific languages. Therefore, it works on every PLC without the need for vendor support. ICSML provides a complete set of components for creating full ML models similarly to established ML frameworks. We run a series of benchmarks studying memory and performance, and compare our solution to the TFLite inference framework. At the same time, we develop domain-specific model optimizations to improve the efficiency of ICSML. To demonstrate the abilities of ICSML, we evaluate a case study of a real defense for process-aware attacks targeting a desalination plant.