%0 Conference Proceedings
%T Detecting Anomalous Programmable Logic Controller Events Using Machine Learning
%+ The University of Hong Kong (HKU)
%A Yau, Ken
%A Chow, Kam-Pui
%Z Part 2: Mobile and Embedded Device Forensics
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 13th IFIP International Conference on Digital Forensics (DigitalForensics)
%C Orlando, FL, United States
%Y Gilbert Peterson
%Y Sujeet Shenoi
%I Springer International Publishing
%3 Advances in Digital Forensics XIII
%V AICT-511
%P 81-94
%8 2017-01-30
%D 2017
%R 10.1007/978-3-319-67208-3_5
%K Programming logic controllers
%K Forensics
%K Machine learning
%Z Computer Science [cs]Conference papers
%X Industrial control system failures can be hazardous to human lives and the environment. Programmable logic controllers are major components of industrial control systems that are used across the critical infrastructure. Attack and accident investigations involving programmable logic controllers rely on forensic techniques to establish the root causes and to develop mitigation strategies. However, programmable logic controller forensics is a challenging task, primarily because of the lack of system logging. This chapter proposes a novel methodology that logs the values of relevant memory addresses used by a programmable logic controller program along with their timestamps. Machine learning techniques are applied to the logged data to identify anomalous or abnormal programmable logic controller operations. An application of the methodology to a simulated traffic light control system demonstrates its effectiveness in performing forensic investigations of programmable logic controllers.
%G English
%Z TC 11
%Z WG 11.9
%2 https://inria.hal.science/hal-01716409/document
%2 https://inria.hal.science/hal-01716409/file/456364_1_En_5_Chapter.pdf
%L hal-01716409
%U https://inria.hal.science/hal-01716409
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-WG
%~ IFIP-TC11
%~ IFIP-DF
%~ IFIP-WG11-9
%~ IFIP-AICT-511