PLC Access Event Detection for Unauthorized Network Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing programmable logic controllers (PLCs) are vulnerable to unauthorized access events, such as Denial of Service attacks, which can lead to malfunction and data integrity issues, as conventional security measures do not address access events unrelated to PLC vulnerabilities.
Innovation Solution
A programmable controller system that includes communication means, training means for identifying exceptional access events, detection means for detecting such events, and processing means to handle them, utilizing a distributed ledger and machine learning to identify and respond to infrequent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security measures are used to protect PLCs, then basic vulnerability protection is achieved, but the system remains vulnerable to unauthorized access events such as DoS attacks
Solution Approach 1:
The system performs preliminary action by training the machine learning model in advance using historical access event data before deployment. The model learns normal access patterns beforehand, enabling it to automatically identify exceptional events without requiring complex rule-based security configurations during operation.
Solution Approach 2:
The security system performs self-service by automatically detecting and responding to unauthorized access events without human intervention. The machine learning model autonomously analyzes access events, identifies exceptions, and triggers appropriate responses, eliminating the need for manual security monitoring and complex configuration management.
2Reliability
If all access events are allowed without differentiation, then system accessibility is maintained, but unauthorized access can occur
Solution Approach 1:
The system applies local quality by differentiating between normal and exceptional access events based on their specific characteristics. Instead of treating all access events uniformly, the machine learning model analyzes individual event properties to identify anomalies, allowing selective security responses tailored to each event type.
Solution Approach 2:
The system utilizes parameter changes by monitoring variations in access event parameters such as frequency, source, and pattern. The machine learning model detects deviations from normal parameter ranges, enabling automatic identification of unauthorized access attempts while maintaining ease of operation through automated threshold-based detection.
3Measurement precision
If a machine learning model is implemented to detect exceptional access events, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system applies partial action by focusing computational resources only on detecting exceptional events rather than analyzing every access event in detail. The machine learning model quickly identifies anomalies and triggers detailed analysis only when needed, reducing overall processing time while maintaining high detection accuracy for unauthorized access.
Solution Approach 2:
The system performs preliminary action by pre-training the machine learning model offline using historical data before deployment. This preliminary training phase enables the model to rapidly classify new events during operation without requiring extensive real-time computational resources, thus reducing processing time while maintaining detection accuracy.
Data Source
AI summary
A programmable logic controller includes a communicator that receives an access event from an external device and performing communication through a network (NW), a trainer that trains a model to identify an exceptional access event occurring less frequently than other access events based on a history of access events received by the communicator, a detector that detects the exceptional access event from a new access event received by the communicator using the model trained by the trainer, and a processor that processes the exceptional access event detected by the detector.