{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,27]],"date-time":"2025-03-27T20:13:35Z","timestamp":1743106415007,"version":"3.40.3"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031818875"},{"type":"electronic","value":"9783031818882"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-81888-2_7","type":"book-chapter","created":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T13:08:17Z","timestamp":1740748097000},"page":"131-152","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Automated Programmable Logic Controller Memory Forensics Using RGB Image Analysis and\u00a0Deep Learning"],"prefix":"10.1007","author":[{"given":"Rima Asmar","family":"Awad","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Sprayberry","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Irfan","family":"Ahmed","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Rogers","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Juan","family":"Lopez","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,2,28]]},"reference":[{"issue":"12","key":"7_CR1","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1109\/MC.2012.325","volume":"45","author":"I Ahmed","year":"2012","unstructured":"Ahmed, I., Obermeier, S., Naedele, M., Richard, G.: SCADA systems: challenges for forensic investigators. IEEE Comput. 45(12), 44\u201351 (2012)","journal-title":"IEEE Comput."},{"key":"7_CR2","doi-asserted-by":"crossref","unstructured":"Alsabbagh, W., Langendorfer, P.: A control injection attack against S7 PLCs \u2013 manipulating the decompiled code. In: Proceedings of the Forty-Seventh Annual Conference of the IEEE Industrial Electronics Society (2021)","DOI":"10.1109\/IECON48115.2021.9589721"},{"key":"7_CR3","unstructured":"Asmar Awad, R.: Automated volatile memory forensics for programmable logic controllers, Ph.D. Dissertation, Department of Computer Science and Engineering, Tennessee Technological University, Cookville, Tennessee (2023)"},{"key":"7_CR4","doi-asserted-by":"crossref","unstructured":"Asmar Awad, R., Beztchi, S., Smith, J., Lyles, B., Prowell, S.: Tools, techniques and methodologies: a survey of digital forensics for SCADA systems. In: Proceedings of the Fourth Annual Industrial Control System Security Workshop (2018)","DOI":"10.1145\/3295453.3295454"},{"key":"7_CR5","doi-asserted-by":"crossref","unstructured":"Asmar Awad, R., Lopez, J., Rogers, M.: Volatile memory extraction based approach for level 0-1 CPS forensics. In: Proceedings of the IEEE International Symposium on Technologies for Homeland Security (2019)","DOI":"10.1109\/HST47167.2019.9032919"},{"key":"7_CR6","first-page":"301513","volume":"44","author":"R Asmar Awad","year":"2023","unstructured":"Asmar Awad, R., Rais, M., Rogers, M., Ahmed, I., Paquit, V.: Towards a generic memory forensic framework for programmable logic controllers. Forensic Sci. Int. Digit. Invest. 44, 301513 (2023)","journal-title":"Forensic Sci. Int. Digit. Invest."},{"key":"7_CR7","doi-asserted-by":"crossref","unstructured":"Ayub, A., Yoo, H., Ahmed, I.: Empirical study of PLC authentication protocols in industrial control systems. In: Proceedings of the IEEE Security and Privacy Workshops, pp. 383\u2013397 (2021)","DOI":"10.1109\/SPW53761.2021.00058"},{"key":"7_CR8","doi-asserted-by":"publisher","first-page":"103010","DOI":"10.1016\/j.cose.2022.103010","volume":"125","author":"M Azzam","year":"2023","unstructured":"Azzam, M., Pasquale, L., Provan, G., Nuseibeh, B.: Forensic readiness of industrial control systems under stealthy attacks. Comput. Secur. 125, 103010 (2023)","journal-title":"Comput. Secur."},{"key":"7_CR9","unstructured":"Biham, E., Bitan, S., Carmel, A., Dankner, A., Malin, U., Wool, A.: Rogue7: Rogue engineering station attacks on S7 Simatic PLCs. In: Presented at Black Hat USA (2019)"},{"issue":"4","key":"7_CR10","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1109\/MC.2011.115","volume":"44","author":"T Chen","year":"2011","unstructured":"Chen, T., Abu-Nimeh, S.: Lessons from Stuxnet. IEEE Comput. 44(4), 91\u201393 (2011)","journal-title":"IEEE Comput."},{"issue":"S","key":"7_CR11","doi-asserted-by":"publisher","first-page":"S26","DOI":"10.1016\/j.diin.2017.06.005","volume":"22","author":"G Denton","year":"2017","unstructured":"Denton, G., Karpisek, F., Breitinger, F., Baggili, I.: Leveraging the SRTP protocol for over-the-network memory acquisition of a GE Fanuc Series 90-30. Digit. Invest. 22(S), S26\u2013S38 (2017)","journal-title":"Digit. Invest."},{"key":"7_CR12","doi-asserted-by":"crossref","unstructured":"Findrik, M., Smith, P., Quill, K., Kieran, M.: PLCBlockMon: data logging and extraction on PLCs for cyber intrusion detection. In: Proceedings of the Fifth International Symposium on ICS and SCADA Cyber Security Research, pp. 102\u2013111 (2018)","DOI":"10.14236\/ewic\/ICS2018.12"},{"key":"7_CR13","doi-asserted-by":"publisher","first-page":"108223","DOI":"10.1016\/j.compeleceng.2022.108223","volume":"102","author":"X Gu","year":"2022","unstructured":"Gu, X., Li, S., Ren, S., Zheng, H., Fan, C., Xu, H.: Adaptive enhanced Swin transformer with U-Net for remote sensing image segmentation. Comput. Electr. Eng. 102, 108223 (2022)","journal-title":"Comput. Electr. Eng."},{"key":"7_CR14","doi-asserted-by":"crossref","unstructured":"Kalle, S., Ameen, N., Yoo, H., Ahmed, I.: CLIK on PLCs! Attacking control logic with decompilation and virtual PLC. In: Proceedings of the Workshop on Binary Analysis Research (2019)","DOI":"10.14722\/bar.2019.23074"},{"key":"7_CR15","doi-asserted-by":"publisher","first-page":"100521","DOI":"10.1016\/j.ijcip.2022.100521","volume":"37","author":"R Kumar","year":"2022","unstructured":"Kumar, R., Kela, R., Singh, S., Trujillo-Rasua, R.: APT attacks on industrial control systems: a tale of three incidents. Int. J. Crit. Infrastruct. Protect. 37, 100521 (2022)","journal-title":"Int. J. Crit. Infrastruct. Protect."},{"key":"7_CR16","volume-title":"Cyber Security in Industrial Automation","author":"K Manoj","year":"2020","unstructured":"Manoj, K.: Cyber Security in Industrial Automation. Notion Press, Chennai, India (2020)"},{"key":"7_CR17","doi-asserted-by":"crossref","unstructured":"Miller, B., Rowe, D.: A survey of SCADA and critical infrastructure incidents. In: Proceedings of the First Annual Conference on Research in Information Technology, pp. 51\u201356 (2012)","DOI":"10.1145\/2380790.2380805"},{"key":"7_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"267","DOI":"10.1007\/978-3-030-87589-3_28","volume-title":"Machine Learning in Medical Imaging","author":"O Petit","year":"2021","unstructured":"Petit, O., Thome, N., Rambour, C., Themyr, L., Collins, T., Soler, L.: U-Net transformer: self and cross attention for medical image segmentation. In: Lian, C., Cao, X., Rekik, I., Xu, X., Yan, P. (eds.) MLMI 2021. LNCS, vol. 12966, pp. 267\u2013276. Springer, Cham (2021). https:\/\/doi.org\/10.1007\/978-3-030-87589-3_28"},{"issue":"S","key":"7_CR19","first-page":"301013","volume":"33","author":"S Qasim","year":"2020","unstructured":"Qasim, S., Smith, J., Ahmed, I.: Control logic forensics framework using a built-in decompiler of engineering software in industrial control systems. Forensic Sci. Int. Digit. Invest. 33(S), 301013 (2020)","journal-title":"Forensic Sci. Int. Digit. Invest."},{"issue":"S","key":"7_CR20","first-page":"301196","volume":"37","author":"M Rais","year":"2021","unstructured":"Rais, M., Asmar Awad, R., Lopez, J., Ahmed, I.: JTAG-based PLC memory acquisition framework for industrial control systems. Forensic Sci. Int. Digit. Invest. 37(S), 301196 (2021)","journal-title":"Forensic Sci. Int. Digit. Invest."},{"issue":"S","key":"7_CR21","first-page":"301339","volume":"40","author":"M Rais","year":"2022","unstructured":"Rais, M., Asmar Awad, R., Lopez, J., Ahmed, J.: Memory forensic analysis of a programmable logic controller in industrial control systems. Forensic Sci. Int. Digit. Invest. 40(S), 301339 (2022)","journal-title":"Forensic Sci. Int. Digit. Invest."},{"key":"7_CR22","doi-asserted-by":"crossref","unstructured":"Rajput, P., Maniatakos, M.: Towards non-intrusive malware detection for industrial control systems. In: Proceedings of the Design, Automation and Test in Europe Conference and Exhibition, pp. 1703\u20131706 (2021)","DOI":"10.23919\/DATE51398.2021.9474121"},{"issue":"4","key":"7_CR23","first-page":"79","volume":"10","author":"T Wu","year":"2015","unstructured":"Wu, T., Nurse, J.: Exploring the use of PLC debugging tools for digital forensic investigations on SCADA systems. J. Digit. Forensics Secur. Law 10(4), 79\u201396 (2015)","journal-title":"J. Digit. Forensics Secur. Law"},{"key":"7_CR24","series-title":"IFIP Advances in Information and Communication Technology","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1007\/978-3-030-22312-0_3","volume-title":"ICT Systems Security and Privacy Protection","author":"H Yoo","year":"2019","unstructured":"Yoo, H., Ahmed, I.: Control logic injection attacks on industrial control systems. In: Dhillon, G., Karlsson, F., Hedstr\u00f6m, K., Z\u00faquete, A. (eds.) SEC 2019. IAICT, vol. 562, pp. 33\u201348. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-22312-0_3"},{"key":"7_CR25","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1007\/978-3-030-22038-9_6","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"H Yoo","year":"2019","unstructured":"Yoo, H., Kalle, S., Smith, J., Ahmed, I.: Overshadow PLC to detect remote control-logic injection attacks. In: Perdisci, R., Maurice, C., Giacinto, G., Almgren, M. (eds.) DIMVA 2019. LNCS, vol. 11543, pp. 109\u2013132. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-22038-9_6"},{"issue":"S","key":"7_CR26","first-page":"301336","volume":"40","author":"N Zubair","year":"2022","unstructured":"Zubair, N., Ayub, A., Yoo, H., Ahmed, I.: PEM: remote forensic acquisition of PLC memory in industrial control systems. Forensic Sci. Int. Digit. Invest. 40(S), 301336 (2022)","journal-title":"Forensic Sci. Int. Digit. Invest."}],"container-title":["IFIP Advances in Information and Communication Technology","Critical Infrastructure Protection XVIII"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-81888-2_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T13:08:23Z","timestamp":1740748103000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-81888-2_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031818875","9783031818882"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-81888-2_7","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"type":"print","value":"1868-4238"},{"type":"electronic","value":"1868-422X"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"28 February 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICCIP","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Critical Infrastructure Protection","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Arlington, VA","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"USA","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 March 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20 March 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"iccip2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ifip1110.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}