Cyber-Attack Detection in Industrial Control Systems

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods fail to automatically and accurately detect cyber-attacks at the domain layer where sensors, controllers, and actuators are located, especially when multiple attacks occur simultaneously, and stealthy attacks may not be readily detectable, leading to potential catastrophic damage to industrial control systems.

Innovation Solution

A system that generates current monitoring node values to create feature vectors, which are used by an attack detection model with decision boundaries to transmit alert signals, enabling automatic and accurate detection of cyber-attacks by distinguishing between normal and attacked operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If current monitoring methods are used to detect cyber-attacks, then the system can identify obvious attacks, but stealthy attacks and multiple simultaneous attacks cannot be accurately detected

Engineering Contradiction:
Improveattack detection accuracyVSAvoiddetection reliability under multiple attacks
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The system segments the attack detection problem by creating separate decision boundaries for different attack scenarios. Multiple decision boundaries are established in the feature space, each corresponding to different attack types and conditions, allowing the system to accurately classify and detect multiple simultaneous attacks without confusion

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system transforms the detection problem from a single-dimensional threshold comparison to a multi-dimensional feature space analysis. By mapping monitoring data into a comprehensive feature vector that includes multiple dimensions (signal values, rates of change, correlations across sensors), the system can distinguish stealthy attacks that would be invisible in single-dimensional monitoring

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

2Device complexity

If traditional anomaly detection methods are used, then the system can operate with simple monitoring, but false positive rates increase during rapid transients

Engineering Contradiction:
Improvemonitoring system simplicityVSAvoidfalse positive rate
Core Design Contradiction:
Device complexityVSReliability

Solution Approach 1:

The system dynamically adapts the decision boundaries based on the current operating state of the industrial asset. During rapid transients, the decision boundaries automatically adjust to account for expected signal variations, preventing false alarms while maintaining sensitivity to actual attacks. This dynamic adaptation allows the system to maintain high reliability without requiring overly complex static monitoring rules

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system incorporates feedback mechanisms where detection results and system state information are continuously used to refine decision boundaries. The decision boundaries are updated based on historical data and current operating conditions, allowing the system to learn from past false positives and improve its accuracy over time without increasing operational complexity

Inventive Principle:
Principle #23Feedback

3Adaptability or versatility

If multiple monitoring nodes are used to improve detection coverage, then the system can detect more attack types, but the complexity of analyzing multiple simultaneous attacks increases

Engineering Contradiction:
Improvedetection coverageVSAvoidanalysis complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system merges data from multiple monitoring nodes into a unified feature vector representation. By combining signals from multiple sensors and monitoring points into a single comprehensive feature space, the system maintains wide detection coverage while simplifying the analysis process. The merged feature vector allows simultaneous evaluation of all monitoring nodes without requiring complex individual analysis of each node

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The feature vector serves as an intermediary that transforms complex multi-node monitoring data into a standardized format suitable for decision boundary evaluation. This intermediary representation layer simplifies the relationship between multiple monitoring nodes and the detection logic, making the system easier to analyze and maintain while preserving the ability to detect diverse attack types

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3515040B1Reliable cyber-threat detection in rapidly changing environments
Publication Date: 2023.03.29 GE INFRASTRUCTURE TECH LLC
  • EP3515040B1 patent drawingFigure 1
  • EP3515040B1 patent drawingFigure 2
  • EP3515040B1 patent drawingFigure 3

AI summary

In some embodiments, a plurality of monitoring nodes (110) each generate a series of current monitoring node (110) values over time that represent a current operation of the industrial asset. An attack detection computer platform (150) may receive the series of current monitoring node (110) values and generate a set of current feature vectors including a current feature for capturing transients (e.g., local transients and/or global transients). The attack detection computer platform (150) may also access an attack detection model (155) having at least one decision boundary that was created using at least one of a set of normal feature vectors and/or a set of attacked feature vectors. The attack detection model (155) may then be executed such that an attack alert signal is transmitted by the attack detection computer platform (150), when appropriate, based on the set of current feature vectors (including the current feature to capture transients) and the at least one decision boundary.