Anomaly Detection in Industrial Control Systems Using Pseudo Normal Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems (ICSs) connected via networks face challenges in anomaly detection, as determining anomalies can burden IT resources and disrupt continuous operations, and existing methods are not applicable to multiple distinct ICSs connected via networks.
Innovation Solution
An anomaly detection system that uses an integrated analyzer to monitor status data from ICSs, identifies suspected anomalies, and implements a pseudo normal mode to minimize the impact on other ICSs by transmitting simulated data, allowing actual data to be rolled back and replaced when the anomaly is confirmed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly determination is performed on ICSs, then anomaly detection capability is improved, but IT resource load increases and processing time is consumed
Solution Approach 1:
The patent introduces an anomaly analyzer as an intermediary component that is distinct from the ICSs themselves. The anomaly analyzer receives status data from multiple ICSs, performs anomaly determination, and sends control data back to the ICSs. This mediator approach allows anomaly detection functionality to be added without burdening the IT resources of the individual ICSs, as the computational load is transferred to the centralized analyzer.
2Measurement precision
If anomaly determination is performed on ICSs, then anomaly detection capability is improved, but processing time is consumed affecting continuous operation
Solution Approach 1:
The patent implements continuous monitoring where the anomaly analyzer continuously receives status data from ICSs and performs real-time anomaly determination. When an anomaly is detected, the system immediately sends control data to switch to pseudo normal mode, minimizing the time the anomalous data can affect other systems. This continuous action approach ensures that anomaly detection does not interrupt the continuous operation of ICSs while maintaining rapid response capability.
3Loss of information
If ICS transmits status data to other ICSs, then information exchange is improved, but risk of affecting other systems with anomalous data increases
Solution Approach 1:
The anomaly analyzer serves as an intermediary that filters and controls data flow between ICSs. When an anomaly is detected in one ICS, the analyzer sends control data to that ICS to switch to pseudo normal mode, preventing the transmission of anomalous status data to other ICSs. This intermediary control mechanism maintains information exchange while blocking harmful data propagation.
Solution Approach 2:
The system takes preliminary anti-action by detecting anomalies and switching to pseudo normal mode before anomalous data can significantly affect other systems. The anomaly analyzer continuously monitors status data and preemptively controls the suspected ICS to transmit normal pattern data instead of potentially harmful anomalous data, thereby preventing harm before it occurs.
4Object-affected harmful factors
If ICS switches to pseudo normal mode, then impact on other systems is minimized, but data accuracy is reduced
Solution Approach 1:
When an ICS switches to pseudo normal mode, it changes the parameter of data transmission from real status data to synthesized normal pattern data. This parameter change minimizes the impact on other systems by providing clean, anomaly-free data. The system manages this trade-off by only activating pseudo normal mode when anomalies are detected, and switching back to real data transmission when normal operation is restored, thus maintaining data accuracy when possible while minimizing harm when necessary.
Data Source
AI summary
A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.