Security monitoring is a key aspect to detect cyberattacks against industrial control systems. However, with the increasing use of encryption in industrial communication protocols, traditional monitoring solutions based on deep packet inspection are becoming less effective. This paper introduces a novel approach for efficient machine learning-based security monitoring and cyberattack classification in encrypted network traffic, named CyberClas+. The approach converts network traffic into time series by computing network metrics and analyzes these time series with a combination of threshold learning and machine learning. Evaluation results on an industrial control system show a classification accuracy of 97% across 14 different cyberattack techniques, with a significantly decreased execution time compared to conventional machine learning methods.

Machine learning based security monitoring can be used to detect cyberattacks and malfunctions in cyber-physical production systems. Acquiring real data sets for training machine learning algorithms is a problem due to high costs, low data quality, data diversity, and the violation of privacy policies. This paper introduces CyberSyn, a novel approach to generate synthetic data sets for machine learning based security monitoring systems. The generated data sets are analyzed using data quality metrics. Two scenarios from process manufacturing and industrial communication networks are used to evaluate the introduced approach. The proposed approach is able to generate synthetic data sets for both scenarios.

Cyberattacks on cyber-physical production systems lead to manipulation of the physical process and pose a serious threat to machines and employees. Preventing cyberattacks and reducing their negative impact is an important aspect of security. This paper presents an approach to reduce the impact of cyberattacks. The approach uses software-defined networking (SDN) in combination with network metrics. The network metrics enable measuring the impact of cyberattacks and the impact reduction by the SDN approach. The SDN approach utilizes four different prevention techniques as countermeasures. Scenarios from discrete manufacturing are used to evaluate the approach. The approach reduces the average impact of the selected cyber-attacks from 82.9% to 98.1%.

The dissolving of the automation pyramid in the course of the fourth industrial revolution will impact the design of industrial networks. Especially processing components which nowadays are residing on a machine can be potentially located remotely in the factory IT or even beyond. In order to fulfill the still existing requirements of industrial automation processes, the network especially the infrastructure devices like switches and routers must be enhanced by new technologies granting real-time capability. Furthermore, the network has to meet Industry 4.0 demands regarding security as well as more flexibility like auto-configuration or seamless reconfiguration. A solution concept to establish secure and time-sensitive communication for remote process control and monitoring as well as first implementation steps are proposed. The concept and implementation include current technologies like Time-Sensitive Networking and deterministic networking in combination with Software-defined Networking. This grants flexibility regarding the configuration of time-sensitive industrial networks and adds possibilities to secure them.

Deep neural network based condition monitoring systems are used to detect system failures of cyber-physical production systems. However, a vulnerability of deep neural networks are adversarial examples. They are manipulated inputs, e.g. process data, with the ability to mislead a deep neural network into misclassification. Adversarial example attacks can manipulate the physical production process of a cyber-physical production system without being recognized by the condition monitoring system. Manipulation of the physical process poses a serious threat for production systems and employees. This paper introduces CyberProtect, a novel approach to prevent misclassification caused by adversarial example attacks. CyberProtect generates adversarial examples and uses them to retrain deep neural networks. This results in a hardened deep neural network with a significant reduced misclassification rate. The proposed countermeasure increases the classification rate from 20% to 82%, as proved by empirical results.

The main feature of cyber-physical production systems is its adaptability. They adapt quickly to new requirements such as new products or product variants. Nowadays, a bottleneck is the automation system, for which high manual engineering efforts are needed: Today, on-site technicians write and rewrite automation software, configure real-time communication protocols and create system configurations consisting of machine timing, physical dimensions of products, sensitivity, and motor control accelerations and velocities. Cyber-physical production systems often solve this dilemma by relying on reusable software components, which are composed in the overall automation software. However, this solution comes with a price, reusable software components need free parameters to adjust to the individual production configurations. This paper addresses this central research question and presents a novel parameter estimation approach to choose automatically optimal system configurations for cyber-physical production systems. Different scenarios from discrete manufacturing plants are used to evaluate the solution approach.

Manufacturing plants become more complex as the desire for modern individual products increases. Programming such plants is a challenging task that consumes a lot of time. This paper proposes a new control-code synthesis algorithm, which aids the programmer by automatically generating parts of the control-code. With the new algorithm, the programmer only has to specify and parametrize the general production process, e.g. drill a hole then paint the workpiece. The control-code for all intermediate processes, like transporting the workpiece from the drilling machine to the paint-spray station is generated automatically. This saves much engineering time and enables the programmer to focus on more challenging tasks, such as process optimisation.

Cyber-physical production systems' main feature is adaptability. They shall adapt quickly to new requirements such as new products or product variants. Nowadays, the bottleneck is the automation system, which requires high manual engineering efforts for every new adaption. For new requirements, an automation software is created by combining pre-defined software components. But this also means that software components need degrees of freedom in form of parameters, such as timing parameters, to be applicable to new requirements. This paper presents a solution to determine parameters automatically for the automation software of cyber-physical production systems. A scenario from discrete manufacturing illustrates the underlying concepts.

Plug and produce (PnP) aims at reducing system engineering effort. Therefore several PnP aspects have to be solved. This paper gives an overview and classifies process types and PnP aspects. Furthermore it identifies coupled processes as the most challenging ones and provides a new engineering approach for such systems. A new two-step descriptive engineering approach is applied to automatically synthesise control code from a given product specification. The main idea of the approach is to use a descriptive view rather than a prescriptive. This means that the engineer specifies what he wants to produce and no longer how he wants to produce it. Thus, it reduces engineering effort and releases more resources to optimize the process.