System and method for protection of an ics network by an hmi server therein

Abstract

A defense suite for an industrial control system (ICS) network is disclosed. The defense suite is installed and executed on a network server hosting the human-machine interface (HMI) function of the network, thereby gaining communication privileges of the HMI server to query and perform other operations with programmable logic controllers (PLCs) and other assets of the network. The defense suite further comprises a network protection engine (NWPE) that alerts a defense suite user of suspicious activity in the network. Normal behavior of the network is obtained by a learning engine, during a learning period. The learning engine can be reactivated after a configuration change in the network. The data suite also comprises an operating system protection engine (OSPE), for preventing removable devices from accessing the HMI server and a preventing execution of unauthorized executables. The OSPE is also trained for which programs are authorized through its own program discovery module.

1 . An abnormal human-machine interface (HMI) behavior (AHB) detection module of an HMI server in an industrial control system (ICS) network, the AHB detection module configured to:
 a. receive tag-related operation attribute vectors (TAVs) extracted by a packet sniffing and analysis module (PSA) module from each data packet communicated between said HMI server and one or more programmable logic controllers (PLCs), wherein the PSA module is configured to:
 i. obtain data packets communicated between the HMI server and assets in the ICS network, wherein the assets comprise one or more PLCs, and wherein the HMI server comprises communication privileges while communicating with the assets; and 
 ii. extract attributes of the obtained data packets; 
   b. compare said extracted TAVs with whitelisted tag-related operations attributes in a tag-related operations whitelist (TWL) file in said database;   c. if the packet was sent from the HMI server to a PLC and extracted TAVs are not in the TWL and is not preceded by activity of input devices of the HMI server within a maximum interval before said tag-related operation, then issue a new tag-related operation (NT) alert; and   d. If the packet is packet that sent from a PLC to the HMI server and said extracted TAVs are not in said TWL, then issue a new tag-related operation (NT) alert.   
     
     
         2 . The AHB detection module of  claim 1 , configured to:
 a. monitor activity of input devices of the HMI server, wherein the input devices comprise a keyboard and a mouse; and   b. compare the monitored activity to data packets communicated between the HMI server and assets in the ICS network.   
     
     
         3 . The AHB detection module of  claim 2 , wherein said maximum interval between said input device activity and said tag-related operation is 0.5 seconds. 
     
     
         4 . The AHB detection module of  claim 1 , wherein the TAVs are received during a learning period. 
     
     
         5 . A method of detecting abnormal human-machine interface (HMI) behavior of an HMI server in an industrial control system (ICS) network, the method comprising:
 monitoring activity of input devices of the HMI server;   receiving tag-related operation attribute vectors (TAVs), extracted by a packet sniffing and analysis module (PSA) module, from each data packet communicated between the HMI server and one or more programmable logic controllers (PLCs);   obtaining data packets communicated between the HMI server and assets in the ICS network, wherein the assets comprise one or more PLCs, and wherein the HMI server comprises communication privileges while communicating with the assets;   extracting attributes of the obtained data packets;   comparing the extracted TAVs with whitelisted tag-related operations attributes in a tag-related operations whitelist (TWL);   if the data packet was sent from the HMI server to a PLC and the extracted TAVs is not in the TWL, and is not preceded by activity of the input devices within a maximum interval before the tag-related operation, issuing a tag-related operation alert; and   if the packet is sent from the PLC to the HMI server and the extracted TAVs is not in the TWL, issuing a tag-related operation alert.   
     
     
         6 . The method of  claim 5 , comprising:
 monitoring activity of input devices of the HMI server, wherein the input devices comprise a keyboard and a mouse; and   comparing the monitored activity to data packets communicated between the HMI server and assets in the ICS network.   
     
     
         7 . The method of  claim 5 , wherein the maximum interval between the input device activity and the tag-related operation is 0.5 seconds. 
     
     
         8 . The method of  claim 5 , wherein the TAVs are received during a learning period.