{"id":"https://openalex.org/W4377235660","doi":"https://doi.org/10.1109/tifs.2023.3277688","title":"PLCPrint: Fingerprinting Memory Attacks in Programmable Logic Controllers","display_name":"PLCPrint: Fingerprinting Memory Attacks in Programmable Logic Controllers","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4377235660","doi":"https://doi.org/10.1109/tifs.2023.3277688"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3277688","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3277688","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://eprints.gla.ac.uk/view/author/35084.html>","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091479151","display_name":"Marco M. Cook","orcid":"https://orcid.org/0000-0002-5232-2381"},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Marco M. Cook","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0002-5232-2381","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021412159","display_name":"Angelos K. Marnerides","orcid":null},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Angelos K. Marnerides","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0002-7996-6216","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5021350142","display_name":"Dimitrios P. Pezaros","orcid":"https://orcid.org/0000-0003-0939-378X"},"institutions":[{"id":"https://openalex.org/I7882870","display_name":"University of Glasgow","ror":"https://ror.org/00vtgdb53","country_code":"GB","type":"education","lineage":["https://openalex.org/I7882870"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Dimitrios Pezaros","raw_affiliation_strings":["School of Computing Science, University of Glasgow, Glasgow, U.K","School of Computing Science, University of Glasgow, Glasgow, Scotland"],"raw_orcid":"https://orcid.org/0000-0003-0939-378X","affiliations":[{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, U.K","institution_ids":["https://openalex.org/I7882870"]},{"raw_affiliation_string":"School of Computing Science, University of Glasgow, Glasgow, Scotland","institution_ids":["https://openalex.org/I7882870"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5091479151"],"corresponding_institution_ids":["https://openalex.org/I7882870"],"apc_list":null,"apc_paid":null,"fwci":5.296,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.95757639,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":"18","issue":null,"first_page":"3376","last_page":"3387"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8793944716453552},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5770301222801208},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5449486970901489},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.5053942203521729},{"id":"https://openalex.org/keywords/programmable-logic-controller","display_name":"Programmable logic controller","score":0.4254502058029175},{"id":"https://openalex.org/keywords/memory-management","display_name":"Memory management","score":0.4253579080104828},{"id":"https://openalex.org/keywords/memory-address","display_name":"Memory address","score":0.423452228307724},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.36017340421676636},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.24635818600654602},{"id":"https://openalex.org/keywords/semiconductor-memory","display_name":"Semiconductor memory","score":0.20805037021636963},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.10538646578788757}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8793944716453552},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5770301222801208},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5449486970901489},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5053942203521729},{"id":"https://openalex.org/C37374048","wikidata":"https://www.wikidata.org/wiki/Q188674","display_name":"Programmable logic controller","level":2,"score":0.4254502058029175},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.4253579080104828},{"id":"https://openalex.org/C153247305","wikidata":"https://www.wikidata.org/wiki/Q835713","display_name":"Memory address","level":3,"score":0.423452228307724},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.36017340421676636},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.24635818600654602},{"id":"https://openalex.org/C98986596","wikidata":"https://www.wikidata.org/wiki/Q1143031","display_name":"Semiconductor memory","level":2,"score":0.20805037021636963},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.10538646578788757},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tifs.2023.3277688","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3277688","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:eprints.gla.ac.uk:297746","is_oa":true,"landing_page_url":"https://eprints.gla.ac.uk/view/author/35084.html>","pdf_url":null,"source":{"id":"https://openalex.org/S4210235606","display_name":"ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam)","issn_l":"2622-8912","issn":["2622-8912","2622-8920"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"}],"best_oa_location":{"id":"pmh:oai:eprints.gla.ac.uk:297746","is_oa":true,"landing_page_url":"https://eprints.gla.ac.uk/view/author/35084.html>","pdf_url":null,"source":{"id":"https://openalex.org/S4210235606","display_name":"ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam)","issn_l":"2622-8912","issn":["2622-8912","2622-8920"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},"sustainable_development_goals":[{"score":0.550000011920929,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[{"id":"https://openalex.org/G4791733040","display_name":"Industrial CASE Account - University of Glasgow 2017","funder_award_id":"EP/R511936/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"},{"id":"https://openalex.org/G8567180171","display_name":null,"funder_award_id":"PA0000000223","funder_id":"https://openalex.org/F4320332972","funder_display_name":"Defence Science and Technology Laboratory"}],"funders":[{"id":"https://openalex.org/F4320319980","display_name":"New Brunswick Innovation Foundation","ror":"https://ror.org/02rbgnh75"},{"id":"https://openalex.org/F4320332972","display_name":"Defence Science and Technology Laboratory","ror":"https://ror.org/04jswqb94"},{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"},{"id":"https://openalex.org/F4320337719","display_name":"Defence and Security Accelerator","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W7870703","https://openalex.org/W2267647354","https://openalex.org/W2594635183","https://openalex.org/W2744632709","https://openalex.org/W2750629981","https://openalex.org/W2908133708","https://openalex.org/W2908471618","https://openalex.org/W2945816945","https://openalex.org/W2946894978","https://openalex.org/W2952754944","https://openalex.org/W2955535915","https://openalex.org/W2962910311","https://openalex.org/W2966748955","https://openalex.org/W3011215978","https://openalex.org/W3042229408","https://openalex.org/W3044438275","https://openalex.org/W3047682089","https://openalex.org/W3127455541","https://openalex.org/W3128032258","https://openalex.org/W3164513951","https://openalex.org/W3173257008","https://openalex.org/W3177650213","https://openalex.org/W3186345182","https://openalex.org/W3203500078","https://openalex.org/W3217563563","https://openalex.org/W4205185981","https://openalex.org/W4221103416","https://openalex.org/W4290996071","https://openalex.org/W6600308458","https://openalex.org/W6743488072"],"related_works":["https://openalex.org/W2030730933","https://openalex.org/W2991958541","https://openalex.org/W2558276258","https://openalex.org/W4214748026","https://openalex.org/W4243333834","https://openalex.org/W2122250971","https://openalex.org/W2116516372","https://openalex.org/W261562921","https://openalex.org/W1566926962","https://openalex.org/W2605670097"],"abstract_inverted_index":{"Programmable":[0],"Logic":[1],"Controllers":[2],"(PLCs)":[3],"constitute":[4],"the":[5,36,51,77,117,126,145,151,200,203],"functioning":[6],"basis":[7],"of":[8,42,81,104,153,205],"Industrial":[9],"Control":[10],"Systems":[11],"(ICS)":[12],"and":[13,54,79,102,122,166],"hence":[14],"are":[15,133,175],"often":[16],"a":[17,47,89,113,135,160,213],"focal":[18],"point":[19],"for":[20],"attackers":[21],"to":[22,34,76,99,139,183],"exploit.":[23],"Previous":[24],"attacks":[25,64,188],"have":[26],"seen":[27],"PLC":[28,96,109,120,127,146,186],"memory":[29,43,97,105,110,123,147,187],"maliciously":[30],"altered":[31],"in":[32,56,62,202],"order":[33],"disrupt":[35],"underlying":[37],"physical":[38,58,74],"process.":[39],"Different":[40],"types":[41],"attack":[44,206],"can":[45,69],"cause":[46],"similar":[48],"impact":[49],"on":[50],"PLC\u2019s":[52],"operation":[53],"result":[55],"indistinguishable":[57],"manifestations.":[59],"Consequently,":[60],"delays":[61],"triaging":[63,208],"through":[65],"digital":[66],"forensic":[67],"practices":[68],"induce":[70],"significant":[71],"financial":[72],"loss,":[73],"damage":[75],"infrastructure,":[78],"degradation":[80],"safety.":[82],"In":[83,193],"this":[84,210],"work,":[85],"we":[86,170,195],"propose":[87],"PLCPrint,":[88],"novel":[90,114],"vendor-independent":[91],"fingerprinting":[92],"approach":[93],"that":[94,197],"utilises":[95],"artefacts":[98,124],"perform":[100],"detection":[101],"classification":[103],"attacks.":[106],"PLCPrint":[107,154,169,198],"uses":[108],"register":[111],"mapping,":[112],"method":[115],"exploiting":[116],"relationship":[118],"between":[119],"registers":[121,132],"including":[125],"application":[128],"code.":[129],"Through":[130,168],"this,":[131],"assigned":[134],"Mapping":[136],"Condition":[137],"(MC)":[138],"indicate":[140],"how":[141,172],"they":[142],"exist":[143],"within":[144,177,216],"artefacts.":[148],"We":[149],"evaluate":[150],"performance":[152],"over":[155],"realistic":[156],"emulations":[157],"conducted":[158],"at":[159],"real":[161],"testbed":[162],"emulating":[163],"water":[164],"filtration":[165],"distribution.":[167],"depict":[171],"MC":[173],"deviations":[174],"utilised":[176],"supervised":[178],"learning":[179],"schemes":[180],"such":[181],"as":[182],"adequately":[184],"classify":[185],"with":[189],"high":[190],"accuracy":[191],"performance.":[192],"general,":[194],"demonstrate":[196],"fills":[199],"gap":[201],"context":[204],"technique":[207],"since":[209],"has":[211],"been":[212],"missing":[214],"element":[215],"current":[217],"ICS":[218],"forensics":[219],"schemes.":[220]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":1}],"updated_date":"2026-05-13T08:25:38.343686","created_date":"2025-10-10T00:00:00"}