Survey and new directions for physics-based attack detection in control systems

Abstract

Monitoring the "physics" of control systems to detect attacks is a growing area of research. In its basic form a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements in order to identify potentially false control commands or false sensor readings. In this paper, we review previous work based on a unified taxonomy that allows us to identify limitations, unexplored challenges, and new solutions. In particular, we propose a new adversary model and a way to compare previous work with a new evaluation metric based on the trade-off between false alarms and the negative impact of undetected attacks. We also show the advantages and disadvantages of three experimental scenarios to test the performance of attacks and defenses: real-world network data captured from a large-scale operational facility, a fully-functional testbed that can be used operationally for water treatment, and a simulation of frequency control in the power grid.

Truth Will Out

“…Most of the previous work focuses on the unreliability of the sensor readings, while trusting actuators and controllers [51]. By contrast, we simulate integrity attacks on both sensors and actuators as depicted in Figure 2.…”

“…There is an emerging trend in ICS intrusion detection research where researchers have shown growing interest in developing techniques that can detect such sophisticated attacks at the process level [8,9,22,28,31,35,46,50,51]. Although intruders may be able to hide in the IT network while figuring out their workings, the main driver of this trend is the observation that they can hardly hide their final goal, which is to cause an adverse effect on the physical process by maliciously manipulating sensor and control data [8].…”

“…A process-level intrusion detection system monitors sensors-the eyes and ears of control systems-and possibly control commands, to determine if the physical process is drifting from the normal or expected behavior. One popular approach frequently used in this domain proposes to build a Linear Dynamical State-Space (LDS) model of the physical process, through what is known as system identification (see [51] and references therein), which is subsequently used to detect anomalies in the system behavior. Although such approaches might detect anomalous behaviors, models are difficult to build, requiring massive human effort at the preliminary stage [15], and a complete and highly detailed model of the physical process that is not always available [28].…”

Integrated protection of industrial control systems from cyber-attacks: the ATENA approach

“…• Statistical protocol probes: they capture different statistical attributes and send them to the domain processor. These statistical attributes 7 We will use the term probes and agents interchangeably.…”

“…Actual regulations, national standards, or guidelines are only suggestions and checklists for critical services providers. They do not supply a platform for detecting cyber threats and evaluating their consequences on the physical process allowing also reaction capabilities [7].…”