PLC Scan Cycle Signature Monitoring for Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Programmable logic controllers (PLCs) in industrial control systems lack robust security measures, making them vulnerable to malicious attacks that can disrupt critical infrastructure, despite their importance in ensuring the reliability and real-time operations of industrial processes.

Innovation Solution

A method is introduced to collect and analyze scan cycle times of PLC programs, comparing them to a baseline signature to detect deviations and potentially malicious reprogramming, using statistical analysis and machine learning techniques to generate and compare operational parameters, and implementing a proof of work function to verify the integrity of PLC operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security measures are implemented in PLCs, then security is improved, but device complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The PLC performs self-monitoring of its own scan cycle times and compares them against baseline values to detect anomalies. The system automatically generates alerts when deviations are detected, enabling the device to monitor and protect itself without requiring external security infrastructure.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system monitors changes in scan cycle time parameters and compares them against established baseline parameters. By detecting parameter deviations rather than implementing complex security protocols, the system achieves security through simple parameter comparison that maintains PLC operational characteristics.

Inventive Principle:

Principle #35Parameter changes

2Reliability

If frequent patching is performed to address software vulnerabilities, then security is improved, but productivity decreases due to downtime

Engineering Contradiction:

ImprovesecurityVSAvoidproductivity

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system establishes baseline scan cycle time parameters during a training period before deployment. This preliminary characterization of normal operation enables the PLC to detect anomalies without requiring subsequent patching or intervention, allowing continuous operation without productivity loss.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The anomaly detection system operates continuously alongside normal PLC operations without interrupting the control process. The monitoring occurs in the background, and alerts are generated without requiring system shutdown or patching, maintaining continuous productive operation.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If strong cryptography is implemented, then security is improved, but resource consumption increases beyond PLC capabilities

Engineering Contradiction:

ImprovesecurityVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system uses lightweight, computationally inexpensive scan cycle time measurements instead of resource-intensive cryptographic protocols. The security mechanism relies on simple temporal parameter collection and comparison that consumes minimal processing power and memory, suitable for resource-constrained PLC environments.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The patent replaces cryptographic security mechanisms with a behavioral monitoring approach based on temporal parameter analysis. Instead of using mathematical cryptography, the system substitutes a physics-based measurement of execution time that is inherently tied to the actual program running on the PLC.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Reliability

If basic security functions are implemented in PLCs, then security is improved, but ease of operation decreases

Engineering Contradiction:

ImprovesecurityVSAvoidease of operation

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The PLC automatically performs baseline comparison and anomaly detection without requiring user configuration or intervention. The system self-manages the security monitoring process, generating alerts automatically when anomalies are detected, thereby maintaining ease of operation while implementing security.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The anomaly detection system leverages existing PLC scan cycle functionality for dual purposes: normal control operations and security monitoring. By reusing existing operational parameters and processes, the system implements security without adding separate operational complexity or requiring new user interactions.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10986107B2Systems and methods for detecting anomalous software on a programmable logic controller

Publication Date: 2021.04.20 GEORGIA TECH RES CORP

AI summary

There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.