Static analysis for Ladder Logic Bombs (LLB) detection in Programmable Logic Controllers (PLC)

• Diego Sousa de Miranda USP
• Victor Takashi Hayashi USP

DOI: https://doi.org/10.5753/sbseg.2026.27121

Resumo

Os PLCs são elementos críticos por traduzirem decisões de controle em ações sobre sensores e atuadores. Nesse contexto, LLB representam uma ameaça relevante devido à sua capacidade furtiva na lógica de controle do PLC. Este trabalho avalia a detecção estática de LLB a partir de atributos extraídos de programas PLC, organizados em grupos estruturais e topológicos, lógicos, semânticos e sequenciais. Foram aplicadas técnicas supervisionadas e não supervisionadas para analisar o potencial discriminativo desses atributos. Os modelos treinados com atributos lógicos e semânticos alcançaram os melhores F1-scores, ambos iguais a 0,9692. A clusterização dos atributos lógicos indicou separabilidade, com Silhouette de 0,8529 e Davies-Bouldin de 0,2155.

Referências

Ali, M. (2020). PyCaret: An open-source, low-code machine learning library in Python. PyCaret version 1.0.0.

Asghar, M. R., Hu, Q., and Zeadally, S. (2019). Cybersecurity in industrial control systems: Issues, technologies, and challenges. Computer Networks, 165:106946.

Boateng, E. A. and Bruce, J. W. (2022). Unsupervised machine learning techniques for detecting plc process control anomalies. Journal of Cybersecurity and Privacy 2022, Vol. 2, Pages 220-244, 2:220–244.

Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, National Security Agency, Environmental Protection Agency, and Israel National Cyber Directorate (2023). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Technical Report AA23-335A, Cybersecurity and Infrastructure Security Agency. Joint Cybersecurity Advisory.

Govil, N., Agrawal, A., and Tippenhauer, N. O. (2017). On ladder logic bombs in industrial control systems. In Proceedings of the Workshop on the Security of Industrial Control Systems and of Cyber-Physical Systems (CyberICPS), co-located with ESORICS.

Iacobelli, A., Rinieri, L., Melis, A., Sadi, A. A., Prandini, M., and Callegati, F. (2024). Detection of ladder logic bombs in plc control programs: an architecture based on formal verification. 2024 IEEE 7th International Conference on Industrial Cyber-Physical Systems, ICPS 2024.

International Electrotechnical Commission (2013). IEC 61131-3: Programmable controllers – Part 3: Programming languages.

International Electrotechnical Commission (2019). IEC 61131-10: Programmable controllers – Part 10: PLCopen XML exchange format.

Langmann, R. and Stiller, M. (2019). The plc as a smart service in industry 4.0 production systems. Applied Sciences, 9(18):3815.

Lee, J. H. et al. (2025). Anomaly detection method considering plc control logic structure for ics cyber threat detection. Applied Sciences, 15(7):3507.

Plachkinova, M. and Vo, A. (2022). A taxonomy of cyberattacks against critical infrastructure. Journal of Cybersecurity Education, Research and Practice, 2021.

Rinieri, L., Iacobelli, A., Melis, A., Prandini, M., and Callegati, F. (2024). Plc-defuser: Detecting hidden ladder logic bombs in plcs via control flow graph and model checking.

Serhane, A., Raad, M., Raad, R., and Susilo, W. (2018). Plc code-level vulnerabilities. 2018 International Conference on Computer and Applications, ICCA 2018, pages 348–352.

Serhane, A., Raad, M., Raad, R., and Susilo, W. (2019). Programmable logic controllers based systems (plc-bs): vulnerabilities and threats. SN Applied Sciences, 1:924–.

Theis, J., Mokhtarian, I., and Darabi, H. (2019). Process mining of programmable logic controllers: Input/output event logs. In 2019 IEEE 15th International Conference on Automation Science and Engineering (CASE), pages 216–221.

Vaidyan, V. M. and Tyagi, A. (2022). Towards quantum artificial intelligence electromagnetic prediction models for ladder logic bombs and faults in programmable logic controllers. Proceedings of the 2022 International Conference on Electronic Systems and Intelligent Computing, ICESIC 2022, pages 1–6.

Yau, K. and Chow, K.-P. (2015). Plc forensics based on control program logic change detection. Journal of Digital Forensics, Security and Law, 10(4).