CREAF-ICS · Cyber-Resilience Enhancing Authentication and Forensics for Industrial Control Systems

Industrial Control Systems (ICSs), integral to modern critical infrastructures, are increasingly exposed to cyber threats. The project, Cyber-Resilience Enhancing Authentication and Forensics for Industrial Control Systems (CREAF-ICS), proposes a defense-in-depth framework that authenticates communication and enables attack forensics for ICSs. For communication authentication, CREAF-ICS develops an in-network, zero-trust strategy to verify communications of all ICS components. Compared to traditional unencrypted and/or high-latency authentication, CREAF-ICS's in-network design enables encrypted and low-latency verification. For attack forensics, CREAF-ICS develops a cross-domain investigation approach that enables the detection of attacks and the tracing of their origins. Moving beyond state-of-the-art attack attributions in individual information domains, CREAF-ICS is capable of identifying the root causes of abnormal behaviors in physical processes and pinpointing the associated malicious activities in hosts of the ICS network. By reinforcing the pre-incident authentication with during-incident forensic results, CREAF-ICS delivers a self-upgrading defense-in-depth framework, enhancing the ICS cyber-resilience while ensuring seamless integration with existing ICS infrastructures.