Automatic Generation of Process Models Using Motion Acceleration Algorithms

No ratings

Presented at s4x17 2017 by

Jason Larsen

Trivial disruption of a process is easy. Almost everything can cause a process to shut down. For most non-trivial damage, the attacker needs the process to stay up while he manipulates it. This requires a model of the process. This is one of the least understood parts of ICS hacking. After the attack, focus is placed on the why the payload worked and little is discovered about the process the attacker used to generate the physics payload. In general, signals that are related by physics tend to move together. Bumping into the side of a table not only makes the table shake, but all the items on the table shake as well. They also tend to move at the same frequencies. Recent advances in motion acceleration algorithms have the potential to revolutionize this step. If those algorithms are applied to process data, a basic model of the process can be built with little or no human interaction. This presentation will take data from a water treatment plant and use it to show how a process model can be built directly from process data using motion acceleration algorithms.