Optimal Device-Type Inference in Cyber-Physical Systems Using Packet Data and Expert Rules

Abstract

As cyber threats to cyber-physical systems continue to escalate, gaining a comprehensive understanding of the system architecture becomes essential for implementing effective defense strategies. However, it is often the case that even system owners lack a complete understanding of their systems. This underscores the need for developing approaches that facilitate the creation of detailed network maps to improve situational awareness and bolster cybersecurity measures. In this paper, we propose a novel approach that integrates mathematical optimization techniques with expert rules to infer device types based on communication patterns observed in passive packet capture (PCAP) data. This methodology serves as a crucial first step in developing detailed network maps, ultimately strengthening the security posture of cyber-physical systems.