Resilient Decision Manifolds for Industrial Control Cyberattacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems connected to the Internet are increasingly vulnerable to cyber-attacks, which can disrupt operations and cause catastrophic damage, as they rely on data-based methods for decision-making and are susceptible to attacks on their detection processes and decision manifolds.
Innovation Solution
A system that includes a detection and neutralization module with a decision manifold capable of generating a resilient decision manifold by separating normal and abnormal operating spaces, detecting inadequacies in the detection model, and neutralizing threats through a projected adversary strategy, thereby creating a protective barrier against cyber-attacks and faults.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If industrial control systems are connected to the Internet for data-based decision-making, then productivity and adaptability are improved, but vulnerability to cyber-attacks increases
Solution Approach 1:
The patent introduces a decision manifold as an intermediary layer between the control system and external data sources. This manifold learns the underlying decision logic and serves as a mediator that can detect and neutralize adversarial attacks before they reach the core control system, thereby maintaining both Internet connectivity and security
Solution Approach 2:
The system performs preliminary training of the decision manifold using legitimate training data before deployment. This preliminary action establishes a baseline understanding of normal decision-making patterns, enabling the system to detect deviations caused by cyber-attacks in real-time operation
2Device complexity
If traditional detection models are used to identify abnormal operations, then device complexity is reduced, but measurement precision and reliability deteriorate under adversarial attacks
Solution Approach 1:
The patent transforms the detection approach by changing the parameter space from direct signal analysis to manifold distance analysis. By measuring the distance of operating points from the learned decision manifold, the system achieves high detection precision while maintaining relatively simple implementation through distance calculations
3Adaptability or versatility
If the decision manifold is updated with new data to improve adaptability, then versatility is improved, but reliability deteriorates due to potential contamination with adversarial data
Solution Approach 1:
The system implements a feedback mechanism where the decision manifold continuously monitors incoming data and compares it against the learned decision boundary. When adversarial data is detected (points falling outside the manifold or showing anomalous patterns), the system provides feedback to reject or correct this data before it can contaminate the training set, thus maintaining reliability while allowing legitimate updates
Data Source
AI summary
According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a decision manifold of a control system for an industrial asset, comprising: a detection and neutralization module including: a decision manifold having a receiver configured to receive a training dataset comprising data, wherein the decision manifold is operative to generate a first decision manifold with the received training dataset; and a detection model; a memory for storing program instructions; and a detection and neutralization processor, coupled to the memory, and in communication with the detection and neutralization module and operative to execute program instructions to: receive the first decision manifold, wherein the first decision manifold separates a normal operating space from an abnormal operating space; determine whether there are one or more inadequacies with the detection model; generate a corrected decision manifold based on the determined one or more inadequacies with the detection model; receive a projected adversary strategy; generate a resilient decision manifold based on the corrected decision manifold and received projected adversary strategy; and an output configured to output a neutralized signal to operate the industrial asset via the control system. Numerous other aspects are provided.