ICSML: Industrial Control Systems Machine Learning Inference Framework
  natively executing on IEC 61131-3 compliant devices
  Industrial Control Systems (ICS) have played a catalytic role in enabling the
4th Industrial Revolution. ICS devices like Programmable Logic Controllers
(PLCs), automate, monitor, and control critical processes in industrial,
energy, and commercial environments. The convergence of traditional Operational
Technology (OT) with Information Technology (IT) has opened a new and unique
threat landscape. This has inspired defense research that focuses heavily on
Machine Learning (ML) based anomaly detection methods that run on external IT
hardware, which means an increase in costs and the further expansion of the
threat landscape. To remove this requirement, we introduce the ICS machine
learning inference framework (ICSML) which enables the execution of ML model
inference natively on the PLC. ICSML is implemented in IEC 61131-3 code and
provides several optimizations to bypass the limitations imposed by the
domain-specific languages. Therefore, it works \emph{on every PLC without the
need for vendor support}. ICSML provides a complete set of components for the
creation of full ML models similarly to established ML frameworks. We run a
series of benchmarks studying memory and performance and compare our solution
to the TFLite inference framework. At the same time, we develop domain-specific
model optimizations to improve the efficiency of ICSML. To demonstrate the
abilities of ICSML, we evaluate a case study of a real defense for
process-aware attacks targeting a desalination plant.
