EM Emanation Sampling for Noisy Control System Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing EM-based anomaly detection methods in industrial control systems (ICSs) are ineffective in noisy environments, leading to unpredictable results due to environmental noise, which degrades the predictive accuracy of anomaly detection techniques.
Innovation Solution
A monitoring system that uses an electromagnetic (EM) probe, amplifier, and control circuitry to generate and amplify EM emanations signals from a processor, sampling these signals at a rate greater than the processor's clock frequency to detect behavior anomalies, with noise elimination techniques like singular value decomposition (SVD) improving accuracy in noisy conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If EM-based anomaly detection is used in industrial control systems, then behavior anomalies can be detected, but environmental noise degrades predictive accuracy and leads to unpredictable results
Solution Approach 1:
The patent converts the harmful environmental noise into a beneficial filtering mechanism by using singular value decomposition (SVD) to separate the signal subspace from the noise subspace. The noise, which initially degrades detection accuracy, is transformed into identifiable singular values that can be mathematically isolated and removed, thereby converting the harmful noise factor into a useful component for enhancing detection precision.
Solution Approach 2:
The patent introduces singular value decomposition (SVD) as an intermediary mathematical technique between the EM signal and the anomaly detection process. This intermediary method acts as a mediator that processes the noisy EM signals, separates them into signal and noise components, and provides a cleaned signal for accurate anomaly detection, thereby resolving the contradiction between noise presence and detection accuracy.
2Measurement precision
If sampling rate is increased to detect minimal code-injection attacks, then detection accuracy improves, but system complexity and resource requirements increase
Solution Approach 1:
The patent replaces the purely mechanical/electronic approach of high-rate sampling with a mathematical signal processing approach using singular value decomposition. Instead of relying solely on increasing sampling rate to achieve detection accuracy, the system uses SVD to extract meaningful signals from noisy data, thereby reducing the burden on sampling hardware complexity while maintaining high detection accuracy for minimal code-injection attacks.
3Measurement precision
If sampling rate is increased to at least eight times the CPU clock frequency, then anomaly detection accuracy improves, but energy consumption and computational load increase
Solution Approach 1:
The patent changes the parameter of signal processing approach from direct high-rate sampling analysis to singular value decomposition-based analysis. By transforming the problem into the singular value domain, the system can achieve high detection accuracy with more efficient computational methods, thereby reducing the energy consumption associated with continuous high-rate sampling and processing while maintaining the ability to detect anomalies at eight times the CPU clock frequency.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
The system achieves high accuracy in detecting minimal code-injection attacks, even in extremely noisy environments, with sampling rates at least eight times the CPU clock frequency and noise reduction methods enabling near-perfect detection of anomalies, maintaining awareness and allowing precise mitigation of cyber-attacks.
Implementation Method 1
The EM probe is configured to generate an emanations signal responsive to EM emanations from a processor
Implementation Method 2
The amplifier is configured to generate an amplified emanations signal responsive to the emanations signal
Data Source
AI summary
Detection of behavior anomalies in control systems and related systems. methods. and devices is disclosed. A method of detecting behavior anomalies in a control system includes probing emanations from a processor controlling at least a portion of the control system to provide an emanations signal. amplifying the emanations signal to provide an amplified emanations signal. and sampling the amplified emanations signal using a sampling rate that is greater than a clock frequency of a processor clock of the processor to provide samples. The method also includes determining whether or not the processor is exhibiting a behavior anomaly responsive to the samples.