[Paper Review] ICSrange: A Simulation-based Cyber Range Platform for Industrial Control Systems

Vincenzo Giuliano, Valerio Formicola|arXiv (Cornell University)|Sep 4, 2019

Network Security and Intrusion Detection4 references4 citations

TL;DR

ICSrange is a simulation-based cyber range platform built with Commercial-Off-The-Shelf (COTS) technologies to emulate industrial control systems (ICS) and enterprise networks, enabling training and testing of cyber defense strategies. It demonstrates effectiveness by simulating a multi-stage Advanced Persistent Threat (APT)-like attack across network segments, including lateral movement into a simulated ICS with water tanks.

ABSTRACT

Maintenance staff of Industrial Control Systems (ICS) is generally not aware about information technologies, and even less about cyber security problems. The scary impact of cyber attacks in the industrial world calls for tools to train defensive skills and test effective security measures. Cyber range offers this opportunity, but current research is lacking cost-effective solutions verticalized for the industrial domain. This work proposes ICSrange, a simulation-based cyber range platform for Industrial Control Systems. ICSrange adopts Commercial-Off-The-Shelf (COTS) technologies to virtualize an enterprise network connected to Industrial Control Systems. ICSrange is the outcome of a preliminary study intended to investigate challenges and opportunities to build a configurable and extensible cyber range with simulated industrial processes. Literature shows that testbeds based on realistic mock-ups are effectively employed to develop complex exploits like Advanced Persistent Threats (APTs), hence motivating their usage to train and test security in ICS. We prove the effectiveness of ICSrange through the execution of a multi-staged attack that breaches an enterprise network and progressively intrudes a simulated ICS with water tanks. The attack mimics lateral movements as observed in APTs.

Motivation & Objective

• To address the lack of cost-effective, domain-specific cyber range platforms tailored for Industrial Control Systems (ICS).
• To bridge the gap between ICS maintenance staff, who often lack cybersecurity awareness, and the growing threat of sophisticated cyber attacks.
• To develop a configurable and extensible simulation platform that enables realistic training and testing of defensive security measures in ICS environments.
• To validate the platform through a realistic, multi-stage cyber attack mimicking APT behavior on a simulated ICS with water tanks.

Proposed method

• ICSrange leverages COTS technologies to virtualize both enterprise networks and industrial control systems, enabling full network and process simulation.
• The platform integrates simulated industrial processes—specifically a water tank system—modeling real-time control behavior using standard industrial protocols.
• It enables the creation of configurable network topologies that connect enterprise IT infrastructure to ICS OT environments.
• The system supports the execution of multi-stage cyber attacks, including lateral movement, to emulate Advanced Persistent Threat (APT) behaviors.
• It uses open-source simulation tools and emulates realistic attack chains to test detection and response capabilities.
• The platform is designed to be extensible, allowing integration of new ICS components, attack scenarios, and security controls.

Experimental results

Research questions

• RQ1 How can a cost-effective, simulation-based cyber range be designed for Industrial Control Systems using COTS technologies?
• RQ2 What are the key challenges in emulating realistic ICS environments for cyber training and testing?
• RQ3 Can a simulated ICS environment effectively support the execution of multi-stage APT-like attacks for training purposes?
• RQ4 How can lateral movement and network progression be realistically modeled in an ICS cyber range?
• RQ5 To what extent can such a platform support the training of ICS personnel in detecting and responding to sophisticated cyber threats?

Key findings

• ICSrange successfully emulates a realistic ICS environment with a water tank process, demonstrating the feasibility of simulating industrial control behavior in a cyber range setting.
• The platform enables the execution of a multi-stage cyber attack that mimics lateral movement typical of Advanced Persistent Threats (APTs).
• The simulation supports the entire attack lifecycle from initial access in the enterprise network to infiltration of the ICS segment.
• The use of COTS technologies ensures cost-effectiveness and ease of deployment, making the platform accessible for training and research.
• The platform proves effective as a training tool by enabling security teams to observe and respond to complex, realistic attack scenarios in a safe, isolated environment.
• The platform’s extensibility allows for integration of new ICS processes and attack vectors, supporting ongoing research and training needs.