Blog
‍

OT

3 Ways AI Secures OT & ICS from Cyber Attacks

Jan 2024

Explore the three challenges facing industries that manage OT and ICS Systems, the benefits of adopting AI technology, and Darktrace/OT’s unique role!

What is OT and ICS?

Operational technologies and industrial control systems are the networked technologies used for the automation of physical processes. These are the technologies that allow operators to control processes and retrieve real time process data from a factory, rail system, pipeline, and other industrial processes. ‍

The role of AI in defending OT/ICS networks

While largely adopted by industrial organizations, OT is utilized by Critical Infrastructures, these being the industries that directly affect the health, safety, and welfare of the public. As these organizations expand and adopt new networked industrial technologies, they are simultaneously expanding their attack surface.

With a larger attack surface, more attacks targeting OT/ICS, and focused coordination around cyber security from regulatory authorities, security personnel have increasing workloads that make it difficult to keep pace with threats and vulnerabilities. Defenders are managing growing attack surfaces due to IT and OT convergence. Thus, the adoption of AI technology to protect, detect, respond, and recover from cyber incidents in industrial systems is paramount for keeping critical infrastructure safe.

This blog will explore three challenges facing industries managing OT/ICS, the perceived benefits of adopting AI technology to address these challenges, and Darktrace/OT’s unique role in this process.

Darktrace also delivers complete AI-powered solutions to defend US federal government customers from cyber disruptions and ensure mission resilience. Learn more about high fidelity detection in Darktrace Federal’s TAC report.

Figure 1: AI statistics from Gartner and Deloitte

Three ways AI helps improves OT/ICS security

1. Anomaly detection and response

In this heightened security landscape, OT/ICS environments face a spectrum of external cyber threats that demand vigilant defense. From the looming risk of industrial ransomware to the threat of insiders, yet another dimension is added to security challenge, meaning security professionals must be equipped to detect and respond to internal and external threats.

While threats are eminent from both inside and outside the organization, many organizations rely on Indicator of Compromises (IOCs) for threat detection. By definition, these solutions can only detect network activity they recognize as an indicator of compromise; therefore, often miss insider threats and novel (zero-day) attacks because the tactics, techniques, and procedures (TTPs) and attack toolkits have never been seen in practice.

Anomaly-based detection is best suited to combat never-before-seen threats and signatureless threats from the inside. However, not all detection methods are equal. Most anomaly-based detection solutions that leverage AI rely on a combination of supervised machine learning, deep learning, and transformers to train and inform their systems. This entails shipping your company’s data out to a large data lake housed somewhere in the cloud where it gets blended with attack data from thousands of other organizations. This data set gets used to train AI systems — yours and everyone else’s — to recognize patterns of attack based on previously encountered threats.

While this method reduces the workload for security teams who would have to input attack data otherwise manually, it runs the same risk of only detecting known threats and has potential privacy concerns when shipping this data externally.

To improve the quality and speed of anomaly detection, Darktrace/OT uses Self-Learning AI that leverages Bayesian Probabilistic Methodologies, Graph Theory, and Deep Neural Networks to learn your organization from the ground up in real time. By learning your unique organization, Darktrace/OT develops a sophisticated baseline knowledge of your network and assets, identifying abnormal activity that indicates a threat based on your unique network data at machine speed. Because the AI engine is local to the organization and/or assets, concerns of data residency and privacy are reduced, and the result is faster time to detect and triage incidents.

Leveraging Self-Learning AI, Darktrace/OT uses autonomous response that severs only the anomalous or risky behaviors allowing the assets to continue to operate as normal. Organizations work with Darktrace to customize how they want Darktrace’s autonomous response to be applied. These options vary from on a device- by-device basis, device type by device type, or subnet by subnet basis and can be done completely autonomously or in human confirmation mode. This gives security teams more time to respond to an incident and reduces operational downtime when facing a threat.

Darktrace leverages a combination of AI methods:

Self-Learning AI
Bayesian classification probabilistic models
Deep neural networks
Transformers
Graph theory models
Clustering models
Anomaly detection models
Generative and applied AI
Natural language processing
Supervised machine learning for investigation process of alerts

2. Vulnerability & Asset Management

At present, managing OT cyber risk is labor and resource intensive. Many organizations use third-party auditors to identify assets and vulnerabilities, grade compliance, and recommend improvements.

At best, these exercises become tick-box exercises for companies to stay in compliance with little measurable reduction in cyber risk. At worst, asset owners can be left with a mountain of vulnerability information to work through, much of it irrelevant to the security risks Engineering and Operations teams deal with day to day, and increasingly out of date each passing day after the annual or biannual audit has been completed.

In both cases, organizations are left using a patchwork of point products to address different aspects of preventative OT cyber security, most of which lack wider business context and lead to costly inefficiencies with no real impact to vulnerability or risk exposure.

Darktrace’s technology helps in three unique ways:

AI populates asset inventories: Self-Learning AI technology listens and learns from network traffic to populate or update asset inventories. It does this not just by identifying simple IPs, mac addresses, and hostnames, it learns from what it sees and automatically classifies or tags specific types of assets with the function that they perform. For example, if a specific device is performing functions like a PLC, sending commands to and from an HMI, it can appropriately tag and label these systems.
AI prioritizes risk: Leveraging Bayesian Probabilistic Methodologies, Graph Theory, and Deep Neural Networks, Darktrace/OT assesses the strategic risks facing your organization in real time. Using knowledge of data points on all your networked assets, data flow topology, your assets vulnerabilities and OSINT, Darktrace identifies and prioritizes high-value assets, potential attack pathways based on an existing vulnerabilities targetability and impact.
AI explains remediation tactics: Many OT devices run 24/7 operations and cannot be taken offline to apply a patch, assuming a patch is even available. Darktrace/OT uses natural language processing to provide and explain prioritized remediation and mitigation associated with a given cyber risk across all MITRE ATT&CK techniques. Thus, where a CVE exists but a patch cannot be applied, a different technical mitigation can be recommended to remove a potential attack path before it can be exploited, preemptively securing vital internal systems and assets.

Figure 2: A critical attack path which starts with the compromise of a PC in the internal IT network, and ends with a PLC in the OT network. Each step is mapped out to the real world TTPs including abuse of SSH sessions and the modifications of ICS programs

3. Simplify compliance and reporting

Organizations, regardless of size or resources, have compliance regulations they need to adhere to. What this creates is an increased workload for security professionals. For smaller organizations, security teams might lack the manpower or resources to report in the short time frame that is required. For large organizations, keeping track of a massive amount of assets proves to be a challenge. Both cases emanate the risk of reporting fatigue where organizations might be hesitant to report incidents due to the complexity and time requirements they demand.

An AI engine within the Darktrace/OT platform, Cyber AI analyst autonomously investigates incidents, summarize findings in natural language, and provides comprehensive insights into the nature and scope of cyber threats to improve the time it takes to triage and report on incidents. The ability to stitch together and present related security events provides a holistic understanding of the incident, enabling security analysts to identify patterns, assess the scope of potential threats, and prioritize responses effectively.

Darktrace's detection capabilities identify every stage of an intrusion, from a compromised domain controller to network reconnaissance and privilege escalation. The AI technology is capable of detecting infections across several devices and generating incident reports that piece together disparate events to give a clear security narrative containing details of the attack, bridging the communication gap between IT and OT specialists.

Post-incident, the technology assists in outlining timelines, discerning compromised data, pinpointing unusual activities, and aiding security teams in proactive threat mitigation.

With its capabilities, organizations can swiftly understand the attack timeline, affected assets, unauthorized accesses, compromised data points, and malicious interactions, facilitating appropriate communication and action. For example, when Cyber AI Analyst shows an attack path, the security team gains insight on the segmentation or lack thereof between two subnets allowing the security team to appropriately segment the subnets.

Cyber AI improves critical infrastructure operators’ ability to report major cyber-attacks to regulatory authorities. Considering that 72 hours is the reporting period for most significant incidents — and 24 hours for ransomware payments — Cyber AI Analyst is no longer a nice-to-have but a must-have for critical infrastructure.

Figure 3: The tabs labeled 1-4 denote model breaches, each with a specific action and severity indicated by color dots. Darktrace integrates these breaches, offering the security team a unified view of interconnected security events.

The right AI for the right challenge

Incident Phase:

‍Protect

Role of AI:

Cyber risk prioritization

Attack path modelling

Compliance reporting

Darktrace Product:

PREVENT/OT

‍

Incident Phase:

Detect

Role of AI:

Anomaly detection

Triaging and investigating

Darktrace Product:

Cyber AI analyst

DETECT/OT

‍

Incident Phase:

Respond

Role of AI:

Autonomous response

Incident reporting

Darktrace Product:

RESPOND/OT

‍

Incident Phase:

Recover

Role of AI:

Incident preparedness

Incident simulations

Darktrace Product:

HEAL

‍

Credit to: Nicole Carignan, VP of Strategic Cyber AI - Kendra Gonzalez Duran, Director of Technology Innovation - & Daniel Simonds, Director of Operational Technology for their contribution to this blog.

INSIDE THE SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

AUTHOR

ABOUT ThE AUTHOR

Oakley Cox

Analyst Technical Director, APAC

Oakley is a technical expert with 5 years’ experience as a Cyber Analyst. After leading a team of Cyber Analysts at the Cambridge headquarters, he relocated to New Zealand and now oversees the defense of critical infrastructure and industrial control systems across the APAC region. His research into cyber-physical security has been published by Cyber Security journals and CISA. Oakley is GIAC certified in Response and Industrial Defense (GRID), and has a Doctorate (PhD) from the University of Oxford.

Watch the NIS2 Webinar

share this article

More in this series

No items found.

Blog
‍

Inside the SOC

Lost in Translation: Darktrace Blocks Non-English Phishing Campaign Concealing Hidden Payloads

May 2024

Email – the vector of choice for threat actors

In times of unprecedented globalization and internationalization, the enormous number of emails sent and received by organizations every day has opened the door for threat actors looking to gain unauthorized access to target networks.

Now, increasingly global organizations not only need to safeguard their email environments against phishing campaigns targeting their employees in their own language, but they also need to be able to detect malicious emails sent in foreign languages too [1].

Why are non-English language phishing emails more popular?

Many traditional email security vendors rely on pre-trained English language models which, while function adequately against malicious emails composed in English, would struggle in the face of emails composed in other languages. It should, therefore, come as no surprise that this limitation is becoming increasingly taken advantage of by attackers.

Darktrace/Email™, on the other hand, focuses on behavioral analysis and its Self-Learning AI understands what is considered ‘normal’ for every user within an organization’s email environment, bypassing any limitations that would come from relying on language-trained models [1].

In March 2024, Darktrace observed anomalous emails on a customer’s network that were sent from email addresses belonging to an international fast-food chain. Despite this seeming legitimacy, Darktrace promptly identified them as phishing emails that contained malicious payloads, preventing a potentially disruptive network compromise.

Attack Overview and Darktrace Coverage

On March 3, 2024, Darktrace observed one of the customer’s employees receiving an email which would turn out to be the first of more than 50 malicious emails sent by attackers over the course of three days.

The Sender

Darktrace/Email immediately understood that the sender never had any previous correspondence with the organization or its employees, and therefore treated the emails with caution from the onset. Not only was Darktrace able to detect this new sender, but it also identified that the emails had been sent from a domain located in China and contained an attachment with a Chinese file name.

Figure 1: The phishing emails detected by Darktrace sent from a domain in China and containing an attachment with a Chinese file name.

Darktrace further detected that the phishing emails had been sent in a synchronized fashion between March 3 and March 5. Eight unique senders were observed sending a total of 55 emails to 55 separate recipients within the customer’s email environment. The format of the addresses used to send these suspicious emails was “12345@fastflavor-shack[.]cn”^*. The domain “fastflavor-shack[.]cn” is the legitimate domain of the Chinese division of an international fast-food company, and the numerical username contained five numbers, with the final three digits changing which likely represented different stores.

^*(To maintain anonymity, the pseudonym “Fast Flavor Shack” and its fictitious domain, “fastflavor-shack[.]cn”, have been used in this blog to represent the actual fast-food company and the domains identified by Darktrace throughout this incident.)

The use of legitimate domains for malicious activities become commonplace in recent years, with attackers attempting to leverage the trust endpoint users have for reputable organizations or services, in order to achieve their nefarious goals. One similar example was observed when Darktrace detected an attacker attempting to carry out a phishing attack using the cloud storage service Dropbox.

As these emails were sent from a legitimate domain associated with a trusted organization and seemed to be coming from the correct connection source, they were verified by Sender Policy Framework (SPF) and were able to evade the customer’s native email security measures. Darktrace/Email; however, recognized that these emails were actually sent from a user located in Singapore, not China.

Figure 2: Darktrace/Email identified that the email had been sent by a user who had logged in from Singapore, despite the connection source being in China.

The Emails

Darktrace/Email autonomously analyzed the suspicious emails and identified that they were likely phishing emails containing a malicious multistage payload.

Figure 3: Darktrace/Email identifying the presence of a malicious phishing link and a multistage payload.

There has been a significant increase in multistage payload attacks in recent years, whereby a malicious email attempts to elicit recipients to follow a series of steps, such as clicking a link or scanning a QR code, before delivering a malicious payload or attempting to harvest credentials [2].

In this case, the malicious actor had embedded a suspicious link into a QR code inside a Microsoft Word document which was then attached to the email in order to direct targets to a malicious domain. While this attempt to utilize a malicious QR code may have bypassed traditional email security tools that do not scan for QR codes, Darktrace was able to identify the presence of the QR code and scan its destination, revealing it to be a suspicious domain that had never previously been seen on the network, “sssafjeuihiolsw[.]bond”.

Figure 4: Suspicious link embedded in QR Code, which was detected and extracted by Darktrace.

At the time of the attack, there was no open-source intelligence (OSINT) on the domain in question as it had only been registered earlier the same day. This is significant as newly registered domains are typically much more likely to bypass gateways until traditional security tools have enough intelligence to determine that these domains are malicious, by which point a malicious actor may likely have already gained access to internal systems [4]. Despite this, Darktrace’s Self-Learning AI enabled it to recognize the activity surrounding these unusual emails as suspicious and indicative of a malicious phishing campaign, without needing to rely on existing threat intelligence.

The most commonly used sender name line for the observed phishing emails was “财务部”, meaning “finance department”, and Darktrace observed subject lines including “The document has been delivered”, “Income Tax Return Notice” and “The file has been released”, all written in Chinese. The emails also contained an attachment named “通知文件.docx” (“Notification document”), further indicating that they had been crafted to pass for emails related to financial transaction documents.

Figure 5: Darktrace/Email took autonomous mitigative action against the suspicious emails by holding the message from recipient inboxes.

Conclusion

Although this phishing attack was ultimately thwarted by Darktrace/Email, it serves to demonstrate the potential risks of relying on solely language-trained models to detect suspicious email activity. Darktrace’s behavioral and contextual learning-based detection ensures that any deviations in expected email activity, be that a new sender, unusual locations or unexpected attachments or link, are promptly identified and actioned to disrupt the attacks at the earliest opportunity.

In this example, attackers attempted to use non-English language phishing emails containing a multistage payload hidden behind a QR code. As traditional email security measures typically rely on pre-trained language models or the signature-based detection of blacklisted senders or known malicious endpoints, this multistage approach would likely bypass native protection.

Darktrace/Email, meanwhile, is able to autonomously scan attachments and detect QR codes within them, whilst also identifying the embedded links. This ensured that the customer’s email environment was protected against this phishing threat, preventing potential financial and reputation damage.

Credit to: Rajendra Rushanth, Cyber Analyst, Steven Haworth, Head of Threat Modelling, Email

Appendices

List of Indicators of Compromise (IoCs)

IoC – Type – Description

sssafjeuihiolsw[.]bond – Domain Name – Suspicious Link Domain

通知文件.docx – File - Payload

References

[1] https://darktrace.com/blog/stopping-phishing-attacks-in-enter-language

[2] https://darktrace.com/blog/attacks-are-getting-personal

[3] https://darktrace.com/blog/phishing-with-qr-codes-how-darktrace-detected-and-blocked-the-bait

[4] https://darktrace.com/blog/the-domain-game-how-email-attackers-are-buying-their-way-into-inboxes

About the author

Rajendra Rushanth

Cyber Analyst

Blog
‍

No items found.

The State of AI in Cybersecurity: The Impact of AI on Cybersecurity Solutions

May 2024

About the AI Cybersecurity Report

Darktrace surveyed 1,800 CISOs, security leaders, administrators, and practitioners from industries around the globe. Our research was conducted to understand how the adoption of new AI-powered offensive and defensive cybersecurity technologies are being managed by organizations.

This blog continues the conversation from “The State of AI in Cybersecurity: Unveiling Global Insights from 1,800 Security Practitioners” which was an overview of the entire report. This blog will focus on one aspect of the overarching report, the impact of AI on cybersecurity solutions.

To access the full report, click here.

The effects of AI on cybersecurity solutions

Overwhelming alert volumes, high false positive rates, and endlessly innovative threat actors keep security teams scrambling. Defenders have been forced to take a reactive approach, struggling to keep pace with an ever-evolving threat landscape. It is hard to find time to address long-term objectives or revamp operational processes when you are always engaged in hand-to-hand combat.

The impact of AI on the threat landscape will soon make yesterday’s approaches untenable. Cybersecurity vendors are racing to capitalize on buyer interest in AI by supplying solutions that promise to meet the need. But not all AI is created equal, and not all these solutions live up to the widespread hype.

Do security professionals believe AI will impact their security operations?

Yes! 95% of cybersecurity professionals agree that AI-powered solutions will level up their organization’s defenses.

Not only is there strong agreement about the ability of AI-powered cybersecurity solutions to improve the speed and efficiency of prevention, detection, response, and recovery, but that agreement is nearly universal, with more than 95% alignment.

This AI-powered future is about much more than generative AI. While generative AI can help accelerate the data retrieval process within threat detection, create quick incident summaries, automate low-level tasks in security operations, and simulate phishing emails and other attack tactics, most of these use cases were ranked lower in their impact to security operations by survey participants.

There are many other types of AI, which can be applied to many other use cases:

Supervised machine learning: Applied more often than any other type of AI in cybersecurity. Trained on attack patterns and historical threat intelligence to recognize known attacks.

Natural language processing (NLP): Applies computational techniques to process and understand human language. It can be used in threat intelligence, incident investigation, and summarization.

Large language models (LLMs): Used in generative AI tools, this type of AI applies deep learning models trained on massively large data sets to understand, summarize, and generate new content. The integrity of the output depends upon the quality of the data on which the AI was trained.

Unsupervised machine learning: Continuously learns from raw, unstructured data to identify deviations that represent true anomalies. With the correct models, this AI can use anomaly-based detections to identify all kinds of cyber-attacks, including entirely unknown and novel ones.

What are the areas of cybersecurity AI will impact the most?

Improving threat detection is the #1 area within cybersecurity where AI is expected to have an impact.

The most frequent response to this question, improving threat detection capabilities in general, was top ranked by slightly more than half (57%) of respondents. This suggests security professionals hope that AI will rapidly analyze enormous numbers of validated threats within huge volumes of fast-flowing events and signals. And that it will ultimately prove a boon to front-line security analysts. They are not wrong.

Identifying exploitable vulnerabilities (mentioned by 50% of respondents) is also important. Strengthening vulnerability management by applying AI to continuously monitor the exposed attack surface for risks and high-impact vulnerabilities can give defenders an edge. If it prevents threats from ever reaching the network, AI will have a major downstream impact on incident prevalence and breach risk.

Where will defensive AI have the greatest impact on cybersecurity?

Cloud security (61%), data security (50%), and network security (46%) are the domains where defensive AI is expected to have the greatest impact.

Respondents selected broader domains over specific technologies. In particular, they chose the areas experiencing a renaissance. Cloud is the future for most organizations,
and the effects of cloud adoption on data and networks are intertwined. All three domains are increasingly central to business operations, impacting everything everywhere.

Responses were remarkably consistent across demographics, geographies, and organization sizes, suggesting that nearly all survey participants are thinking about this similarly—that AI will likely have far-reaching applications across the broadest fields, as well as fewer, more specific applications within narrower categories.

Going forward, it will be paramount for organizations to augment their cloud and SaaS security with AI-powered anomaly detection, as threat actors sharpen their focus on these targets.

How will security teams stop AI-powered threats?

Most security stakeholders (71%) are confident that AI-powered security solutions are better able to block AI-powered threats than traditional tools.

There is strong agreement that AI-powered solutions will be better at stopping AI-powered threats (71% of respondents are confident in this), and there’s also agreement (66%) that AI-powered solutions will be able to do so automatically. This implies significant faith in the ability of AI to detect threats both precisely and accurately, and also orchestrate the correct response actions.

There is also a high degree of confidence in the ability of security teams to implement and operate AI-powered solutions, with only 30% of respondents expressing doubt. This bodes well for the acceptance of AI-powered solutions, with stakeholders saying they’re prepared for the shift.

On the one hand, it is positive that cybersecurity stakeholders are beginning to understand the terms of this contest—that is, that only AI can be used to fight AI. On the other hand, there are persistent misunderstandings about what AI is, what it can do, and why choosing the right type of AI is so important. Only when those popular misconceptions have become far less widespread can our industry advance its effectiveness.

To access the full report, click here.

About the author

The Darktrace Community

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Start your free trial

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: 3 Ways AI Secures OT & ICS from Cyber Attacks

Blog
‍

OT

3 Ways AI Secures OT & ICS from Cyber Attacks

What is OT and ICS?

The role of AI in defending OT/ICS networks