State Transition Model for Industrial Control Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems in industrial control systems are ineffective against sophisticated attacks like Stuxnet, where an attacker takes over a server and mixes attack communication with normal communication, evading white-list type countermeasures, and cannot block unauthorized communication even when vulnerability in permitted applications is exploited.
Innovation Solution
A data determination apparatus that uses a state transition model and communication permission list to determine whether communication data is permitted based on the current operating state, allowing for detection of unauthorized communications and blocking of abnormal communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a white-list type countermeasure is adopted to permit only predefined communications, then known attacks can be detected, but sophisticated attacks like Stuxnet that mix attack communication with normal communication can evade detection
Solution Approach 1:
The patent applies dynamics by transitioning from a static white-list approach to a dynamic state transition model. The system continuously updates its understanding of normal communication patterns based on observed states, allowing it to adapt to and detect sophisticated attacks that mix malicious traffic with legitimate communication sequences.
Solution Approach 2:
The patent implements preliminary action by pre-defining multiple possible communication states and transition rules between them. This preparation allows the system to quickly identify anomalies when actual communication deviates from the expected state transitions, enabling detection of both known and unknown attacks.
2Ease of operation
If communication is permitted based on predefined sequences and states, then normal operations are controlled, but unauthorized communications through taken-over servers cannot be blocked
Solution Approach 1:
The patent implements feedback by continuously monitoring communication flows and comparing them against the state transition model. When deviations are detected, the system provides feedback to block unauthorized communications while maintaining normal operations, thus achieving both ease of operation and security against takeover attacks.
3Reliability
If application-level communication permission is enforced, then unauthorized programs are detected, but vulnerabilities in permitted applications cannot be exploited
Solution Approach 1:
The patent applies another dimension by moving from application-level security checks to a communication sequence and state-based security model. This dimensional shift allows the system to detect and block attacks that exploit vulnerabilities in permitted applications by analyzing the temporal and contextual patterns of communication rather than just the application identity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data determination apparatus of the present invention includes a state transition model storage unit (130) to store a state transition model (1031) representing a state transition, a state management unit (103) to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit (105) to store, as a communication permission list (114), communication permitted data whose communications are permitted in respective operating states, a communication unit (107) to obtain communication determination data (109), and a determination unit (106) to determine whether or not the communication determination data (109) is communication permitted data whose communication has been permitted in a current operating state (113), using the current operating state (113) and the communication permission list (114).