Destructive Attacks Detection and Response System for Physical Devices in Cyber-Physical Systems

Abstract

Nowadays, physical health of equipment controlled by Cyber-Physical Systems (CPS) is a significant concern. This paper reports a work, in which, a hardware is placed between Programmable Logic Controller (PLC) and the actuator as a solution. The proposed hardware operates in two conditions, i.e. passive and active. Operation of the proposed solution is based on the repetitive operational profile of the actuators. The normal operational profile of the actuator is fed to the protective hardware and is considered as the normal operating condition. In the normal operating condition, the middleware operates in its passive mode and simply monitors electronic signals passing between PLC and Actuator. In case of any malicious operation, the proposed hardware operates in its active mode and both slowly stops the actuator and sends an alert to SCADA server initiating execution of the actuator's emergency profile. Thus, the proposed hardware gains control over the actuator and prevents any physical damage on the operating devices. Two sample experiments are reported in which, results of implementing the proposed solution are reported and assessed. Results show that once the PLC sends incorrect data to actuator, the proposed hardware detects it as an anomaly. Therefore, it does not allow the PLC to send incorrect and unauthorized data pattern to its actuator. Significance of the paper is in introducing a solution to prevent destruction of physical devices apart from source or purpose of the encountered anomaly and apart from CPS functionality or PLC model and operation.

A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

“…These can include metrics such as network latency, link saturation, and levels of CPU utilization. However, accurately defining known ranges of acceptable operation in OT networks has proven more challenging due to the influence of real-world environmental fluctuations [15]. For instance, in a smart city setting, a network of air quality sensors utilizing wi-fi or cellular networks may experience variations in communication latency caused by factors like fog or rain.…”