Mitigating cyberattack related domino effects in process plants via ICS segmentation Abstract   Domino effects are highimpact phenomena that have caused catastrophic damage to several chemical and process plants around the world through secondary incidents caused by primary ones. With the increasing trend of cyberattacks targeting critical infrastructures, there is a concern that such cyberattacks may trigger domino effects, by manipulating industrial control systems in such a way that the physical consequences are likely to escalate. In this study, we have demonstrated that via network segmentation of industrial control systems, the plant robustness against cyberattackrelated domino effects can be improved. To this end, a riskbased decisionmaking methodology is developed based on Bayesian network and graph theory to investigate and evaluate the robustness of segmentation alternatives. The application of the methodology to an illustrative case study shows the efficacy of the approach as a viable cyber risk mitigation measure in chemical and process plants.

An Improved Industrial Control System Device Logs Processing Method for ProcessBased Anomaly Detection Detecting processbased attacks on industrial control systems (ICS) is challenging. These cyberattacks are designed to disrupt the industrial process by changing the state of a system, while keeping the systemu0027s behaviour close to the expected behaviour. Such anomalous behaviour can be effectively detected by an eventdriven approach. Petri Net (PN) model identification has proved to be an effective method for eventdriven system analysis and anomaly detection. However, PN identificationbased anomaly detection methods require ICS device logs to be converted into event logs (sequence of events). Therefore, in this paper we present a formalised method for preprocessing and transforming ICS device logs into event logs. The proposed approach outperforms the previous methods of device logs processing in terms of anomaly detection. We have demonstrated the results using two published datasets.