Industrial Control Systems are part of our daily life in industries such as transportation, water, gas, oil, smart cities, and telecommunications. Technological development over time have improved their components including operating system platforms, hardware capabilities, and connectivity with networks inside and outside the organization. Consequently, the Industrial Control Systems components are exposed to sophisticated threats with weak security mechanism in place. This paper proposes a supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system. A testbed of such a system is implemented using the Festo MPA Control Process Rig. The machine-learning algorithms, which include SVN, KNN, and Random Forest, perform classification tasks process in three different datasets obtained from the testbed. The algorithms are compared in terms of accuracy and F-measure. The results show that Random Forest achieves 5% better performance over KNN and SVM with small datasets and 4% regarding large datasets. For the time taken to build the model, KNN presents the best performance. However, its difference with Random Forest is smaller than with SVM.

Industrial Control Systems are an essential part of our daily lives and can be found in industries such as oil, utilities, and manufacturing. Rapid growth in technology has introduced industrial components with network capabilities that allow them to communicate with traditional computer networks, thus increasing their exposure to cyber-attacks. Current research on Industrial Control Systems suffer from lack of technical information as these systems are part of critical infrastructures. To overcome this, researchers have employed different types of testbeds to develop their mechanisms of cyber-attack detection and prevention. This manuscript describes, implements, and evaluates physical, hybrid, and virtual application of a clean water supply system developed for cybersecurity research. The results show that physical testbeds allow an understanding of the behaviour and dynamics of control components like sensors and actuators, which might be affected by external influences such as noise, vibration, temperature, and non-ideal device behaviour. Although, hybrid testbeds reduce the cost of implementation, they ignore the physical dynamics of the system as explained above. Virtual testbeds are the cheapest option in comparison with physical and hybrid testbeds; however, they provide a limited view of the control system operation that could have negative consequences when developing a detection/prevention system.

Industrial Control Systems (ICS) have faced a growing number of threats over the past few years. Reliance on isolated controls networks or air-gapped computers is no longer a feasible solution when it comes to protecting ICS. New architectures of control system networks have allowed businesses to access the data from Distributed Control Systems (DCS) or Programming Logic Controllers (PLC) from anywhere in a real-time manner. On the other hand, this connectivity exposes control system networks, with low or poor security in place, to a wide range of new attacks such as ransomware, trojans and malware. In this paper, we present a stealthy malware named as WaterLeakage that exfiltrates information from an uninterrupted clean water supply system using a visual covert channel. For the experiment, we physically modelled such a system using the Festo Rig MPA Compact Workstation. Our developed plug and play WaterLeakage malware is placed on a Raspberry Pi connected to the control system network. The malware extracts vital information from the PLC such as CPU Model, Vendor, and Input Memory Values and then exfiltrates this information using two lamps connected to the output memory of the PLC. In our experiments, a receiver has been configured with two different resolutions to record the exfiltrated information and further decode them back to the original sensitive data. The results show that by using our WaterLeakage malware an attacker can successfully collect the important information from the control process, which can be used further to plan more sophisticated attacks on ICS.