MARS: Detecting Unauthorized Variable Manipulations in Multi-Application PLC Runtimes

2026-09-05

AI Summary

MARS通过在虚拟PLC上建立应用级授权和归属策略，检测并归责多应用PLC运行时未经授权的变量操作问题。

Abstract

Programmable Logic Controllers (PLCs) increasingly run multiple applications alongside the main control program, with shared access to PLC variables. Yet, Industrial Control System (ICS) defenses primarily detect malicious updates by checking whether variable values violate expected bounds, without considering which application performed the update. A malicious application can exploit this gap by modifying variables within normal bounds while still driving the physical process toward an unsafe state. Even when such manipulation is detected, operators cannot identify the responsible application because PLCs do not associate variable updates with application identity. We present MARS, an automated framework for application-level authorization and attribution of PLC variable manipulations. MARS profiles applications on an isolated virtual PLC (vPLC) to derive application-specific variable-access policies and uses a shadow vPLC during operation to attribute production-PLC updates to individual applications without instrumenting the production controller. MARS also detects manipulations that occur only on the production PLC and therefore have no corresponding update on the shadow vPLC. We evaluate MARS on manufacturing, chemical, and water-treatment systems against attacks in which unauthorized applications manipulate PLC variables while remaining within normal bounds. Our results show that MARS detects these manipulations and identifies the responsible application.

Problem

• Industrial Control System (ICS)
• Programmable Logic Controller (PLC)
• variable manipulation
• application-level authorization
• attribution

Innovation

• application-level authorization
• variable-access policies
• shadow vPLC
• unauthorized variable manipulations