ICS Anomaly Detection Using Process Invariants and Behavioral Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems for industrial control systems (ICS) are inadequate in detecting sophisticated cyberattacks due to their reliance on traditional network-centric defenses and are either limited to small plants or generate excessive false alarms in large, complex systems, failing to learn the behaviors of heterogeneous components.
Innovation Solution
A system and method that determines state variables and invariants based on system design, uses machine learning algorithms to construct behavioral models from historical data, and detects anomalies by comparing current measurements against predicted data to identify deviations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network-centric defense systems are used for anomaly detection in ICS, then unauthorized access can be prevented, but sophisticated cyberattacks can still evade detection and cause catastrophic damages
Solution Approach 1:
The system segments the ICS into multiple process zones and functional areas, creating decentralized anomaly detectors for each segment. This allows localized detection of cyberattacks without requiring a centralized defense system, enabling timely response to sophisticated attacks while maintaining system reliability.
Solution Approach 2:
The patent introduces process invariants as intermediary elements that mediate between the physical process and cyber defenses. These invariants serve as a bridge that translates physical process knowledge into detectable anomalies, allowing the system to detect cyberattacks that evade traditional network-centric defenses.
2Reliability
If design-centric anomaly detectors based on manual rules are deployed, then small plants can achieve adequate detection, but large complex systems generate excessive false alarms and cannot scale
Solution Approach 1:
The system creates a universal framework that combines design-centric process invariants with data-centric machine learning models. This multi-functional approach allows the same system to handle both small and large complex ICS deployments, achieving scalability while maintaining detection accuracy through the unified architecture.
Solution Approach 2:
The patent transforms static manual rules into dynamic adaptive models by changing the parameter representation from fixed thresholds to learned behavioral patterns. Machine learning models automatically adjust detection parameters based on historical data, enabling the system to scale from small to large plants without manual rule reconfiguration.
3Measurement precision
If data-centric anomaly detectors using machine learning are applied, then temporal dependencies can be captured, but the systems fail to learn behaviors of heterogeneous components and generate false alarms
Solution Approach 1:
The system merges design-centric process invariants with data-centric machine learning models into a hybrid architecture. This combination allows the system to capture temporal dependencies through machine learning while constraining false alarms using physical process knowledge from invariants, achieving both behavioral pattern recognition and reliability.
Solution Approach 2:
The patent implements feedback mechanisms where machine learning models continuously learn from detected anomalies and adjust their behavioral patterns. The system uses feedback from process invariants to validate machine learning predictions, reducing false alarms while improving behavioral pattern recognition for heterogeneous components.
Data Source
AI summary
An anomaly detection method includes determining state variables of an industrial control system based on a system design of the industrial control system; determining invariants governing the state variables based on the system design; receiving historical measurement data of the state variables of each invariant from the industrial control system; constructing a set of behavioural models for each invariant using a set of machine learning algorithms and the historical measurement data of the respective state variables, the behavioural models representing normal behaviour of the respective state variables; predicting measurement data of the state variables of each invariant using the behavioural models and the historical measurement data of the respective state variables; receiving current measurement data of the state variables during operation of the industrial control system; and detecting the anomalies based on deviations between the current measurement data and predicted measurement data of the state variables of each invariant.