An autonomous system resets critical devices to counter OT intrusions

A research team from the KTH Royal Institute of Technology has developed an autonomous defense agent capable of deciding when to intervene in critical industrial networks, even going so far as to reset devices to counter ongoing intrusions. The system is based on a model trained with real network traffic data collected during simulated attacks on an emulated infrastructure.

Quick Response

  • The autonomous agent analyzes six network traffic parameters to assess the state of an intrusion
  • It can intervene with selective or total resets of devices, with minimal impact on operations
  • The system is based on real traffic measurements collected during simulated attacks
  • The solution represents an innovative approach to incident response in OT networks

A realistic approach to defending OT networks

Most previous research in this field assumed that the defense agent could directly observe the system's state or the attacker's actions. The Swedish researchers consider this hypothesis unrealistic and have chosen a different approach: their agent operates with partial information, based only on network packet counters.

How the autonomous defense system works

The agent analyzes six numbers per interval: packet counters that cross network segments and move toward and from individual devices. From this data, it infers the progression of an intrusion and decides whether to intervene. Intervention options include:

  • Reset of one of the three supervisory hosts
  • Reset of one of the two tank control processes
  • Complete reset of all hosts in the supervisory and control subnets

Each reset involves rebooting the target device, renewing credentials, and changing the IP address, with minimal disruption to industrial operations.

Training with real attack data

To train the defense system, the researchers built an emulation of a segmented industrial network, repeatedly attacking it for 14 days. They collected 40,000 intervals of 30-second network traffic, although they admit that this sample is limited compared to what would be needed to fully model the system's state.

The defense system's results

The best agent developed by the researchers maintains 500 updated hypotheses about the network's state, updated at each interval. This approach outperformed agents based on raw data and approached the performance of an agent with complete visibility of the system's state. A critical aspect of the system is that it is based on a model of the attacker's behavior, which could limit its effectiveness against unknown threats.

The tested infrastructure and known vulnerabilities

The emulated network included three supervisory hosts, two PLCs, and two control tanks. The exposed HMIs used HTTP with weak credentials, while the engineering workstation was vulnerable to CVE-2017-7494 and offered SSH, Telnet, and SMB services with weak credentials. The researchers did not verify whether their model generalizes to other configurations or types of attacks.

Belief tracking: the system's key innovation

The most innovative element of this approach is "belief tracking," a method for maintaining a probability distribution of how far an intrusion has progressed on each asset. This system can show the probability that a host has been exploited, offering a useful visualization for security operators. The researchers have made their implementation public and plan to test the approach on an industrial testbed with a partner.

Implications for NIS2 compliance and operational resilience

This research takes on particular importance in light of the NIS2 directive, which requires essential service operators to improve resilience against cyber threats. The system developed by KTH could contribute to the digital operational resilience required by the DORA regulation, offering an automated method for responding to intrusions in critical networks.

Challenges for operational adoption

The researchers acknowledge that operational security limits possible defense strategies. The system must be designed to intervene without compromising industrial operations, a delicate balance that requires further study. Their future research will focus on this critical aspect, aiming to develop solutions that can be adopted in real operational environments without compromising the security or efficiency of critical infrastructures.

Opportunities for SOC and MDR services

This innovation represents a significant opportunity for managed Security Operations Centers and MDR services, which could integrate these autonomous agents into their monitoring systems. The approach could improve the ability to detect and respond to intrusions in real time, reducing the need for human intervention and improving the efficiency of incident response.

Considerations for cyber insurance

The implementation of autonomous defense systems like this could influence cyber insurance premiums, offering companies a more effective way to mitigate risks. Insurance companies could consider these solutions as risk reduction factors, potentially lowering premiums for companies that adopt them. However, it will be necessary to demonstrate the system's effectiveness in real environments before insurance companies recognize it as a valid security measure.

Next steps in research

The researchers plan to test their approach on an industrial testbed with a partner, a crucial step to validate the system's effectiveness in real conditions. This test will be fundamental to demonstrating that the agent can operate effectively in a real industrial environment, maintaining security without compromising operations.

Download the full report

For more technical details, you can download the full report How security controls perform in practice from the official KTH Royal Institute of Technology website.

The impact on the industrial cybersecurity market

The innovation developed by the KTH Royal Institute of Technology fits into a rapidly evolving market context, where demand for solutions for the security of OT (Operational Technology) networks is constantly growing. According to MarketsandMarkets data, the global OT security market should reach $24 billion by 2026, with an annual growth rate of 12.1%. The solution proposed by the Swedish researchers could represent a turning point in this sector, offering an automated and proactive alternative to traditional defense methodologies.

Comparison with existing solutions

Currently, companies mainly rely on intrusion detection systems (IDS) and teams of experts for incident management. However, these solutions have significant limitations. IDS often generate false positives, while manual incident response is slow and subject to human error. The autonomous system developed by KTH offers a more efficient approach, reducing response time and minimizing the impact on operations. Moreover, compared to solutions based on generic artificial intelligence, the autonomous agent is specifically designed for industrial environments, leveraging real network traffic data.

Implications for risk management

The adoption of autonomous defense systems like the one developed by KTH could have a significant impact on risk management in critical infrastructures. According to a Ponemon Institute report, the average cost of a security incident for organizations is $4.35 million. The implementation of autonomous agents could reduce these costs, improving the ability to detect and respond to attacks in real time. Furthermore, the integration of these systems with Data Loss Prevention (DLP) solutions could offer even more robust protection, preventing the loss of sensitive data during an intrusion.

Challenges of integration with existing systems

One of the main challenges for the adoption of this system is integration with existing infrastructures. Many companies operate with heterogeneous industrial networks, which include devices of different ages and types. The autonomous agent must be able to adapt to these different configurations while ensuring minimal disruption to operations. The researchers acknowledge this challenge and plan to conduct further tests on an industrial testbed with a partner, a crucial step to validate the system's effectiveness in real conditions.

Opportunities for managed security services

The innovation developed by KTH represents a significant opportunity for managed Security Operations Centers (SOC) and MDR services. These providers could integrate autonomous agents into their monitoring systems, offering customers a more advanced solution for incident response. Furthermore, the adoption of these systems could improve the ability to detect and respond to intrusions in real time, reducing the need for human intervention and improving the overall efficiency of security operations.

Considerations for regulatory compliance

The NIS2 directive and the DORA regulation pose new challenges for companies operating in critical sectors. These regulatory frameworks require the implementation of advanced security measures and the demonstration of digital operational resilience. The autonomous agent developed by KTH could significantly contribute to achieving these objectives, offering an automated method for responding to intrusions in critical networks. Furthermore, the adoption of these systems could facilitate the audit and certification process, demonstrating the company's commitment to cybersecurity.

Future prospects and expected developments

The researchers at KTH plan to continue developing and testing their system, focusing on the critical aspects of operational security. A promising area of research is the integration with other emerging technologies, such as behavioral analysis and artificial intelligence. These integrations could further improve the system's ability to detect and respond to unknown threats, offering even more robust protection for critical infrastructures.

The importance of collaboration between academia and industry

The development of innovative solutions like KTH's underscores the importance of collaboration between academia and industry. The researchers have worked closely with industrial partners to emulate a real infrastructure and test their system under controlled conditions. This collaboration has helped overcome some of the technical challenges associated with the adoption of autonomous agents in industrial environments. In the future, these collaborations are expected to become even more crucial as companies seek to adopt advanced technologies to improve the security of their infrastructures.

The evolution of the threat landscape

The cyber threat landscape is constantly evolving, with attackers developing new techniques to bypass traditional defenses. The autonomous agent developed by KTH represents a significant step forward in the fight against these threats, offering a proactive approach to OT network security. However, it will be necessary to continue monitoring the system's effectiveness against new attack techniques, adapting and improving it over time to maintain an adequate level of protection.

Conclusions and forecasts

The autonomous agent developed by the KTH Royal Institute of Technology represents a significant innovation in the field of OT network security. With its ability to analyze network traffic and intervene selectively, the system offers a more efficient and proactive approach compared to traditional solutions. Although there are still challenges to be addressed, such as integration with existing infrastructures and the need for further testing in real environments, the prospects for the adoption of this technology are promising. In a rapidly evolving market context and with increasingly stringent regulations, the autonomous agent could become a fundamental tool for improving digital operational resilience and the security of critical infrastructures.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.