Jean-Francois Couchot
email: jean-francois.couchot@univ-fcomte.fr

Raphaël Couturier
email: raphael.couturier@univ-fcomte.fr

Michel Salomon
email: michel.salomon@univ-fcomte.fr

Improving Blind Steganalysis in Spatial Domain using a Criterion to Choose the Appropriate Steganalyzer between CNN and SRM+EC

Keywords: Steganalysis, Spatial Domain, CNN, SRM+EC

Conventional state-of-the-art image steganalysis approaches usually consist of a classifier trained with features provided by rich image models. As both features extraction and classification steps are perfectly embodied in the deep learning architecture called Convolutional Neural Network (CNN), different studies have tried to design a CNN-based steganalyzer. This work proposes a criterion to choose either the CNN designed by Xu et al. or the combination Spatial Rich Models (SRM)

and Ensemble Classifier (EC) for an input image. Our approach is studied with three steganographic spatial domain algorithms: S-UNIWARD, MiPOD, and HILL, and exhibits detection capabilities better than each method alone. As SRM+EC and the CNN are only trained with MiPOD the proposed method can be seen as an approach for blind steganalysis.

Introduction

During this past decade many steganographic algorithms have been proposed to hide a secret message inside a cover image. Such embedding schemes can operate in the spatial domain, like for example MiPOD [START_REF] Sedighi | Content-adaptive steganography by minimizing statistical detectability[END_REF], S-UNIWARD [START_REF] Holub | Universal distortion function for steganography in an arbitrary domain[END_REF], HILL [START_REF] Li | A new cost function for spatial image steganography[END_REF], WOW [START_REF] Holub | Designing steganographic distortion using directional filters[END_REF], HUGO [START_REF] Pevný | Using high-dimensional image models to perform highly undetectable steganography[END_REF], or STABYLO [START_REF] Couchot | STABYLO: steganography with adaptive, bbs, and binary embedding at low cost[END_REF] but also in the frequency domain as J(PEG) counterpart of S-UNIWARD. When designing such an algorithm the objective is to provide an approach that changes the cover image as little as possible. The less the cover is modified, the less likely the stego image containing the message is to be detected and thus the more secure the steganographic scheme is. Obviously, assessing the security of steganographic tools has given rise to the dual challenge of detecting hidden information, also called steganalysis.

The wide majority of image steganalysis approaches are two-step. The first stage exhibits useful information on image content by computing a set of features and the second one uses them to train a machine learning tool to distinguish cover images from stego ones. For the first step, different Rich Models (RM) have been proposed for the spatial domain (SRM) [START_REF] Fridrich | Multivariate gaussian model for designing additive distortion for steganography[END_REF] and the JPEG one [START_REF] Holub | Low-complexity features for JPEG steganalysis using undecimated DCT[END_REF], while for the second step the most common choice is Ensemble Classifier (EC) [START_REF] Kodovský | Ensemble classifiers for steganalysis of digital media[END_REF]. This combination RM+EC is used in many state-of-the-art image steganalysis tools. As an illustration, in [START_REF] Fridrich | Multivariate gaussian model for designing additive distortion for steganography[END_REF] stego images obtained with the steganographic algorithm HUGO have been detected with errors of 13% and 37%, respectively, for embedding payloads of 0.4 and 0.1 bpp. These errors were slightly reduced (12% and 36%) in [START_REF] Holub | Random projections of residuals for digital image steganalysis[END_REF] thanks to an improved rich model.

Deep learning [START_REF] Schmidhuber | Deep learning in neural networks: An overview[END_REF][START_REF] Lecun | Deep learning[END_REF] has led to breakthrough improvements in various challenging tasks in computer vision, becoming the state-of-the-art for many of them.

A key reason for this success is the current availability of powerful computing platforms, and more particularly GPU-accelerated ones. Among the different network architectures belonging to this family of machine learning methods, Convolutional Neural Networks (CNN) [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF] are very efficient to solve image classification problems. As steganalysis is a similar problem, since the objective is to classify an input image as either a cover or a stego, the design of a CNN-based steganalyzer has received increasing attention for the past few years.

From an architecture point of view, a CNN is a feedforward network composed of two parts matching exactly the two steps used in conventional steganalysis. The first part, called the convolutional part, consists of one or several layers trained to extract feature maps becoming smaller with the layer depth. The second one is composed of some fully-connected layers trained simultaneously to perform the classification task. Hence, CNN does not only learn how to classify, but also how to automatically find a set of features giving a better representation of the input image thanks to 2D convolution kernels. A feature map is usually produced by a three-step process: a combination of filtered maps of the previous layer (or the input image for the first layer), a nonlinear processing by a neuron, and finally a size reduction through pooling (see [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF] for more details).

The remainder of this paper proceeds as follows. Section 2 presents related works. The next section first recalls the CNN architecture designed by Xu et al. [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF]. After an experimental study, we focus on why it sometimes fails to detect some stego images. Section 4 is devoted to our proposal: a criterion to choose the best suited method between CNN and SRM+EC. The paper ends with a section that summarizes the contributions and outlines suggestions for future work.

Related Works

Steganography

To be self-sufficient, this article recalls the key ideas of the three most secure steganographic tools, namely S-UNIWARD [START_REF] Holub | Universal distortion function for steganography in an arbitrary domain[END_REF], MiPOD [START_REF] Sedighi | Content-adaptive steganography by minimizing statistical detectability[END_REF], and HILL [START_REF] Li | A new cost function for spatial image steganography[END_REF]. For each of these algorithms, a distortion function ρ associates to each pixel the cost of modifying it. More formally, for a given cover X, let ρpXq be the matrix whose elements represent the cost of increasing or decreasing by 1 the corresponding pixels. By ranking pixels according to their value in ρpXq, one can compute the set of pixels whose modification induces the smallest detectability. For instance the distortion function ρ U of S-UNIWARD is defined by:

ρ U pXq " 3 ÿ k"1 1 |X ‹ K k | `σ ‹ |K k | ð , (1)
where ‹ is a convolution mirror-padded product, Y ð is the result of a 180 degrees rotation of Y , K k , 1 ď k ď 3 are Daubechies-8 wavelet kernels in the three directions, and σ is a stabilizing constant. It should be noticed that the multiplicative inverse is element-wise applied. An element of ρ U pXq is small if and only if there are large variations of large cover wavelet coefficients in the three directions.

In MiPOD, the distortion function ρ M is obtained thanks to a probabilistic approach. More precisely, let β be the matrix defined as the probabilities to increase by 1 the image pixels. The objective of such a scheme is then to find probabilities which minimize a deflection coefficient, Σσ ´4β 2 , where σ is the residual variance matrix of image pixels. Notice that the product is elementwise applied and the sum concerns all the elements of the matrix. Thanks to a Wiener filter and a Lagrangian method, β can be computed. Considering such pixel probabilities, the distortion cost ρ M is defined by:

ρ M pXq " ln ˆ1 β ´2˙. (2)
Finally, the distortion function ρ H of the HILL steganographic scheme is based on combinations of convolution products. However, contrary to the distortion function ρ U of S-UNIWARD, this one combines a high-pass filter H 1 and two low-pass filters L 1 and L 2 . More precisely, ρ H is defined by:

ρ H pXq " 1 |X ‹ H 1 | ‹ L 1 ‹ L 2 , where H 1 " » - ´1 2 ´1 2 ´4 2 ´1 2 ´1 fi fl (3)
and L 1 (resp. L 2 ) is a 3 ˆ3 (resp. 5 ˆ5) mean matrix. In all aforementioned schemes, the distortion function reflects the underlying image model. To summarize, ρ returns a large value in a easy-defined or smooth area, whereas in a textured or "chaotic" area, i.e., with no model, it returns a small value.

CNN-based Steganalysis

The first attempt at designing a CNN-based steganalyzer for image steganalysis is due to Tan et al. [START_REF] Tan | Stacked convolutional auto-encoders for steganalysis of digital images[END_REF]. Their proposal, a stacking of convolutional autoencoders, yielded for HUGO a detection error more than twice as bad as the one given by SRM+EC: 31% compared to 14% for a payload of 0.4 bpp.

Qian et al. [START_REF] Qian | Deep learning for steganalysis via convolutional neural networks[END_REF] have proposed for 256 ˆ256 input images a CNN consisting of a convolutional part of 5 layers producing at the end 256 features, which are then processed by a fully-connected part of two hidden layers and a final output one of two softmax neurons. The preliminary high-pass filtering is done using a 5 ˆ5 kernel, called F 0 , similar to the 5 ˆ5 kernel predictor obtained in [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF]. As noticed by Fridrich and Kodovský in [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF], this kernel is inspired by a specific embedding algorithm, namely HUGO, but it worked well for the other steganographic algorithms they tested. The detection performance of this CNN was still slightly lower than the state-of-the-art SRM+EC steganalyzer, but Pibre et al. [START_REF] Pibre | Deep learning is a good steganalysis tool when embedding key is reused for different images, even if there is a cover source-mismatch[END_REF] improved it thanks to a CNN with a different shape.

In comparison with the work of Pibre et al., the CNN we designed in [START_REF] Couchot | Steganalysis via a Convolutional Neural Network using Large Convolution Filters for Embedding Process with Same Stego Key[END_REF] being shallow, was quite different and calling into question some assumptions previously made. On the one hand, we proposed a convolutional part of two layers: a first layer reduced to a single 5 ˆ5 kernel trained to replace F 0 , followed by a layer using large kernels (almost as large as the image size). On the other hand, the resulting set of 256 features (for an input image of 512 ˆ512 pixels) was so discriminating that the fully-connected network doing the classification task could be shortened to the two final softmax neurons. Unfortunately, our work, as well as the one of Pibre et al., suffers from a crippling drawback: stego images were always obtained by using the same embedding key. The work by Qian et al. might suffer from the same drawback too.

More recently, the works [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] and [START_REF] Xu | Ensemble of cnns for steganalysis: An empirical study[END_REF] by Xu et al. have shown that CNNbased steganalysis remains competitive with conventional steganalysis. In [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] they first proposed a structural design of CNNs for steganalysis that is neither large, nor deep, and learns from noise residuals, since they considered as input image the one issued from high-pass filtering using the kernel F 0 . The architecture of such convolutional networks, which is the basis of our work presented thereafter, will be described in detail in the next section. The experiments they completed have considered two spatial content-adaptive steganographic algorithms: S-UNIWARD and HILL. They have shown that the performance gained by an ensemble of five CNNs is comparable to the one of SRM+EC. In the following work [START_REF] Xu | Ensemble of cnns for steganalysis: An empirical study[END_REF], Xu et al. decided to study the merging of CNNs and ensemble classifier. The background idea is to train a second level classifier using information provided by CNNs. Furthermore, they also sligthly modified the architecture of the original CNN designed in [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF]. This new CNN architecture has one more layer and changed pooling sizes in the previous ones. In addition to the ensemble method [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF], called PROB, where EC will use the output of 16 CNNs instead of five, they defined two further ensemble methods. The first one, called PROB POOL, is supposed to lower the loss of information induced by the pooling operation. Indeed, when the stride value is larger than one, some sampling operations are dropped. For a stride value p ą 1, applying the pooling on a block of p ˆp pixels gives a single value, whereas for a stride of 1 the same block would have been replaced by p ˆp values. The idea is thus to also consider independently each remaining p ˆp ´1 possible sampling. The second new ensemble method, called FEA, is simpler: it uses an architecture merging the convolutional part and the ensemble classifier. From the experiments done with these 6 ensemble scenarios (two possible sizes for the final vector of features and three methods), Xu et al. concluded that it might be interesting to replace the fully-connected part of the CNN by EC for image steganalysis. obtained by using a 5ˆ5 DCT basis pattern, and three Q&T combinations. Then, for each group of residual maps for a given Q&T combination, a subnetwork corresponding to a simplified version of the convolutional part proposed by Xu et al. in [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] is trained to produce a feature vector of 512 components. To obtain the final prediction, the three vectors are concatenated and given as input to a three-layer fully connected network, which is trained together with the three subnets. Based on the experiments performed on more or less large databases of images issued from ImageNet, the authors claim that their proposal outperforms all other existing steganalysis approaches.

Convolutional Neural Networks for Image Steganalysis

3.1 The CNN Architecture Proposed by Xu et al. [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] Like almost all the previous research works on CNNs for image steganalysis in the spatial domain, Xu et al. proposed an architecture that takes as input a highpass filtered (HPF) version of the input image as shown in Fig. 1(a). Therefore, they used the kernel denoted by F 0 in [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF][START_REF] Qian | Deep learning for steganalysis via convolutional neural networks[END_REF][START_REF] Pibre | Deep learning is a good steganalysis tool when embedding key is reused for different images, even if there is a cover source-mismatch[END_REF] to highlight noise residuals. This filtering is obviously of great importance, since it provides the input information to the CNN, and thus must be suited to the classification task. The relevance of this kernel comes from its design for rich models. A classification part reduced to output neurons means that a linear classification is able to distinguish covers from stegos using the features produced by the final convolutional layer.

Starting with a HPF image of 512 ˆ512 pixels, the convolutional part results in 128 features, as shown in Fig. 1(b). Each of the four first layers successively halves the image size by generating feature maps using an average pooling, while the fifth one replaces each feature map by a single value obtained through a global average pooling. Layers 1 and 2 learn 5ˆ5 kernels, and the remaining layers 1ˆ1 ones, the idea being to avoid an overfitting of the CNN to image content and/or stego noise. Layer 1 has also a specific function applied onto the outcome of the convolution, namely the absolute function (ABS), supposed to ensure that the model takes care of the symmetry in noise residuals like in rich models [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF]. Batch normalization (BN) [START_REF] Ioffe | Batch normalization: Accelerating deep network training by reducing internal covariate shift[END_REF] is performed in every convolutional layer. A mixing of Tanh and ReLU non-linear activation offered the best performance.

Detection Performance Evaluation of the CNN

To study and assess the performance of Xu et al. proposal, which was originally evaluated using a modified version of Caffe toolbox, the corresponding CNN has been implemented with the open source software library TensorFlow. The implementation is available on download from GitHub1 . All the experiments are performed on a NVIDIA Tesla Titan X GPU, using as cover database the wellknown BOSSBase [START_REF] Bas | Break Our Steganographic System[END_REF]. Six stego images are associated to each cover image. They are obtained by embedding a message with S-UNIWARD, MiPOD, and HILL schemes considering two different payload values: 0.1 and 0.4 bpp. During a training execution a CNN is trained on a set of 5,000 cover-stego pairs and its detection performance assessed on a the remaining 5,000 pairs. Both training and testing sets are built by randomly picking pairs of images.

Notice that even if we implemented exactly a CNN according to the proposal, there is a major difference in comparison with the original work in the way the final prediction is obtained. In [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] Xu et al. generated from a training set five different non-overlapping 4,000/1,000 splits and each of them is used to train separately a CNN occurrence. The final prediction for a given test image is then obtained by averaging the five output probabilities.

Let us explain how the final prediction is computed with a set of T trained CNNs which are denoted as CNN 1 , CNN 2 , . . . , CNN T . First of all, each CNN i , 1 ď i ď T , memorizes its L last versions provided by the L last training epochs obtained all along the program execution. These internal CNNs are denoted as CNN 1 i , CNN 2 i , . . . CNN L i . Each of these internal CNNs gives an answer, which is 0 if the tested image I is declared as cover and 1 otherwise. Finally, the average of all the values is computed, and a discrete answer is returned by each CNN depending on whether this average is greater or equal to 0.5 or not. This is formalized for each i, 1 ď i ď T , by: is stegopI, CNN i q "

[ 1 L L ÿ j"1 is stegopI, CNN j i q `0.5 _ . (4)
The aggregation of these results must take into consideration the fact that an image I we want to classify is used in training step in some CNN i or not. Let us consider the set T I " ti|1 ď i ď T and I is used in testing step of CNN i u and T I be its cardinality. The number T I counts the number of times I is used as a testing image by some CNNs. The final answer is then the discrete answer of the average of all the CNNs that have used I as testing image. This is formalized by: is stego CNNpIq "

[ 1 T I ÿ iPT I is stegopI, CNN i q `0.5 _ . (5)
Indeed, as both training and testing sets are built by randomly picking images, the number of times an image I is in a test set varies. Due to the huge computation cost we have only trained CNNs using MiPOD dataset and tested them directly on the S-UNIWARD and HILL ones. Hence, we can assess whether a CNN is competitive in a blind steganalysis approach.

The key training parameters for reproducible experiments are discussed thereafter. First, a CNN is trained for a maximum number of training epochs E max set to 1, 000 and 300, respectively, for embedding payloads of 0.1 and 0.4 bpp, without any overfitting control with a validation set. To compute the prediction given by a network CNN i , L " 20 occurrences are used. Second, the network parameters are optimized by applying a mini-batch stochastic gradient descent, a typical choice in deep learning. We have used a mini-batch size of 64 samples. The gradient descent parameters are: a learning rate initialized to 0.001, but with no weight decay, and a momentum set to 0.9.

The obtained average detection errors are reported in Table 1. The first line labelled with "Caffe [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF]" recalls values given in [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF]. It should be noticed that "X" means that HILL has not been evaluated with the Caffe framework. The second line gives the average error rates from T " 12 independent training runs of the TensorFlow implementation for embedding payload of 0.4 bits per pixel. The third gives the average error rates for 200 runs with classical SRM+EC. In this latter context maxSRMd2 [START_REF] Denemark | Selectionchannel-aware rich model for steganalysis of digital images[END_REF] has been used as a feature set. Finally, the last line gives the results obtained when the training stage is executed with images modified by MiPOD, whereas the testing stage is executed with images modified with another embedding scheme (SRM+EC and maxSRMd2 are still used). From the values given in this table we can draw several conclusions. First, despite the differences highlighted previously, for a payload of 0.4 bpp the Ten-sorFlow implementation produces nearly the same performance for S-UNIWARD and HILL than the original Caffe one, while for 0.1 bpp the performance is worse due to the blind context. Second, we observe that SRM+EC results in the best performances for S-UNIWARD in case of non-blind steganalysis. Third, for Mi-POD the CNN approach is still competitive with SRM+EC. Fourth, the CNNs trained by only making use of the MiPOD dataset can provide a similar detection accuracy for S-UNIWARD and HILL, even if for the payload of 0.1 bpp a larger degradation of the accuracy can be noticed. Obviously, the lowest detection error is gained for the embedding scheme which has provided the training data. Fifth, CNNs outperform SRM+EC in blind steganalysis context with a payload of 0.4 bpp, which means that CNNs allow a better generalization to different steganographic algorithms.

Characterizing the mis-CNN-classified Images

Let us start with some illustrative examples of images describing the typical behavior of the CNN in the case of MiPOD with payload 0.4 bpp. Fig. 2 presents four case examples where for each we have the cover image and the corresponding differences between it and the stego one. From the images showing the differences we can distinguish two groups of images according to the pixels modified by the embedding process. It clearly appears that for both images shown on the upper line, 1388.pgm and 8873.pgm, MiPOD mainly modifies pixels corresponding to edges. For 1911.pgm and 3394.pgm, changes are scattered without obviously highlighting any underlying image edge. Consequently, since a CNN mainly learns to detect underlying edges, one can easily guess that the CNNsteganalyzer is able to detect both cover and stego for 1388.pgm and 8873.pgm, whereas it fails for the two other images. We are then left to provide a metric on images which reflects the difficulty to perform the CNN classification task.

Since the aforementioned steganographic schemes have their own distortion function ρ, we decided to study whether a metric can be deduced from it. Therefore, for each image I of the BossBase we have performed 200 classification procedures with SRM+EC (thanks to maxSRMd2) for the embedding algorithm MiPOD at payload 0.4 bpp. Fig. 3(a) presents the resulting scatter plot of pρ U pIq, e SRM+EC pIqq pairs and the curve linking the mean error of each class, whereas the bar displays its corresponding standard deviation. This figure is obtained for S-UNIWARD, while Fig. 3(c) and 3(e) are the corresponding ones for HILL and MiPOD. Similarly, Fig. 3(b), 3(d), and 3(f) show the scatter plots, curve, and error bars, for the CNN. In that case, pρ U pIq, e CNN pIqq, pρ H pIq, e CNN pIqq, and pρ M pIq, e CNN pIqq are the average testing error obtained after training 12 independent networks. This low number explains why in comparison with the SRM+EC steganalysis context the points are less vertically spread. The scalar ρ U pIq is the mean of all the matrices ρ U pXq presented in equation [START_REF] Bas | Break Our Steganographic System[END_REF], where U means S-UNIWARD. ρ M pIq has a similar definition for MiPOD. Finally ρ H pIq is not directly the mean of all the matrices ρ H pXq of HILL. Due to its definition (Eq. ( 3)), some extremely large values may result from an extremely small denominator and lead to a meaningless mean value. To avoid this behavior, extremely large values are excluded from the computation.

By focusing on Fig.

, it can be first deduced that the detection error of SRM+EC is quite independent of ρ. Secondly, considering Fig. 3(b) and 3(d), we can deduce that the CNN testing error continuously decreases with respect to ρ U pIq and with ρ H pIq. The good correlation between the prediction accuracy of the CNN for a given image I and the value of ρpIq can be observed in the two former cases but not in the last one. The functions ρ U and ρ H are thus an indicator of the CNN accuracy. For instance, in Fig 2 ,  for the misclassified images we obtain ρ U p1911q " 2.1 and ρ U p3394q " 3.06; on the other hand for the well detected images we get ρ U p1388q " 7.05 and ρ U p8874q " 7.39. Thus ρ U and ρ H enable to cluster the images in two groups which are in accordance with those noticed at the beginning of the section.

4 Taking the Best from CNN and SRM+EC Predictions

Choosing the Best Method for a Given Input Image

We have shown that the lower the distortion function mean ρ U of an input image is, the more difficult it will be for the CNN to correctly detect whether the image is a cover or a stego. Conversely, SRM+EC gives rather regular detection errors, without showing too much sensitivity to ρ U , being robust against the image structure. A look at Fig. 3(a) and 3(b) shows that we can take advantage from these different behaviors to improve the detection performance on the BossBase.

In fact, SRM+EC and the CNN can be combined due to complementary purposes. As can be seen in Fig. 4, from the largest ρ U value up to the point where both curves intersect the CNN is the most competitive, whereas after, towards the lowest ρ U value, it is SRM+EC which is the most accurate. Formally, this can be expressed as follows for an input image I, once ρ U pIq is computed: if ρ U pIq ă ρ X U use SRM+EC prediction, otherwise use CNN prediction [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF] where ρ X U corresponds to the intersection abscissa. For Fig. 4, we have obtained ρ X U " 6.6. Let us emphasize that the same approach can be applied to S-UNIWARD and HILL algorithms, leading to different values for ρ X U . Overall, the feature set generated by a spatial rich model is so large and diverse that it is able to give predictions yielding almost the same level of accuracy, regardless of the pixels modified by the embedding process. Moreover, the computing of the features is precisely defined. Conversely, the CNN learns to extract a set of features to fulfill its classification task according to the data given during the training step. Therefore, it will be well-suited to process images having the same kind of embedding than the main trend in the training set. In other words, images having low ρ U values are so underrepresented in the BossBase that they have a limited influence during the training process.

Detection Performance Evaluation of the Proposal

Table 2 presents in its last column the average detection error obtained for the three steganographic algorithms. The first column gives the performance of SRM+EC computed on images I such that ρ U ă ρ X U , this last value is shown in the second column, while the third column shows the results gained from CNN for the remaining images. The proposal improves the detection performance for each embedding algorithm. For a payload of 0.4 bpp, S-UNIWARD has the lowest error rate with 14.82%, whereas for MiPOD and HILL we have values slightly below 17%. The lines labelled as non blind correspond to situations where SRM+EC was trained with the same algorithm than the one used to perform the embedding. Conversely, the lines denoted as blind mean that SRM+EC was trained with MiPOD and then used to detect S-UNIWARD or HILL. This also explains why for both blind and non blind situations the CNN gives the same error when both cases use the same value for ρ X U . For the lower payload of 0.1 bpp, the improvements provided by our method are also clearly visible. These results are also somewhat surprising, since they are obtained by training only CNNs using images embedding hidden messages with MiPOD. This means that even if each steganographic algorithm has its own distortion function, there is certainly a high redundancy among the modifications they made on the same cover image. A closer look on the performances of each steganalyzer on the subset of images it has to classify according to ρ X U explains why our proposal is relevant. Indeed, in comparison with the performances shown in Table 1 we can remark that the SRM+EC error rate is slightly worse than on the whole dataset. Thus we take advantage from the low error rate of the CNN at a price of a slightly worse misclassification by SRM+EC. Another point to notice is the evolution in opposite directions of ρ X U and payload values, which means that, as expected, the scatterness of the modified pixels increases and thus is more difficult to detect with the current CNN architecture. Nevertheless, our approach allows us to build a competitive blind steganalyzer, which gives lower detection errors than CNN based only or SRM+EC based only approaches.

Conclusion and Future Work

Over the past two years the design of deep learning based approaches for image steganalysis in spatial domain, using more particularly convolutional neural networks, has received an increasing attention due to their impressive successes on many classification tasks. Recently, Xu et al. have introduced a CNN architecture, which, to the best of our knowledge, is the most competitive one compared to rich models with ensemble classifier. In this paper, we have investigated when this CNN architecture fails in order to propose a method improving the detection performance on the BossBase for different spatial steganography algorithms.

Thanks to a TensorFlow implementation of the CNN, giving nearly the same detection performance than the original Caffe one for S-UNIWARD and HILL, we have found a metric strongly correlated with the CNN classification performance. This metric consists in the mean of all the elements in the cost matrix provided by the distortion function ρ of the considered steganographic algorithm for the input image. We have shown that the lower this latter value ρ U for S-UNIWARD is, the more the CNN fails to correctly detect if the image is a cover or a stego. Fortunately, the CNN and SRM+EC detection errors evolve in different ways according to the metric function. By computing the intersection of the corresponding curves we are then able to define a reliable criterion allowing to decide, for an input image, when to use the CNN or SRM+EC to obtain the most accurate prediction. The experiments done considering the steganographic algorithms S-UNIWARD, HILL, and MiPOD, have validated the proposed criterion, since it has always led to improved detection performance, regardless of the embedding payload value. Another contribution of this work is to have designed a steganalyzer insensitive to the embedding process (blind detection).

Our future work will focus on two aspects. First, it might be interesting to subdivide the BossBase in disjoint subsets according to the average distortion function value and to train several CNNs on them. However, to be able to train a CNN for low ρ U values, the database should be expanded to include more images corresponding to this case. Second, CNNs dealing with spatial domain steganalysis work on a single high-pass filtered version of the input image. Therefore, we plan to replace the single filter by a filter bank, an approach which in the case of the JPEG domain steganalysis seems to be successful according to [START_REF] Zeng | Large-scale JPEG steganalysis using hybrid deep-learning framework[END_REF].

Finally, we can

  notice the latest work[START_REF] Zeng | Large-scale JPEG steganalysis using hybrid deep-learning framework[END_REF] by Zeng et al. dealing with JPEG domain steganalysis. They propose to start by manually applying to the input image the first two phases of DCTR[START_REF] Holub | Low-complexity features for JPEG steganalysis using undecimated DCT[END_REF], namely a convolution followed by Quantization & Truncation (Q&T). They use 25 residual images, where each is

Fig. 1 .

 1 Fig. 1. CNN proposed by Xu et al. [23]: (a) overall architecture and (b) detailed view.

  (a) Cover 1388.pgm and differences. (b) Cover 8873.pgm and differences. (c) Cover 1911.pgm and differences. (d) Cover 3394.pgm and differences.

Fig. 2 .

 2 Fig.2. Examples of differences images between cover and corresponding stego when embedding is performed using MiPOD with a payload of 0.4 bpp.

  (a) Detection error w.r.t image ρU value for SRM+EC. (b) Detection error w.r.t image ρU value for the CNN by Xu et al. (c) Detection error w.r.t image ρH value for SRM+EC. (d) Detection error w.r.t image ρH value for the CNN by Xu et al. (e) Detection error w.r.t image ρM value for SRM+EC. (f) Detection error w.r.t image ρM value for the CNN by Xu et al.

Fig. 3 .

 3 Fig. 3. Relation between testing errors and distortion function mean.

Fig. 4 .

 4 Fig. 4. Average error of CNN and SRM+EC for MiPOD 0.4 bpp w.r.t ρU .

Table 1 .

 1 Average detection error as a function of classifier (original Caffe by Xu et al., our TensorFlow trained only with MiPOD at 0.4 bpp, and SRM+EC) and of payload.

		S-UNIWARD MiPOD	HILL
		0.1	0.4	0.1 0.4 0.1 0.4
	Caffe [23]	42.67 19.76	X	X 41.56 20.76
	TensorFlow	47.38 20.52 43.72 19.36 46.79 20.25
	SRM + EC	39.84 18.06 41.18 21.42 42.96 23.31
	SRM + EC (blind) 40.57 20.85 41.18 21.42 43.35 23.99

Table 2 .

 2 Average detection error according to ρ X U for different embedding payloads.

		SRM+EC	ρ X U		CNN	CNN + SRM+EC
	Payload (bpp) 0.1	0.4	0.1 0.4	0.1	0.4	0.1	0.4
	S-UNIWARD non blind	40.08 20.01	9.2 7.1	23.36 8.25	38.06 14.82
	S-UNIWARD blind	41	22.05	9.2 6.9	23.36 9.5	38.88 15.87
	MiPOD non blind	42.13 23.89	8 6.6	25.84 9.26	37.82 15.65
	HILL non blind	43.48 24.51	8.9 6.6	21.88 9.78	40.24 16.22
	HILL blind	44.30 25.41	8.3 6.6	27.72 9.78	40.64 16.61

https://github.com/rcouturier/steganalysis with CNN and SRM.git

Acknowledgments

This article is partially funded by the Labex ACTION program (ANR-11-LABX-01-01 contract) and the Franche-Comté regional council. We would like to thank NVIDIA for hardware donation under CUDA Research Center 2014 and the Mésocentre de calcul de Franche-Comté for the use of the GPUs.


Michael Denzel
email: m.denzel@cs.bham.ac.uk

Mark Ryan
email: m.d.ryan@cs.bham.ac.uk

Eike Ritter
email: e.ritter@cs.bham.ac.uk

A Malware-Tolerant, Self-Healing Industrial Control System Framework

Keywords: Malware Tolerance, Self-Healing, Industrial Control System (ICS), Security

Industrial Control Systems (ICSs) are computers managing many critical infrastructures like power plants, aeroplanes, production lines, etc. While ICS were specialised hardware circuits without internet connection in former times, they are nowadays commodity computers with network connection, TCP/IP stack, and a full operating system, making them vulnerable to common attacks. The defensive mechanisms, however, are still lacking behind due to the strong requirement for availability of ICSs which prohibits to deploy typical countermeasures like e.g. an anti-virus. New techniques are needed to defend these systems under their distinct prerequisites. We introduce the concept of a malware-tolerant ICS network architecture which can still operate securely even when some components are entirely compromised by an attacker. This was done by replacing all single pointof-failures with multiple components verifying each other. We provide ProVerif proofs to show the correctness of the network protocol one-byone assuming each device compromised. Furthermore, we added a self-healing mechanism based on invariants to the architecture on network as well as system level which will reset failed or compromised systems. To demonstrate system level self-healing, we implemented it on top of FreeRTOS and ARM TrustZone. The network level self-healing was incorporated into the ProVerif proofs by formally verifying the absence of type 1 (falsely identified attacks) and type 2 errors (missed attacks).

Introduction

Industrial Control Systems (ICSs) received a lot of media attention with the Stuxnet attack [START_REF] Langner | Stuxnet: Dissecting a cyberwarfare weapon[END_REF]. But there are also more examples like Duqu, Flame, Red October, MiniDuke [START_REF] Virvilis | Trusted computing vs. advanced persistent threats: Can a defender win this game?[END_REF], Gauss, Energetic Bear, Epic Turla [START_REF]Empowering industrial cyber security[END_REF], and the attack on a German steel mill [START_REF]BSI: Die lage der it-sicherheit in deutschland 2014[END_REF].

ICSs are sensor-actuator networks that control physical systems. The core components are so-called Programmable Logic Controllers (PLCs), which nowadays are essentially commodity computers with specialised software to satisfy the requirement for high availability and real-time operation. Due to these requirements, they cannot run common defensive measures like an anti-virus. Defensive mechanisms have, thus, to be deployed (less effective) elsewhere in the network. Moreover, PLCs have a long lifetime (10-20 years) and are not usually patched to avoid downtime and bricking the devices. [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) security[END_REF] A corrupted patch can render a PLC unusable possibly leading to a shutdown of part of the network which is potentially life-threatening. In combination with historic protocols which do not even offer basic authentication (like the Modbus protocol [START_REF] Fovino | Design and implementation of a secure modbus protocol[END_REF]) these systems fall in the hands of attackers as soon as the attacker has network access.

Governmental organisations [START_REF]Recommended practice: Improving industrial control systems cybersecurity with defense-in-depth strategies[END_REF][START_REF] Stouffer | Guide to Industrial Control Systems (ICS) security[END_REF] recommend a strategy called "defence in depth" which tries to deploy defences at every layer of the network. We want to go one step further and, instead of only defending problematic devices, we aim to distribute trust over several independent components in a way that an individual component infected with malware cannot break the security policy. We call this approach malware-tolerance. Simply put, we want to remove every single pointof-failure at critical intersections throughout the entire ICS architecture. Our secondary goal is to enable the architecture to automatically repair ordinary and malicious faults, so-called self-healing. With this approach, it is also possible to recover from corrupted or incomplete patches.

Contributions:

-We design the architecture of a malware-tolerant ICS that has no single point-of-failure at critical intersection points and can self-heal failed or (maliciously) misbehaving PLCs. -We also formally prove the network architecture with state-of-the-art protocol verifier ProVerif 1 . The proofs can be found online 2 . -To achieve our architecture, we also develop a self-healing mechanism which detects incorrect behaviour by verifying invariants, and recovers to a good state. We adjusted FreeRTOS 3 to include our mechanism and released our implementation as open-source 4 .

Overview

Traditional Industrial Control System Architecture

Traditional ICSs separate the network into zones which are isolated from each other by firewalls resulting in a layered network with Intrusion Detection System (IDS) at intersection points (defence in depth). The innermost part of an ICS is called control loop and consists of a PLC as well as sensors and actuators. This part of the system is the actual cyber-physical system and has hardly any (often no) defensive measures apart from the firewall in front of it due to availability and real-time constraints. The control loop can be at a different location (field site) than the control centre. An example for such a control loop would be a temperature control system with e.g. some water tanks which should neither freeze nor boil. The PLC would read the temperature from a sensor and adjust the heating/cooling of the water to maintain a temperature between 0 to 100 • C.

Assumptions

1. We assume a Dolev-Yao attacker [START_REF] Dolev | On the security of public key protocols[END_REF] on the network who interacts with software-side technologies. The attacker has no physical access to the facilities and cannot change cabling or remotely introduce electrical signals directly into wires (apart from assumption 2). 2. Additionally, the attacker can choose one5 device (except the actuator) of which he gains full controli.e. also access to corresponding cryptographic keys and "software" access to the physical wires connected to the chosen device. If the attacker chooses e.g. a PLC, he has access to the connected sensors, can read their values, but cannot change wiring or sensors. The attacker can manipulate the hardware of a chosen device once (during production) but has no physical access afterwards any more. If the chosen device has network access, the attacker can update software and firmware. 3. We are initially not aware which device the attacker chose. 4. We assume the 2-out-of-3 circuit is hardware-only and in scope of verification. 5. Attacks on cryptography and phishing attacks are out of scope. 6. PLCs and sensors work synchronously or are buffered.

Proposed Architecture

Our approach is an extension to already existent firewalls, network zones, IDSs etc. and changes the control loop at the field site. Figure 1 displays our infrastructure with the changes being highlighted in red. Our concept adds hardware in form of reset-circuits; data by images and policies; and software in form of a self-healing Real-Time Operating System (RTOS) and the netboot firmware of the reset-chip. Additionally, we leverage existent redundancy of PLCs and a 2out-of-3 (2oo3) circuit which are already in place in some ICS facilities.

Basis of the malware-tolerant architecture are three diverse PLCs combined with trusted computing. The 2-out-of-3 hardware circuit combines the results of the PLCs and forward them to the actuator. That means none of the PLCs has to be invulnerable to attacks or failures, it is enough if two of the three work. The PLCs must differ in their soft-as well as hardware which we achieve with a special kind of N-variant system and diverse hardware (details in section 4.2).

We also added self-healing functionality that can recover failed and compromised PLCs with (1) a RTOS based on ARM TrustZone that can reset user level tasks and (2) a network protocol and reset-circuits to defend against attacks on system level and on the Trusted Execution Environment (TEE). Self-Healing RTOS: To demonstrate the RTOS, we created a proof-of-concept implementation based on ARM TrustZone and the FreeRTOS operating system which we ported to ARM TrustZone to protect critical functionality like scheduling and interrupts. ARM TrustZone, is a TEE which consists of two separated environments: the secure world and the normal world. While the secure world has full access to the system, the normal world is restricted in its capabilities. The switch between the two worlds is handled by the so-called monitor. Trust-Zone chips usually come with the TrustZone Interrupt Controller (TZIC) and functionality to manage memory, i.e. a TrustZone-aware Memory Management Unit, routines to forbid Direct Memory Access, and so on. We refer to the ARM documentation [START_REF]ARM: Building a secure system using trustzone technology[END_REF] for more details.

Figure 2 shows the control flow of our TrustZone-aware RTOS. Periodically, the TZIC will generate a timer interrupt (1.) which is setup as an Fast Interrupt (FIQ) trapping into monitor mode (2.). The monitor will save the context and jump to the interrupt handler (3.) which will, for timer interrupts, call the FreeRTOS scheduler (4.). After scheduler (5.) and interrupt handler (6.) return, the next task is determined. At this point, the monitor will invoke a detection routine (7.). To reveal faults or malicious behaviour of certain tasks, the detection routine checks various system variables and external values (e.g. sensor values) against invariants which are stored in form of a policy, cryptographically signed, on at least two servers. These invariants are implicitly given by the setpoints the operator of the system placed. For our water tank example, the operator could e.g. set the temperature t to 0 to 100 • C, forbid heating for t > 50 • C, and forbid cooling for t < 50 • C. If the temperature is below or above this range Fig. 2: TrustZone-aware Real-Time Operating System and the task does not enable the actuator, our task is faulty. The result of the detection routine is returned to the monitor (8.) which then (9.) either runs the task or dispatches a restoration routine if the task was misbehaving. The restoration routine only runs during the time-slice of the misbehaving task which ensures availability of the rest of the system including other tasks and operating system functionality. The restoration terminates the task and loads an image of the original task from a protected memory region inside the secure world. Lastly, the task is added to the scheduler again. The critical steps are run inside the TrustZone secure world to protect them from manipulation.

To avoid unnecessary resets due to false positives, we created a specificationbased detection technique. These have a lower rate of false alarms than nonspecification-based techniques but might miss some attacks. [START_REF] Sekar | Specification-based anomaly detection: a new approach for detecting network intrusions[END_REF] If the presented online self-healing mechanism fails, the network level self-healing approach (see following paragraph) will restore the particular PLC but at the cost of a restart.

Reset-Circuits and Network Protocol: Our reset-circuits consist of a network boot chip (e.g. iPXE 6 ) and a logical circuit to control resets (Fig. 3). A low frequency clock signal restricts resets to a certain interval. Optionally, the inputs to the circuit (label 1. in Fig. 3) can be replaced with flipflops to enable synchronising the PLCs. Circuits for P LC 2 and P LC 3 can be similarly derived.

Since network-based detection indicates that system level self-healing (taking place beforehand) failed, we intentionally clear the state to recover from the attack. We re-initialise state either by discovery or by requesting it from the other PLCs. In our temperature maintenance example, discovering the temperature and adjusting the actuator is straight forward. For more complex scenarios, the reset PLC would request the state from the other two PLCs and compare it. The full message sequence chart of our malware-tolerant, self-healing network protocol is presented in Fig. 4: Every PLC reads the current sensor value s (for simplicity we drew only one sensor but multiple sensors are possible) and computes the adjustment a i of the actuator. This is sent to the 2-out-of-3 circuit which forwards the end result a to the actuator. Parallel, each reset-circuit receives the three response values of the PLCs, each checks if a reset for its corresponding PLC should happen (r ? = 1), and resets it if this is the case. Rebooting PLCs load the netboot image from the network. The figure displays a reset of P LC 1 as an example.

3 Security Analysis and Results

ProVerif Proofs

To give evidence of the security features of our architecture, we utilised ProVerif -a state-of-the-art protocol verifier -to test our network protocol. We modelled the protocol as shown in Fig. 4 for various configurations (see Table 1) where we grant the attacker control over different sets of devices.

In order to reason about malware-tolerant systems, we analysed the system based on multiple Trusted Computing Bases (TCBs). A TCB is the minimum set of honest components needed to secure the system; multiple such sets can exist. A system is malware-tolerant if there are at least two disjoint TCBs that provide the same property. Each independent component of the system -i.e. mostly entire devices as e.g. the CPU depends on the computer and is not an independent component -can be part of multiple TCBs.

With this notation, we can reason about a system based on TCBs. The system is secure if any T CB i is secure. E.g. if device d 1 and d 2 are part of T CB 1 and device d 2 and d 3 are part of T CB 2 , then the system is secure if

(d 1 ∧ d 2 ) ∨ (d 2 ∧ d 3 ) is secure.
As we can see here, d 2 is part of all TCBs and is, thus, the single point-of-failure. The system is not malware-tolerant because there are no disjoint TCBs (T CB 1 and T CB 2 overlap).

The TCB model of our proposed ICS is shown in expression 1. R i stands for the reset-circuit of PLC number i. Since R i controls P LC i , we have to consider (R i , P LC i ) pairs as they are the smallest subset of independent components. Our system is malware tolerant, because no (R i , P LC i ) pair is part of all TCBs.

T CB 1 = {(R 1 , P LC 1 ), (R 2 , P LC 2 )} . T CB 2 = {(R 1 , P LC 1 ), (R 3 , P LC 3 )} . T CB 3 = {(R 2 , P LC 2 ), (R 3 , P LC 3 )} . (1)
We formally verified our architecture by testing five properties of our protocol (Fig. 4) with ProVerif (results shown in Table 1):

1./2. 1 st /2 nd iteration: As ProVerif cannot verify loops, we modelled two iterations of the protocol. These two iterations are sufficient, since computations are independent from each other and resets only affect the next loop iteration.

For each iteration, we tested if the actuator received the correct value. 3./4. Self-Healing: The self-healing column in Table 1 consists of two proofs; the absence of type I errors and the absence of type II errors.

-Type I error (false positive): Regarding our protocol, a false positive is the case where we reset an honest PLC. In ProVerif this has to be expressed as: For all reset events of P LC i , P LC i misbehaved. At first, this seems to not prove that if P LC i misbehaved, a reset happens but in combination with the type II error and knowing that reset is a binary event (it can either happen or not happen), we prove the property. -Type II error (false negative): False negative refers to the case where a misbehaving PLC is not reset (missed attack). In ProVerif: For all not_reset events of P LC i , P LC i behaved correctly. Again, it seems that if P LC i is honest, no reset happens is not proven. This is applicable, similar to before, by the absence of type I errors. 5. End reached: We tested if the protocol runs through. This is done in ProVerif by detecting the deliberate leak of a secret value at the end of the protocol. The proofs (Table 1) show that the physical system, i.e. the actuator, is supplied with correct values for the cases where the adversary controls one device (cases 2-4 and 6-8) or one (P LC i , Reset i )-pair (cases 9-11). Self-healing works for one compromised PLC but functional reset-circuits (cases 2-4). Also, everything works if there is no attack (case 1). We tested more hypothetical cases as sanity checks, e.g. the case where the attacker can physically change the 2-outof-3 circuit (case 5) which is a validation of our assumption. The expected result is that the protocol fails since we hand the asset to the attacker from the very beginning. Case 24 is a special sanity check where we give the adversary control over literally everything. Both cases (case 5 and 24) fail as predicted.

Evaluation of Self-Healing FreeRTOS

Since we are not aware of any Common Vulnerabilities and Exposures (CVE) for FreeRTOS, we could not test any real-world attacks against our extended FreeRTOS operating system (a broader analysis of attacks follows in section 4.1).

To test the system level self-healing capability of our proof-of-concept implementation, we introduced a buffer overflow in our Input/Output (I/O) driver using the vulnerable C-function strcpy. We exploited this vulnerability by overflowing the buffer and overwriting the settings in the PLC. We chose this attack as it is the most common vulnerability in C and is similar to a range of attacks, e.g. format string attacks and return-oriented-programming.

Our simplified detection routine checks that the settings are within an accepted range and otherwise triggers restoration. The results show that the task and the temperature driver are reset to their original if the maximum temperature is changed to values outside the range (for more details see code of adjusted FreeRTOS implementation).

Performance Analysis of TrustZone

We conducted a performance analysis of the TrustZone world switch on a Free-Scale i.MX53 Quick Start Board with 1 GB DDR3 SDRAM running a 1 GHz ARM Cortex-A8. For this, we measured the time of 1531 task switches on a system running four tasks and FreeRTOS. The measurements start from the timer interrupt until restoring the context of the next task. This experiment was executed twice, once with and once without TrustZone. To measure the time accurately, we read the CCNT-register which stores the cycle count. The overhead Table 2: Data values of the Box-andwhisker diagram in Fig. 5 of our timing function calls was 0.9 µs, allowing us an accuracy of microseconds.

The average overhead of a TrustZone task switch was 29 µs. Figure 5 presents the overhead as box-and-whisker diagram and the values are listed in Table 2.

A TrustZone task switch in comparison to a non-TrustZone one is equal to 3.6 malloc system calls (average time for malloc on our system: 8 µs) overhead; in other words memory management overhead is comparable to TrustZone.

Discussion

Attacks

We examine how our architecture behaves in different attack classes.

-Attacks that change invariants: Let us assume an adversary compromises a PLC but changes some invariants -e.g. he overflows a buffer and inserts a new task but the policy states that there are only N tasks. The system level self-healing will immediately reset the tasks, removing the malicious task. This type of defence was demonstrated in a simple fashion by the buffer overflow above (section 3.2). -Stealthy attacks (Advanced Persistent Threats (APTs), backdoors, rootkits, trojans etc.): Suppose an attacker manages to deploy a stealthy rootkit on a PLC without being detected. He can now manipulate the PLC as he likes, but the other two PLCs continue to function correctly. If the rogue PLC affects outputs, its reset-circuit will notice this and reinstall the PLC, thus removing the rootkit. If the rootkit resides in the normal world, it will be removed even earlier by the system level self-healing. -Firmware/hardware attacks: Suppose the attacker deploys a firmware or hardware rootkit in a PLC or in a reset-circuit, then software-based selfhealing becomes impossible. However, if the other two PLCs remain operational, then manipulations of outputs are still detected and outvoted by those other two PLCs (through the 2-out-of-3 circuit). -Attacks on network protocol flaws (e.g. Modbus): Since all PLCs presumably have to support the same protocols, exploits targeting the protocol itself (in contrast to its implementation) are not prevented. To defend against these attacks, one has to modify the protocol standard which is beyond our scope. -Attacks on the policy/administrator account: We rely on the information in the (cryptographically signed) policy. If the account in charge of it is compromised, the adversary can change the policy freely. To prevent this, trusted input techniques as in [START_REF] Zhou | Building verifiable trusted path on commodity x86 computers[END_REF] should be utilised. -Denial of Service (DoS): Since we deliberately grant the attacker full control over some devices (see assumption 2 section 2.2), he already has the ability to turn these devices off, but we aim at not enabling further DoS attacks.

Diversity of PLCs

It is crucial for our architecture that PLCs are diverse in their software as well as hardware. To achieve this, we suggest to use different reset-chips and different CPU architectures, e.g. ARM TrustZone, Intel Software Guard Extensions (SGX), and a PowerPC with a TPM chip. Since the architectures are different, an adversary has to craft different exploits, however, he can still use the same exploit idea to attack the software of all PLCs. N-version programming was shown to be ineffective against malicious attacks [START_REF] Cai | An experimental evaluation on reliability features of N-version programming[END_REF][START_REF] Salewski | The effect of diverse hardware platforms on N-version programming in embedded systems-an empirical evaluation[END_REF] as people make correlated mistakes. Hence, we suggest to use a form of artificial N-variant systems where N systems are crafted such that they are distinct by design. [START_REF] Weatherwax | A model of secretless security in N-variant systems[END_REF] Cox et al. [START_REF] Cox | N-variant systems: A secretless framework for security through diversity[END_REF] used address space partitioning and instruction set tagging to create different programs that cannot be compromised with the same exploit. Salamat et al. [START_REF] Salamat | Multivariant program execution: Using multi-core systems to defuse buffer-overflow vulnerabilities[END_REF] proposed to invert the stack and demonstrated this by a special compiler. There is also a compiler which splits stack into data and control structures. [START_REF] Kugler | Scads separated control-and data-stacks[END_REF] By utilising N-variant system techniques, we can artificially create distinct software, that cannot be compromised with the same exploit idea -e.g. a RTOS with the stack growing downwards, one with the stack growing upwards, and one with separate data and control stack cannot all be exploited with the same stack-based attack. If we additionally require each netboot image to be diverse from the last one, similar to [START_REF] Sousa | Highly available intrusion-tolerant services with proactive-reactive recovery[END_REF], an attacker would need to learn the properties of the new image to compromise it. That means, it is considerably harder for an attacker to compromise two PLCs at the same time.

Implications

The practical implications of our architecture for the real world are that an attacker would have to find twice the amount of vulnerabilities for an ICS since he has to compromise two different devices (e.g. an ARM TrustZone and an Intel SGX PLC). Hence, our system would double the cost for the attacker.

The cost for the defender will not double. Considering that a lot of companies already have redundant PLCs, the hardware cost for the company would roughly stay the same. Diverse software versions can be created similar to the artificial Nvariant systems. As the special compilers used to generate these variants [START_REF] Cox | N-variant systems: A secretless framework for security through diversity[END_REF][START_REF] Salamat | Multivariant program execution: Using multi-core systems to defuse buffer-overflow vulnerabilities[END_REF] demonstrate, software can be automatically diversified except for architecture dependent code. In our proof-of-concept implementation based on FreeRTOS 7.8% is platform specific code (780 lines Assembly; 9956 lines C-code) 7 .

Another advantage is that network-based self-healing prevents bricking PLCs. If a PLC is partially flashed with an image and crashes, it would automatically reboot triggering the netboot chip to reinstall the image. Thus, patching of the PLCs can now be done conveniently by central image servers with signed images.

Related Work and Comparison

Industrial Control Systems: The ICS architecture was already analysed in general: Virvilis et al. [START_REF] Virvilis | Trusted computing vs. advanced persistent threats: Can a defender win this game?[END_REF] studied a variety of APT attacks in depth and their countermeasures. They suggest proper patch management, network segregation, white-listing of outgoing connections, filtering dynamic content execution, and employing trusted computing. Fitzek et al. combined ARM TrustZone with an ICS but relied on a single TCB. [START_REF] Fitzek | The andix research os-arm trustzone meets industrial control systems security[END_REF] Another new TEE is Intel SGX [START_REF] Hoekstra | Using innovative instructions to create trustworthy software solutions[END_REF] but we are not aware of any studies considering APTs or ICSs.

On the defence side, there is the term secure control, i.e. controlling a cyberphysical system while preventing attacks. [START_REF] Cardenas | Secure control: Towards survivable cyberphysical systems[END_REF] Also governmental organisations already approached the topic [START_REF]Recommended practice: Improving industrial control systems cybersecurity with defense-in-depth strategies[END_REF][START_REF] Stouffer | Guide to Industrial Control Systems (ICS) security[END_REF] focusing on thoroughly enhancing every layer of the architecture, so-called Defence in Depth. Coexisting, there is also a Defence in Breadth which is not clearly defined but is described as the use of multiple instances of a security technology within a security layer. [START_REF] Paillet | Defending against cyber threats to building management systems[END_REF] Commonly, intrusion detection and tolerance systems [START_REF] Kuang | An intrusion-tolerant mechanism for intrusion detection systems[END_REF] and firewalls are deployed to prevent or limit damage through attackers. Intrusion tolerance draws its ideas from the field of fault-tolerance [START_REF] Veronese | Efficient byzantine fault-tolerance[END_REF][START_REF] Amir | Prime: Byzantine replication under attack. Dependable and Secure Computing[END_REF] which focuses on safe operation of a system by using redundancy. Totel et al. [START_REF] Totel | COTS diversity based intrusion detection and application to web servers[END_REF] proposed to use multiple diverse off-the-shelf devices in combination with an IDS proxy to detect attacks. They demonstrated this on the example of a webserver. However, their proxy is a single point-of-failure.

Self-Healing Systems: The field of self-healing is not well established, especially considering security. Ghosh et al. [START_REF] Ghosh | Self-healing systems -survey and synthesis[END_REF] gave a detailed overview of existing techniques. The closest ones to our technique are Finite State Automaton (FSA) approaches [START_REF] Tu | Comparisons of self-healing fault-tolerant computing schemes[END_REF][START_REF] Hong | Closed loop design for software rejuvenation[END_REF] which model the systems as an FSA and rejuvenate it when invalid states are reached. Our self-healing technique based on invariants is more efficient than FSA as we do not actively keep track of the state. Since invariants can be declared as regular expressions and every FSA can be translated into a regular expression [START_REF] Meduna | Converting finite automata to regular expressions[END_REF], our technique is as representative as FSA.

Bessani et al. [START_REF] Bessani | The crutial way of critical infrastructure protection[END_REF] use proactive-reactive rejuvenation to restore intrusiontolerant Crutial Information Switches (a firewall device) throughout the network. It is an example of a hybrid distributed system [START_REF] Verissimo | Travelling through wormholes: a new look at distributed systems models[END_REF]. While their system targets the firewall in front of critical devices like PLCs, our approach is aimed at PLCs directly. Platania et al. [START_REF] Platania | Towards a practical survivable intrusion tolerant replication system[END_REF] proposed a rejuvenation architecture similar to ours. Instead of self-healing upon detected misbehaviour, they proactively rejuvenate PLCs periodically; each on its own to ensure availability of the whole system.

Periodic system resets can defend against attacks before visible effects occur -independently of any detection algorithm -however, they impose an overhead on the system even though the system is mostly in a valid state. In contrast to Bessani et al. and Platania et al., we removed single point-of-failures8 and kept the system running as long as possible through system level reactive measurements making it more applicable to scenarios were availability is a major concern.

Conclusion

We presented a malware-tolerant Industrial Control System architecture without single point-of-failures at critical intersection points. We achieve this by relying on diverse, redundant PLCs and a 2-out-of-3 circuit. The infrastructure can push an attacker out of any single PLC using its offline self-healing abilities on the network level. By also employing online self-healing at system level, we maintain high availability during basic failures or simple attacks. To prove our claims, we utilised ProVerif, a state-of-the-art protocol verifier, and implemented proofof-concept self-healing capabilities on top of FreeRTOS and ARM TrustZone. Proofs as well as RTOS implementation are open-source.

Fig. 1 :

 1 Fig. 1: Proposed Industrial Control System Architecture

Fig. 3 : 3 aFig. 4 :

 334 Fig. 3: Reset-circuit for P LC 1

Fig. 5 :

 5 Fig. 5: Box-and-whisker diagram of time for task switches

Table 1 :

 1 ProVerif Results

	End reached

№ Compromised Devices 1 st Iteration 2 nd Iteration Self-Healing

We only show the basic case of an attacker compromising one system. Tolerating attacks on multiple systems is more challenging but similarly possible.

www.ipxe.org

measured with the CLOC Linux tool

The wormhole devices of Bessani et al. storing the cryptographic key and the rejuvenation device of Platania et al. are single point-of-failures.