Common security solutions such as firewalls, intrusion detection systems (IDS) and antivirus programmes mainly apply blacklisting approaches. These solutions process signatures created in modern malware labs or from community data collected in cloud-based malware detection systems and regularly distributed to endpoints to enable detection of known malicious activity. While they work reliably for known attack attempts, they fail when new attack techniques are used or unknown vulnerabilities or weaknesses are exploited. As a result, anomaly detection is required, which can detect even minor deviations in system behaviour that can lead to traces of unknown attacks.

Unfortunately, most modern anomaly detection solutions are not readily applicable to cyber-physical systems (CPS) and control technology (OT), which are fundamentally different from enterprise IT networks in terms of complexity, size and widely distributed installations. In addition, the few OT security solutions available are not designed to work across different infrastructure layers (i.e. correlating information from OT and IT systems as well as data from the network layer and log data from endpoints) and are therefore mostly unsuitable for detecting modern multi-stage cyber attacks.

Another reason why today's anomaly detection systems are largely unsuitable for CPS is that CPS not only differ from companies' IT networks, but also differ greatly from one another. On the one hand, CPS have variable network infrastructures and, on the other, the integrated components are diverse. Therefore, machine learning approaches are required that do not depend on the specifics of a particular system to recognise attacks, but adapt to different usage scenarios. In addition, the operational characteristics of CPS differ from corporate IT. The processes are usually based on highly deterministic machine-to-machine communication, which allows for more sensitive anomaly detection with lower thresholds for system behaviour. However, existing anomaly detection approaches hardly utilise this. Attackers can exploit vulnerabilities and weaknesses at different levels and in different areas of complex CPS as entry points for successful multi-step attacks. To counter these often advanced malicious activities, we argue that an appropriate composition of different detection approaches for individual infrastructure layers (WAN, LAN, field level) improves the effectiveness of anomaly detection in CPS. These cross-layer solutions correlate several interesting data streams measured at different locations and OSI layers of the protocol stack. With the right combination and methods of analysis, a cross-layer approach can greatly increase overall security awareness in CPS. Nevertheless, the selection of suitable data streams and observation parameters (e.g. observation points, time periods, granularity and layers) remains a challenging task. In addition to the quality of detection, the resources required for detection (time, budget, effort) are also important.

The synERGY project aimed to develop an architecture and demonstrate a proof-of-concept implementation of a modern reactive security solution specifically designed for large-scale and complex CPS. The design criteria of this architecture are:

• It utilises operational data sources of all kinds, especially network and endpoint data, as well as different areas of a CPS from the field level to the enterprise level.
• It applies best-in-class anomaly detection mechanisms, not just signature-based solutions, and uses machine learning to optimise them.
• It utilises cross-correlation techniques to increase confidence in results and detect new multi-stage attacks progressing through an infrastructure.
• It facilitates the interpretation of detected anomalies using contextual data from the organisation.

The synERGY project investigated how to design, develop and validate an adaptive, self-learning, cross-layer anomaly detection system based on open standards that can be applied to a range of CPS in a vendor-independent manner and detect the traces of a variety of modern cyber-attacks with limited human effort by applying cross-correlation techniques of numerous data streams.

Working on the associated challenges as part of a cooperative research project was important in order to develop a vendor-independent solution. For this reason, open source solutions and open standards were selected for development.

In the synERGY project, we worked on a special use case that was motivated by the increasing number of cyber attacks on energy suppliers or other operators of critical infrastructure, including Stuxnet, Crashoverride, Black Energy and Petya. In terms of power distribution networks, a modern substation comprises a range of security, monitoring and control equipment. For the cross-correlation use case, we assume that all technologically possible security measures are implemented and function correctly. However, since the life cycle of industrial components in the energy industry is very long compared to standard IT, the existence of legacy equipment with additional protection requirements is quite common. Due to these conditions, the application of anomaly detection is a promising means to further protect such systems. When applying advanced anomaly detection systems, the primary protection goals in the area of industrial safety, availability and integrity are of utmost importance.

In particular, the real-time properties of industrial systems must not be restricted. This is a significant difference to the classic office IT world, where confidentiality is usually the top priority. A key concept in the field of industrial security is "defence-in-depth", which is based on the realisation that protection against cyber attacks on industrial plants, such as the power grid in our use case, involves all stakeholders, including operators, integrators and manufacturers.

In addition to building a defence concept, the correlation of detected anomalies from the different layers of the shell model is crucial to detect well-hidden attackers earlier and to increase the quality of alarms, i.e. to reduce the false positive rate.

false positive rate. From an overall security perspective, correlating detected anomalies in network traffic with physical data sources such as access control, work order database, etc. has great potential. The synERGY use case therefore takes these factors into account.

Unauthorised access to the process network is one of the biggest threats to the overall system and forms the basis for a variety of threat scenarios. Such access can occur either physically or logically via the network to practically every component and every area of the network. Unauthorised access to components in the field is particularly critical, as an attacker may find little or no physical access protection there. Access allows the attacker to copy, intercept or modify the transmitted data and use it for their own purposes. This use case deals specifically with the following four attacks (also labelled as stars in Fig. 1):

1. the attacker physically breaks into a transformer station (secondary substation) and gains access to an RTU.

2. the attacker physically breaks into a substation (primary substation) and gains access to an MTU.

3. the attacker gains access to the network via remote maintenance access.

4. the attacker gains access to the network via a compromised device, e.g. a PC (engineering workstation) or a maintenance notebook.