Critical Infrastructure Maintenance: The Power of System Reboot for Reliability

Post Views: 5

Turn it off and on again, but for critical infrastructure A team from KTH Royal Institute of Technology developed a containerized simulation of a segmented industrial network, subjecting it to repeated attacks over a 14-day period.

The Experiment

The experiment aimed to train a defensive agent capable of autonomously determining when to intervene in an intrusion. The agent evaluates six numerical metrics per interval, including packet traffic volumes between network segments and individual devices.

Agent’s Possible Actions

The agent’s possible actions include taking no action, rebooting one of three supervisory hosts, restarting one of two water tank processes, or resetting all hosts within the supervisory and control subnets. Each reset reboots targeted systems, revokes credentials, and assigns new IP addresses.

Research Challenges

Current research in reinforcement learning for industrial intrusion response typically assumes direct visibility into system states or attacker activities. The study challenges this assumption, arguing that such scenarios are unrealistic.

Data Collection and Simplification

The researchers conducted 30-second intervals of network activity, collecting 40,000 data points. They acknowledged that modeling full system state variations would require approximately 100 million measurements, so they simplified their approach by focusing solely on traffic patterns tied to attacker actions.

Agent Performance

The most effective agent among those tested maintained 500 probabilistic estimates of the network’s state, updating them iteratively. It compressed these estimates before feeding them to its decision-making policy. This agent outperformed models using raw historical data and approached the performance of a baseline system with full visibility.

Limitations and Constraints

A critical limitation in the model’s design lies in its reliance on a predefined system evolution model that incorporates attacker behavior. The agent achieving near-full-visibility performance operated under a specific adversary description.

Test Environment

The test environment included three supervisory hosts, two programmable logic controllers (PLCs), and two water tanks. Human-machine interfaces (HMIs) used HTTP with weak credentials, while the engineering workstation exposed SSH, Telnet, and SMB protocols, along with vulnerability CVE-2017-7494.

Belief Tracking and Future Work

The study did not assess whether the model adapts to alternative configurations or attack vectors. However, the researchers highlighted that belief tracking—a method of maintaining probability distributions over intrusion stages—can be implemented without reinforcement learning. This approach assigns costs to each stage of an attack, from initial reconnaissance to exploitation.

The team has open-sourced their implementation and plans to validate the approach on an industrial testbed in collaboration with a partner organization. They emphasize operational safety as a priority for future work, noting that it imposes constraints on defensive strategies.

Conclusion

The research underscores the potential of autonomous systems in industrial control environments while highlighting the challenges of balancing security with operational continuity.