Cyber Attack Classification for Industrial Assets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial asset control systems connected to the Internet are vulnerable to cyber-attacks, with existing fault detection and isolation methods limited in addressing multiple simultaneous attacks and distinguishing between independent and dependent attacks, which can lead to inaccurate threat detection and potential catastrophic damage.
Innovation Solution
A system that generates monitoring node feature vectors from real-time signal values, compares them to decision boundaries to classify attacks as independent or dependent, and updates decisions based on new signal values, enabling automatic and accurate threat detection and classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional FDIA approaches are used to detect attacks, then single sensor faults can be detected, but multiple simultaneous attacks cannot be accurately distinguished and classified
Solution Approach 1:
The patent segments the attack detection problem into two distinct classification tasks: independent attack classification and dependent attack classification. By dividing the complex problem of detecting multiple simultaneous attacks into separate manageable segments, the system can accurately identify and classify different attack types using separate machine learning models trained on specific attack patterns.
Solution Approach 2:
The patent introduces decision boundaries as intermediary elements that mediate between raw sensor data and attack classification. These decision boundaries serve as intermediate representations that capture the essential characteristics of normal vs. attacked states, enabling the system to accurately distinguish between multiple simultaneous attacks by comparing sensor readings against pre-established decision boundaries.
2Device complexity
If a single decision model is used for attack classification, then the system is simpler, but the accuracy in distinguishing independent vs. dependent attacks decreases
Solution Approach 1:
The patent segments the classification system into two distinct decision models: one for independent attack classification and another for dependent attack classification. This segmentation allows each model to be specialized and optimized for its specific task, improving overall classification accuracy while maintaining manageable system complexity through modular architecture.
Solution Approach 2:
The patent applies local quality by training different decision models with different sets of inputs tailored to specific attack types. The independent attack classifier uses features optimized for detecting standalone attacks, while the dependent attack classifier uses features optimized for detecting cascading attacks, allowing each part of the system to have the quality needed for its specific function.
3Speed
If real-time attack classification is performed without updating decisions, then processing is faster, but accuracy deteriorates as new attack patterns emerge
Solution Approach 1:
The patent implements continuous useful action by systematically updating attack classification decisions as new sensor data becomes available. Rather than performing single static classifications, the system continuously monitors sensor readings, updates attack status determinations, and maintains current attack classifications, ensuring both real-time responsiveness and sustained accuracy throughout the monitoring period.
Data Source
AI summary
Streams of monitoring node signal values over time, representing a current operation of the industrial asset, are used to generate current monitoring node feature vectors. Each feature vector is compared with a corresponding decision boundary separating normal from abnormal states. When a first monitoring node passes a corresponding decision boundary, an attack is detected and classified as an independent attack. When a second monitoring node passes a decision boundary, an attack is detected and a first decision is generated based on a first set of inputs indicating if the attack is independent/dependent. From the beginning of the attack on the second monitoring node until a final time, the first decision is updated as new signal values are received for the second monitoring node. When the final time is reached, a second decision is generated based on a second set of inputs indicating if the attack is independent/dependent.