Protecting OT Hosts with Intelligent Model-Based Defense System Against Malware Families

Abstract

Over the course of the past few decades, it has been abundantly clear that modern cybercrime committed against ICS has been expanding at an exponential rate. Operational Technology, also known as OT, has been the target of different types of attacks using a variety of tactics and approaches that have been specially tailored against them. Malwares, especially like backdoors, are the most prominent types of these attacks. Major constituents of OT are the Supervisory Control and Data Acquisition systems (SCADA), Programmable Logic Controllers (PLC), and Distributed Control Systems (DCS). It is harder to patch the existing vulnerabilities due to its devastating effect on the availability of the service. Attacks against the ICS have disastrous repercussions for the nation’s security. Industries have encountered many of them such as Stuxnet, BlackEnergy, CrashOverRide and many in the past years. Malwares that are polymorphic and metamorphic, both of which have efficient mutational features, are largely responsible for the exponential increase in the variability of malwares. The efficient categorization of the malware samples is a crucial and challenging task. This study mainly focuses on the efficient categorization of the huge samples of malware from nine different scandalous families, using their byte files. These byte file samples were passed into 3 different machine learning algorithms (k-neighbor, logistic regression, random forest), from which the best results were obtained from the random forest algorithm with a larger number of samples. The Identification results with the small dataset demonstrates that Random forest is not suited for the identification of malware that vary their signature. The feature extraction and the application of the machine learning algorithm aids the process and opens a wide scope for future research on this area.