Papers for

industrial cybersecurity teams

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Automated defense strategies improve industrial control system security

Learning Intrusion Response Strategies for OT Systems

Abstract: Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.

Wed 9 SeptCryptography and SecurityArtificial Intelligence
The gist
Industrial control systems that operate critical infrastructure like power plants and factories are at risk from cyberattacks. The authors developed a way to automatically decide how to respond to intrusions, even though they only partially observe the network traffic. They used a type of machine learning called PPO to learn effective defense strategies. When tested on a simulated industrial system, these strategies successfully defended against various cyberattacks. This approach helps protect essential services by automating complex security decisions.
Open → 2609.10298v1

Iiot sensor node criticality ranked by data and security risks

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Abstract: The integration of the Industrial Internet of Things (IIoT) into manufacturing has transformed industrial operations by optimising production management and ensuring product quality through smart industrial sensors that regulate processes based on real-time data. However, these sensor nodes are highly vulnerable to cyber threats, posing significant security risks that compromise their reliability and integrity. While existing research explores cybersecurity vulnerabilities and cyberattack-based methods for ranking critical nodes, some studies assess node criticality based on the impact of sensor data on product quality. However, a comprehensive approach that integrates both data criticality and cybersecurity vulnerability remains unexplored. To bridge this gap, this study introduces a novel framework that evaluates IIoT sensor node criticality by leveraging Dempster--Shafer (D-S) theory to fuse data criticality and cybersecurity vulnerabilities. The proposed method is validated using a dataset from red wine production, demonstrating its effectiveness in ranking sensor nodes based on both factors. The results show that criticality rankings based on security vulnerability scores computed using CVSS version 4.0 differ significantly from those obtained with CVSS version 3.1, highlighting the influence of enhanced vulnerability assessment methodologies. While initially applied to wine manufacturing, this framework is adaptable to broader industrial applications with minimal modifications, offering a robust approach to securing IIoT-enabled production systems.

Wed 9 SeptCryptography and Security
The gist
Industrial sensors help factories run smoothly by constantly checking processes. But these sensors can be hacked or fail, which causes trouble. The authors made a way to figure out which sensors are most important by looking at both how their data affects the product and how vulnerable they are to cyberattacks. They tested their method using sensors in wine production and found some differences depending on the security scoring system used. This approach can be used in many factories to keep sensor networks more secure and reliable.
Open → 2609.09807v1