רוברט מושקוביץ'

Industrial control systems (ICSs) lack a standardized ontology for describing normal operational processes. This gap, which arises from the assumption that every process is unique, limits the development of scalable, process-aware security solutions and creates communication barriers between security and operations teams. To address this deficiency, we propose the Common Operational Process Enumeration (COPE) framework, a hierarchical ontology which systematizes operational behaviors. COPE employs a four-level taxonomy (Tactic, Technique, Sub-Technique, and Procedure), structurally inspired by the MITRE ATT&CK framework, to transform the vast amount of existing site-specific processes into a standardized, sharable terminology. This lexicon facilitates process-aware threat detection and the secure sharing of indicators of compromise (IOCs) without exposing proprietary details. To validate COPE's efficacy, we applied a systematic top-down methodology in three water system testbeds used to study ICS security. We identified and categorized 35 functional units (logical groupings of equipment performing a single function) and categorized them into a compact set of four unique Tactics that originate eight unique Techniques. The results reveal a high degree of reusability: over 80% of the identified functional units are described by just two Tactics (Storage and Filtering) and three Techniques. For instance, the Storage Tactic accounts for 71% of all functional units, while the Continuous Storage Monitoring Technique appears in 37% of units across the testbeds. This work demonstrates that common operational patterns exist and can be systematically identified and standardized. COPE provides the structured, contextual baseline of normal process behavior required to develop process-aware intrusion detection systems, while establishing a common language for incident response and cross-domain collaboration in ICS environments.