Passive asset discovery and operating system fingerprinting in industrial control system networks

Maintaining situational awareness in networks of industrial control systems is challenging due to the sheer number of devices involved, complex connections between subnetworks and the delicate nature of industrial processes. While current solutions for automatic discovery of devices and their operating system are lacking, plant operators need to have accurate information about the systems to be able to manage them effectively and detect, prevent and mitigate security and safety incidents. In this work, we present two tools that enable automatic and completely passive discovery of hosts and their operating systems (OSes) and we prove that using machine learning to perform passive OS detection yields promising performance gains. The results of the tests we performed on real-world ICS network data bolster the effectiveness of our approach and propose the direction that future work can follow towards further improvement. Passive Asset Discovery and Operating System Fingerprinting in ICS Networks iii Acknowledgements (ACK) This thesis describes the result of my final project towards the completion of the Information Security Technology (IST) master’s program at Eindhoven University of Technology. I would like to thank my supervisor, prof. Sandro Etalle, whose lectures were so interesting that immediately intrigued and motivated me to look into critical infrastructure from the first semester of the aforementioned program. I thank him for honoring me by accepting me as a master’s student and bringing me in contact with interesting problems and brilliant people. I also want to thank dr. Tanir Özçelebi for joining the assessment committee and devoting his time to judge this work. My graduation tutor, dr. Elisa Costante, deserves her own paragraph, along with my sincerest gratitude for all the guidance, feedback and help she provided in the course of this project. Her critical thinking, attention to detail, academic experience and tireless inner drive enabled me to complete this thesis and make the most out of it. This project was carried out in collaboration with SecurityMatters B.V. which evolved into a welcoming big famiglia. I want to thank Damiano Bolzoni and Emmanuele Zambon who believed in me at first sight and gave me all the guidance I needed to explore the -until then unknown to meICS setting. Special thanks to Chris and Maarten for patiently answering all my questions about ICS networks and providing me with all the server power I needed to run experiments. I thank the rest of the crew, too, who welcomed me and made the days at the company so enjoyable: Christina, Daniel, Daniele, Gijs, Giorgio, Marieke, Massimo and Michele thank you so much! Finally, I thank my family, who tirelessly supported me throughout the project, remotely or by visiting. Really, I don’t know many other parents who are so devoted to their children. Last but not least, my love, Despina, thank you for the endless support and encouragement that you never seemed to run out of, no matter how bleak the situation seemed. I truly appreciate it. Chris M. , Eindhoven, October 2015. Passive Asset Discovery and Operating System Fingerprinting in ICS Networks v