KTH Researchers Test an Intrusion-Response Agent on an Emulated Industrial Network
Summary
KTH researchers trained an agent on traffic from a repeatedly attacked industrial network replica. Packet-count belief tracking nearly matched a full-visibility baseline, but the study did not test generalization and flags operational-safety concerns.
Key points
- Researchers ran attacks against a containerized, segmented industrial network for 14 days and collected 40,000 30-second observation intervals.
- The agent used six packet-count signals to estimate intrusion progress and could reset individual supervisory hosts, tank processes, or all hosts in supervisory and control subnets.
- The best agent maintained 500 possible network-state estimates and performed better than agents using raw observation history, coming close to a baseline with full system visibility.
- Giving the agent four intervals of history instead of one reduced performance.
- The agent’s state estimates relied on a model of attacker behavior, an assumption the authors identify as a limitation.
- The test setup included weak credentials and exposure to CVE-2017-7494; the researchers did not test whether the model generalizes to other configurations or attack types.
- The researchers released their implementation and plan to test the approach on an industrial testbed; operational safety remains future work.
Article Details
- Attack Vectors
- The emulated network included HMIs running HTTP with weak credentials and an engineering workstation running SSH, Telnet, and SMB with weak credentials.
- The engineering workstation was exposed to CVE-2017-7494; the article does not specify that the vulnerability was exploited.
- Defensive Notes
- The defense agent used packet-count signals to estimate intrusion progress and could reset individual supervisory hosts, tank processes, or all hosts in the supervisory and control subnets.
- A reset rebooted the target, renewed its credentials, and changed its IP address, but could briefly interrupt industrial operations.
- The researchers note that the model's ability to generalize to other network configurations or attack types was not studied, and that operational safety constrains defender actions.