Non-Intrusive Sensor Corroboration for SCADA Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SCADA systems in industrial settings are difficult and costly to design, implement, and modify, and are vulnerable to cyber attacks, lacking real-time, independent verification mechanisms to detect system compromises or anomalies.
Innovation Solution
The System for Process Abnormality Recognition and Corroboration (SPARC) uses a network of non-intrusive sensors to independently verify data from SCADA systems, identifying process anomalies and providing real-time monitoring and early warnings through machine-learning modeling, thus creating an additional layer of defense against cyber threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If SCADA systems are used to control industrial processes, then automation and remote control capabilities are improved, but vulnerability to cyber attacks and lack of independent verification worsen
Solution Approach 1:
The patent introduces an intermediary verification system that acts as a mediator between the SCADA system and the physical process. This system uses independent sensors and machine learning models to verify SCADA data without directly controlling the process, providing security verification while maintaining automation. The intermediary nature allows it to monitor for anomalies without interfering with normal SCADA operations.
Solution Approach 2:
The verification system is segmented into independent components: non-intrusive sensors, data processing modules, and machine learning anomaly detection models. This segmentation allows the verification function to operate independently from the control function, enabling security monitoring without compromising the automated control capabilities of the SCADA system.
2Reliability
If traditional SCADA modification is implemented to improve security, then system reliability is improved, but deployment time and cost worsen
Solution Approach 1:
Instead of modifying the existing SCADA system, the patent creates a separate copy/replica of the verification functionality using machine learning models that replicate normal system behavior. This copying approach allows security verification to be added without altering or reconfiguring the existing SCADA infrastructure, enabling rapid deployment without lengthy modification processes.
Solution Approach 2:
The machine learning models are trained to autonomously learn normal system patterns and automatically detect anomalies without requiring manual configuration or expert intervention. This self-service capability eliminates the need for time-consuming system modifications and allows the security verification system to be deployed quickly and adapted automatically to different processes.
3Adaptability or versatility
If non-intrusive sensors are deployed for independent verification, then system adaptability and rapid deployment are improved, but system complexity worsens
Solution Approach 1:
The verification system uses universal machine learning models and standardized sensor interfaces that can be applied across different industrial processes and SCADA systems. This multi-functionality allows the same verification architecture to adapt to various applications without requiring process-specific customization, simplifying deployment while maintaining adaptability to different industrial contexts.
Data Source
AI summary
A system includes a plurality of non-intrusive sensors, an access point device, and a computing device. The non-intrusive sensors are configured to monitor activities associated with one or more devices, wherein at least one non-intrusive sensor of the plurality of non-intrusive sensors is positioned within a physical vicinity of the one or more devices. The access point device is communicatively coupled to the plurality of non-intrusive sensors, wherein the access point device is configured to receive data associated with the monitored activities from the plurality of non-intrusive sensors and further to transmit the data associated with the monitored activities to a computing device for processing. The computing device is configured to receive the data associated with the monitored activities and process the data to determine an anomaly associated with the one or more devices.