Aye: A Trusted Forensic Method for Firmware Tampering Attacks

The Programmable Logic Controller (PLC) is located at the junction of virtual network and physical reality in Industrial Control System (ICS), which vulnerable to attacks due its weak security. Specifically, firmware tampering take under PLC operating system as primary attack target. provides bridge between PLC’s hardware software, means against can be more destructive harmful than other attacks. However, existing defense forensics methods are asymmetrical, directly leads proliferation such difficulty forensic tracing. How accurately, quickly, efficiently conduct for an urgent problem. In this paper, we designed implemented a reliable detection method based on Joint Test Action Group (JTAG) memory comparison—Aye, detect mainstream reliably. To determine effectiveness reliability Aye, selected widely used observe Aye’s performance by simulating two latest methods. experimental results show that Aye effectively defend attacks, helping improve efficiency accuracy forensics.