CyberRadar: A Regression Analysis Approach to the Identification of Cyber-Physical Mappings in Process Control Systems

One of the attack requirements for maximizing physical damage to digitally controlled infrastructures is the identification of a mapping between program variables in a compromised control system and physical parameters related to physical processes or physical equipment. A cyber-physical mapping is quite critical from the offensive perspective as physical parameters are affected via modification of the associated program variables. The difficulty of such a reconnaissance challenge is acknowledged by control system security analysts as what they’re presented with during experimental attacks is comprised of long series of random looking bytes or variable names. In this paper we provide a formal and thorough formulation of the cyber-physical mapping problem, propose a statistical approach to the identification of a cyber-physical mapping in large sets of scanning data, and further develop and demonstrate the proposed approach by applying it on a practical example, namely a network inertial attack on an electric motor.