Systems and methods for real-time binary analysis with hot patching of programmable logic controllers
Described herein are systems and methods for performing real-time binary analysis of code running in programmable logic controllers, and specifically to systems and methods for generating patches, testing patches, and implementing patches on programmable logic controllers while the controller is operating is provided. In one or more examples, a profile of the physical operation controlled by the PLC and the broader system can be generated. In one or more examples, once a profile has been generated, the system and methods described herein can capture data images that provide information regarding the operation of the system as well as the PLC. Based on the received data images, and the generated profile, the system can detect anomalies and/or safety constraint violations in the operation of the system that can be rectified or mitigated through patching (i.e., modification of the datasets or binary code used by the PLC).
1. A method for deploying a patch for a programmable logic controller (PLC) deployed within a system, the method comprising:
generating a profile of the PLC, wherein the generated profile comprises one or more patterns observed in one or more data variables associated with operation of the PLC, wherein generating the profile of the PLC comprises:
receiving one or more selections indicating the one or more data variables associated with operation of the PLC to observe,
operating the system that the PLC is deployed on,
observing the one or more data variables associated with operation of the PLC,
determining the one or more patterns within the one or more data variables,
determining that the observation of the one or more data variables is sufficient to generate the profile, and
generating the profile based on the one or more patterns within the one or more data variables;
receiving one or more data images of the PLC, wherein the data images of the PLC comprise recorded values of the one or more data variables associated with operation of the PLC and collected during operation of the PLC;
detecting one or more anomalies in the received one or more data images based on, at least in part, a comparison between the received one or more data images and the generated profile;
determining a patching strategy based on the detected anomalies;
generating a patch based on the determined patching strategy; and
installing the patch on the PLC while the PLC is operating the system.
2. The method of claim 1 , wherein determining that the observation of the one or more data variables is sufficient to generate the profile comprises:
comparing the observed one or more data variables to the one or more patterns within the one or more data variables; and
determining whether the one or more patterns occur in the observed one or more data variables above a pre-determined percentage.
3. The method of claim 1 , wherein the one or more data variables associated with operation of the PLC of the received one or more data images comprise the one or more data variables indicated by the received one or more selections.
4. The method of claim 1 , wherein detecting one or more anomalies in the received one or more data images comprises applying threat intelligence information to the received one or more data images.
5. The method of claim 1 , wherein detecting one or more anomalies in the received one or more data images comprises detecting one or more control logic invariant violations in the one or more data images.
6. The method of claim 1 , wherein detecting one or more anomalies in the received one or more data images comprises determining a mode of operation of the system that the PLC is deployed on.
7. The method of claim 1 , wherein determining a patching strategy based on the detected anomalies comprises:
identifying one or more regions of interest in one or more portions of an operating code of the PLC based on the detected anomalies;
performing a causality analysis on each of the identified one or more regions of interest; and
determining the patching strategy based on the identified one or more regions of interest and the performed causality analysis.
8. A computing system for deploying a patch for a programmable logic controller (PLC) deployed within a system, the computing system comprising:
a memory;
one or more processors; and
one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs when executed by the one or more processors cause the processor to:
generate a profile of the PLC, wherein the generated profile comprises one or more patterns observed in one or more data variables associated with operation of the PLC, wherein generating the profile of the PLC comprises:
receiving one or more selections indicating the one or more data variables associated with operation of the PLC to observe,
operating the system that the PLC is deployed on,
observing the one or more data variables associated with operation of the PLC,
determining the one or more patterns within the one or more data variables,
determining that the observation of the one or more data variables is sufficient to generate the profile, and
generating the profile based on the one or more patterns within the one or more data variables;
receive one or more data images of the PLC, wherein the data images of the PLC comprise recorded values of the one or more data variables associated with operation of the PLC and collected during operation of the PLC;
detect one or more anomalies in the received one or more data images based on, at least in part, a comparison between the received one or more data images and the generated profile;
determine a patching strategy based on the detected anomalies;
generate a patch based on the determined patching strategy; and
install the patch on the PLC while the PLC is operating the system.
9. The computing system of claim 8 , wherein determining that the observation of the one or more data variables is sufficient to generate the profile comprises:
comparing the observed one or more data variables to the one or more patterns within the one or more data variables; and
determining whether the one or more patterns occur in the observed one or more data variables above a pre-determined percentage.
10. The computing system of claim 8 , wherein the one or more data variables associated with operation of the PLC of the received one or more data images comprise the one or more data variables indicated by the received one or more selections.
11. The computing system of claim 8 , wherein detecting one or more anomalies in the received one or more data images comprises applying threat intelligence information to the received one or more data images.
12. The computing system of claim 8 , wherein detecting one or more anomalies in the received one or more data images comprises detecting one or more control logic invariant violations in the one or more data images.
13. The computing system of claim 8 , wherein detecting one or more anomalies in the received one or more data images comprises determining a mode of operation of the system that the PLC is deployed on.
14. The computing system of claim 8 , wherein determining a patching strategy based on the detected anomalies comprises:
identifying one or more regions of interest in one or more portions of an operating code of the PLC based on the detected anomalies;
performing a causality analysis on each of the identified one or more regions of interest; and
determining the patching strategy based on the identified one or more regions of interest and the performed causality analysis.
15. A non-transitory computer readable storage medium storing one or more programs for deploying a patch for a programmable logic controller (PLC) deployed within a system, the one or more programs comprising instructions, which, when executed by an electronic device with a display and a user input interface, cause the device to:
generate a profile of the PLC, wherein the generated profile comprises one or more patterns observed in one or more data variables associated with operation of the PLC, wherein generating the profile of the PLC comprises:
receiving one or more selections indicating the one or more data variables associated with operation of the PLC to observe,
operating the system that the PLC is deployed on,
observing the one or more data variables associated with operation of the PLC,
determining the one or more patterns within the one or more data variables,
determining that the observation of the one or more data variables is sufficient to generate the profile, and
generating the profile based on the one or more patterns within the one or more data variables;
receive one or more data images of the PLC, wherein the data images of the PLC comprise recorded values of the one or more data variables associated with operation of the PLC and collected during operation of the PLC;
detect one or more anomalies in the received one or more data images based on, at least in part, a comparison between the received one or more data images and the generated profile;
determine a patching strategy based on the detected anomalies;
generate a patch based on the determined patching strategy; and
install the patch on the PLC while the PLC is operating the system.
16. The non-transitory computer readable storage medium of claim 15 , wherein determining that the observation of the one or more data variables is sufficient to generate the profile comprises:
comparing the observed one or more data variables to the one or more patterns within the one or more data variables; and
determining whether the one or more patterns occur in the observed one or more data variables above a pre-determined percentage.
17. The non-transitory computer readable storage medium of claim 15 , wherein the one or more data variables associated with operation of the PLC of the received one or more data images comprise the one or more data variables indicated by the received one or more selections.
18. The non-transitory computer readable storage medium of claim 15 , wherein detecting one or more anomalies in the received one or more data images comprises applying threat intelligence information to the received one or more data images.
19. The non-transitory computer readable storage medium of claim 15 , wherein detecting one or more anomalies in the received one or more data images comprises detecting one or more control logic invariant violations in the one or more data images.
20. The non-transitory computer readable storage medium of claim 15 , wherein detecting one or more anomalies in the received one or more data images comprises determining a mode of operation of the system that the PLC is deployed on.
21. The non-transitory computer readable storage medium of claim 15 , wherein determining a patching strategy based on the detected anomalies comprises:
identifying one or more regions of interest in one or more portions of an operating code of the PLC based on the detected anomalies;
performing a causality analysis on each of the identified one or more regions of interest; and
determining the patching strategy based on the identified one or more regions of interest and the performed causality analysis.