Replay Attack Detection Using Ambient Correlation in Industrial Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current replay attack detection methods in industrial control systems, which rely on injecting authentication signals, face a trade-off between detection rate and control performance, and often fail to detect attacks that maintain temporal and spatial correlations among hijacked sensors.
Innovation Solution
A method that analyzes correlations between ambient condition data from multiple monitoring nodes to identify replay attacks without injecting signals, using features like ambient temperature and pressure correlations to categorize requests as attacks, leveraging cooperative attack detectors in a hierarchical system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication signals are injected into the control system to detect replay attacks, then detection rate is improved, but control performance deteriorates
Solution Approach 1:
The patent extracts the detection function from the control signal path by using ambient condition sensors separate from the control system. Instead of injecting authentication signals into the control loop, the system extracts ambient data (temperature, pressure, humidity) from the environment and uses correlation analysis to detect replay attacks, thereby eliminating the trade-off between detection rate and control performance
Solution Approach 2:
The patent introduces ambient conditions (temperature, pressure, humidity) as an intermediary medium to detect replay attacks. These ambient conditions serve as a mediator that correlates with both the control system and the physical process without interfering with control signals. The ambient data acts as a natural authentication reference that does not require injection into the control system
2Measurement precision
If large variance noise is injected to improve detection rate, then detection accuracy improves, but control system performance deteriorates
Solution Approach 1:
The system uses ambient conditions that naturally exist in the environment to perform detection. The ambient temperature, pressure, and humidity data serve themselves as authentication references without requiring any external injection or modification of control signals. This self-service approach eliminates the need to balance noise variance between detection accuracy and control performance
3Device complexity
If current correlation-based approaches are used to detect replay attacks, then temporal and spatial correlations are maintained, but detection fails
Solution Approach 1:
Instead of analyzing correlations among control system sensors (which maintains temporal and spatial correlations during replay attacks), the patent inverts the approach by analyzing correlations between ambient conditions and control system outputs. The ambient conditions provide an independent reference frame that reveals inconsistencies in replayed data, enabling detection where traditional correlation methods fail
Data Source
AI summary
In some embodiments, identifying a replay attack in an industrial control system of an industrial asset includes receiving a first set of time series data associated with an ambient condition of one or more first monitoring nodes at a first location of the industrial control system. An actual system feature value for the industrial asset is determined based upon the first set of time series data. A second set of time series data indicative of the ambient condition at a second location is received, and a nominal system feature value is determined based upon the second set of time series data. A correlation between the actual feature value and the nominal system feature value is analyzed to determine a correlation result. A request received by the industrial control system is selectively categorized as a replay attack based upon the correlation result.