A comprehensive survey on deep learning based malware detection techniques

Since the 1990s, the digitalization process has transformed the communication infrastructure within the electrical grid: proprietary infrastructures and protocols have been replaced by the IEC 61850 approach, which realizes interoperability among vendors. Furthermore, the latest networking solutions merge operational technologies (OTs) and informational technology (IT) traffics in the same media, such as time-sensitive networking (TSN)—standard, interoperable, deterministic, and Ethernet-based. It merges OT and IT worlds by defining three basic traffic types: scheduled, best-effort, and reserved traffic. However, TSN demands security against potential new cyberattacks, primarily, to protect real-time critical messages. Consequently, security in the smart grid has turned into a hot topic under regulation, standardization, and business. This survey collects vulnerabilities of the communication in the smart grid and reveals security mechanisms introduced by international electrotechnical commission (IEC) 62351-6 and how to apply them to time-sensitive networking.

A Survey on Vulnerabilities and Countermeasures in the Communications of the Smart Grid

The IEEE 1588 Precision Time Protocol (PTP) is a widely used mechanism to provide time synchronization of computer clocks down to microsecond accuracy as required by many financial and industrial applications ("IEEE Standard for a Precision Clock Synchronization Protocol for Networked Measurement and Control Systems," 2008). However, PTP is vulnerable to infrastructure cyber-attacks that reduce the desired accuracy. IEEE 1588 defined an experimental security extension (Annex K) in order to protect a PTP network, but various drawbacks have been discovered, resulting in further improvements including the use of public-key encryption ( Itkin & Wool, 2020 ) and reduce the three-way handshake mechanism to one way authentication ( Onal & Kirrmann, 2012 ). Today Annex K is deprecated in favor of L2 / L3 security mechanisms. Further on, in 2020 a backwards compatible IEEE 1588 version (v2.1) will be introduced, that contains a new security extension called Annex S. Annex S consists of four prongs as follows ("IEEE Draft Standard for a Precision Clock Synchronization Protocol for Networked Measurement and Control Systems," 2019): • Prong (A) PTP Integrated Security Mechanism describes an authentication type-length-value (TLV) that is aligned with and integrated into the PTP message. • Prong (B) PTP External Transport Security Mechanisms describes the current external security mechanisms that can be used to provide protection to PTP message i.e., IPsec and MACsec. • Prong (C) Architecture Guidance describes a redundant time system, redundant grandmaster, and redundant paths. • Prong D (Monitoring and Management Guidance) suggests monitoring the slaves’ synchronization process.

A Detection Model Against Precision Time Protocol Attacks

The IEEE 1588 precision time protocol (PTP) is very important for many industrial sectors and applications that require time synchronization accuracy between computers down to microsecond and even nanosecond levels. Nevertheless, PTP and its underlying network infrastructure are vulnerable to cyber-attacks, which can stealthily reduce the time synchronization accuracy to unacceptable and even damage-causing levels for individual clocks or an entire network, leading to financial loss or even physical destruction. Existing security protocol extensions only partially address this problem. This paper provides a comprehensive analysis of strategies for advanced persistent threats to PTP infrastructure, possible attacker locations, and the impact on clock and network synchronization in the presence of security protocol extensions, infrastructure redundancy, and protocol redundancy. It distinguishes between attack strategies and attacker types as described in RFC7384, but further distinguishes between the spoofing and time source attack, the simple internal attack, and the advanced internal attack. Some experiments were conducted to demonstrate the impact of PTP attacks. Our analysis shows that a sophisticated attacker has a range of methodologies to compromise a PTP network. Moreover, all PTP infrastructure components can host an attacker, making the comprehensive protection of a PTP network against a malware infiltration, as for example exercised by Stuxnet, a very tedious task.

/pdf/precision-time-protocol-attack-strategies-and-their-4q8ltw09nl.pdf

Precision time protocol attack strategies and their resistance to existing security extensions

The Precision Time Protocol is essential for many time-sensitive and time-aware applications. However, it was never designed for security, and despite various approaches to harden this protocol against manipulation, it is still prone to cyber-attacks. Here Advanced Persistent Threats (APT) are of particular concern, as they may stealthily and over extended periods of time manipulate computer clocks that rely on the accurate functioning of this protocol. Simulating such attacks is difficult, as it requires firmware manipulation of network and PTP infrastructure components. Therefore, this paper proposes and demonstrates a programmable Man-in-the-Middle (pMitM) and a programmable injector (pInj) device that allow the implementation of a variety of attacks, enabling security researchers to quantify the impact of APTs on time synchronisation.

Practical Implementation of APTs on PTP Time Synchronisation Networks

High accurate time synchronization is very important for many applications and industrial environments. In a computer network, synchronization of time for connected devices is provided by the Precision Time Protocol (PTP), which in principal allows for device time synchronization down to microsecond level. However, PTP and network infrastructures are vulnerable to cyber-attacks, which can de-synchronize an entire network, leading to potentially devastating consequences. This paper will focus on the issue of internal attacks on time synchronization networks and discuss how counter-measures based on public key infrastructures, trusted platform modules, network intrusion detection systems and time synchronization supervisors can be adopted to defeat or at least detect such internal attacks.

Advanced methodologies to deter internal attacks in PTP time synchronization networks

The IEEE 1588 precision time protocol (PTP) is used by many time-sensitive applications and systems, as it achieves sub-microsecond time synchronization between computer clocks. However, a PTP network is vulnerable to cyber-attacks that can reduce the protocol accuracy to unacceptable levels for some or all clocks in a network with potentially devastating consequences. Of particular concern are advanced persistent threats (APT), where an actor infiltrates a network and operates stealthily and over extended periods of time before being discovered. This paper investigates the impact of the most important APT strategies on a PTP network, i.e., the delay attack, packet modification or transparent clock attack, and time reference attack, using a fully programable and customizable man in the middle device, thereby considering the two most popular PTP slave daemons PTPd and PTP4l. In doing so, it determines suitable attack patterns and parameters to compromise the time synchronization covertly.

Cyber Attacks on Precision Time Protocol Networks—A Case Study

The IEEE 1588 Precision Time Protocol (PTP) is very important for many financial and industrial applications, as it can provide highly accurate time synchronisation down to microsecond level. However, any PTP infrastructure is vulnerable to cyber-attacks that can de-synchronise some or all network devices, causing potentially destructive consequences. This paper will focus on how two of these attacks, the asymmetric delay and the byzantine attack, can be implemented in a PTP network, analyses their impact on slave clocks, and investigates how these attacks can be detected.

Waleed Alghamdi

Papers

Advanced methodologies to deter internal attacks in PTP time synchronization networks

Cyber Attacks on Precision Time Protocol Networks—A Case Study

Precision time protocol attack strategies and their resistance to existing security extensions

Practical Implementation of APTs on PTP Time Synchronisation Networks

Slave Clock Responses to Precision Time Protocol Attacks: A Case Study