Embedded PLC Intrusion Detection for Edge Attack Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems lack effective intrusion detection at the edge controllers, making them vulnerable to cyberattacks that can compromise the entire system, as main computer-based IDSs are ineffective when compromised.
Innovation Solution
An embedded intrusion detection system (IDS) in programmable logic controllers (PLCs) that detects anomalies in network traffic and device operations, uses a peer-to-peer network for information sharing, incorporates LSTM neural networks for integrity prediction, and employs clustering algorithms and state estimators to identify and mitigate attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If intrusion detection system is located in main computer, then centralised security monitoring is achieved, but system security deteriorates when main computer is compromised
Solution Approach 1:
The patent divides the intrusion detection capability into two levels: a centralized IDS in the main computer for overall security monitoring, and embedded IDS modules in each edge controller for local security enforcement. This segmentation ensures that compromise of the main computer does not disable security at the edge controllers, as each operates independently to verify message authenticity.
Solution Approach 2:
The embedded IDS in edge controllers performs preliminary security verification by checking the authenticity of incoming messages from the main computer before executing control actions. This preliminary check prevents compromised messages from affecting physical processes, even if the main computer is later compromised.
2Device complexity
If edge controllers lack security features, then device simplicity is maintained, but vulnerability to cyberattacks increases
Solution Approach 1:
The embedded IDS in edge controllers enables each controller to perform self-security verification by independently checking the authenticity of incoming messages using cryptographic signatures. This self-service capability allows edge controllers to protect themselves without requiring complex external security infrastructure, maintaining simplicity while enhancing security.
3Reliability
If embedded IDS is added to edge controllers, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a lightweight cryptographic intermediary mechanism where the main computer signs messages with a private key, and edge controllers verify these signatures using the corresponding public key. This intermediary approach provides robust security without requiring complex security software or hardware in the edge controllers, as the cryptographic verification is computationally efficient and can be implemented with minimal resources.
Data Source
AI summary
An intrusion detection system can be embedded in an industrial controller to detect an attack on an industrial control system. The intrusion detection system can detect an attack by determining if there are anomalies related to the network traffic in the industrial control system and/or by determining if the devices (e.g., sensors and actuators) connected to the industrial controllers of the industrial control system are not operating within expected ranges. To assist in determining if the devices of the industrial control system are not operating properly, the industrial controllers can also be networked together in a peer-to-peer network that permits each industrial controller to share its state information with the other industrial controllers.