PLC Anomaly Monitoring via External Forensic Plugins
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SCADA systems in cyber-physical environments face security vulnerabilities and resource constraints, limiting their ability to gather and retain information about lower-level monitoring of hardware components such as memory, routing tables, and temporary file systems, and are inadequate in detecting cyber-intrusions and performance anomalies.
Innovation Solution
A lightweight forensic toolkit is provided with a separate controller and plugin modules for monitoring PLCs, capable of detecting anomalies by comparing data to learned behavior patterns, minimizing processing impact on the cyber-physical environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional SCADA system is used to monitor PLCs, then basic monitoring functions are provided, but security vulnerabilities increase and the ability to monitor lower-level hardware components deteriorates
Solution Approach 1:
The monitoring system is divided into separate functional modules: a data collection module that interfaces with PLCs, a separate analysis server that performs forensic analysis, and plugin modules for specific monitoring tasks. This segmentation isolates the complex security monitoring functions from the operational PLC system, reducing security vulnerabilities while maintaining monitoring capability.
Solution Approach 2:
A separate controller or analysis server acts as an intermediary between the PLCs and the monitoring interface. This intermediary captures and analyzes data without requiring direct access to PLC memory or file systems, reducing security risks while enabling comprehensive monitoring of lower-level hardware components.
2Loss of information
If comprehensive monitoring of lower-level hardware components is implemented, then forensic information capability improves, but resource constraints and processing performance impact worsen
Solution Approach 1:
The system extracts and captures volatile data (memory contents, routing tables, temporary files) from PLCs and stores them externally on the monitoring server. This extraction allows comprehensive forensic information retention without consuming PLC resources, as the data is captured and stored outside the constrained PLC environment.
Solution Approach 2:
The system performs preliminary data capture and caching of volatile information before it is overwritten or lost. By proactively capturing memory contents, network routing tables, and temporary files in real-time or near-real-time, the system preserves forensic information without requiring continuous heavy processing during analysis.
3Measurement precision
If volatile data from memory and file systems is captured, then measurement precision of system state improves, but the extent of automation and system overhead worsen
Solution Approach 1:
The system creates copies of volatile data (memory dumps, file system contents, network routing tables) for analysis rather than directly accessing or modifying the original PLC data. These copies provide precise measurement of system state while minimizing automation overhead, as the copying process is lightweight and non-intrusive.
4Productivity
If a lightweight monitoring approach is used, then system performance impact is minimized, but the quantity of monitored information deteriorates
Solution Approach 1:
The monitoring system is designed with universal plugin modules that can monitor multiple aspects of PLC operation (memory, network, file systems, registers) through a single lightweight architecture. This multi-functionality allows comprehensive monitoring of diverse data types without requiring separate heavy-duty monitoring systems for each function.
Data Source
AI summary
An anomaly monitoring system for a cyber-physical environment having at least one programmable logic controller (PLC) and a monitored component, the monitoring system having a human machine interface, a separate controller with at least a processor and associated memory, and providing a communication network for electronic communication between components of the cyber-physical environment, the anomaly monitoring system providing at least one plugin module to monitor the performance of the component and the PLC, as provided through the communication network through a PLC data collection module, the plugin comparing the data from the PLC data collection module to a model of learned behavior patterns, and thereby classify reviewed data as being normal or anomaly events.