State Transition Model for Industrial Control Intrusion Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional intrusion detection systems in industrial control systems are ineffective against sophisticated attacks like Stuxnet, where an attacker takes over a server and mixes attack communication with normal communication, evading white-list type countermeasures, and cannot block unauthorized communication even when vulnerability in permitted applications is exploited.

Innovation Solution

A data determination apparatus that uses a state transition model and communication permission list to determine whether communication data is permitted based on the current operating state, allowing for detection of unauthorized communications and blocking of abnormal communications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a white-list type countermeasure is adopted to permit only predefined communications, then known attacks can be detected, but sophisticated attacks like Stuxnet that mix attack communication with normal communication can evade detection

Engineering Contradiction:
Improvedetection capabilityVSAvoidability to detect unknown attacks
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies dynamics by transitioning from a static white-list approach to a dynamic state transition model. The system continuously updates its understanding of normal communication patterns based on observed states, allowing it to adapt to and detect sophisticated attacks that mix malicious traffic with legitimate communication sequences.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent implements preliminary action by pre-defining multiple possible communication states and transition rules between them. This preparation allows the system to quickly identify anomalies when actual communication deviates from the expected state transitions, enabling detection of both known and unknown attacks.

Inventive Principle:
Principle #10Preliminary action

2Ease of operation

If communication is permitted based on predefined sequences and states, then normal operations are controlled, but unauthorized communications through taken-over servers cannot be blocked

Engineering Contradiction:
Improvecommunication controlVSAvoidsecurity against takeover attacks
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent implements feedback by continuously monitoring communication flows and comparing them against the state transition model. When deviations are detected, the system provides feedback to block unauthorized communications while maintaining normal operations, thus achieving both ease of operation and security against takeover attacks.

Inventive Principle:
Principle #23Feedback

3Reliability

If application-level communication permission is enforced, then unauthorized programs are detected, but vulnerabilities in permitted applications cannot be exploited

Engineering Contradiction:
Improveapplication securityVSAvoidvulnerability exploitation
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies another dimension by moving from application-level security checks to a communication sequence and state-based security model. This dimensional shift allows the system to detect and block attacks that exploit vulnerabilities in permitted applications by analyzing the temporal and contextual patterns of communication rather than just the application identity.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Data Source

PatentEP3246841B1Data assessment device, data assessment method, and program
Publication Date: 2019.06.26 MITSUBISHI ELECTRIC CORP
  • EP3246841B1 patent drawingFigure 1
  • EP3246841B1 patent drawingFigure 2
  • EP3246841B1 patent drawingFigure 3

AI summary

A data determination apparatus of the present invention includes a state transition model storage unit (130) to store a state transition model (1031) representing a state transition, a state management unit (103) to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit (105) to store, as a communication permission list (114), communication permitted data whose communications are permitted in respective operating states, a communication unit (107) to obtain communication determination data (109), and a determination unit (106) to determine whether or not the communication determination data (109) is communication permitted data whose communication has been permitted in a current operating state (113), using the current operating state (113) and the communication permission list (114).