Using the Process Deviations for Anamoly Detection in ICS

What is it about?

Anomalies in the Industrial Control Systems (ICS) can occur due to multiple reasons, including but not limited to device malfunction/fault or an intentional attack. In this work, we focus on the anomalies due to the attacks. Attack on an ICS can be catastrophic as it not only damages the computing system of it but also the physical space and the process. The physical process is designed to follow the specific dynamical behavior but in reality, due to process-specific skews, we find certain deviations from the design. We capture those deviations specific to each process using a system model-based approach and call those as process skews.

Featured Image

Photo by Mladen Borisov on Unsplash

Photo by Mladen Borisov on Unsplash

Why is it important?

Understanding the physical space and process dynamics of an ICS is important to ensure the secure operation of a process plant. Sensitive information like process skew would reveal even the slightest of the change made by a malicious entity. Using the process skew it is also possible to tell what is the true state of the process, since the skew depends on the process itself, for example, a water filling process has different characteristics as compared to the water emptying process. Therefore, an intruder could not fake the real state of the process without disturbing the skew and hence exposing itself. We can use the proposed technology for intrusion detection in Industrial Control Systems.

Perspectives