Industrial control system attack detection method and system

Abstract

The application provides an industrial control system attack detection method and system, and belongs to the technical field of industrial control network security. The method can at least partially solve the problems that the existing security protection system is difficult to capture weak abnormal signals in the early stage of attack, cannot reveal the causal relationship and propagation path between multi-step attack events, leading to detection delay and lack of traceability. The application comprises the following steps: acquiring multi-source time series data of an industrial control system; generating early abnormal warning information based on the data; in response to the warning information, performing time series analysis on the data to determine attack feature information; performing causal analysis on the data to quantify the causal propagation strength between devices and construct an attack propagation graph; and fusing the early abnormal warning information, attack feature information and causal propagation strength to generate a comprehensive risk judgment result. The application improves the timeliness and accuracy of detection, and can intuitively display the attack propagation path, which is helpful for real-time response and traceability analysis.

Description

Technical Field

[0001] This invention belongs to the field of industrial control network security technology, specifically relating to an industrial control system attack detection method and system. Background Technology

[0002] Industrial Control Systems (ICS) are the nerve center of critical national infrastructure operations, including power, oil and gas, manufacturing, rail transportation, and water conservancy. Traditionally, ICS relied on physically isolated dedicated networks for security. However, with the development of the Industrial Internet and smart manufacturing technologies, ICS are rapidly interacting and merging with enterprise IT networks and even the Internet. While this open interconnection improves production and operational efficiency, it also significantly increases the attack surface of ICS.

[0003] In recent years, advanced persistent threats (APTs) targeting ICS have become increasingly frequent. These attacks are no longer isolated intrusions, but rather multi-stage, long-term chain attacks, where attackers gradually infiltrate and remain infiltrated, ultimately gaining control of critical equipment to cause physical damage.

[0004] Currently, security measures against Intrusion Detection Systems (ICS), such as signature- or feature-matching-based Intrusion Detection Systems (IDS) or traditional anomaly detection methods, primarily rely on known attack patterns or thresholds that significantly deviate from normal operating conditions. While these methods are effective in detecting known, severe attacks, their technical limitations are becoming increasingly apparent. On one hand, they struggle to capture subtle anomaly signals exhibited during the attack preparation or latency phases, leading to delayed security responses, missed optimal defense opportunities, and the technical problem of "detection delay."

[0005] On the other hand, complex APT attacks consist of a series of interconnected steps. Existing detection methods often operate in isolation, treating each anomaly as a separate event and lacking the ability to analyze the inherent logic and causal relationships between multiple attack steps. This results in the system being unable to reveal the complete propagation path of the attack and making it difficult to trace the source of the attack, creating a technical problem of "lack of tracing capability."

[0006] Therefore, there is an urgent need for a detection scheme that can integrate early warning of weak signals with multi-stage attack causal correlation analysis to solve the aforementioned technical problems of detection delay and lack of traceability. Summary of the Invention

[0007] The present invention aims to solve at least one of the technical problems existing in the prior art, and to provide a method and system for detecting attacks on industrial control systems.

[0008] This invention provides a method for detecting attacks on industrial control systems, comprising: Acquire multi-source timing data from industrial control systems; Early anomaly warning information is generated based on the multi-source time-series data; In response to the early anomaly warning information, time series analysis is performed on the multi-source time series data to determine attack characteristic information; Causal analysis is performed on the multi-source time-series data to quantify the causal propagation strength between devices and to construct an attack propagation graph; The early anomaly warning information, the attack characteristic information, and the causal propagation strength are integrated to generate a comprehensive risk assessment result.

[0009] Furthermore, the generation of early anomaly warning information includes: The isolated forest algorithm is used to calculate the anomaly score of the multi-source time series data; Based on the sliding window mechanism and a preset threshold, the early anomaly warning information is generated according to the anomaly score.

[0010] Furthermore, the information used to determine attack characteristics includes: A long short-term memory network model is used to perform time series classification on the multi-source time series data; Based on the results of the time-series classification, the attack feature information is output, which includes the attack type and source device information.

[0011] Furthermore, the causal analysis includes: The multi-source time series data is decomposed using ensemble empirical mode decomposition to obtain the intrinsic mode function sequence; Based on the intrinsic mode function sequence, the causal propagation strength between the devices is calculated through phase coherence analysis.

[0012] Furthermore, the integration of the early anomaly warning information, the attack characteristic information, and the causal propagation strength to generate a comprehensive risk assessment result includes: The early anomaly warning information, the attack feature information, and the causal propagation strength are fused using a preset weighted average to calculate and generate the comprehensive risk assessment result.

[0013] Further, it is characterized by further comprising: Based on the risk level determined by the comprehensive risk assessment, preset security protection operations are executed.

[0014] An industrial control system attack detection system, comprising: The data acquisition module is used to acquire multi-source time-series data from industrial control systems; The early warning module is used to generate early warning information of anomalies based on the multi-source time-series data; The timing detection module is used to perform timing analysis on the multi-source timing data in response to the early anomaly warning information in order to determine attack feature information; The causal analysis module is used to perform causal analysis on the multi-source time-series data to quantify the causal propagation strength between devices and construct an attack propagation graph. The fusion judgment module is used to fuse the early anomaly warning information, the attack feature information, and the causal propagation strength to generate a comprehensive risk judgment result.

[0015] Furthermore, the early warning module is configured as follows: The isolated forest algorithm is used to calculate the anomaly score of the multi-source time series data; Furthermore, based on the sliding window mechanism and a preset threshold, the early anomaly warning information is generated according to the anomaly score.

[0016] Furthermore, the timing detection module is configured as follows: A long short-term memory network model is used to perform time series classification on the multi-source time series data; Furthermore, based on the results of the time-series classification, the attack feature information is output, which includes the attack type and source device information.

[0017] Furthermore, the causal analysis module is configured as follows: The multi-source time series data is decomposed using ensemble empirical mode decomposition to obtain the intrinsic mode function sequence; Furthermore, based on the intrinsic mode function sequence, the causal propagation strength between the devices is calculated through phase coherence analysis.

[0018] The beneficial effects of this invention are as follows: Through the coordinated efforts of early warning, time-series analysis, and causal analysis, end-to-end monitoring was achieved, from capturing weak signals in the attack preparation phase to tracing the propagation path in the attack diffusion phase.

[0019] By combining the high-dimensional classification capabilities of time series analysis with the signal decomposition capabilities of causal analysis, the detection accuracy is improved. At the same time, by constructing an attack propagation graph to intuitively reveal the attack propagation path, the interpretability of the system's detection results is significantly enhanced.

[0020] This invention can not only detect attacks that have already occurred, but also capture early signs of attacks and assess the potential scope of impact through causal analysis, thereby enhancing the proactiveness of security protection.

[0021] The industrial control system attack detection system supports a layered deployment architecture of edge and center, which can be flexibly configured according to actual industrial scenarios, and has good applicability and scalability. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the basic process of an industrial control system attack detection method according to a specific embodiment of the present invention. Figure 2 Causal propagation and multi-stage fusion decision response diagram of an industrial control system attack detection system according to a specific embodiment of the present invention; Figure 3 This is a schematic diagram of the system architecture of an industrial control system attack detection system according to a specific embodiment of the present invention. Figure 4 This is a schematic diagram of a timing anomaly detection process according to a specific embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and beneficial effects of this application clearer, the following detailed description, in conjunction with the accompanying drawings and specific embodiments, further illustrates this application. It should be understood that the specific embodiments described in this specification are merely for explaining this application and are not intended to limit it.

[0024] An industrial control system attack detection method and system, such as Figure 3 As shown, the system adopts a layered modular architecture, including a data acquisition module, an early warning module, a time-series detection module, a causal analysis module, a fusion judgment module, and a response and handling module. Each module is coupled through a unified timestamp and device identifier ID interface, forming an end-to-end closed-loop security protection process. Figure 1 As shown, this invention provides a method for detecting attacks on industrial control systems, specifically including the following steps: Step 1: Acquire multi-source timing data of the industrial control system.

[0025] like Figure 3As shown, this step is performed by the data acquisition module. The data acquisition module collects various data sources from the industrial control system, specifically covering sensor data from PMUs (Phasor Measurement Units) and RTUs (Remote Terminal Units) in the power system, IEDs (Intelligent Electronic Devices), PLCs (Programmable Logic Controllers), Historian logs from SCADA (Supervisory Control and Data Acquisition) systems, operation records from HMIs (Human-Machine Interfaces), and network-level traffic mirroring. Network traffic mirroring includes Modbus or DNP3 packets parsed from industrial protocols, VLAN mirroring, and system and authentication logs.

[0026] To reduce real-time latency, edge-distributed data collectors are used to collect various types of data separately and perform preliminary preprocessing. All collected data must undergo strict time synchronization, using Network Time Protocol (NTP) or Global Positioning System (GPS) to ensure time consistency. Simultaneously, the data format is standardized, becoming structured data containing fields such as timestamp, device ID, metric type, and value.

[0027] For data cleaning, median filtering is used to remove sensor jitter, and forward padding or compensation is used for missing or abrupt data. For network traffic data, session-level statistical feature extraction is performed, including connection rate, packet rate, byte rate, session duration, and failure rate.

[0028] Step 2: Generate early anomaly warning information based on the acquired multi-source time series data.

[0029] like Figure 3 As shown, this step is performed by the early warning module, with the goal of detecting subtle abnormal trends in the attack preparation phase or early stage before obvious attack consequences occur.

[0030] In a preferred embodiment, generating early warning information for anomalies includes: First, the Isolation Forest algorithm is used to calculate anomaly scores on multi-source time-series data. Specifically, unsupervised scoring is performed on each collected time-series data point or feature vector constructed based on the network and operational events to obtain a point-level anomaly score. s(xi) The Isolation Forest algorithm constructs multiple isolated iTrees by randomly selecting features and randomizing the split threshold. Outlier samples, due to their rarity and variability, typically have shorter average path lengths within the trees. For each sample... xi Calculate its average path length E[h( x )], and normalize it to map it to anomaly scores: , where c(n) is a constant approximation of the sample size n. s(x The value of ) ranges from 0 to 1, and the closer it is to 1, the more abnormal it is.

[0031] Then, based on a sliding window mechanism and a preset threshold, early anomaly warning information is generated according to the calculated anomaly score. Specifically, a sliding window mechanism is used to calculate the window-level average anomaly score: , where w is the window length.

[0032] The calculated window-level average anomaly score Compare with a preset threshold τ. If If the value is greater than τ, an early warning is triggered, generating early anomaly warning information.

[0033] In a further embodiment, the preset threshold is set as a multi-level threshold, distinguished as τL, τM, and τH, corresponding to low, medium, and high warning levels, respectively. Furthermore, these thresholds are adaptively adjusted according to the system's current load or operating mode. The sliding window length w is also dynamically scaled according to different application scenarios to balance detection sensitivity and accuracy, ranging from 5 to 30 seconds for the fast control system (SWaT).

[0034] The feature vectors used in the Isolation Forest algorithm employ a combination of network features, operational command features, physical quantity features, and frequency domain features. Network features include source IP, destination IP, port distribution, connection rate, probe failure rate, and burst port scan count. Operational command features include the frequency of write commands within a short window, configuration modification frequency, and non-working time control commands. Physical quantity features include instantaneous jumps in PMU phase angle or amplitude and their rates of change. Frequency domain features include Short-Time Fourier Transform (STFT) or wavelet energy, used to detect periodic frequency sweep or modulation attack patterns.

[0035] Step 3: In response to the generated early anomaly warning information, perform time series analysis on multi-source time series data to determine attack characteristic information.

[0036] like Figure 3 As shown, this step is performed by the timing detection module. When an early anomaly warning is triggered, this module starts to detect the attack at the data level and locate the source of the attack.

[0037] In a preferred embodiment, such as Figure 4 As shown, the attack signature information includes: First, a Long Short-Term Memory (LSTM) network model is used for time series classification of multi-source time series data. As a recurrent neural network, LSTM, through its unique input gate, forget gate, and output gate structure, can effectively handle long-term dependencies in time series data. The model's input tensor format is a multi-channel time series segment, i.e., a three-dimensional array (batch, timesteps, features). Here, batch is the batch size, timesteps is the length of the time series, and features is the number of features at each time point, including voltage, current, and network flow indicators.

[0038] Then, based on the results of temporal classification, attack feature information is output. The model backend connects a fully connected layer and a Softmax output layer. The fully connected layer converts the feature vector output by the LSTM into a fixed-dimensional vector, and the Softmax output layer converts this vector into a probability distribution to determine whether the sample is abnormal and output attack feature information. The attack feature information specifically includes attack type, such as FDIA, DoS, and data tampering, and source device information, such as the most likely source device ID, IED number, or PLC address.

[0039] During model training, to address the class imbalance problem in industrial data where normal samples far outnumber attack samples, a weighted cross-entropy loss function or a Focal Loss loss function is employed to make the model focus more on samples that are difficult to classify. The optimizer uses the Adam optimization algorithm, with an initial learning rate of 1e-3, supplemented by learning rate decay and early stopping strategies.

[0040] To prevent overfitting, Dropout regularization is used between layers to randomly drop some neurons during training. A small amount of noise is also added to the data for data augmentation, improving the model's robustness.

[0041] After system deployment, periodic retraining is employed to adapt to drift caused by changes in the industrial environment over time. To meet the real-time requirements of industrial sites, the model is quantized, compressing model parameters from 32-bit floating-point numbers to 8-bit integers. The model is then deployed on edge GPUs or FPGAs according to actual conditions, employing pipelined parallel inference.

[0042] Step 4: Perform causal analysis on multi-source time-series data to quantify the causal propagation strength between devices and construct an attack propagation graph.

[0043] like Figure 3 As shown, this step is performed by the causal analysis module. This module starts in parallel with step three and is used to deeply explore the causal dependencies between events.

[0044] In a preferred embodiment, such as Figure 2As shown, causal analysis includes: First, ensemble empirical mode decomposition (EEMD) is used to decompose multi-source time-series data to obtain intrinsic mode function (IMF) sequences. This step targets time-series signals from suspected attacked device pairs. EEMD effectively suppresses mode aliasing by injecting Gaussian white noise multiple times into the original signal and averaging the results of each decomposition, decomposing complex non-stationary and nonlinear signals into several IMF components. In one specific implementation, the amplitude of the injected Gaussian white noise is 20% to 50% of the standard deviation of the original signal, and the number of ensemble iterations N is set to 1000.

[0045] Then, based on the acquired intrinsic mode function (IMF) sequence, the causal propagation strength between devices is calculated through phase coherence analysis. Specifically, taking the analysis of the causal relationship between device A and device B as an example: each IMF component of device A is traversed, and a certain IMF component of A is removed one by one and the time-series signal is reconstructed. Then, the reconstructed signal is decomposed again using EEMD, and the phase coherence difference between the original signal and the reconstructed signal on that component is calculated. The phase differences of all IMF levels are summarized by methods such as variance-weighted Euclidean distance, and finally, a quantified causal strength score C(A→B) is obtained. The value of C(A→B) ranges from 0 to 1, where 0.5 indicates no significant causal effect, and values ​​close to 0 or 1 indicate a strong unidirectional causal relationship. Furthermore, C(B→A) is calculated using the same method.

[0046] Finally, based on the calculated causal propagation strength between devices, an attack propagation graph is constructed. This graph is a directed graph G, where nodes represent ICS devices. A directed edge from device A to device B is established in the graph only if the causal propagation strength C(A→B) from device A to device B exceeds a preset causal judgment threshold θ. In a specific implementation, the threshold θ is set to 0.75.

[0047] After constructing the graph, graph traversal algorithms, such as depth-first search or breadth-first search, are used to start from the known attack source node and trace the subsequent possible propagation nodes along the causal edges to achieve complete reconstruction and visualization of the multi-step attack path.

[0048] Step 5: Integrate early anomaly warning information, attack characteristic information, and causal propagation strength to generate a comprehensive risk assessment result.

[0049] like Figure 3 As shown, this step is performed by the fusion judgment module. This module integrates the outputs of the aforementioned modules and provides a final alert and risk classification for the attack event.

[0050] In a preferred embodiment, the fusion process calculates and generates a comprehensive risk assessment result by performing a pre-defined weighted fusion of early anomaly warning information, attack characteristic information, and causal propagation strength.

[0051] In one specific implementation, the comprehensive risk assessment result is represented by a comprehensive risk score R. This weighted fusion uses a linear weighting method, as shown in the following formula: ; Among them, α, , These are preset weighting coefficients, set based on historical data training or operational strategies; The average anomaly score at the window level; The anomaly probability is the output of the LSTM. The maximum out-degree causal strength of the relevant nodes; for The normalization benchmark is generally taken as the maximum value of a specific time period (determined by the actual working conditions). Sw ).

[0052] Based on the calculated comprehensive risk score R value, risk levels are classified, including low risk, medium risk, high risk, and catastrophic risk.

[0053] Step Six: Based on the risk level determined by the comprehensive risk assessment, execute the preset safety protection operations.

[0054] like Figure 3 As shown, this step is performed by the response and handling module. In a preferred embodiment, based on the risk level of the comprehensive risk assessment result generated in step five, the corresponding security protection operation is performed: If the risk is low, log the information, preserve the evidence, and notify the operations and maintenance personnel.

[0055] If the risk level is medium, notify the on-duty personnel and recommend strengthening security measures, upgrading the audit level, and enhancing monitoring of relevant equipment.

[0056] If the risk is high or critical, the system will automatically perform isolation or blocking operations, including automatically isolating suspicious ports or VLANs, closing related network sessions, moving devices to isolated network segments, and even triggering emergency shutdowns. The system supports automatically issuing control commands such as firewall rules, SDN flow tables, and PLC read / write locks, and also writes events, generates work orders, or sends maintenance notifications through the SIEM system.

[0057] The present invention also provides an industrial control system attack detection system, the system comprising: The system includes a data acquisition module, an early warning module, a time series detection module, a causal analysis module, and a fusion judgment module.

[0058] in: The data acquisition module is used to acquire multi-source time-series data from industrial control systems.

[0059] The early warning module, connected to the data acquisition module, is used to generate early anomaly warning information based on multi-source time-series data. In a preferred embodiment, the early warning module is configured to calculate anomaly scores using the Isolation Forest algorithm and generate warning information based on a sliding window mechanism and a preset threshold. Its specific implementation has been described in detail in step two.

[0060] The timing detection module, connected to the data acquisition module and responding to the early warning module, is used to perform timing analysis on multi-source timing data to determine attack characteristic information. In a preferred embodiment, the timing detection module is configured to use a Long Short-Term Memory (LSTM) network model for timing classification and output attack characteristic information including attack type and source device information. Its specific implementation has been described in detail in step three.

[0061] The causal analysis module, connected to the data acquisition module, is used to perform causal analysis on multi-source time-series data to quantify the causal propagation strength between devices and construct an attack propagation graph. In a preferred embodiment, such as... Figure 2 As shown, the causal analysis module is configured to obtain the intrinsic mode function sequence using ensemble empirical mode decomposition (EEMD) and calculate the causal propagation strength based on phase coherence analysis. Its specific implementation is described in detail in step four.

[0062] The fusion judgment module, connected to the early warning module, time series detection module, and causal analysis module, is used to fuse early anomaly warning information, attack characteristic information, and causal propagation strength to generate a comprehensive risk judgment result. Its specific implementation method has been described in detail in step five.

[0063] In a preferred embodiment, the system further includes a response and handling module connected to the fusion judgment module, used to execute preset security protection operations based on the risk level of the comprehensive risk judgment result. Its specific implementation has been described in detail in step six.

[0064] In a further embodiment, the system adopts a layered deployment architecture: The Isolation Forest algorithm in the early warning module, due to its relatively small computational load, is deployed on the edge side, such as the edge collector or near-edge analysis layer, to achieve low-latency early warning.

[0065] The causal analysis module, due to its involvement in complex set empirical mode decomposition (EEMD) calculations, requires significant computing resources and is therefore deployed on a central high-performance computing cluster.

[0066] The LSTM model of the timing detection module can be flexibly deployed on edge GPUs and FPGAs for fast inference, or deployed in a central cluster for complex model training and inference, depending on real-time requirements.

[0067] This implementation method integrates the anomaly warning mechanism of Isolation Forest, the temporal modeling capability of LSTM, and the causal inference method of EEMD to achieve accurate identification and process analysis of multi-stage attacks on ICS.

[0068] In summary, the embodiments disclosed herein have at least the following technical effects: Comprehensive coverage of the attack lifecycle: Through the coordinated work of early warning, time sequence analysis and causal analysis, end-to-end monitoring is achieved, from capturing weak signals in the attack preparation stage to tracing the propagation path in the attack diffusion stage.

[0069] Improving detection accuracy and interpretability: By comprehensively utilizing the high-dimensional classification capabilities of time series analysis and the signal decomposition capabilities of causal analysis, the detection accuracy is improved; at the same time, by constructing an attack propagation graph to intuitively reveal the attack propagation path, the interpretability of the system's detection results is significantly enhanced.

[0070] Enhanced proactive protection: This invention can not only detect attacks that have already occurred, but also capture early signs of attacks and assess the potential scope of impact through causal analysis, thereby enhancing the proactive nature of security protection.

[0071] Flexible deployment and strong applicability: The system supports a layered deployment architecture of edge and center, which can be flexibly configured according to actual industrial scenarios, and has good applicability and scalability.

[0072] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for detecting attacks on industrial control systems, characterized in that, include: Acquire multi-source timing data from industrial control systems; Early anomaly warning information is generated based on the multi-source time-series data; In response to the early anomaly warning information, time series analysis is performed on the multi-source time series data to determine attack characteristic information; Causal analysis is performed on the multi-source time-series data to quantify the causal propagation strength between devices and to construct an attack propagation graph; as well as The early anomaly warning information, the attack characteristic information, and the causal propagation strength are integrated to generate a comprehensive risk assessment result.

2. The attack detection method according to claim 1, characterized in that, The generation of early anomaly warning information includes: The isolated forest algorithm is used to calculate the outlier score of the multi-source time series data; Based on the sliding window mechanism and a preset threshold, the early anomaly warning information is generated according to the anomaly score.

3. The attack detection method according to claim 1, characterized in that, The information used to determine attack characteristics includes: A long short-term memory network model is used to perform time series classification on the multi-source time series data; Based on the results of the time-series classification, the attack feature information is output, which includes the attack type and source device information.

4. The attack detection method according to claim 1, characterized in that, The causal analysis includes: The multi-source time series data is decomposed using ensemble empirical mode decomposition to obtain the intrinsic mode function sequence; Based on the intrinsic mode function sequence, the causal propagation strength between the devices is calculated through phase coherence analysis.

5. The attack detection method according to claim 1, characterized in that, The process of integrating the early anomaly warning information, the attack characteristic information, and the causal propagation strength to generate a comprehensive risk assessment result includes: The early anomaly warning information, the attack feature information, and the causal propagation strength are fused using a preset weighted average to calculate and generate the comprehensive risk assessment result.

6. The attack detection method according to any one of claims 1 to 5, characterized in that, Further includes: Based on the risk level determined by the comprehensive risk assessment, preset security protection operations are executed.

7. An industrial control system attack detection system, characterized in that, include: The data acquisition module is used to acquire multi-source time-series data from industrial control systems; The early warning module is used to generate early warning information of anomalies based on the multi-source time-series data; The timing detection module is used to perform timing analysis on the multi-source timing data in response to the early anomaly warning information in order to determine attack feature information; The causal analysis module is used to perform causal analysis on the multi-source time-series data to quantify the causal propagation strength between devices and construct an attack propagation graph. The fusion judgment module is used to fuse the early anomaly warning information, the attack feature information, and the causal propagation strength to generate a comprehensive risk judgment result.

8. The attack detection system according to claim 7, characterized in that, The early warning module is configured as follows: The isolated forest algorithm is used to calculate the outlier score of the multi-source time series data; Furthermore, based on the sliding window mechanism and a preset threshold, the early anomaly warning information is generated according to the anomaly score.

9. The attack detection system according to claim 7, characterized in that, The timing detection module is configured as follows: A long short-term memory network model is used to perform time series classification on the multi-source time series data; Furthermore, based on the results of the time-series classification, the attack feature information is output, which includes the attack type and source device information.

10. The attack detection system according to any one of claims 7 to 9, characterized in that, The causal analysis module is configured as follows: The multi-source time series data is decomposed using ensemble empirical mode decomposition to obtain the intrinsic mode function sequence; Furthermore, based on the intrinsic mode function sequence, the causal propagation strength between the devices is calculated through phase coherence analysis.

Images