PLC and External Sensor Analytics for ICS Data Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to comprehensively detect anomalies in industrial control systems (ICS) due to the complexity of factory systems and noise in sensor measurements, making it difficult to ensure data integrity and detect cyber-physical attacks, especially when external sensors may not measure the same quantities as internal sensors.
Innovation Solution
The implementation of an AI-powered system that utilizes time series machine learning to analyze data from multiple sources, including PLCs and external sensors, to detect complex operation patterns over time, enabling the identification of new states and potential security incidents by comparing probabilistic representations of PLC and external sensor data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ICS security methods (network traffic analysis, protocol inspection) are used, then detection of obvious attacks is possible, but complex cyber-physical attacks involving data manipulation remain undetected
Solution Approach 1:
The patent combines multiple data sources (PLC internal sensors, external sensors, network traffic data) into a unified monitoring system that cross-validates information to detect sophisticated attacks that would evade single-source detection methods
Solution Approach 2:
The system introduces an AI-based intermediary layer that analyzes correlations between PLC data and external sensor data, acting as a mediator to detect anomalies without requiring direct modification of the existing ICS infrastructure
2Loss of information
If external sensors are added to monitor ICS, then additional data sources for anomaly detection are available, but integration complexity and data correlation difficulties increase
Solution Approach 1:
The system transforms external sensor data into probabilistic representations that match the format and characteristics of PLC internal sensor data, enabling direct comparison and correlation without complex integration of heterogeneous data formats
Solution Approach 2:
The patent replaces manual data correlation methods with AI-based probabilistic analysis that automatically identifies relationships between external sensor readings and PLC internal states, eliminating the need for manual configuration of data mappings
3Measurement precision
If sensor noise filtering is applied to improve measurement accuracy, then data quality improves, but detection of subtle anomalies may be reduced
Solution Approach 1:
The system applies selective filtering only to known noise patterns while preserving signal components that match expected operational variations, using AI to distinguish between benign noise and malicious anomalies based on contextual patterns
4Reliability
If AI-based probabilistic analysis is implemented, then detection of complex attack patterns improves, but computational requirements and processing time increase
Solution Approach 1:
The system pre-computes probabilistic models of normal operational patterns during system setup and training phases, enabling real-time detection to rely on comparing current readings against pre-established baselines rather than performing complex analysis on every data point
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The application relates to a method, program and apparatus executing the following steps: for a state of a factory determined from current operating conditions of the factory: receiving streaming Programmable Logic Controller (PLC) values (205) from PLCs on a network of the factory, and streaming external sensor (206) values from sensors in the factory connected externally to the network; conducting probabilistic analytics on the streaming PLC values and streaming external sensor values against historical PLC values and historical sensor values associated with the state of the factory; and for the probabilistic analytics indicative of the streaming PLC values being within expectation for the state, and the streaming external sensor values not being within expectation for the state, providing an indication of a security incident (207).