PLC Anomaly Detection via Scan Cycle Baseline Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programmable logic controllers (PLCs) in industrial control systems lack robust security measures, making them vulnerable to attacks that can disrupt critical infrastructure, despite their importance in ensuring the reliability and real-time operations of industrial processes.
Innovation Solution
A method and system for detecting endpoint security threats in PLCs by establishing a baseline program signature based on scan cycle times and operational parameters, using statistical analysis and machine learning techniques, and implementing a proof of work function to verify the integrity of PLC operations, which alerts users to deviations and allows for responsive actions such as shutting down or reprogramming the PLC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented in PLCs, then security defense capability is improved, but device complexity increases
Solution Approach 1:
The security system is segmented into multiple independent components: a monitoring device that collects operational data, a baseline signature database stored in memory, and an analysis module that compares current operations against baselines. This segmentation allows security functionality to be added without fundamentally redesigning the PLC architecture, thereby improving security while managing complexity through modular design.
Solution Approach 2:
Baseline program signatures are established in advance during a training phase before actual security monitoring begins. These baselines capture normal operational patterns including scan cycle times and operational parameters. By performing this preliminary characterization, the system prepares detection criteria beforehand, enabling real-time security monitoring without adding computational complexity during critical operational phases.
2Measurement precision
If real-time monitoring is implemented, then detection capability is improved, but use of energy increases
Solution Approach 1:
The monitoring system collects only specific operational parameters necessary for detection rather than all possible PLC data. Focus is placed on key indicators such as scan cycle times and critical operational parameters that, when monitored, provide sufficient detection capability without the energy overhead of comprehensive real-time monitoring of all system states.
Solution Approach 2:
Instead of performing complex real-time analysis of raw operational data, the system creates simplified copies or representations of normal operational patterns in the form of baseline signatures. These signatures are stored in memory and used for comparison, enabling detection through simple pattern matching rather than computationally intensive real-time analysis, thereby reducing energy consumption while maintaining detection precision.
3Reliability
If PLCs are patched frequently to address vulnerabilities, then security is improved, but productivity decreases
Solution Approach 1:
The system performs preliminary characterization of normal operational patterns during a training phase before deployment. This baseline establishment captures the PLC's operational behavior under normal conditions. By preparing this reference data in advance, the system enables continuous security monitoring without requiring interruptions for updates or reconfiguration, thus maintaining productivity while improving security through persistent anomaly detection.
Solution Approach 2:
The monitoring system operates autonomously by continuously comparing current PLC operations against stored baseline signatures and automatically generating security alerts when anomalies are detected. This self-service capability eliminates the need for manual intervention, frequent patching, or system interruptions, thereby maintaining high productivity while providing ongoing security protection through automatic anomaly detection and alerting.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.