Techniques for detecting exploitation of manufacturing device vulnerabilities
View Patent ↗A system and method for determining device attributes using a classifier hierarchy. The method includes determining exploitation conditions for a manufacturing device based on a first set of device attributes of the manufacturing device and a second set of device attributes indicated in a vulnerabilities database; analyzing behavior and configuration of the manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the exploitation conditions; and performing mitigation actions based on the exploitable vulnerability. The vulnerabilities database further indicates known exploits for the second set of device attributes. Analyzing the behavior and configuration of the manufacturing device includes identifying that a port is open and querying a vulnerability scanner for identifying information of the open port, wherein the currently exploitable vulnerability is detected based further on the identifying information of the open port.
1. A method for detecting manufacturing device exploitable vulnerabilities, comprising:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class comprises a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the classifier output by a most recently applied sub-model and the hierarchy;
determining a first device attribute of a manufacturing device based on the classifier output by a last sub-model of the sequentially applied plurality of sub-models;
determining at least one exploitation condition for the manufacturing device based on the first device attribute of the manufacturing device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyzing the manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the at least one exploitation condition, wherein analyzing the behavior and configuration of the manufacturing device further comprises identifying that a port is open and querying a vulnerability scanner for identifying information of the open port; and
performing at least one mitigation action based on the exploitable vulnerability.
2. The method of claim 1 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes communicating with another device, wherein the plurality of known exploits includes communicating with an unapproved type of device.
3. The method of claim 2 , wherein the other device is an unapproved type of device, wherein performing the at least one mitigation action further comprises:
severing a connection between the manufacturing device and the other device.
4. The method of claim 1 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes receiving update data from another device, wherein the plurality of known exploits includes receiving update data from an unapproved type of device.
5. The method of claim 4 , wherein the other device is an unapproved type of device, wherein performing the at least one mitigation action further comprises:
deleting the update data received from the other device; and
sending new update data to the manufacturing device.
6. The method of claim 1 , wherein the manufacturing device is any of a programmable logic controller, a human-machine interface, a supervisory control and data acquisition (SCADA) system, an engineering station, and a historian server.
7. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class comprises a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the classifier output by a most recently applied sub-model and the hierarchy;
determining a first device attribute of a manufacturing device based on the classifier output by a last sub-model of the sequentially applied plurality of sub-models;
determining at least one exploitation condition for a manufacturing device based on the first device attribute of the manufacturing device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyzing manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the at least one exploitation condition, wherein analyzing the behavior and configuration of the manufacturing device further comprises identifying that a port is open and querying a vulnerability scanner for identifying information of the open port; and
performing at least one mitigation action based on the exploitable vulnerability.
8. A system for determining device attributes using a classifier hierarchy, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class comprises a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the classifier output by a most recently applied sub-model and the hierarchy;
determining a first device attribute of a manufacturing device based on the classifier output by a last sub-model of the sequentially applied plurality of sub-models;
determine at least one exploitation condition for the manufacturing device based on a first device attribute of the manufacturing device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyze the manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the at least one exploitation condition, wherein analyzing the behavior and configuration of the manufacturing device further includes identifying that a port is open and querying a vulnerability scanner for identifying information of the open port; and
perform at least one mitigation action based on the exploitable vulnerability.
9. The system of claim 8 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes communicating with another device, wherein the plurality of known exploits includes communicating with an unapproved type of device.
10. The system of claim 9 , wherein the other device is an unapproved type of device, wherein the system is further configured to:
sever a connection between the manufacturing device and the other device.
11. The system of claim 8 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes receiving update data from another device, wherein the plurality of known exploits includes receiving update data from an unapproved type of device.
12. The system of claim 11 , wherein the other device is an unapproved type of device, wherein the system is further configured to:
delete the update data received from the other device; and
send new update data to the manufacturing device.
13. The system of claim 8 , wherein the manufacturing device is any of a programmable logic controller, a human-machine interface, a supervisory control and data acquisition (SCADA) system, an engineering station, and a historian server.
14. The non-transitory computer readable medium of claim 7 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes communicating with another device, wherein the plurality of known exploits includes communicating with an unapproved type of device.
15. The non-transitory computer readable medium of claim 14 , wherein the other device is an unapproved type of device, wherein the system is further configured to:
sever a connection between the manufacturing device and the other device.
16. The non-transitory computer readable medium of claim 7 , wherein the first device attribute includes a device type, wherein the behavior of the manufacturing device includes receiving update data from another device, wherein the plurality of known exploits includes receiving update data from an unapproved type of device.
17. The non-transitory computer readable medium of claim 7 , wherein the other device is an unapproved type of device, wherein the system is further configured to:
delete the update data received from the other device; and
send new update data to the manufacturing device.
18. The non-transitory computer readable medium of claim 7 , wherein the manufacturing device is any of a programmable logic controller, a human-machine interface, a supervisory control and data acquisition (SCADA) system, an engineering station, and a historian server.