Industrial Control Intrusion Detection Using SSA Signal Subspaces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems in industrial control systems face challenges in detecting sophisticated attacks due to the inability to capture critical correlations between process variables and are susceptible to evasion attacks, with univariate methods failing to detect correlations and multivariate methods experiencing performance degradation.
Innovation Solution
A system and method that utilizes Singular Spectrum Analysis (SSA) to generate projection matrices, aggregation matrices, and decision boundaries, processing real-time sensor measurements to map lag vectors into noise-free signal subspaces, aggregate them, and compute departure scores using decision boundaries to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If univariate IDS approaches are used to analyze each process variable independently, then the system is simpler to implement, but it fails to detect critical correlations between PVs, leaving systems vulnerable to sophisticated attacks
Solution Approach 1:
The patent combines multiple process variables into a multivariate analysis framework, merging individual PV analyses into a unified detection system that captures correlations between variables while maintaining manageable complexity through structured aggregation methods
2Measurement precision
If multivariate IDS methods are used to capture correlations between PVs, then detection accuracy improves, but the system becomes susceptible to evasion attacks and performance degradation due to inclusion of uncorrelated PVs
Solution Approach 1:
The patent applies local quality by differentiating between correlated and uncorrelated process variables, assigning different weights and aggregation methods to different PV groups based on their correlation characteristics, thereby maintaining high detection accuracy while filtering out noise from uncorrelated variables
Solution Approach 2:
The system dynamically adjusts aggregation parameters and decision thresholds based on the specific correlation structure of the process variables being monitored, adapting the detection sensitivity to match the underlying process dynamics and reduce vulnerability to evasion attacks
3Reliability
If process-level IDS analyzes physical process behaviors and sensor data to detect anomalies, then defense-in-depth is increased, but real-time processing becomes challenging due to the dynamic nature of sensor data
Solution Approach 1:
The patent segments the sensor data processing into distinct stages: data collection, correlation analysis, anomaly detection, and response generation. This segmentation allows real-time processing by handling each stage independently with appropriate time scales and computational resources
Solution Approach 2:
The system performs preliminary aggregation and correlation analysis on sensor data before full anomaly detection is required, pre-processing the data to reduce computational burden during critical real-time detection phases and improve overall processing efficiency
Data Source
AI summary
The present invention discloses a method and system for detecting intrusion in industrial control systems. The method comprises generating predetermined parameters for detection, including projection matrices, aggregation matrices, and decision boundaries, receiving real-time sensor measurements from a plurality of sensors, generating a plurality of lag vectors from the received sensor measurements, mapping the lag vectors into a noise-free signal subspace using the predetermined projection matrices, aggregating the mapped lag vectors into an aggregated signal subspace using an aggregation function, wherein the aggregation function is generated using the generated predetermined aggregation matrices, computing a plurality of departure scores using the predetermined decision boundaries, aggregating the plurality of departure scores to perform a smoothing on the aggregated departure scores and generating an alert when the smoothed departure score exceeds a predetermined threshold.