Trust Model for Active Scanning Methods, Ensuring Their Secure Interaction with Automated Process Control Networks

Active network scanning methods are increasingly used in modern intrusion detection systems (IDS) to collect and analyze circulating traffic in the network of an automated process control system (APCS). Despite the legitimacy of the active scanning process, it may turn out to be unsafe for the stability of the ICS network, since it requires a formalized response from the network equipment. Production processes are typically continuous, so network scanning is carried out in real time, and disruption of equipment due to failure is unacceptable. In this regard, the development of safe methods for active scanning of networks is relevant. The work formulates a trust model for active scanning methods based on a number of conditions, ensuring their secure interaction with automated process control networks. The model includes 3 trust conditions that must be met to ensure safe scanning. The operation of the model was tested on a laboratory bench operating under the control of programmable logic controllers of the Siemens and KEAZ families. During the experiments, three characteristics were statistically assessed: the volume of excess traffic, the accuracy of constructing the network topology, and the proportion of correct node responses, reflecting the fulfillment of trust conditions for the studied active scanning methods. Based on the results of the experiments, conclusions were drawn about the effectiveness of the model.