Using Physical Models for Anomaly Detection in Control Systems

Abstract

Supervisory control and data acquisition (SCADA) systems are increasingly used to operate critical infrastructure assets. However, the inclusion of advanced information technology and communications components and elaborate control strategies in SCADA systems increase the threat surface for external and subversion-type attacks. The problems are exacerbated by site-specific properties of SCADA environments that make subversion detection impractical; and by sensor noise and feedback characteristics that degrade conventional anomaly detection systems. Moreover, potential attack mechanisms are ill-defined and may include both physical and logical aspects. This paper employs an explicit model of a SCADA system in order to reduce the uncertainty inherent in anomaly detection. Detection is enhanced by incorporating feedback loops in the model. The effectiveness of the approach is demonstrated using a model of a hydroelectric power plant for which several attack vectors are described.

Defeating Node Based Attacks on SCADA Systems Using Probabilistic Packet Observation

“…Such attacks have been discussed extensively [4,5,6]. Detective strategies based on protocol analysis, or statistical signal analysis by themselves can be shown to have weaknesses in uncovering such attacks [7], particularly in the face of an adversary with the ability to subvert network nodes in the system [3]. Hence conjoint reasoning over both communication and control functionality, making use of advanced state estimation techniques, is necessary to detect such attacks [2] [8].…”

Towards Large-Scale, Heterogeneous Anomaly Detection Systems in Industrial Networks: A Survey of Current Trends

“…Physical-level ADSs can be divided into two main groups: ADSs where it is necessary to model the physical process [59,60] or ADSs that do not need a specific model for the physical process [61,62]. Few proposals combine data from both levels [63,64].…”

“…might be present. There are several examples of IN ADSs that leverage field-level data [59][60][61][62]. This data can come from logs on a control server, direct process measurements, and simulated data or can be scattered across different hosts or devices.…”

Theory of evidence-based automated decision making in cyber-physical systems

“…We begin by mentioning the work of Svendsen and Wolthusen [11] that use an explicit model of a SCADA system for anomaly detection. The detection process is enhanced by using feedback control theory to predict future values and ultimately detect physical anomalies in the system.…”