TRIST: Towards a container-based ICS testbed for cyber threat simulation and anomaly detection

Lo, Carol; Christie, Jack; Win, Thu Yein; Rezaeifar, Zeinab; Khan, Zaheer; Legg, Phil

Abstract

Cyber-attacks on Industrial Control Systems (ICS), as exemplified by the incidents at the Maroochy water treatment plant and the Ukraine's electric power grid, have demonstrated that cyber threats can inflict significant physical impacts. These incidents caused widespread service disruptions and substantial economic losses, underscoring the urgent need for an in-depth understanding of cyber threats in industrial environments. Industrial security research is usually conducted on physical testbeds to avoid safety issues, production interruptions and other operational constraints in industrial processes. Nevertheless, security defenders often encounter obstacles in developing or accessing physical testbeds due to associated costs and complexities. These factors hinder research progress to devise early detection mechanisms for cyber threats-essential for effective incident response. To overcome these obstacles, this paper presents a container-based virtual testbed. Its lightweight architecture enables replicable and efficient deployment of testbeds at low cost for simulating cyber threats on Cyber-Physical Systems (CPS)-the cornerstone of industrial automation and control systems. Also, the container-based virtual testbed provides a cost-effective option for producing datasets for training, testing and optimization of unsupervised anomaly detection models. Besides, an evaluation on resource consumption is conducted. The paper also discusses the benefits and limitations of proposed container-based ICS testbeds and suggests future research areas.

Citation

Lo, C., Christie, J., Win, T. Y., Rezaeifar, Z., Khan, Z., & Legg, P. (in press). TRIST: Towards a container-based ICS testbed for cyber threat simulation and anomaly detection. In Springer Proceedings in Complexity book series

• Conference Name: Cyber Science 2024
• Conference Location: Edinburgh Napier University, Craiglockhart Campus, Scotland
• Start Date: Jun 27, 2024
• End Date: Jun 28, 2024
• Acceptance Date: Apr 30, 2024
• Deposit Date: Jun 4, 2024
• Book Title: Springer Proceedings in Complexity book series
• Keywords: Cybersecurity; Testbeds; Industrial Control Systems; Cyber-Physi- cal Systems; Container; Threat Simulation; Datasets; Anomaly Detection
• Public URL: https://uwe-repository.worktribe.com/output/12034510