Industrial Control Intrusion Detection Through Process Timing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems for industrial control systems lack precision in detecting intrusions, particularly during vulnerability exploitation, privilege escalation, and persistence stages.
Innovation Solution
A method utilizing a trained data set that records and compares the duration of processes in an industrial control system against expected durations, based on multiple previous records, to detect anomalies indicating intrusions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing intrusion detection systems are used to monitor industrial control systems, then intrusion detection capability is provided, but detection precision is insufficient
Solution Approach 1:
The patent changes the detection parameter from binary security events to continuous process duration measurements. By monitoring how long processes take to complete and comparing against expected durations from training data, the system achieves more precise intrusion detection. This parameter transformation enables detection of subtle anomalies that traditional security event monitoring misses.
Solution Approach 2:
The system performs preliminary training by collecting process duration data during normal operation before actual intrusion detection begins. This training phase establishes baseline expected durations for various processes, which are then used to detect deviations indicating intrusions. The preliminary action of data collection and model training significantly improves subsequent detection precision.
2Measurement precision
If traditional security monitoring methods are applied, then basic intrusion detection is achieved, but precision during vulnerability exploitation, privilege escalation, and persistence stages is insufficient
Solution Approach 1:
The detection system serves itself by automatically learning normal process duration patterns during the training phase without requiring manual configuration of detection thresholds or rules. The system autonomously builds its detection model from observed data, reducing complexity while improving precision across different attack stages including vulnerability exploitation, privilege escalation, and persistence attempts.
3Measurement precision
If process duration monitoring is implemented for each process in every cycle, then intrusion detection precision is enhanced, but system overhead increases
Solution Approach 1:
The system applies monitoring selectively to processes that are relevant to intrusion detection rather than uniformly to all system processes. By focusing computational resources on critical processes and using efficient duration comparison against pre-computed expected values, the system achieves high detection precision while minimizing overhead and maintaining system execution efficiency.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A method (300) for detecting an intrusion into an industrial control system including an industrial control program and an industrial control device (510), which is configured for a cycle-based execution of the industrial control program, wherein the method (300, 5112) includes: providing (5114) a trained data set, which is trained based on multiple previous records including an identifier indicative of a respective process and a duration of the process, wherein the data set is configured to output an expected duration in response to a query including the identifier; performing (S200) for each process in each cycle (500): recording (S214) an identifier; recording (S212, 5228) a duration of the execution of the process; querying (S238) the recorded identifier to the data set; receiving (S240) from the data set an expected duration; and detecting (S244) an intrusion based on comparing (S242) the recorded duration with the expected duration.