[Paper Review] SoK: Attacks on Industrial Control Logic and Formal Verification-Based Defenses

Ruimin Sun, Alejandro Mera+2 more|arXiv (Cornell University)|Jun 9, 2020

Security and Verification in Computing79 references4 citations

TL;DR

This paper systematizes attacks on industrial control logic and formal verification-based defenses, revealing that control logic modification attacks have evolved to bypass detection by exploiting implicit properties and system complexity. It identifies critical challenges in formal verification—such as real-time constraints, ad-hoc specification generation, and vendor-specific dependencies—and recommends a full-stack defense approach with open-source tools, incremental specification, and runtime verification to improve security beyond safety.

ABSTRACT

Programmable Logic Controllers (PLCs) play a critical role in the industrial control systems. Vulnerabilities in PLC programs might lead to attacks causing devastating consequences to the critical infrastructure, as shown in Stuxnet and similar attacks. In recent years, we have seen an exponential increase in vulnerabilities reported for PLC control logic. Looking back on past research, we found extensive studies explored control logic modification attacks, as well as formal verification-based security solutions. We performed systematization on these studies, and found attacks that can compromise a full chain of control and evade detection. However, the majority of the formal verification research investigated ad-hoc techniques targeting PLC programs. We discovered challenges in every aspect of formal verification, rising from (1) the ever-expanding attack surface from evolved system design, (2) the real-time constraint during the program execution, and (3) the barrier in security evaluation given proprietary and vendor-specific dependencies on different techniques. Based on the knowledge systematization, we provide a set of recommendations for future research directions, and we highlight the need of defending security issues besides safety issues.

Motivation & Objective

• To understand the evolution and impact of control logic modification attacks in industrial control systems (ICS), particularly those that evade detection.
• To analyze the limitations and challenges in existing formal verification-based defenses for PLC programs.
• To identify gaps in current research, especially in specification generation, real-time verification, and tooling availability.
• To recommend a comprehensive, full-chain defense strategy that addresses integrity, confidentiality, and availability in ICS.
• To advocate for open-source tools, vendor-agnostic benchmarks, and interactive specification refinement to improve evaluation and reproducibility in PLC security research.

Proposed method

• Conducted a systematization of knowledge (SoK) across 86 CVEs and 97 studies on PLC control logic attacks and formal verification techniques.
• Categorized studies based on threat models, security goals, underlying weaknesses, detection evasion, and defense focus (e.g., behavior modeling, state reduction, specification generation).
• Analyzed attack surfaces across sensor inputs, engineering stations, and inter-PLC communication, identifying stealthy evasion via implicit properties.
• Evaluated formal verification approaches, highlighting ad-hoc practices such as manual safety property definition and limited test case coverage.
• Proposed a framework for full-chain protection, including plant behavior formalization, incremental specification generation, and runtime verification with dedicated security components.
• Advocated for open-source tooling compliant with IEC-61131-3 and the development of standardized PLC security benchmarks for evaluation.

Experimental results

Research questions

• RQ1 How have control logic modification attacks evolved in their ability to compromise the full control chain and evade detection?
• RQ2 What are the key challenges in formal verification of PLC programs, particularly regarding real-time constraints and specification generation?
• RQ3 Why do most formal verification studies remain ad-hoc, and what barriers hinder the adoption of systematic, reusable verification techniques?
• RQ4 How can runtime verification be made practical and secure in PLCs, especially when engineering stations are vulnerable to attack?
• RQ5 What role can open-source tools and standardized benchmarks play in advancing reproducible and scalable PLC security research?

Key findings

• Control logic modification attacks have become increasingly sophisticated, capable of compromising the entire control chain and evading detection by exploiting implicitly specified properties.
• Formal verification research remains largely ad-hoc, with most studies manually defining safety properties and relying on minimal test cases, despite the availability of more advanced techniques.
• A significant barrier to progress is the lack of open-source tools and standardized benchmarks, which hinders evaluation, reproducibility, and tool integration.
• Runtime verification is underdeveloped due to real-time constraints and the vulnerability of engineering stations, necessitating dedicated security components like bump-in-the-wire solutions.
• Existing formal verification approaches focus predominantly on integrity, with limited attention to confidentiality and availability, especially in multitask and event-driven PLC programs.
• Incremental and automated specification generation remains under-investigated, despite its potential to improve scalability and maintainability in evolving ICS environments.