Process-Level Stealth Attack Detection Using SVD Departure Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems for cyber-physical systems are inadequate as they do not consider process semantics, leading to delayed detection of anomalies, and existing data-driven approaches often yield inaccurate results due to subtle changes in sensor measurements.
Innovation Solution
A two-stage method using Singular Value Decomposition (SVD) to extract noise-reduced information from time series data, creating a mathematical representation of normal behavior and detecting anomalies by calculating a departure score based on the distance from a centroid in a signal subspace, without requiring prior knowledge of system dynamics or machine learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional intrusion detection systems are used, then IT infrastructure security is maintained, but process-level attacks remain undetected for extended periods
Solution Approach 1:
The patent segments the detection problem into two distinct levels: IT infrastructure level (using traditional IDS) and process level (using the proposed SVD-based anomaly detection). This segmentation allows each layer to specialize in detecting specific types of threats, with the process-level detector catching subtle attacks that IT-level systems miss, thereby improving overall detection accuracy without relying solely on one system
Solution Approach 2:
The patent introduces an intermediary component that bridges the IT infrastructure layer and the physical process layer. The SVD-based detector acts as a mediator that monitors process data and flags anomalies that may indicate stealthy attacks, enabling early detection before these attacks propagate through the system and cause significant damage
2Reliability
If Linear Dynamical State-Space models are built for process monitoring, then anomaly detection capability is improved, but system complexity and implementation effort increase significantly
Solution Approach 1:
Instead of building complex, persistent Linear Dynamical State-Space models that require extensive domain knowledge and manual tuning, the patent uses a simpler, more disposable approach: applying Singular Value Decomposition directly to the process data matrices. This SVD-based method achieves comparable anomaly detection capability with significantly reduced complexity and implementation effort
Solution Approach 2:
The patent substitutes the mechanical model-building process (system identification, parameter estimation, model validation) with a direct mathematical transformation approach (SVD). This replacement eliminates the need for complex model construction while maintaining the ability to detect anomalies, thereby reducing implementation complexity
3Ease of manufacture
If simple linear models are fitted to noisy sensor measurements, then implementation simplicity is maintained, but detection accuracy deteriorates due to noise sensitivity
Solution Approach 1:
The patent changes the parameter representation from simple scalar values to matrix structures that capture temporal relationships. By organizing sensor measurements into data matrices and applying SVD, the method transforms the parameter space to separate signal from noise, maintaining implementation simplicity while significantly improving detection accuracy
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Method and device for extracting noise-reduced signal information from a time series of sensor measurements during normal process operation and then actively checking whether present realizations of the process are departing from historical normal behavior. To extract signal information,the solution borrows ideas from singular spectrum analysis a non-parametric exploratory analysis tool for time series that is particularly suitable for separating the deterministic part of a dynamical system behavior from the chaotic part, purely from noisy time series of measurements.