# Code Integrity Attestation for PLCs using Black Box Neural Network Predictions

arXiv: https://arxiv.org/abs/2106.07851 · HTML: https://mlsanity.com/paper/2106.07851/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 83 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 21 of 21)

- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Crafting Adversarial Input Sequences for Recurrent Neural Networks](https://mlsanity.com/paper/1604.08275/) (2016)
- [Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing](https://mlsanity.com/paper/1812.05793/) (2018)
- [Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks](https://mlsanity.com/paper/1806.08110/) (2018)
- [Robustness to Adversarial Examples through an Ensemble of Specialists](https://mlsanity.com/paper/1702.06856/) (2017)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [C-FLAT: Control-FLow ATtestation for Embedded Systems Software](https://mlsanity.com/paper/1605.07763/) (2016)
- [Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System](https://mlsanity.com/paper/1801.00903/) (2018)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks](https://mlsanity.com/paper/1911.04831/) (2019)
- [Log-based Anomaly Detection of CPS Using a Statistical Method](https://mlsanity.com/paper/1701.03249/) (2017)
- [Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences](https://mlsanity.com/paper/1909.05410/) (2019)
- [SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses](https://mlsanity.com/paper/2006.04806/) (2020)
- [Scanning the Cycle: Timing-based Authentication on PLCs](https://mlsanity.com/paper/2102.08985/) (2021)
- [Towards Learning and Verifying Invariants of Cyber-Physical Systems by Code Mutation](https://mlsanity.com/paper/1609.01491/) (2016)
- [Control Behavior Integrity for Distributed Cyber-Physical Systems](https://mlsanity.com/paper/1812.08310/) (2018)
- [Active Fuzzing for Testing and Securing Cyber-Physical Systems](https://mlsanity.com/paper/2005.14124/) (2020)
- [No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems](https://mlsanity.com/paper/2012.03586/) (2020)
- [Automatically 'Verifying' Discrete-Time Complex Systems through Learning, Abstraction and Refinement](https://mlsanity.com/paper/1610.06371/) (2016)
- [Assessing the Effectiveness of Attack Detection at a Hackfest on Industrial Control Systems](https://mlsanity.com/paper/1809.04786/) (2018)

## Abstract (arXiv)

Cyber-physical systems (CPSs) are widespread in critical domains, and significant damage can be caused if an attacker is able to modify the code of their programmable logic controllers (PLCs). Unfortunately, traditional techniques for attesting code integrity (i.e. verifying that it has not been modified) rely on firmware access or roots-of-trust, neither of which proprietary or legacy PLCs are likely to provide. In this paper, we propose a practical code integrity checking solution based on privacy-preserving black box models that instead attest the input/output behaviour of PLC programs. Using faithful offline copies of the PLC programs, we identify their most important inputs through an information flow analysis, execute them on multiple combinations to collect data, then train neural networks able to predict PLC outputs (i.e. actuator commands) from their inputs. By exploiting the black box nature of the model, our solution maintains the privacy of the original PLC code and does not assume that attackers are unaware of its presence. The trust instead comes from the fact that it is extremely hard to attack the PLC code and neural networks at the same time and with consistent outcomes. We evaluated our approach on a modern six-stage water treatment plant testbed, finding that it could predict actuator states from PLC inputs with near-100% accuracy, and thus could detect all 120 effective code mutations that we subjected the PLCs to. Finally, we found that it is not practically possible to simultaneously modify the PLC code and apply discreet adversarial noise to our attesters in a way that leads to consistent (mis-)predictions.