How useful is AI in OT security monitoring?

Artificial intelligence seems to be seen as a panacea these days – from tomorrow’s shopping list to world peace. Even cybersecurity solution providers are increasingly proclaiming their use of artificial intelligence (AI) in their solutions to show their advanced and state-of-the-art credentials. As of yet, Rhebo has been avoiding the use of AI in its solutions. We explain why.

It seems to be the case that in the technology world, nothing works without AI. In OT security as well, there have long been offers and (not very transparent) solutions, but to date, these have merely been advertising promises, hypotheses and superficial arguments. There is no actual proof.

In order to establish whether AI improves OT security, companies should ask themselves (and their vendors) three questions:

• Is this even AI that is being used here? Or are you being sold an apple for pear?
• What added value does AI have in OT security compared to other approaches?
• What are the risks that AI poses to the stability and availability of my industrial processes and to occupational safety?

1. Not everything that bills AI actually contains it

The term AI is frequently used to denote all software solutions that enable a certain degree of automation. In actuality, whether the solutions are really “intelligent” or whether they actually “simply” work with defined algorithms based on statistical and heuristic methods is dubious. So a cybersecurity system that detects various anomalies, aggregates them to a network scan alert and maybe adds an explanation, might – at first glance - appear intelligent. Though the truth is, this  can be done entirely using defined algorithms.

Companies are well advised to ask providers of so-called AI-driven OT cybersecurity solutions what exactly the AI in the solution is and how it works.

2. Is AI even needed in OT security?

The effectiveness and efficiency of AI in OT security have in fact not yet been conclusively clarified. Between 2020 and 2023, the “Hybrid AI Intrusion Prevention for Industrial Control Systems” (HAIP) research project1, supported by the German Federal Ministry of Education and Research, investigated the added value of AI for anomaly detection in industrial environments. The research team did in fact arrive at the conclusion in their final report that AI can support anomaly detection and assessment. However, the performance and accuracy were on par with and even partly below other methods such as heuristics, statistics and algorithms defined by a team of experts.

The result is not surprising for OT networks: The most important anomalies can already be reliably identified using statistical and heuristic methods, since OT communication is deterministic and repetitive. In addition, OT networks typically lack the data volume and data variability that AI needs to be trained and to provide added value through more complex analytics.

The OT monitoring with integrated anomaly and intrusion detection from Rhebo Industrial Protector therefore uses:

• heuristic methods

• statistical Methods

• algorithms based on the Tactics, Techniques & Procedures (TTPs) of the Mitre Att&ck Framework for Enterprise and ICS

• algorithms based on over ten years of expertise in analyzing cyber incidents and OT networks.

As the SANS Institute notes in a recent article: It is important to also note, there may be higher priority items inside engineering and ICS security that would provide higher return on investment than undertaking AI at this time.”2

AI can however help in a second step – the integration of OT security into IT security via a Security Information & Event Management (SIEM) system – to better classify anomalies. In the SIEM, the logs and event reports for the individual cybersecurity components (firewalls, virus scanners, authorization mechanisms, anomaly detection) are aggregated and automatically evaluated. It is only at this juncture that complex analyses using AI can create added value.

For this purpose, Rhebo Industrial Protector provides an interface to send OT events to SIEM systems:

• via encrypted Syslog,

• in industry standard format CEF,

• as algorithmically prequalified security events (e.g. directly as TTPs according to the Mitre Att&ck frameworks).

3. Consider the risks of AI in OT

At present, the most visible form of AI are products like ChatGPT, Gemma and Mistral. Due to their public exposure, they are also the (only) AI products that really can be evaluated independently, i.e. by a 3rd party. Therefore, the results of a study by an Apple research team should definitely be taken into account when analyzing the risks of AI.3

The team investigated the ability of AI systems to actually think logically and make deductions. For most of the systems tested, reasoning worked very well, provided the tasks closely matched the training data. When researchers began to expand the tasks, for example by including information that did not influence the outcome at all, the number of false results rapidly increased.4 That is, the AI systems could easily be distracted and led astray – leaving aside the many anecdotes where ChatGPT and the like hallucinated or simply made false statements without blinking.  

In OT security, these weaknesses can cause the number of false-positive intrusion detection alerts to increase, while real attacks go undetected due to obfuscation and distraction. This may endanger not only the processes, but also the people who work at the facilities.

3.1. AI lacks transparency

On top of that, commercial AI products, under the cloak of trade secrets, typically are not transparentat all. When the AI decides something, users do not know how the AI came to that conclusion. In the area of cybersecurity and even more so in the area of OT security, where occupational safety, stability and availability are paramount, black box AI is in fact a no-go. If there is no transparency of how AI works – i.e. without explainable AI – companies get black box cybersecurity in an OT that is already run as a black box.

Rhebo Industrial Protector, in contrast, is designed as a completely transparent tool in which decision-makers within the respective company retain full control:

• Each anomaly is logged with all details including pcaps for evaluation. This also means that all information is available for forensic analysis and reporting to the authorities.

• Each anomaly is pre-evaluated with a risk score. The scores can be adjusted by the operating security officers according their own network specifications.

• Any unclear anomaly can be saved on a separate monitoring list. If this anomaly occurs again, the reoccurrence is presented in the context of previous alerts. This enables security operators to identify and understand context and make better decisions.

• At the push of a button, security officers can declare any anomaly as a legitimate communication and add it to the baseline. This allows the intrusion detection system to learn in a comprehensible manner without giving rise to any ambiguities in the decision-making process.

Ultimately, OT security is all about OT visibility and transparency. An additional black box only creates more confusion here, rather than anything else.