Industrial Control Systems (ICS) have played a catalytic role in enabling the 4th Industrial Revolution. ICS devices like Programmable Logic Controllers (PLCs), automate, monitor, and control critical processes in industrial, energy, and commercial environments. The convergence of traditional Operational Technology (OT) with Information Technology (IT) has opened a new and unique threat landscape. This has inspired defense research that focuses heavily on Machine Learning (ML) based anomaly detection methods that run on external IT hardware, which means an increase in costs and the further expansion of the threat landscape. To remove this requirement, we introduce the ICS machine learning inference framework (ICSML) which enables executing ML model inference natively on the PLC. ICSML is implemented in IEC 61131-3 code and provides several optimizations to bypass the limitations imposed by the domain-specific languages. Therefore, it works on every PLC without the need for vendor support. ICSML provides a complete set of components for creating full ML models similarly to established ML frameworks. We run a series of benchmarks studying memory and performance, and compare our solution to the TFLite inference framework. At the same time, we develop domain-specific model optimizations to improve the efficiency of ICSML. To demonstrate the abilities of ICSML, we evaluate a case study of a real defense for process-aware attacks targeting a desalination plant.

翻译：工业控制系统（ICS）在推动第四次工业革命中发挥了催化作用。可编程逻辑控制器（PLC）等ICS设备可自动化、监控并控制工业、能源及商业环境中的关键流程。传统运营技术（OT）与信息技术的融合开辟了全新且独特的威胁格局。这催生了侧重于在外部IT硬件上运行基于机器学习（ML）的异常检测方法的防御研究，但此类方法意味着成本增加及威胁格局的进一步扩大。为消除这一需求，我们提出了ICS机器学习推理框架（ICSML），该框架支持在PLC上原生执行ML模型推理。ICSML采用IEC 61131-3代码实现，并通过多项优化突破了领域特定语言带来的限制。因此，它可在无需供应商支持的情况下适用于任何PLC。ICSML提供了类似成熟ML框架的完整组件集，可用于创建完整的ML模型。我们开展了一系列内存与性能基准测试，并将我们的方案与TFLite推理框架进行了对比。同时，我们开发了领域特定的模型优化以提升ICSML的效率。为验证ICSML的能力，我们针对某海水淡化厂面临的面向过程攻击，评估了一个真实防御案例。