Decoding the Human Element in APT Attacks: Unveiling Attention Diversion Techniques in Cyber-Physical System Security

The number of complex cyber-attacks, such as Advanced Persistent Threats (APTs), on Critical Infrastructures (CIs) continues to rise. Recently, attackers have targeted lower layers of the Purdue model, specifically the Operational Technology (OT) part, traditionally considered secure and unreachable. APTs are characterized by their stealthy, prolonged presence in systems, often going undetected until significant damage is inflicted. While defensive cyber deception technology, such as honeypots, has been introduced to address sophisticated attacks, there remains a gap in understanding the role of deception techniques from the attacker’s perspective in manipulating defenders and system operators.

Therefore, this paper emphasizes the critical role of deception techniques, particularly attention diversion, in APTs. The paper delves into the multi-layered nature of APTs and explains the role of attention diversion in manipulating human operators and system processes, and why this is important to succeed with an APT. This psychological manipulation aims to create a misleading sense of normalcy, diverting attention from critical vulnerabilities in the system. Such attention diversion techniques can also amplify the challenge of detecting and mitigating APTs, exploiting both human psychology and operational procedures within CPS. To illustrate these aspects, the paper describes how attention diversion techniques was applied in a case study of an APT attack conducted on a digital substation Hardware-in-the-Loop (HIL) testbed and discusses the results.

The main purpose of this paper is to highlight the under-explored area of deceptive strategies, particularly in OT, to motivate further research into this area.